ALIASES:

Spammer:Win32/Talwadig.A (Microsoft); Downloader.a!bdt (McAfee); Backdoor.Trojan (Symantec); Backdoor.Win32.Agent.akiq (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt); Backdoor.IRCBot.ACUW (FSecure)

 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Worm

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size: 475,136 bytes
File Type: EXE
Memory Resident: Yes
Initial Samples Received Date: 05 Apr 2012

Arrival Details

This worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This worm drops the following copies of itself into the affected system:

  • %Windows%\ukasf.exe
  • %System Root%\System Volume Information\qxu.exe
  • %Windows%\ime\chsime\applets\qpasf.exe
  • %System Root%\System Volume Information\qxudabh.exe
  • %System Root%\RECYCLER\urtdad.exe
  • %Windows%\Debug\UserMode\jf.exe
  • %Windows%\Provisioning\Schemas\bpasfd.scr
  • %Windows%\Provisioning\Schemas\bpa.scr
  • %Windows%\ehome\efas.scr
  • %System Root%\the_configurator\cws_once\qcfw.exe
  • %User Profile%\History.IE5\bd.exe
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\li.scr
  • %Windows%\ukas.scr
  • %Program Files%\Outlook Express\vcwsfk.exe
  • %System Root%\System Volume Information\qxu.scr
  • %Program Files%\Windows NT\Accessories\unft.exe
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lif.scr
  • %System Root%\the_configurator\cws_once\qcfw.scr
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifqhks.scr
  • %Windows%\java\trustlib\jfasft.exe
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifq.exe
  • %System Root%\the_configurator\cws_once\qcfwn.scr
  • %System Root%\System Volume Information\qxuda.scr
  • %System Root%\the_configurator\cws_once\qcf.exe
  • %Windows%\Debug\UserMode\wuasfci.exe
  • %Start Menu%\Programs\Accessories\Entertainment\lnury.exe
  • %User Profile%\History.IE5\jqvspjk.exe
  • %System Root%\the_configurator\cws_once\qcfwnfd.scr
  • %Program Files%\ComPlus Applications\daq.exe
  • %Windows%\Connection Wizard\qpa.scr
  • %Program Files%\microsoft frontpage\version3.0\bin\iub.scr
  • %Windows%\Prefetch\daasf.scr
  • %System Root%\ulrnfxp.exe
  • %System Root%\the_configurator\cws_once\qcf.scr
  • %Windows%\Media\yfas.exe
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqh.exe
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifqhks.exe
  • %Program Files%\MSN Gaming Zone\Windows\xf.scr
  • %System Root%\ulrnf.exe
  • %Program Files%\MSN Gaming Zone\Windows\xfgq.scr
  • %System Root%\System Volume Information\qxud.exe
  • %Program Files%\Windows NT\Accessories\unf.scr
  • %Program Files%\MSN Gaming Zone\Windows\xfgqq.scr
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifqhk.exe
  • %User Profile%\dayvnuu.scr
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqh.scr
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lif.exe
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifq.scr
  • %Program Files%\NetMeeting\lmcda.scr
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifqh.exe
  • %System Root%\the_configurator\cws_once\qc.scr
  • %Program Files%\WinPcap\jjsfof.exe
  • %System Root%\System Volume Information\qxud.scr
  • %Program Files%\Movie Maker\Shared\Profiles\tynut.exe
  • %System Root%\ulr.exe
  • %Desktop%\tbqn.exe
  • %User Profile%\Templates\bda.exe
  • %Temporary Internet Files%\Content.IE5\2BAREZOP\qsf.exe
  • %System Root%\the_configurator\cws_once\qc.exe
  • %Program Files%\Movie Maker\MUI\0409\daqlgpm.scr
  • %Windows%\Connection Wizard\qp.scr
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lif.exe
  • %User Profile%\History\comjv.scr
  • %User Profile%\History.IE5\xu.exe
  • %System Root%\System Volume Information\qxudabh.scr
  • %Windows%\ukasfq.scr
  • %System Root%\ulr.scr
  • %Windows%\ime\imejp\applets\qpasfs.exe
  • %User Profile%\My Pictures\htwtgv.exe
  • %Windows%\ukasfq.exe
  • %System Root%\RECYCLER\urtdad.scr
  • %Application Data%\Identities\{736CCBC7-ECC5-4A94-8856-77115D1B5FF1}\Microsoft\Outlook Express\tbq.scr
  • %System Root%\ulrnfx.scr
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqhks.scr
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lif.scr
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\li.exe
  • %System Root%\System Volume Information\qxudab.scr
  • %Program Files%\eoiky.exe
  • %Windows%\SoftwareDistribution\EventCache\xaasfw.exe
  • %User Profile%\My Music\bd.exe
  • %Program Files%\Uninstall Information\da.scr
  • %Program Files%\Online Services\vc.scr
  • %Program Files%\NetMeeting\lmc.exe
  • %Windows%\Resources\Themes\Luna\Shell\Homestead\bpasf.exe
  • %Windows%\Config\yfas.exe
  • %User Profile%\Cookies\bdawehp.scr
  • %Program Files%\Uninstall Information\daql.exe
  • %User Profile%\Media Player\xu.scr
  • %System Root%\the_configurator\cws_once\qcfwnf.scr
  • %Program Files%\eoi.exe
  • %Program Files%\Online Services\vcwsf.exe
  • %User Profile%\Cookies\dayvnuu.scr
  • %System Root%\ulrnfx.exe
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\li.scr
  • %Program Files%\microsoft frontpage\version3.0\bin\iubgvpm.scr
  • %Program Files%\ComPlus Applications\daqlgpm.scr
  • %Program Files%\NetMeeting\lmcd.exe
  • %Program Files%\MSN Gaming Zone\Windows\xfgqqp.exe
  • %Program Files%\MSN\MSNCoreFiles\OOBE\daqlgp.exe
  • %System Root%\Documents and Settings\wj.exe
  • %Program Files%\Messenger\jjsf.exe
  • %Windows%\ime\imkr6_1\applets\qpa.scr
  • %Windows%\Driver Cache\tf.scr
  • %User Profile%\SendTo\lnur.scr
  • %Program Files%\Internet Explorer\SIGNUP\xfgqqpm.scr
  • %System Root%\ulrnf.scr
  • %Program Files%\Internet Explorer\PLUGINS\xfgqqpm.exe
  • %Application Data%\Identities\{341F68BA-C841-4200-A7B4-3D5CFF202166}\Microsoft\tbqnky.scr
  • %Windows%\repair\yfasfc.scr
  • %Windows%\SoftwareDistribution\bpasf.exe
  • %Program Files%\WindowsUpdate\qh.scr
  • %Temporary Internet Files%\Content.IE5\2TPM8950\jqvspj.scr
  • %Program Files%\Internet Explorer\Connection Wizard\lmcda.scr
  • %Program Files%\Outlook Express\vcws.exe
  • %Program Files%\Online Services\vcwsfk.scr
  • %Program Files%\WindowsUpdate\qhmxpkh.scr
  • %Program Files%\Uninstall Information\daql.scr
  • %System Root%\System Volume Information\qx.exe
  • %User Profile%\Recent\tb.scr
  • %Program Files%\ytxpjf.scr
  • %System Root%\RECYCLER\urt.scr
  • %User Profile%\Media Player\xuo.scr
  • %System Root%\System Volume Information\qx.scr
  • %User Profile%\Cookies\ov.scr
  • %Windows%\ukas.exe
  • %Windows%\Downloaded Program Files\qp.exe
  • %Windows%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\efasfkf.exe
  • %Windows%\ukasfqw.scr
  • %Windows%\msapps\msinfo\wuasff.exe
  • %Program Files%\WindowsUpdate\qhmxp.exe
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifq.exe
  • %System Root%\the_configurator\cws_once\qcfwn.exe
  • %Windows%\SoftwareDistribution\SelfUpdate\xa.scr
  • %User Profile%\Templates\lnu.exe
  • %User Profile%\Cookies\bd.scr
  • %Windows%\security\Database\qpasf.exe
  • %System Root%\ul.scr
  • %Program Files%\xerox\nwwia\qhmxp.scr
  • %System Root%\System Volume Information\qxudab.exe
  • %Program Files%\MSN\MSNCoreFiles\OOBE\da.exe
  • %Windows%\Resources\Themes\Luna\Shell\NormalColor\bpa.exe
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqhk.scr
  • %Program Files%\Internet Explorer\Connection Wizard\lm.scr
  • %User Profile%\Cookies\tbq.scr
  • %System Root%\the_configurator\cws_once\qcfwnf.exe
  • %System Root%\ul.exe
  • %Windows%\msagent\chars\jfasf.scr
  • %System Root%\the_configurator\cws_once\qcfwnfd.exe
  • %User Profile%\S-1-5-20\ygb.scr
  • %User Profile%\Templates\xu.scr
  • %User Profile%\Cookies\bdawe.scr
  • %Program Files%\Common Files\qhmxp.scr
  • %Windows%\mui\ukasfjc.scr
  • %User Profile%\S-1-5-19\ellif.scr
  • %Windows%\inf\ukas.scr
  • %Windows%\Tasks\efa.exe
  • %Favorites%\tbqnk.exe
  • %Program Files%\WindowsUpdate\qh.exe
  • %Windows%\Connection Wizard\qpasfwp.exe
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifqhk.scr
  • %User Temp%\bdaw.exe
  • %Program Files%\WindowsUpdate\qhmxpkh.exe
  • %User Profile%\NetHood\tbqnk.exe
  • %System Root%\System Volume Information\qxuda.exe
  • %Windows%\ime\imkr6_1\lpasf.scr
  • %Windows%\srchasst\chars\wuas.scr
  • %Windows%\srchasst\chars\wuasfda.exe
  • %Program Files%\Common Files\ODBC\Data Sources\grrik.exe
  • %User Profile%\PrintHood\ln.scr
  • %User Profile%\SendTo\dayvn.scr
  • %Windows%\srchasst\chars\wuasf.scr
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqhk.exe
  • %System Root%\ulrn.exe
  • %Windows%\SoftwareDistribution\Download\xaasfw.scr
  • %User Profile%\xu.scr
  • %System Root%\ulrnfxp.scr
  • %User Profile%\NetHood\lnury.exe
  • %System Root%\the_configurator\da.exe
  • %User Profile%\Recent\dayv.exe
  • %User Profile%\{341F68BA-C841-4200-A7B4-3D5CFF202166}\umdac.exe
  • %Program Files%\Internet Explorer\PLUGINS\xfgq.exe
  • %Temporary Internet Files%\xuoldau.scr
  • %Windows%\Resources\Themes\Luna\Shell\Metallic\gpas.scr
  • %Temporary Internet Files%\Content.IE5\2BAREZOP\qsfcj.exe
  • %Program Files%\Online Services\vcwsf.scr
  • %User Temp%\da.exe
  • %Program Files%\NetMeeting\lmc.scr
  • %Program Files%\Internet Explorer\SIGNUP\xfgqqp.exe
  • %Windows%\repair\yf.exe
  • %Program Files%\xerox\nwwia\qh.exe
  • %User Profile%\Internet Explorer\arnkmna.exe
  • %System Root%\the_configurator\da.scr
  • %System Root%\RECYCLER\ur.exe
  • %Favorites%\Links\tbqnky.exe
  • %Program Files%\WinPcap\wqo.scr
  • %Program Files%\WinPcap\jjs.exe
  • %Program Files%\Windows Media Player\Sample Playlists\lmcdakh.scr
  • %System Root%\ulrn.scr
  • %Program Files%\Common Files\MSSoap\Binaries\Resources\1033\bwhnu.scr
  • %Program Files%\WinPcap\wq.scr
  • %User Profile%\qsf.scr
  • %Program Files%\Uninstall Information\daqlg.scr
  • %Temporary Internet Files%\Content.IE5\4H9MXTT9\jqvspj.exe
  • %Windows%\uka.scr
  • %Windows%\Driver Cache\i386\qp.exe
  • %Windows%\Cursors\yfa.scr
  • %Windows%\Prefetch\daasfda.scr
  • %System Root%\Documents and Settings\jqvspjk.exe
  • %Program Files%\MSN\MSNCoreFiles\OOBE\daql.exe
  • %User Profile%\Media Index\bd.exe
  • %Program Files%\Windows NT\Pinball\tyn.exe
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqhks.exe
  • %Program Files%\ComPlus Applications\da.scr
  • %Windows%\pss\ukasffj.exe
  • %User Profile%\qsfcj.exe
  • %User Profile%\SendTo\ln.exe
  • %Windows%\Registration\CRMLog\qpasfcu.scr
  • %System Root%\RECYCLER\urtdada.scr
  • %Windows%\Fonts\efasf.scr
  • %Program Files%\WindowsUpdate\qhmxpk.exe
  • %System Root%\the_configurator\dap.scr
  • %Program Files%\Windows Media Player\Skins\iub.scr
  • %Program Files%\Messenger\wq.scr
  • %User Profile%\Cookies\ovgd.scr
  • %Program Files%\ytxpjfc.scr
  • %System Root%\RECYCLER\urt.exe
  • %Application Data%\Microsoft\Windows\ygbxu.exe
  • %Windows%\ehome\yfasf.scr
  • %System Root%\the_configurator\daph.exe
  • %Windows%\Tasks\efas.exe
  • %Program Files%\xerox\nwwia\qhmxpk.scr
  • %User Profile%\Internet Explorer\arnkm.exe
  • %Windows%\Cursors\yfasfj.exe
  • %Program Files%\Windows Media Player\Skins\iubgvpm.scr
  • %Windows%\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\mua.scr
  • %Program Files%\Movie Maker\MUI\0409\da.scr
  • %Windows%\addins\efasf.scr
  • %Windows%\Registration\CRMLog\qpas.exe
  • %Windows%\Debug\UserMode\jfa.scr
  • %User Profile%\My Music\fw.scr
  • %Windows%\Connection Wizard\qpasf.exe
  • %Windows%\inf\ukas.exe
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifq.scr
  • %Windows%\addins\yf.exe
  • %Program Files%\yt.exe
  • %User Profile%\Sample Music\fwxuwia.scr
  • %Program Files%\WindowsUpdate\qhmxp.scr
  • %Windows%\repair\efa.scr
  • %Windows%\PeerNet\yfasfcl.exe
  • %Windows%\Registration\CRMLog\qp.exe
  • %Program Files%\microsoft frontpage\daql.scr
  • %Windows%\pss\ukasf.exe
  • %Program Files%\Windows Media Player\Sample Playlists\lmc.exe
  • %Windows%\Driver Cache\i386\qpa.scr
  • %System Root%\RECYCLER\urtd.exe
  • %Windows%\AppPatch\daa.scr
  • %Windows%\pchealth\helpctr\HelpFiles\daasfx.exe
  • %Windows%\twain_32\da.exe
  • %Program Files%\ComPlus Applications\da.exe
  • %User Profile%\{341F68BA-C841-4200-A7B4-3D5CFF202166}\umdacs.exe
  • %Windows%\Connection Wizard\qpasf.scr
  • %Program Files%\Windows NT\Pinball\qhmxpk.scr
  • %Windows%\Debug\UserMode\wu.scr
  • %System Root%\Documents and Settings\wjcylg.exe
  • %Windows%\Prefetch\da.scr
  • %Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daql.exe
  • %Desktop%\ln.scr
  • %Temp%\History\History.IE5\qpasfc.scr
  • %User Profile%\Cookies\tbqnk.exe
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\li.exe
  • %Windows%\pchealth\UploadLB\Binaries\daasfxu.scr
  • %Application Data%\Microsoft\Windows\ygb.exe
  • %Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daq.exe
  • %User Profile%\Recent\tbqnky.scr
  • %Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daqlg.exe
  • %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifqh.scr
  • %Program Files%\Messenger\wqor.scr
  • %User Profile%\SendTo\tbqnkyk.scr
  • %Program Files%\Windows Media Player\Visualizations\lmcda.exe
  • %User Profile%\S-1-5-19\ell.scr
  • %Windows%\Registration\CRMLog\qpasf.exe
  • %Windows%\inf\ukasfu.exe
  • %User Temp%\bd.exe
  • %Windows%\Cursors\yfas.exe
  • %System Root%\Documents and Settings\jqvsp.scr
  • %Windows%\Debug\UserMode\jfasf.exe
  • %Windows%\Registration\CRMLog\qpa.exe
  • %Program Files%\ComPlus Applications\daqlg.scr
  • %Windows%\twain_32\daasf.exe
  • %User Profile%\SendTo\tbqn.exe
  • %Windows%\Downloaded Program Files\qpasf.scr
  • %System Root%\the_configurator\daphi.exe
  • %Program Files%\Outlook Express\vcws.scr
  • %Program Files%\WinPcap\wqorx.exe
  • %User Profile%\SendTo\lnu.exe
  • %Program Files%\MSN Gaming Zone\Windows\xfgqqp.scr
  • %User Profile%\PrintHood\lnur.scr
  • %Favorites%\Links\bda.scr
  • %Program Files%\NetMeeting\lm.scr
  • %Windows%\repair\yfa.scr
  • %User Profile%\History.IE5\bdawe.scr
  • %System Root%\the_configurator\daphip.scr
  • %User Profile%\Media Player\bdawe.scr
  • %Program Files%\MSN Gaming Zone\Windows\xfgq.exe
  • %Program Files%\Internet Explorer\SIGNUP\xfgq.exe
  • %Temporary Internet Files%\Content.IE5\IX09SXE9\qsfcj.scr
  • %Program Files%\WindowsUpdate\qhm.scr
  • %Windows%\uk.scr
  • %Windows%\Downloaded Program Files\qpas.scr
  • %User Profile%\Templates\bdawehp.exe
  • %User Profile%\Templates\ln.scr
  • %Program Files%\WinPcap\jjsfof.scr
  • %Windows%\WinSxS\InstallTemp\qpasf.exe
  • %User Temp%\day.scr
  • %Windows%\Fonts\yfasfw.scr
  • %User Profile%\Certificates\jqvspj.scr
  • %Program Files%\ComPlus Applications\daqlgpm.exe
  • %User Profile%\Address Book\xuolda.scr
  • %Program Files%\xerox\nwwia\qh.scr
  • %User Profile%\S-1-5-20\ygbxu.scr
  • %System Root%\Documents and Settings\wjc.exe
  • %System Root%\Documents and Settings\jqvs.scr
  • %Program Files%\Windows Media Player\Icons\iubgv.exe
  • %Windows%\ime\imjp8_1\applets\qpas.scr
  • %Program Files%\ytxpj.scr
  • %User Profile%\DRM\vxp.scr
  • %Windows%\ime\chsime\applets\qpasfs.exe
  • %Windows%\Installer\{FE2F6A2C-196E-4210-9C04-2B1BC21F07EF}\kk.scr
  • %Windows%\Fonts\yfa.scr
  • %Windows%\Offline Web Pages\qp.scr
  • %Program Files%\ytx.exe
  • %Windows%\Driver Cache\i386\qpas.scr
  • %Program Files%\Common Files\System\Ole DB\xfgqqpm.exe
  • %Windows%\Offline Web Pages\qpasfei.exe
  • %Program Files%\Messenger\wq.exe
  • %User Profile%\Templates\tb.exe
  • %Windows%\Web\ukas.exe
  • %Program Files%\Common Files\System\ado\xf.scr
  • %Program Files%\Online Services\vcwsfk.exe
  • %Windows%\msapps\msinfo\wuasffy.scr
  • %User Profile%\SendTo\lnurywp.scr
  • %Program Files%\ytxpj.exe
  • %Windows%\AppPatch\daasfy.exe
  • %User Profile%\Templates\bda.scr
  • %Favorites%\Links\tbqn.scr
  • %Windows%\Cursors\yf.scr
  • %Program Files%\MSN Gaming Zone\Windows\xfgqq.exe
  • %User Profile%\Cookies\bdawe.exe
  • %Program Files%\MSN\MSNCoreFiles\OOBE\daqlgpm.exe
  • %User Profile%\Templates\lnurywp.exe
  • %Temporary Internet Files%\Content.IE5\X9QQH2D9\jqv.exe
  • %Program Files%\Windows NT\lmc.exe
  • %Program Files%\Messenger\wqorxaw.scr
  • %Application Data%\Microsoft\Media Player\jqvsp.scr
  • %Favorites%\Links\lnurywp.scr
  • %Program Files%\Movie Maker\Shared\Profiles\ty.exe
  • %Windows%\mui\ukasf.exe
  • %Windows%\repair\ef.exe
  • %Program Files%\Online Services\vc.exe
  • %Program Files%\Messenger\jjsfofc.scr
  • %User Profile%\My Music\bdawehp.scr
  • %Windows%\Registration\CRMLog\qpas.scr
  • %Favorites%\Links\lnury.scr
  • %Windows%\inf\ukasf.exe
  • %Windows%\addins\efasfak.scr
  • %Windows%\Cursors\yfas.scr
  • %User Profile%\Cookies\da.scr
  • %Program Files%\Uninstall Information\daqlgp.scr
  • %User Profile%\S-1-5-19\ellifok.exe
  • %Program Files%\Online Services\vcws.exe
  • %User Profile%\NetHood\lnu.exe
  • %Desktop%\xu.scr
  • %User Profile%\vx.exe
  • %Windows%\msapps\efasf.scr
  • %Program Files%\Windows NT\Pinball\fdajr.exe
  • %User Profile%\User Account Pictures\lnu.scr
  • %System Root%\the_configurator\daphip.exe
  • %User Profile%\Sample Pictures\bdaweh.scr
  • %User Profile%\Local Settings\lnury.exe
  • %Program Files%\xerox\nwwia\qhmxpkh.scr
  • %Program Files%\microsoft frontpage\version3.0\oe.exe
  • %Program Files%\Online Services\vcw.scr
  • %Windows%\Registration\CRMLog\qpasfc.exe
  • %User Profile%\SendTo\tbqn.scr
  • %Windows%\addins\yfasfak.scr
  • %Program Files%\Windows Media Player\Sample Playlists\lmcdakh.exe
  • %Program Files%\Windows Media Player\Skins\iubgvp.exe
  • %Windows%\java\classes\tfas.scr
  • %Program Files%\microsoft frontpage\version3.0\bin\iubgvp.exe
  • %Temporary Internet Files%\Content.IE5\SMCZPN4M\ygbxu.scr
  • %Temporary Internet Files%\Content.IE5\O7EHUPCN\qs.scr
  • %Windows%\twain_32\daa.exe
  • %Temporary Internet Files%\Content.IE5\M94XI96V\qsfcj.scr
  • %User Temp%\kc.exe
  • %User Temp%\bdaweh.exe
  • %Windows%\Downloaded Program Files\fkasfw.scr
  • %Windows%\Resources\Themes\Luna\Shell\NormalColor\bp.scr
  • %User Profile%\My Pictures\jqvs.exe
  • %Windows%\java\classes\tf.exe
  • %Windows%\inf\uka.exe
  • %Start Menu%\Programs\Accessories\Entertainment\lnury.scr
  • %Start Menu%\Programs\WinPcap\htwtgv.scr
  • %Application Data%\Microsoft\Media Player\ifjgx.exe
  • %User Profile%\NetHood\tbqnk.scr
  • %Windows%\srchasst\mui\0409\qpas.exe
  • %User Profile%\PrintHood\bd.scr
  • %Windows%\SoftwareDistribution\Download\xaasfwe.scr
  • %Windows%\repair\efasf.scr
  • %Program Files%\Outlook Express\vcw.exe
  • %Windows%\inf\ukasfu.scr
  • %System Root%\the_configurator\daphi.scr
  • %Windows%\srchasst\chars\wua.exe
  • %Program Files%\Movie Maker\MUI\0409\daq.exe
  • %Windows%\Config\efasfw.exe
  • %User Profile%\Cookies\ovgdaek.exe
  • %System%\efas.exe
  • %Windows%\mui\ukas.scr
  • %User Profile%\DRM\vxpmtmp.exe
  • %User Profile%\Templates\vxpmtmp.scr
  • %Windows%\Resources\Themes\Luna\Shell\NormalColor\bpasf.exe
  • %User Profile%\Cookies\bdaweh.exe
  • %Program Files%\WindowsUpdate\qhmx.scr
  • %Program Files%\Messenger\jjsfofc.exe
  • %User Profile%\Recent\tbqn.exe
  • %Windows%\Cursors\efasfjp.exe
  • %Windows%\Tasks\yfasf.exe
  • %User Profile%\NetHood\da.exe
  • %Temp%\History\History.IE5\fkas.exe
  • %System Root%\RECYCLER\ur.scr
  • %User Profile%\Recent\ln.scr
  • %Windows%\Prefetch\daasfda.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.. %Desktop% is the current user's desktop, which is usually C:\Windows\Profiles\{user name}\Desktop on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Desktop on Windows NT, and C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003.. %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.. %Favorites% is the current user's Favorites folder, which is usually C:\Windows\Favorites on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Favorites on Windows NT, and C:\Documents and Settings\{user name}\Favorites on Windows 2000, XP, and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp or C:\WINNT\Temp.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Autostart Technique

This worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Registration\CRMLog\qpa.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Registration\CRMLog\qpa.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Registration\CRMLog\qpa.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Registration\CRMLog\qpa.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Registration\CRMLog\qpa.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Registration\CRMLog\qpa.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\twain_32\daasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\twain_32\daasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\twain_32\daasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\twain_32\daasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\twain_32\daasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\twain_32\daasf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\SendTo\tbqn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\SendTo\tbqn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\SendTo\tbqn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\SendTo\tbqn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\SendTo\tbqn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\SendTo\tbqn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\SendTo\tbqn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\SendTo\tbqn.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\the_configurator\daphi.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\the_configurator\daphi.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System Root%\the_configurator\daphi.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\the_configurator\daphi.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\the_configurator\daphi.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\the_configurator\daphi.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\the_configurator\daphi.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\WinPcap\wqorx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\WinPcap\wqorx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\WinPcap\wqorx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\WinPcap\wqorx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\WinPcap\wqorx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\WinPcap\wqorx.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\SendTo\lnu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\SendTo\lnu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\SendTo\lnu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\SendTo\lnu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\SendTo\lnu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\SendTo\lnu.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\MSN Gaming Zone\Windows\xfgq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\MSN Gaming Zone\Windows\xfgq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\MSN Gaming Zone\Windows\xfgq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\MSN Gaming Zone\Windows\xfgq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\MSN Gaming Zone\Windows\xfgq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\MSN Gaming Zone\Windows\xfgq.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Internet Explorer\SIGNUP\xfgq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Internet Explorer\SIGNUP\xfgq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Internet Explorer\SIGNUP\xfgq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Internet Explorer\SIGNUP\xfgq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Internet Explorer\SIGNUP\xfgq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Internet Explorer\SIGNUP\xfgq.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\Templates\bdawehp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\Templates\bdawehp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\Templates\bdawehp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\Templates\bdawehp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\Templates\bdawehp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\Templates\bdawehp.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\WinSxS\InstallTemp\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\WinSxS\InstallTemp\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\WinSxS\InstallTemp\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\WinSxS\InstallTemp\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\WinSxS\InstallTemp\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\WinSxS\InstallTemp\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\WinSxS\InstallTemp\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\WinSxS\InstallTemp\qpasf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\ComPlus Applications\daqlgpm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\ComPlus Applications\daqlgpm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\ComPlus Applications\daqlgpm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\ComPlus Applications\daqlgpm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\ComPlus Applications\daqlgpm.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Internet Explorer\PLUGINS\xfgq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Internet Explorer\PLUGINS\xfgq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Internet Explorer\PLUGINS\xfgq.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\Documents and Settings\wjc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\Documents and Settings\wjc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\Documents and Settings\wjc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\Documents and Settings\wjc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System Root%\Documents and Settings\wjc.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Windows Media Player\Icons\iubgv.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Windows Media Player\Icons\iubgv.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Windows Media Player\Icons\iubgv.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Windows Media Player\Icons\iubgv.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Windows Media Player\Icons\iubgv.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Windows Media Player\Icons\iubgv.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\ime\chsime\applets\qpasfs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\ime\chsime\applets\qpasfs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\ime\chsime\applets\qpasfs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\ime\chsime\applets\qpasfs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\ime\chsime\applets\qpasfs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\ime\chsime\applets\qpasfs.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\ytx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\ytx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\ytx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\ytx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\ytx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Online Services\vcwsf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Common Files\System\Ole DB\xfgqqpm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Common Files\System\Ole DB\xfgqqpm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Common Files\System\Ole DB\xfgqqpm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Common Files\System\Ole DB\xfgqqpm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Common Files\System\Ole DB\xfgqqpm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Common Files\System\Ole DB\xfgqqpm.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Offline Web Pages\qpasfei.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Offline Web Pages\qpasfei.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Offline Web Pages\qpasfei.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Offline Web Pages\qpasfei.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Offline Web Pages\qpasfei.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Offline Web Pages\qpasfei.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Messenger\wq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Messenger\wq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Messenger\wq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Messenger\wq.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\Templates\tb.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\Templates\tb.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\Templates\tb.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\Templates\tb.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\Templates\tb.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\Templates\tb.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Web\ukas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Web\ukas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\Web\ukas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Web\ukas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Web\ukas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Web\ukas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Web\ukas.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Online Services\vcwsfk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Online Services\vcwsfk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Online Services\vcwsfk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Online Services\vcwsfk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Online Services\vcwsfk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Online Services\vcwsfk.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\ytxpj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\ytxpj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\ytxpj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\ytxpj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\ytxpj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\ytxpj.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\AppPatch\daasfy.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\AppPatch\daasfy.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\AppPatch\daasfy.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\AppPatch\daasfy.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\AppPatch\daasfy.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\AppPatch\daasfy.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Outlook Express\vcwsfk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Outlook Express\vcwsfk.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\MSN Gaming Zone\Windows\xfgqq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\MSN Gaming Zone\Windows\xfgqq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\MSN Gaming Zone\Windows\xfgqq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\MSN Gaming Zone\Windows\xfgqq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\MSN Gaming Zone\Windows\xfgqq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\MSN Gaming Zone\Windows\xfgqq.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\Cookies\bdawe.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\Cookies\bdawe.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\Cookies\bdawe.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\Cookies\bdawe.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\Cookies\bdawe.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\Cookies\bdawe.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Registration\CRMLog\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Registration\CRMLog\qpasf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgpm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgpm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgpm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgpm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgpm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgpm.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\Templates\lnurywp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\Templates\lnurywp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\Templates\lnurywp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\Templates\lnurywp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\Templates\lnurywp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\Templates\lnurywp.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Temporary Internet Files%\Content.IE5\X9QQH2D9\jqv.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Temporary Internet Files%\Content.IE5\X9QQH2D9\jqv.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Temporary Internet Files%\Content.IE5\X9QQH2D9\jqv.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Temporary Internet Files%\Content.IE5\X9QQH2D9\jqv.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Temporary Internet Files%\Content.IE5\X9QQH2D9\jqv.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Windows NT\lmc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Windows NT\lmc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Windows NT\lmc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Windows NT\lmc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Windows NT\lmc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Windows NT\lmc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Windows NT\lmc.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Movie Maker\Shared\Profiles\ty.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Movie Maker\Shared\Profiles\ty.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Movie Maker\Shared\Profiles\ty.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Movie Maker\Shared\Profiles\ty.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\mui\ukasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\mui\ukasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\mui\ukasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\mui\ukasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\mui\ukasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\mui\ukasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\mui\ukasf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\repair\ef.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\repair\ef.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\repair\ef.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\repair\ef.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\repair\ef.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Online Services\vc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Online Services\vc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Online Services\vc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Online Services\vc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Online Services\vc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Online Services\vc.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\inf\ukasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\inf\ukasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\inf\ukasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\inf\ukasf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\S-1-5-19\ellifok.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\S-1-5-19\ellifok.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\S-1-5-19\ellifok.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\S-1-5-19\ellifok.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\S-1-5-19\ellifok.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\S-1-5-19\ellifok.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\S-1-5-19\ellifok.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Online Services\vcws.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Online Services\vcws.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Online Services\vcws.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Online Services\vcws.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Online Services\vcws.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Online Services\vcws.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\NetHood\lnu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\NetHood\lnu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\NetHood\lnu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\NetHood\lnu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\NetHood\lnu.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\vx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\vx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\vx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\vx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\vx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\vx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\vx.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Windows NT\Pinball\fdajr.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Windows NT\Pinball\fdajr.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Windows NT\Pinball\fdajr.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Windows NT\Pinball\fdajr.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Windows NT\Pinball\fdajr.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Windows NT\Pinball\fdajr.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\MSN Gaming Zone\Windows\xfgq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\MSN Gaming Zone\Windows\xfgq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\MSN Gaming Zone\Windows\xfgq.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\the_configurator\daphip.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\the_configurator\daphip.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System Root%\the_configurator\daphip.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\the_configurator\daphip.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\the_configurator\daphip.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\Local Settings\lnury.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\Local Settings\lnury.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\Local Settings\lnury.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\Local Settings\lnury.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\Local Settings\lnury.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\Local Settings\lnury.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\microsoft frontpage\version3.0\oe.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\microsoft frontpage\version3.0\oe.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\microsoft frontpage\version3.0\oe.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\microsoft frontpage\version3.0\oe.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\NetHood\lnury.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\WinPcap\wqorx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\WinPcap\wqorx.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Registration\CRMLog\qpasfc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Registration\CRMLog\qpasfc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Registration\CRMLog\qpasfc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Registration\CRMLog\qpasfc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Registration\CRMLog\qpasfc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Registration\CRMLog\qpasfc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\Registration\CRMLog\qpasfc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Windows Media Player\Sample Playlists\lmcdakh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Windows Media Player\Sample Playlists\lmcdakh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Windows Media Player\Sample Playlists\lmcdakh.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Windows Media Player\Skins\iubgvp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Windows Media Player\Skins\iubgvp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Windows Media Player\Skins\iubgvp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Windows Media Player\Skins\iubgvp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Windows Media Player\Skins\iubgvp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Windows Media Player\Skins\iubgvp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\microsoft frontpage\version3.0\bin\iubgvp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\microsoft frontpage\version3.0\bin\iubgvp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\microsoft frontpage\version3.0\bin\iubgvp.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\twain_32\daa.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\twain_32\daa.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\twain_32\daa.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\twain_32\daa.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\twain_32\daa.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\twain_32\daa.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Temp%\kc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Temp%\kc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Temp%\kc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Temp%\kc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Temp%\kc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Temp%\kc.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Temp%\bdaweh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Temp%\bdaweh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Temp%\bdaweh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Temp%\bdaweh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Temp%\bdaweh.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\My Pictures\jqvs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\My Pictures\jqvs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\My Pictures\jqvs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\My Pictures\jqvs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\My Pictures\jqvs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\My Pictures\jqvs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\My Pictures\jqvs.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\java\classes\tf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\java\classes\tf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\java\classes\tf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\java\classes\tf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\java\classes\tf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\java\classes\tf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\java\classes\tf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\inf\uka.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\inf\uka.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\inf\uka.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\inf\uka.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\inf\uka.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\inf\uka.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\inf\uka.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Application Data%\Microsoft\Media Player\ifjgx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Application Data%\Microsoft\Media Player\ifjgx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Application Data%\Microsoft\Media Player\ifjgx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Application Data%\Microsoft\Media Player\ifjgx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Application Data%\Microsoft\Media Player\ifjgx.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifq.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\srchasst\mui\0409\qpas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\srchasst\mui\0409\qpas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\srchasst\mui\0409\qpas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\srchasst\mui\0409\qpas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\srchasst\mui\0409\qpas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\srchasst\mui\0409\qpas.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Outlook Express\vcw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Outlook Express\vcw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Outlook Express\vcw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Outlook Express\vcw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Outlook Express\vcw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Outlook Express\vcw.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\srchasst\chars\wua.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\srchasst\chars\wua.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\srchasst\chars\wua.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\srchasst\chars\wua.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\srchasst\chars\wua.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\srchasst\chars\wua.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Movie Maker\MUI\0409\daq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Movie Maker\MUI\0409\daq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Movie Maker\MUI\0409\daq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Movie Maker\MUI\0409\daq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Movie Maker\MUI\0409\daq.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Config\efasfw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Config\efasfw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\Config\efasfw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Config\efasfw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Config\efasfw.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\Cookies\ovgdaek.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\Cookies\ovgdaek.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\Cookies\ovgdaek.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\Cookies\ovgdaek.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\Cookies\ovgdaek.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System%\efas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System%\efas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System%\efas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System%\efas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System%\efas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System%\efas.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\DRM\vxpmtmp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\DRM\vxpmtmp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\DRM\vxpmtmp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\DRM\vxpmtmp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\DRM\vxpmtmp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\DRM\vxpmtmp.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpasf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\Cookies\bdaweh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\Cookies\bdaweh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\Cookies\bdaweh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\Cookies\bdaweh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\Cookies\bdaweh.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Messenger\jjsfofc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Messenger\jjsfofc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Messenger\jjsfofc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Messenger\jjsfofc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Messenger\jjsfofc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Messenger\jjsfofc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Messenger\jjsfofc.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\Recent\tbqn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\Recent\tbqn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\Recent\tbqn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\Recent\tbqn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\Recent\tbqn.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Cursors\efasfjp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\Cursors\efasfjp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Cursors\efasfjp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Cursors\efasfjp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Cursors\efasfjp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Cursors\efasfjp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Cursors\efasfjp.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Tasks\yfasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Tasks\yfasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Tasks\yfasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\Tasks\yfasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Tasks\yfasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Tasks\yfasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Tasks\yfasf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\NetHood\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\NetHood\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\NetHood\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\NetHood\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\NetHood\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\NetHood\da.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Temp%\History\History.IE5\fkas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Temp%\History\History.IE5\fkas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Temp%\History\History.IE5\fkas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Temp%\History\History.IE5\fkas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Temp%\History\History.IE5\fkas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Temp%\History\History.IE5\fkas.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Prefetch\daasfda.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Prefetch\daasfda.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Prefetch\daasfda.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Prefetch\daasfda.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Prefetch\daasfda.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "{malware path and file name}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "{malware path and file name}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "{malware path and file name}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "{malware path and file name}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "{malware path and file name}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "{malware path and file name}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "{malware path and file name}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\ukasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\ukasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\ukasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\ukasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\ukasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\ukasf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "{malware path and file name}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "{malware path and file name}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "{malware path and file name}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\ime\chsime\applets\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\ime\chsime\applets\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\ime\chsime\applets\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\ime\chsime\applets\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\ime\chsime\applets\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\ime\chsime\applets\qpasf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "{malware path and file name}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\RECYCLER\urtdad.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\RECYCLER\urtdad.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\RECYCLER\urtdad.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\RECYCLER\urtdad.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\RECYCLER\urtdad.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\RECYCLER\urtdad.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Debug\UserMode\jf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Debug\UserMode\jf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Debug\UserMode\jf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Debug\UserMode\jf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Debug\UserMode\jf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Debug\UserMode\jf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "{malware path and file name}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "{malware path and file name}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\the_configurator\cws_once\qcfw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\the_configurator\cws_once\qcfw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\the_configurator\cws_once\qcfw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\the_configurator\cws_once\qcfw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\the_configurator\cws_once\qcfw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\the_configurator\cws_once\qcfw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System Root%\the_configurator\cws_once\qcfw.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\History.IE5\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\History.IE5\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\History.IE5\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\History.IE5\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\History.IE5\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\History.IE5\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\History.IE5\bd.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Outlook Express\vcwsfk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Outlook Express\vcwsfk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Outlook Express\vcwsfk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Outlook Express\vcwsfk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Outlook Express\vcwsfk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Outlook Express\vcwsfk.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Windows NT\Accessories\unft.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Windows NT\Accessories\unft.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Windows NT\Accessories\unft.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Windows NT\Accessories\unft.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Windows NT\Accessories\unft.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Windows NT\Accessories\unft.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\java\trustlib\jfasft.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\java\trustlib\jfasft.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\java\trustlib\jfasft.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\java\trustlib\jfasft.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\java\trustlib\jfasft.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\java\trustlib\jfasft.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "{random characters}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "{random characters}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "{random characters}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "{random characters}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "{random characters}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifq.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\the_configurator\cws_once\qcf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\the_configurator\cws_once\qcf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\the_configurator\cws_once\qcf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\the_configurator\cws_once\qcf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\the_configurator\cws_once\qcf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\the_configurator\cws_once\qcf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Debug\UserMode\wuasfci.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Debug\UserMode\wuasfci.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\Debug\UserMode\wuasfci.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Debug\UserMode\wuasfci.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Debug\UserMode\wuasfci.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Debug\UserMode\wuasfci.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Start Menu%\Programs\Accessories\Entertainment\lnury.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Start Menu%\Programs\Accessories\Entertainment\lnury.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Start Menu%\Programs\Accessories\Entertainment\lnury.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Start Menu%\Programs\Accessories\Entertainment\lnury.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Start Menu%\Programs\Accessories\Entertainment\lnury.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Start Menu%\Programs\Accessories\Entertainment\lnury.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Start Menu%\Programs\Accessories\Entertainment\lnury.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\History.IE5\jqvspjk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\History.IE5\jqvspjk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\History.IE5\jqvspjk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\History.IE5\jqvspjk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\History.IE5\jqvspjk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\History.IE5\jqvspjk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\History.IE5\jqvspjk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\History.IE5\jqvspjk.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\ComPlus Applications\daq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\ComPlus Applications\daq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\ComPlus Applications\daq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\ComPlus Applications\daq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\ComPlus Applications\daq.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\ulrnfxp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\ulrnfxp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\ulrnfxp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System Root%\ulrnfxp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\ulrnfxp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\ulrnfxp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\ulrnfxp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\ulrnfxp.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "{malware path and file name}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Media\yfas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Media\yfas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Media\yfas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Media\yfas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\Media\yfas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Media\yfas.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifqhks.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifqhks.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifqhks.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\ulrnf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\ulrnf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\ulrnf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\ulrnf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\ulrnf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\ulrnf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\ulrnf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifq.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "{random characters}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifqhk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifqhk.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "{random characters}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lif.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lif.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Startup%\fwxuw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Startup%\fwxuw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Startup%\fwxuw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Startup%\fwxuw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Startup%\fwxuw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Startup%\fwxuw.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifqh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifqh.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\WinPcap\jjsfof.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\WinPcap\jjsfof.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\WinPcap\jjsfof.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\WinPcap\jjsfof.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\WinPcap\jjsfof.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\WinPcap\jjsfof.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Movie Maker\Shared\Profiles\tynut.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Movie Maker\Shared\Profiles\tynut.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Movie Maker\Shared\Profiles\tynut.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Movie Maker\Shared\Profiles\tynut.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Movie Maker\Shared\Profiles\tynut.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Movie Maker\Shared\Profiles\tynut.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Movie Maker\Shared\Profiles\tynut.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\ulr.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System Root%\ulr.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\ulr.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\ulr.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\ulr.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\ulr.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Desktop%\tbqn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Desktop%\tbqn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Desktop%\tbqn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Desktop%\tbqn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Desktop%\tbqn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Desktop%\tbqn.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\Templates\bda.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\Templates\bda.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\Templates\bda.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\Templates\bda.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\Templates\bda.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\Templates\bda.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Temporary Internet Files%\Content.IE5\2BAREZOP\qsf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Temporary Internet Files%\Content.IE5\2BAREZOP\qsf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Temporary Internet Files%\Content.IE5\2BAREZOP\qsf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Temporary Internet Files%\Content.IE5\2BAREZOP\qsf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Temporary Internet Files%\Content.IE5\2BAREZOP\qsf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\the_configurator\cws_once\qc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\the_configurator\cws_once\qc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\the_configurator\cws_once\qc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\the_configurator\cws_once\qc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lif.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lif.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lif.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\History.IE5\xu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\History.IE5\xu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\History.IE5\xu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\History.IE5\xu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\History.IE5\xu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\History.IE5\xu.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\ime\imejp\applets\qpasfs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\ime\imejp\applets\qpasfs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\ime\imejp\applets\qpasfs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\ime\imejp\applets\qpasfs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\ime\imejp\applets\qpasfs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\ime\imejp\applets\qpasfs.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\My Pictures\htwtgv.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\My Pictures\htwtgv.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\My Pictures\htwtgv.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\My Pictures\htwtgv.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\My Pictures\htwtgv.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\My Pictures\htwtgv.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\ukasfq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\ukasfq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\ukasfq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\ukasfq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\ukasfq.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\li.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\li.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\li.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\li.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\eoiky.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\eoiky.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\eoiky.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\eoiky.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\eoiky.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\eoiky.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\SoftwareDistribution\EventCache\xaasfw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\SoftwareDistribution\EventCache\xaasfw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\SoftwareDistribution\EventCache\xaasfw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\SoftwareDistribution\EventCache\xaasfw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\SoftwareDistribution\EventCache\xaasfw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\SoftwareDistribution\EventCache\xaasfw.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\My Music\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\My Music\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\My Music\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\My Music\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\My Music\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\My Music\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\My Music\bd.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\NetMeeting\lmc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\NetMeeting\lmc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\NetMeeting\lmc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\NetMeeting\lmc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\NetMeeting\lmc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\NetMeeting\lmc.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Resources\Themes\Luna\Shell\Homestead\bpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Resources\Themes\Luna\Shell\Homestead\bpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Resources\Themes\Luna\Shell\Homestead\bpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\Resources\Themes\Luna\Shell\Homestead\bpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Resources\Themes\Luna\Shell\Homestead\bpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Resources\Themes\Luna\Shell\Homestead\bpasf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Config\yfas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Config\yfas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Config\yfas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Config\yfas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Config\yfas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Config\yfas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Config\yfas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\Config\yfas.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Uninstall Information\daql.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Uninstall Information\daql.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Uninstall Information\daql.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Uninstall Information\daql.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Uninstall Information\daql.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Uninstall Information\daql.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Uninstall Information\daql.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\eoi.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\eoi.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\eoi.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\eoi.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\eoi.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\eoi.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Online Services\vcwsf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Online Services\vcwsf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Online Services\vcwsf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Online Services\vcwsf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Online Services\vcwsf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Online Services\vcwsf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Online Services\vcwsf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\ulrnfx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\ulrnfx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\ulrnfx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\ulrnfx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\ulrnfx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\ulrnfx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\ulrnfx.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\NetMeeting\lmcd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\NetMeeting\lmcd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\NetMeeting\lmcd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\NetMeeting\lmcd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\NetMeeting\lmcd.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\MSN Gaming Zone\Windows\xfgqqp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\MSN Gaming Zone\Windows\xfgqqp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\MSN Gaming Zone\Windows\xfgqqp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\MSN Gaming Zone\Windows\xfgqqp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\MSN Gaming Zone\Windows\xfgqqp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\MSN Gaming Zone\Windows\xfgqqp.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgp.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\Documents and Settings\wj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\Documents and Settings\wj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\Documents and Settings\wj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System Root%\Documents and Settings\wj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\Documents and Settings\wj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\Documents and Settings\wj.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Messenger\jjsf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Messenger\jjsf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Messenger\jjsf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Messenger\jjsf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Messenger\jjsf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Messenger\jjsf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Internet Explorer\PLUGINS\xfgqqpm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Internet Explorer\PLUGINS\xfgqqpm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Internet Explorer\PLUGINS\xfgqqpm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Internet Explorer\PLUGINS\xfgqqpm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Internet Explorer\PLUGINS\xfgqqpm.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System Root%\the_configurator\cws_once\qc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\the_configurator\cws_once\qc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\the_configurator\cws_once\qc.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\SoftwareDistribution\bpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\SoftwareDistribution\bpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\SoftwareDistribution\bpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\SoftwareDistribution\bpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\SoftwareDistribution\bpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\SoftwareDistribution\bpasf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Outlook Express\vcws.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Outlook Express\vcws.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Outlook Express\vcws.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Outlook Express\vcws.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Outlook Express\vcws.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Outlook Express\vcws.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\ukas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\ukas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\ukas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\ukas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\ukas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\ukas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\ukas.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Downloaded Program Files\qp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Downloaded Program Files\qp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Downloaded Program Files\qp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Downloaded Program Files\qp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Downloaded Program Files\qp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Downloaded Program Files\qp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\msapps\msinfo\wuasff.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\msapps\msinfo\wuasff.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\msapps\msinfo\wuasff.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\msapps\msinfo\wuasff.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\msapps\msinfo\wuasff.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\msapps\msinfo\wuasff.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\WindowsUpdate\qhmxp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\WindowsUpdate\qhmxp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\WindowsUpdate\qhmxp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\WindowsUpdate\qhmxp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\WindowsUpdate\qhmxp.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifq.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\the_configurator\cws_once\qcfwn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\the_configurator\cws_once\qcfwn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\the_configurator\cws_once\qcfwn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\the_configurator\cws_once\qcfwn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\the_configurator\cws_once\qcfwn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\the_configurator\cws_once\qcfwn.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System Root%\ulrnf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System Root%\ulrnf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\Templates\lnu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\Templates\lnu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\Templates\lnu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\Templates\lnu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\Templates\lnu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\Templates\lnu.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\security\Database\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\security\Database\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\security\Database\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\security\Database\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\security\Database\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\security\Database\qpasf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\MSN\MSNCoreFiles\OOBE\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\MSN\MSNCoreFiles\OOBE\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\MSN\MSNCoreFiles\OOBE\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\MSN\MSNCoreFiles\OOBE\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\MSN\MSNCoreFiles\OOBE\da.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpa.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpa.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpa.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpa.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpa.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpa.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\the_configurator\cws_once\qcfwnf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\the_configurator\cws_once\qcfwnf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\the_configurator\cws_once\qcfwnf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\the_configurator\cws_once\qcfwnf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System Root%\the_configurator\cws_once\qcfwnf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\the_configurator\cws_once\qcfwnf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\ul.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\ul.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\ul.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\ul.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\ul.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\ul.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\the_configurator\cws_once\qcfwnfd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\the_configurator\cws_once\qcfwnfd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\the_configurator\cws_once\qcfwnfd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\the_configurator\cws_once\qcfwnfd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\the_configurator\cws_once\qcfwnfd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\the_configurator\cws_once\qcfwnfd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System Root%\the_configurator\cws_once\qcfwnfd.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Tasks\efa.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Tasks\efa.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Tasks\efa.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Tasks\efa.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\Tasks\efa.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Tasks\efa.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Favorites%\tbqnk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Favorites%\tbqnk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Favorites%\tbqnk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Favorites%\tbqnk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Favorites%\tbqnk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Favorites%\tbqnk.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\WindowsUpdate\qh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\WindowsUpdate\qh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\WindowsUpdate\qh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\WindowsUpdate\qh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\WindowsUpdate\qh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\WindowsUpdate\qh.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\Connection Wizard\qpasfwp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\Connection Wizard\qpasfwp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Connection Wizard\qpasfwp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Connection Wizard\qpasfwp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Connection Wizard\qpasfwp.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Temp%\bdaw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Temp%\bdaw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Temp%\bdaw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Temp%\bdaw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Temp%\bdaw.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Temp%\bdaw.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\WindowsUpdate\qhmxpkh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\WindowsUpdate\qhmxpkh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\WindowsUpdate\qhmxpkh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\WindowsUpdate\qhmxpkh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\WindowsUpdate\qhmxpkh.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\NetHood\tbqnk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\NetHood\tbqnk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\NetHood\tbqnk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\NetHood\tbqnk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\NetHood\tbqnk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\NetHood\tbqnk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\NetHood\tbqnk.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System Root%\RECYCLER\urtdad.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System Root%\RECYCLER\urtdad.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\RECYCLER\urtdad.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\srchasst\chars\wuasfda.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\srchasst\chars\wuasfda.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\srchasst\chars\wuasfda.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\srchasst\chars\wuasfda.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\srchasst\chars\wuasfda.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Common Files\ODBC\Data Sources\grrik.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Common Files\ODBC\Data Sources\grrik.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Common Files\ODBC\Data Sources\grrik.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Common Files\ODBC\Data Sources\grrik.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Common Files\ODBC\Data Sources\grrik.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Connection Wizard\qpasfwp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Connection Wizard\qpasfwp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Connection Wizard\qpasfwp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Connection Wizard\qpasfwp.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqhk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqhk.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\ulrn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\ulrn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\ulrn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\ulrn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\ulrn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\ulrn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\ulrn.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\My Music\bd.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\NetHood\lnury.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\NetHood\lnury.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\NetHood\lnury.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\NetHood\lnury.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\NetHood\lnury.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\the_configurator\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\the_configurator\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\the_configurator\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\the_configurator\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System Root%\the_configurator\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\the_configurator\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\the_configurator\da.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\Recent\dayv.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\Recent\dayv.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\Recent\dayv.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\Recent\dayv.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\Recent\dayv.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\{341F68BA-C841-4200-A7B4-3D5CFF202166}\umdac.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\{341F68BA-C841-4200-A7B4-3D5CFF202166}\umdac.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\{341F68BA-C841-4200-A7B4-3D5CFF202166}\umdac.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\{341F68BA-C841-4200-A7B4-3D5CFF202166}\umdac.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Internet Explorer\PLUGINS\xfgq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Internet Explorer\PLUGINS\xfgq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Internet Explorer\PLUGINS\xfgq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Internet Explorer\PLUGINS\xfgq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Internet Explorer\PLUGINS\xfgq.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Startup%\fwxu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Startup%\fwxu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Startup%\fwxu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Startup%\fwxu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Startup%\fwxu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Startup%\fwxu.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Temporary Internet Files%\Content.IE5\2BAREZOP\qsfcj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Temporary Internet Files%\Content.IE5\2BAREZOP\qsfcj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Temporary Internet Files%\Content.IE5\2BAREZOP\qsfcj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Temporary Internet Files%\Content.IE5\2BAREZOP\qsfcj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Temporary Internet Files%\Content.IE5\2BAREZOP\qsfcj.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Temp%\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Temp%\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Temp%\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Temp%\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Temp%\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Temp%\da.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Internet Explorer\SIGNUP\xfgqqp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Internet Explorer\SIGNUP\xfgqqp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Internet Explorer\SIGNUP\xfgqqp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Internet Explorer\SIGNUP\xfgqqp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Internet Explorer\SIGNUP\xfgqqp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Internet Explorer\SIGNUP\xfgqqp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Internet Explorer\SIGNUP\xfgqqp.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\the_configurator\cws_once\qcfwnf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\the_configurator\cws_once\qcfwnf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\the_configurator\cws_once\qcfwnf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\repair\yf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\repair\yf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\repair\yf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\repair\yf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\repair\yf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\repair\yf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\xerox\nwwia\qh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\xerox\nwwia\qh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\xerox\nwwia\qh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\xerox\nwwia\qh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\xerox\nwwia\qh.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\Internet Explorer\arnkmna.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\Internet Explorer\arnkmna.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\Internet Explorer\arnkmna.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\Internet Explorer\arnkmna.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\Internet Explorer\arnkmna.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\Internet Explorer\arnkmna.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\RECYCLER\ur.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System Root%\RECYCLER\ur.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\RECYCLER\ur.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\RECYCLER\ur.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\RECYCLER\ur.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\RECYCLER\ur.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Favorites%\Links\tbqnky.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Favorites%\Links\tbqnky.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Favorites%\Links\tbqnky.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Favorites%\Links\tbqnky.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Favorites%\Links\tbqnky.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Favorites%\Links\tbqnky.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\WinPcap\jjs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\WinPcap\jjs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\WinPcap\jjs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\WinPcap\jjs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\WinPcap\jjs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqhk.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Temporary Internet Files%\Content.IE5\4H9MXTT9\jqvspj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Temporary Internet Files%\Content.IE5\4H9MXTT9\jqvspj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Temporary Internet Files%\Content.IE5\4H9MXTT9\jqvspj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Temporary Internet Files%\Content.IE5\4H9MXTT9\jqvspj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Temporary Internet Files%\Content.IE5\4H9MXTT9\jqvspj.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\Driver Cache\i386\qp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Driver Cache\i386\qp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Driver Cache\i386\qp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Driver Cache\i386\qp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Driver Cache\i386\qp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\Driver Cache\i386\qp.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\li.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\ul.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System Root%\Documents and Settings\jqvspjk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\Documents and Settings\jqvspjk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\Documents and Settings\jqvspjk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System Root%\Documents and Settings\jqvspjk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\Documents and Settings\jqvspjk.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\MSN\MSNCoreFiles\OOBE\daql.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\MSN\MSNCoreFiles\OOBE\daql.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\MSN\MSNCoreFiles\OOBE\daql.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\MSN\MSNCoreFiles\OOBE\daql.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\MSN\MSNCoreFiles\OOBE\daql.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\Media Index\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\Media Index\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\Media Index\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\Media Index\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\Media Index\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\Media Index\bd.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Windows NT\Pinball\tyn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Windows NT\Pinball\tyn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Windows NT\Pinball\tyn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Windows NT\Pinball\tyn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Windows NT\Pinball\tyn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\Windows NT\Pinball\tyn.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqhks.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\pss\ukasffj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\pss\ukasffj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\pss\ukasffj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\pss\ukasffj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\pss\ukasffj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\pss\ukasffj.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\qsfcj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\qsfcj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\qsfcj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\qsfcj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\qsfcj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\qsfcj.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\SendTo\ln.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\SendTo\ln.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\SendTo\ln.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\SendTo\ln.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\SendTo\ln.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\SendTo\ln.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\WindowsUpdate\qhmxpk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\WindowsUpdate\qhmxpk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\WindowsUpdate\qhmxpk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\WindowsUpdate\qhmxpk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\WindowsUpdate\qhmxpk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\WindowsUpdate\qhmxpk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqh.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\xerox\nwwia\qh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\xerox\nwwia\qh.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\xerox\nwwia\qh.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\RECYCLER\urt.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\RECYCLER\urt.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\RECYCLER\urt.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\RECYCLER\urt.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\RECYCLER\urt.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Application Data%\Microsoft\Windows\ygbxu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Application Data%\Microsoft\Windows\ygbxu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Application Data%\Microsoft\Windows\ygbxu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Application Data%\Microsoft\Windows\ygbxu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Application Data%\Microsoft\Windows\ygbxu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Application Data%\Microsoft\Windows\ygbxu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Application Data%\Microsoft\Windows\ygbxu.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\the_configurator\daph.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\the_configurator\daph.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System Root%\the_configurator\daph.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\the_configurator\daph.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\the_configurator\daph.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\the_configurator\daph.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Tasks\efas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Tasks\efas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Tasks\efas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Tasks\efas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Tasks\efas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Tasks\efas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\Tasks\efas.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\Internet Explorer\arnkm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Profile%\Internet Explorer\arnkm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\Internet Explorer\arnkm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\Internet Explorer\arnkm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\Internet Explorer\arnkm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\Internet Explorer\arnkm.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\Internet Explorer\arnkm.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\Cursors\yfasfj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Cursors\yfasfj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Cursors\yfasfj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Cursors\yfasfj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Cursors\yfasfj.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Cursors\yfasfj.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\RECYCLER\ur.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\RECYCLER\ur.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Registration\CRMLog\qpas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Prefetch\daasfda.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\Prefetch\daasfda.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Registration\CRMLog\qpas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Registration\CRMLog\qpas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Registration\CRMLog\qpas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Registration\CRMLog\qpas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Registration\CRMLog\qpas.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Connection Wizard\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Connection Wizard\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Connection Wizard\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Connection Wizard\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Connection Wizard\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Connection Wizard\qpasf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\inf\ukas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\inf\ukas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\inf\ukas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\inf\ukas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\inf\ukas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\inf\ukas.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\addins\yf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\addins\yf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\addins\yf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\addins\yf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\addins\yf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\yt.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\yt.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\yt.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\yt.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\yt.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\yt.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Program Files%\yt.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\PeerNet\yfasfcl.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\PeerNet\yfasfcl.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\PeerNet\yfasfcl.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\PeerNet\yfasfcl.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\PeerNet\yfasfcl.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\PeerNet\yfasfcl.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Registration\CRMLog\qp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Registration\CRMLog\qp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Registration\CRMLog\qp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Registration\CRMLog\qp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Registration\CRMLog\qp.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Registration\CRMLog\qp.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\pss\ukasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\pss\ukasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\pss\ukasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\pss\ukasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\pss\ukasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\pss\ukasf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqhks.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "{random characters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Windows Media Player\Sample Playlists\lmc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Windows Media Player\Sample Playlists\lmc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Windows Media Player\Sample Playlists\lmc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Windows Media Player\Sample Playlists\lmc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\Windows Media Player\Sample Playlists\lmc.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\Windows Media Player\Sample Playlists\lmc.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\ul.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\ul.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System Root%\ul.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\RECYCLER\urtd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\RECYCLER\urtd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%System Root%\RECYCLER\urtd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\RECYCLER\urtd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\RECYCLER\urtd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\RECYCLER\urtd.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\pchealth\helpctr\HelpFiles\daasfx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\pchealth\helpctr\HelpFiles\daasfx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\pchealth\helpctr\HelpFiles\daasfx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\pchealth\helpctr\HelpFiles\daasfx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\pchealth\helpctr\HelpFiles\daasfx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\pchealth\helpctr\HelpFiles\daasfx.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\twain_32\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\twain_32\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\twain_32\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\twain_32\da.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\the_configurator\daph.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\the_configurator\daph.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\ComPlus Applications\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\ComPlus Applications\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\ComPlus Applications\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\ComPlus Applications\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\ComPlus Applications\da.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\ComPlus Applications\da.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\{341F68BA-C841-4200-A7B4-3D5CFF202166}\umdacs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\{341F68BA-C841-4200-A7B4-3D5CFF202166}\umdacs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\{341F68BA-C841-4200-A7B4-3D5CFF202166}\umdacs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Profile%\{341F68BA-C841-4200-A7B4-3D5CFF202166}\umdacs.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\{341F68BA-C841-4200-A7B4-3D5CFF202166}\umdacs.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\Documents and Settings\wjcylg.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%System Root%\Documents and Settings\wjcylg.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%System Root%\Documents and Settings\wjcylg.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%System Root%\Documents and Settings\wjcylg.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\Documents and Settings\wjcylg.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%System Root%\Documents and Settings\wjcylg.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daql.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daql.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daql.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daql.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\Cookies\tbqnk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%User Profile%\Cookies\tbqnk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Profile%\Cookies\tbqnk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Profile%\Cookies\tbqnk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Profile%\Cookies\tbqnk.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Profile%\Cookies\tbqnk.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "{random characters}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\li.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\li.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Application Data%\Microsoft\Windows\ygb.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Application Data%\Microsoft\Windows\ygb.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Application Data%\Microsoft\Windows\ygb.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Application Data%\Microsoft\Windows\ygb.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Application Data%\Microsoft\Windows\ygb.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Application Data%\Microsoft\Windows\ygb.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daq.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daq.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daqlg.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daqlg.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daqlg.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daqlg.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Program Files%\Windows Media Player\Visualizations\lmcda.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Program Files%\Windows Media Player\Visualizations\lmcda.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Program Files%\Windows Media Player\Visualizations\lmcda.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Program Files%\Windows Media Player\Visualizations\lmcda.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Registration\CRMLog\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Registration\CRMLog\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\Registration\CRMLog\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Registration\CRMLog\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Registration\CRMLog\qpasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Registration\CRMLog\qpasf.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\inf\ukasfu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\inf\ukasfu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\inf\ukasfu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\inf\ukasfu.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\inf\ukasfu.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%User Temp%\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%User Temp%\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%User Temp%\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%User Temp%\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%User Temp%\bd.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%User Temp%\bd.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Cursors\yfas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NTFS backup service. = "%Windows%\Cursors\yfas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Cursors\yfas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Cursors\yfas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Cursors\yfas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Cursors\yfas.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\Cursors\yfas.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
COM+ Server Host Process = "%Windows%\Debug\UserMode\jfasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Adobe Color Palette loader = "%Windows%\Debug\UserMode\jfasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Mirosoft Windows Explorer tweaker = "%Windows%\Debug\UserMode\jfasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
System Cleaner = "%Windows%\Debug\UserMode\jfasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Scheduled Tasks. = "%Windows%\Debug\UserMode\jfasf.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSN Messenger service spawner. = "%Windows%\Debug\UserMode\jfasf.exe"

Dropping Routine

This worm drops the following files:

  • %User Startup%\fwxuw.exe
  • %User Startup%\bdaw.scr
  • %User Startup%\bdawe.scr
  • %User Startup%\fwxu.exe
  • %User Startup%\fw.scr
  • %User Startup%\fwxuwi.scr

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

This report is generated via an automated analysis system.

  SOLUTION

Minimum Scan Engine: 9.200

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Restart in Safe Mode

[ Learn More ]

Step 3

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "{malware path and file name}"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "{malware path and file name}"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "{malware path and file name}"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "{malware path and file name}"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "{malware path and file name}"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "{malware path and file name}"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "{malware path and file name}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\ukasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\ukasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\ukasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\ukasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\ukasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\ukasf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "{malware path and file name}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "{malware path and file name}"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "{malware path and file name}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\ime\chsime\applets\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\ime\chsime\applets\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\ime\chsime\applets\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\ime\chsime\applets\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\ime\chsime\applets\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\ime\chsime\applets\qpasf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "{malware path and file name}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\RECYCLER\urtdad.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\RECYCLER\urtdad.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\RECYCLER\urtdad.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\RECYCLER\urtdad.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\RECYCLER\urtdad.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\RECYCLER\urtdad.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Debug\UserMode\jf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Debug\UserMode\jf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Debug\UserMode\jf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Debug\UserMode\jf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Debug\UserMode\jf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Debug\UserMode\jf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "{malware path and file name}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "{malware path and file name}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\the_configurator\cws_once\qcfw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\the_configurator\cws_once\qcfw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\the_configurator\cws_once\qcfw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\the_configurator\cws_once\qcfw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\the_configurator\cws_once\qcfw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\the_configurator\cws_once\qcfw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System Root%\the_configurator\cws_once\qcfw.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\History.IE5\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\History.IE5\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\History.IE5\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\History.IE5\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\History.IE5\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\History.IE5\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\History.IE5\bd.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Outlook Express\vcwsfk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Outlook Express\vcwsfk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Outlook Express\vcwsfk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Outlook Express\vcwsfk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Outlook Express\vcwsfk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Outlook Express\vcwsfk.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Windows NT\Accessories\unft.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Windows NT\Accessories\unft.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Windows NT\Accessories\unft.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Windows NT\Accessories\unft.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Windows NT\Accessories\unft.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Windows NT\Accessories\unft.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\java\trustlib\jfasft.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\java\trustlib\jfasft.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\java\trustlib\jfasft.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\java\trustlib\jfasft.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\java\trustlib\jfasft.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\java\trustlib\jfasft.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "{random characters}"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "{random characters}"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "{random characters}"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "{random characters}"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "{random characters}"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifq.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\the_configurator\cws_once\qcf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\the_configurator\cws_once\qcf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\the_configurator\cws_once\qcf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\the_configurator\cws_once\qcf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\the_configurator\cws_once\qcf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\the_configurator\cws_once\qcf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Debug\UserMode\wuasfci.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Debug\UserMode\wuasfci.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\Debug\UserMode\wuasfci.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Debug\UserMode\wuasfci.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Debug\UserMode\wuasfci.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Debug\UserMode\wuasfci.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Start Menu%\Programs\Accessories\Entertainment\lnury.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Start Menu%\Programs\Accessories\Entertainment\lnury.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Start Menu%\Programs\Accessories\Entertainment\lnury.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Start Menu%\Programs\Accessories\Entertainment\lnury.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Start Menu%\Programs\Accessories\Entertainment\lnury.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Start Menu%\Programs\Accessories\Entertainment\lnury.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Start Menu%\Programs\Accessories\Entertainment\lnury.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\History.IE5\jqvspjk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\History.IE5\jqvspjk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\History.IE5\jqvspjk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\History.IE5\jqvspjk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\History.IE5\jqvspjk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\History.IE5\jqvspjk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\History.IE5\jqvspjk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\History.IE5\jqvspjk.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\ComPlus Applications\daq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\ComPlus Applications\daq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\ComPlus Applications\daq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\ComPlus Applications\daq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\ComPlus Applications\daq.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\ulrnfxp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\ulrnfxp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\ulrnfxp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System Root%\ulrnfxp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\ulrnfxp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\ulrnfxp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\ulrnfxp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\ulrnfxp.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "{malware path and file name}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Media\yfas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Media\yfas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Media\yfas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Media\yfas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\Media\yfas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Media\yfas.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifqhks.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifqhks.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifqhks.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\ulrnf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\ulrnf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\ulrnf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\ulrnf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\ulrnf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\ulrnf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\ulrnf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifq.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "{random characters}"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifqhk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifqhk.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "{random characters}"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lif.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lif.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Startup%\fwxuw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Startup%\fwxuw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Startup%\fwxuw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Startup%\fwxuw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Startup%\fwxuw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Startup%\fwxuw.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifqh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lifqh.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\WinPcap\jjsfof.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\WinPcap\jjsfof.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\WinPcap\jjsfof.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\WinPcap\jjsfof.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\WinPcap\jjsfof.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\WinPcap\jjsfof.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Movie Maker\Shared\Profiles\tynut.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Movie Maker\Shared\Profiles\tynut.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Movie Maker\Shared\Profiles\tynut.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Movie Maker\Shared\Profiles\tynut.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Movie Maker\Shared\Profiles\tynut.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Movie Maker\Shared\Profiles\tynut.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Movie Maker\Shared\Profiles\tynut.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\ulr.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System Root%\ulr.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\ulr.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\ulr.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\ulr.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\ulr.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Desktop%\tbqn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Desktop%\tbqn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Desktop%\tbqn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Desktop%\tbqn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Desktop%\tbqn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Desktop%\tbqn.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\Templates\bda.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\Templates\bda.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\Templates\bda.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\Templates\bda.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\Templates\bda.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\Templates\bda.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Temporary Internet Files%\Content.IE5\2BAREZOP\qsf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Temporary Internet Files%\Content.IE5\2BAREZOP\qsf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Temporary Internet Files%\Content.IE5\2BAREZOP\qsf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Temporary Internet Files%\Content.IE5\2BAREZOP\qsf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Temporary Internet Files%\Content.IE5\2BAREZOP\qsf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\the_configurator\cws_once\qc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\the_configurator\cws_once\qc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\the_configurator\cws_once\qc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\the_configurator\cws_once\qc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lif.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lif.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\lif.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\History.IE5\xu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\History.IE5\xu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\History.IE5\xu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\History.IE5\xu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\History.IE5\xu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\History.IE5\xu.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\ime\imejp\applets\qpasfs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\ime\imejp\applets\qpasfs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\ime\imejp\applets\qpasfs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\ime\imejp\applets\qpasfs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\ime\imejp\applets\qpasfs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\ime\imejp\applets\qpasfs.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\My Pictures\htwtgv.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\My Pictures\htwtgv.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\My Pictures\htwtgv.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\My Pictures\htwtgv.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\My Pictures\htwtgv.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\My Pictures\htwtgv.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\ukasfq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\ukasfq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\ukasfq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\ukasfq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\ukasfq.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\li.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\li.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\li.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\li.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\eoiky.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\eoiky.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\eoiky.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\eoiky.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\eoiky.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\eoiky.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\SoftwareDistribution\EventCache\xaasfw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\SoftwareDistribution\EventCache\xaasfw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\SoftwareDistribution\EventCache\xaasfw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\SoftwareDistribution\EventCache\xaasfw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\SoftwareDistribution\EventCache\xaasfw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\SoftwareDistribution\EventCache\xaasfw.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\My Music\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\My Music\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\My Music\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\My Music\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\My Music\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\My Music\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\My Music\bd.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\NetMeeting\lmc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\NetMeeting\lmc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\NetMeeting\lmc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\NetMeeting\lmc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\NetMeeting\lmc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\NetMeeting\lmc.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Resources\Themes\Luna\Shell\Homestead\bpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Resources\Themes\Luna\Shell\Homestead\bpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Resources\Themes\Luna\Shell\Homestead\bpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\Resources\Themes\Luna\Shell\Homestead\bpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Resources\Themes\Luna\Shell\Homestead\bpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Resources\Themes\Luna\Shell\Homestead\bpasf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Config\yfas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Config\yfas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Config\yfas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Config\yfas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Config\yfas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Config\yfas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Config\yfas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\Config\yfas.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Uninstall Information\daql.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Uninstall Information\daql.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Uninstall Information\daql.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Uninstall Information\daql.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Uninstall Information\daql.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Uninstall Information\daql.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Uninstall Information\daql.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\eoi.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\eoi.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\eoi.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\eoi.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\eoi.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\eoi.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Online Services\vcwsf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Online Services\vcwsf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Online Services\vcwsf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Online Services\vcwsf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Online Services\vcwsf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Online Services\vcwsf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Online Services\vcwsf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\ulrnfx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\ulrnfx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\ulrnfx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\ulrnfx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\ulrnfx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\ulrnfx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\ulrnfx.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\NetMeeting\lmcd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\NetMeeting\lmcd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\NetMeeting\lmcd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\NetMeeting\lmcd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\NetMeeting\lmcd.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\MSN Gaming Zone\Windows\xfgqqp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\MSN Gaming Zone\Windows\xfgqqp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\MSN Gaming Zone\Windows\xfgqqp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\MSN Gaming Zone\Windows\xfgqqp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\MSN Gaming Zone\Windows\xfgqqp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\MSN Gaming Zone\Windows\xfgqqp.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgp.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\Documents and Settings\wj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\Documents and Settings\wj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\Documents and Settings\wj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System Root%\Documents and Settings\wj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\Documents and Settings\wj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\Documents and Settings\wj.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Messenger\jjsf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Messenger\jjsf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Messenger\jjsf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Messenger\jjsf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Messenger\jjsf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Messenger\jjsf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Internet Explorer\PLUGINS\xfgqqpm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Internet Explorer\PLUGINS\xfgqqpm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Internet Explorer\PLUGINS\xfgqqpm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Internet Explorer\PLUGINS\xfgqqpm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Internet Explorer\PLUGINS\xfgqqpm.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System Root%\the_configurator\cws_once\qc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\the_configurator\cws_once\qc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\the_configurator\cws_once\qc.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\SoftwareDistribution\bpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\SoftwareDistribution\bpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\SoftwareDistribution\bpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\SoftwareDistribution\bpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\SoftwareDistribution\bpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\SoftwareDistribution\bpasf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Outlook Express\vcws.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Outlook Express\vcws.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Outlook Express\vcws.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Outlook Express\vcws.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Outlook Express\vcws.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Outlook Express\vcws.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\ukas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\ukas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\ukas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\ukas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\ukas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\ukas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\ukas.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Downloaded Program Files\qp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Downloaded Program Files\qp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Downloaded Program Files\qp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Downloaded Program Files\qp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Downloaded Program Files\qp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Downloaded Program Files\qp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\msapps\msinfo\wuasff.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\msapps\msinfo\wuasff.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\msapps\msinfo\wuasff.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\msapps\msinfo\wuasff.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\msapps\msinfo\wuasff.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\msapps\msinfo\wuasff.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\WindowsUpdate\qhmxp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\WindowsUpdate\qhmxp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\WindowsUpdate\qhmxp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\WindowsUpdate\qhmxp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\WindowsUpdate\qhmxp.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifq.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\the_configurator\cws_once\qcfwn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\the_configurator\cws_once\qcfwn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\the_configurator\cws_once\qcfwn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\the_configurator\cws_once\qcfwn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\the_configurator\cws_once\qcfwn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\the_configurator\cws_once\qcfwn.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System Root%\ulrnf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System Root%\ulrnf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\Templates\lnu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\Templates\lnu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\Templates\lnu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\Templates\lnu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\Templates\lnu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\Templates\lnu.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\security\Database\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\security\Database\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\security\Database\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\security\Database\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\security\Database\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\security\Database\qpasf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\MSN\MSNCoreFiles\OOBE\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\MSN\MSNCoreFiles\OOBE\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\MSN\MSNCoreFiles\OOBE\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\MSN\MSNCoreFiles\OOBE\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\MSN\MSNCoreFiles\OOBE\da.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpa.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpa.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpa.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpa.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpa.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpa.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\the_configurator\cws_once\qcfwnf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\the_configurator\cws_once\qcfwnf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\the_configurator\cws_once\qcfwnf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\the_configurator\cws_once\qcfwnf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System Root%\the_configurator\cws_once\qcfwnf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\the_configurator\cws_once\qcfwnf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\ul.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\ul.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\ul.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\ul.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\ul.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\ul.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\the_configurator\cws_once\qcfwnfd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\the_configurator\cws_once\qcfwnfd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\the_configurator\cws_once\qcfwnfd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\the_configurator\cws_once\qcfwnfd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\the_configurator\cws_once\qcfwnfd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\the_configurator\cws_once\qcfwnfd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System Root%\the_configurator\cws_once\qcfwnfd.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Tasks\efa.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Tasks\efa.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Tasks\efa.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Tasks\efa.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\Tasks\efa.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Tasks\efa.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Favorites%\tbqnk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Favorites%\tbqnk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Favorites%\tbqnk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Favorites%\tbqnk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Favorites%\tbqnk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Favorites%\tbqnk.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\WindowsUpdate\qh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\WindowsUpdate\qh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\WindowsUpdate\qh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\WindowsUpdate\qh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\WindowsUpdate\qh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\WindowsUpdate\qh.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\Connection Wizard\qpasfwp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\Connection Wizard\qpasfwp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Connection Wizard\qpasfwp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Connection Wizard\qpasfwp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Connection Wizard\qpasfwp.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Temp%\bdaw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Temp%\bdaw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Temp%\bdaw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Temp%\bdaw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Temp%\bdaw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Temp%\bdaw.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\WindowsUpdate\qhmxpkh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\WindowsUpdate\qhmxpkh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\WindowsUpdate\qhmxpkh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\WindowsUpdate\qhmxpkh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\WindowsUpdate\qhmxpkh.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\NetHood\tbqnk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\NetHood\tbqnk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\NetHood\tbqnk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\NetHood\tbqnk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\NetHood\tbqnk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\NetHood\tbqnk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\NetHood\tbqnk.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System Root%\RECYCLER\urtdad.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System Root%\RECYCLER\urtdad.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\RECYCLER\urtdad.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\srchasst\chars\wuasfda.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\srchasst\chars\wuasfda.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\srchasst\chars\wuasfda.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\srchasst\chars\wuasfda.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\srchasst\chars\wuasfda.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Common Files\ODBC\Data Sources\grrik.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Common Files\ODBC\Data Sources\grrik.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Common Files\ODBC\Data Sources\grrik.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Common Files\ODBC\Data Sources\grrik.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Common Files\ODBC\Data Sources\grrik.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Connection Wizard\qpasfwp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Connection Wizard\qpasfwp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Connection Wizard\qpasfwp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Connection Wizard\qpasfwp.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqhk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqhk.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\ulrn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\ulrn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\ulrn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\ulrn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\ulrn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\ulrn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\ulrn.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\My Music\bd.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\NetHood\lnury.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\NetHood\lnury.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\NetHood\lnury.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\NetHood\lnury.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\NetHood\lnury.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\the_configurator\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\the_configurator\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\the_configurator\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\the_configurator\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System Root%\the_configurator\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\the_configurator\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\the_configurator\da.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\Recent\dayv.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\Recent\dayv.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\Recent\dayv.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\Recent\dayv.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\Recent\dayv.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\{341F68BA-C841-4200-A7B4-3D5CFF202166}\umdac.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\{341F68BA-C841-4200-A7B4-3D5CFF202166}\umdac.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\{341F68BA-C841-4200-A7B4-3D5CFF202166}\umdac.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\{341F68BA-C841-4200-A7B4-3D5CFF202166}\umdac.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Internet Explorer\PLUGINS\xfgq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Internet Explorer\PLUGINS\xfgq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Internet Explorer\PLUGINS\xfgq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Internet Explorer\PLUGINS\xfgq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Internet Explorer\PLUGINS\xfgq.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Startup%\fwxu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Startup%\fwxu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Startup%\fwxu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Startup%\fwxu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Startup%\fwxu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Startup%\fwxu.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Temporary Internet Files%\Content.IE5\2BAREZOP\qsfcj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Temporary Internet Files%\Content.IE5\2BAREZOP\qsfcj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Temporary Internet Files%\Content.IE5\2BAREZOP\qsfcj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Temporary Internet Files%\Content.IE5\2BAREZOP\qsfcj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Temporary Internet Files%\Content.IE5\2BAREZOP\qsfcj.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Temp%\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Temp%\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Temp%\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Temp%\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Temp%\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Temp%\da.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Internet Explorer\SIGNUP\xfgqqp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Internet Explorer\SIGNUP\xfgqqp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Internet Explorer\SIGNUP\xfgqqp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Internet Explorer\SIGNUP\xfgqqp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Internet Explorer\SIGNUP\xfgqqp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Internet Explorer\SIGNUP\xfgqqp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Internet Explorer\SIGNUP\xfgqqp.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\the_configurator\cws_once\qcfwnf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\the_configurator\cws_once\qcfwnf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\the_configurator\cws_once\qcfwnf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\repair\yf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\repair\yf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\repair\yf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\repair\yf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\repair\yf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\repair\yf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\xerox\nwwia\qh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\xerox\nwwia\qh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\xerox\nwwia\qh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\xerox\nwwia\qh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\xerox\nwwia\qh.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\Internet Explorer\arnkmna.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\Internet Explorer\arnkmna.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\Internet Explorer\arnkmna.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\Internet Explorer\arnkmna.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\Internet Explorer\arnkmna.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\Internet Explorer\arnkmna.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\RECYCLER\ur.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System Root%\RECYCLER\ur.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\RECYCLER\ur.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\RECYCLER\ur.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\RECYCLER\ur.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\RECYCLER\ur.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Favorites%\Links\tbqnky.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Favorites%\Links\tbqnky.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Favorites%\Links\tbqnky.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Favorites%\Links\tbqnky.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Favorites%\Links\tbqnky.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Favorites%\Links\tbqnky.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\WinPcap\jjs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\WinPcap\jjs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\WinPcap\jjs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\WinPcap\jjs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\WinPcap\jjs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqhk.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Temporary Internet Files%\Content.IE5\4H9MXTT9\jqvspj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Temporary Internet Files%\Content.IE5\4H9MXTT9\jqvspj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Temporary Internet Files%\Content.IE5\4H9MXTT9\jqvspj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Temporary Internet Files%\Content.IE5\4H9MXTT9\jqvspj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Temporary Internet Files%\Content.IE5\4H9MXTT9\jqvspj.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\Driver Cache\i386\qp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Driver Cache\i386\qp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Driver Cache\i386\qp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Driver Cache\i386\qp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Driver Cache\i386\qp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\Driver Cache\i386\qp.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\li.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\ul.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System Root%\Documents and Settings\jqvspjk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\Documents and Settings\jqvspjk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\Documents and Settings\jqvspjk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System Root%\Documents and Settings\jqvspjk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\Documents and Settings\jqvspjk.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\MSN\MSNCoreFiles\OOBE\daql.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\MSN\MSNCoreFiles\OOBE\daql.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\MSN\MSNCoreFiles\OOBE\daql.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\MSN\MSNCoreFiles\OOBE\daql.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\MSN\MSNCoreFiles\OOBE\daql.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\Media Index\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\Media Index\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\Media Index\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\Media Index\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\Media Index\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\Media Index\bd.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Windows NT\Pinball\tyn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Windows NT\Pinball\tyn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Windows NT\Pinball\tyn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Windows NT\Pinball\tyn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Windows NT\Pinball\tyn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Windows NT\Pinball\tyn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqhks.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\pss\ukasffj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\pss\ukasffj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\pss\ukasffj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\pss\ukasffj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\pss\ukasffj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\pss\ukasffj.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\qsfcj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\qsfcj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\qsfcj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\qsfcj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\qsfcj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\qsfcj.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\SendTo\ln.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\SendTo\ln.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\SendTo\ln.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\SendTo\ln.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\SendTo\ln.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\SendTo\ln.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\WindowsUpdate\qhmxpk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\WindowsUpdate\qhmxpk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\WindowsUpdate\qhmxpk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\WindowsUpdate\qhmxpk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\WindowsUpdate\qhmxpk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\WindowsUpdate\qhmxpk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqh.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\xerox\nwwia\qh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\xerox\nwwia\qh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\xerox\nwwia\qh.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\RECYCLER\urt.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\RECYCLER\urt.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\RECYCLER\urt.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\RECYCLER\urt.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\RECYCLER\urt.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Application Data%\Microsoft\Windows\ygbxu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Application Data%\Microsoft\Windows\ygbxu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Application Data%\Microsoft\Windows\ygbxu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Application Data%\Microsoft\Windows\ygbxu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Application Data%\Microsoft\Windows\ygbxu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Application Data%\Microsoft\Windows\ygbxu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Application Data%\Microsoft\Windows\ygbxu.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\the_configurator\daph.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\the_configurator\daph.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System Root%\the_configurator\daph.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\the_configurator\daph.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\the_configurator\daph.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\the_configurator\daph.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Tasks\efas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Tasks\efas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Tasks\efas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Tasks\efas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Tasks\efas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Tasks\efas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\Tasks\efas.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\Internet Explorer\arnkm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\Internet Explorer\arnkm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\Internet Explorer\arnkm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\Internet Explorer\arnkm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\Internet Explorer\arnkm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\Internet Explorer\arnkm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\Internet Explorer\arnkm.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\Cursors\yfasfj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Cursors\yfasfj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Cursors\yfasfj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Cursors\yfasfj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Cursors\yfasfj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Cursors\yfasfj.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\RECYCLER\ur.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\RECYCLER\ur.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Registration\CRMLog\qpas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Registration\CRMLog\qpas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Registration\CRMLog\qpas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Registration\CRMLog\qpas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Registration\CRMLog\qpas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Registration\CRMLog\qpas.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Connection Wizard\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Connection Wizard\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Connection Wizard\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Connection Wizard\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Connection Wizard\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Connection Wizard\qpasf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\inf\ukas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\inf\ukas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\inf\ukas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\inf\ukas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\inf\ukas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\inf\ukas.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\addins\yf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\addins\yf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\addins\yf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\addins\yf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\addins\yf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\yt.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\yt.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\yt.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\yt.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\yt.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\yt.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\yt.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\PeerNet\yfasfcl.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\PeerNet\yfasfcl.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\PeerNet\yfasfcl.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\PeerNet\yfasfcl.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\PeerNet\yfasfcl.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\PeerNet\yfasfcl.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Registration\CRMLog\qp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Registration\CRMLog\qp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Registration\CRMLog\qp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Registration\CRMLog\qp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Registration\CRMLog\qp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Registration\CRMLog\qp.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\pss\ukasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\pss\ukasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\pss\ukasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\pss\ukasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\pss\ukasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\pss\ukasf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifqhks.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "{random characters}"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Windows Media Player\Sample Playlists\lmc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Windows Media Player\Sample Playlists\lmc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Windows Media Player\Sample Playlists\lmc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Windows Media Player\Sample Playlists\lmc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Windows Media Player\Sample Playlists\lmc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Windows Media Player\Sample Playlists\lmc.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\ul.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\ul.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System Root%\ul.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\RECYCLER\urtd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\RECYCLER\urtd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System Root%\RECYCLER\urtd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\RECYCLER\urtd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\RECYCLER\urtd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\RECYCLER\urtd.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\pchealth\helpctr\HelpFiles\daasfx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\pchealth\helpctr\HelpFiles\daasfx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\pchealth\helpctr\HelpFiles\daasfx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\pchealth\helpctr\HelpFiles\daasfx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\pchealth\helpctr\HelpFiles\daasfx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\pchealth\helpctr\HelpFiles\daasfx.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\twain_32\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\twain_32\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\twain_32\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\twain_32\da.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\the_configurator\daph.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\the_configurator\daph.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\ComPlus Applications\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\ComPlus Applications\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\ComPlus Applications\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\ComPlus Applications\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\ComPlus Applications\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\ComPlus Applications\da.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\{341F68BA-C841-4200-A7B4-3D5CFF202166}\umdacs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\{341F68BA-C841-4200-A7B4-3D5CFF202166}\umdacs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\{341F68BA-C841-4200-A7B4-3D5CFF202166}\umdacs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\{341F68BA-C841-4200-A7B4-3D5CFF202166}\umdacs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\{341F68BA-C841-4200-A7B4-3D5CFF202166}\umdacs.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\Documents and Settings\wjcylg.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\Documents and Settings\wjcylg.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\Documents and Settings\wjcylg.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\Documents and Settings\wjcylg.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\Documents and Settings\wjcylg.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\Documents and Settings\wjcylg.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daql.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daql.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daql.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daql.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\Cookies\tbqnk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\Cookies\tbqnk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\Cookies\tbqnk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\Cookies\tbqnk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\Cookies\tbqnk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\Cookies\tbqnk.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "{random characters}"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\li.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\li.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Application Data%\Microsoft\Windows\ygb.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Application Data%\Microsoft\Windows\ygb.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Application Data%\Microsoft\Windows\ygb.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Application Data%\Microsoft\Windows\ygb.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Application Data%\Microsoft\Windows\ygb.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Application Data%\Microsoft\Windows\ygb.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daq.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daqlg.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daqlg.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daqlg.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\daqlg.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Windows Media Player\Visualizations\lmcda.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Windows Media Player\Visualizations\lmcda.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Windows Media Player\Visualizations\lmcda.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Windows Media Player\Visualizations\lmcda.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Registration\CRMLog\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Registration\CRMLog\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\Registration\CRMLog\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Registration\CRMLog\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Registration\CRMLog\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Registration\CRMLog\qpasf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\inf\ukasfu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\inf\ukasfu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\inf\ukasfu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\inf\ukasfu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\inf\ukasfu.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Temp%\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Temp%\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Temp%\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Temp%\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Temp%\bd.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Temp%\bd.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Cursors\yfas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Cursors\yfas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Cursors\yfas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Cursors\yfas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Cursors\yfas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Cursors\yfas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\Cursors\yfas.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Debug\UserMode\jfasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Debug\UserMode\jfasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Debug\UserMode\jfasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\Debug\UserMode\jfasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Debug\UserMode\jfasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Debug\UserMode\jfasf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Registration\CRMLog\qpa.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Registration\CRMLog\qpa.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Registration\CRMLog\qpa.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Registration\CRMLog\qpa.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Registration\CRMLog\qpa.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Registration\CRMLog\qpa.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\twain_32\daasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\twain_32\daasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\twain_32\daasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\twain_32\daasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\twain_32\daasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\twain_32\daasf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\SendTo\tbqn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\SendTo\tbqn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\SendTo\tbqn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\SendTo\tbqn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\SendTo\tbqn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\SendTo\tbqn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\SendTo\tbqn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\SendTo\tbqn.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\the_configurator\daphi.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\the_configurator\daphi.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System Root%\the_configurator\daphi.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\the_configurator\daphi.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\the_configurator\daphi.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\the_configurator\daphi.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\the_configurator\daphi.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\WinPcap\wqorx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\WinPcap\wqorx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\WinPcap\wqorx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\WinPcap\wqorx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\WinPcap\wqorx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\WinPcap\wqorx.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\SendTo\lnu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\SendTo\lnu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\SendTo\lnu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\SendTo\lnu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\SendTo\lnu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\SendTo\lnu.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\MSN Gaming Zone\Windows\xfgq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\MSN Gaming Zone\Windows\xfgq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\MSN Gaming Zone\Windows\xfgq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\MSN Gaming Zone\Windows\xfgq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\MSN Gaming Zone\Windows\xfgq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\MSN Gaming Zone\Windows\xfgq.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Internet Explorer\SIGNUP\xfgq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Internet Explorer\SIGNUP\xfgq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Internet Explorer\SIGNUP\xfgq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Internet Explorer\SIGNUP\xfgq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Internet Explorer\SIGNUP\xfgq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Internet Explorer\SIGNUP\xfgq.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\Templates\bdawehp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\Templates\bdawehp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\Templates\bdawehp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\Templates\bdawehp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\Templates\bdawehp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\Templates\bdawehp.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\WinSxS\InstallTemp\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\WinSxS\InstallTemp\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\WinSxS\InstallTemp\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\WinSxS\InstallTemp\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\WinSxS\InstallTemp\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\WinSxS\InstallTemp\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\WinSxS\InstallTemp\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\WinSxS\InstallTemp\qpasf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\ComPlus Applications\daqlgpm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\ComPlus Applications\daqlgpm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\ComPlus Applications\daqlgpm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\ComPlus Applications\daqlgpm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\ComPlus Applications\daqlgpm.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Internet Explorer\PLUGINS\xfgq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Internet Explorer\PLUGINS\xfgq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Internet Explorer\PLUGINS\xfgq.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\Documents and Settings\wjc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\Documents and Settings\wjc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System Root%\Documents and Settings\wjc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%System Root%\Documents and Settings\wjc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System Root%\Documents and Settings\wjc.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Windows Media Player\Icons\iubgv.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Windows Media Player\Icons\iubgv.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Windows Media Player\Icons\iubgv.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Windows Media Player\Icons\iubgv.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Windows Media Player\Icons\iubgv.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Windows Media Player\Icons\iubgv.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\ime\chsime\applets\qpasfs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\ime\chsime\applets\qpasfs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\ime\chsime\applets\qpasfs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\ime\chsime\applets\qpasfs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\ime\chsime\applets\qpasfs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\ime\chsime\applets\qpasfs.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\ytx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\ytx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\ytx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\ytx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\ytx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Online Services\vcwsf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Common Files\System\Ole DB\xfgqqpm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Common Files\System\Ole DB\xfgqqpm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Common Files\System\Ole DB\xfgqqpm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Common Files\System\Ole DB\xfgqqpm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Common Files\System\Ole DB\xfgqqpm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Common Files\System\Ole DB\xfgqqpm.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Offline Web Pages\qpasfei.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Offline Web Pages\qpasfei.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Offline Web Pages\qpasfei.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Offline Web Pages\qpasfei.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Offline Web Pages\qpasfei.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Offline Web Pages\qpasfei.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Messenger\wq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Messenger\wq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Messenger\wq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Messenger\wq.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\Templates\tb.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\Templates\tb.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\Templates\tb.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\Templates\tb.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\Templates\tb.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\Templates\tb.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Web\ukas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Web\ukas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\Web\ukas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Web\ukas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Web\ukas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Web\ukas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Web\ukas.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Online Services\vcwsfk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Online Services\vcwsfk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Online Services\vcwsfk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Online Services\vcwsfk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Online Services\vcwsfk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Online Services\vcwsfk.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\ytxpj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\ytxpj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\ytxpj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\ytxpj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\ytxpj.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\ytxpj.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\AppPatch\daasfy.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\AppPatch\daasfy.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\AppPatch\daasfy.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\AppPatch\daasfy.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\AppPatch\daasfy.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\AppPatch\daasfy.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Outlook Express\vcwsfk.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Outlook Express\vcwsfk.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\MSN Gaming Zone\Windows\xfgqq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\MSN Gaming Zone\Windows\xfgqq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\MSN Gaming Zone\Windows\xfgqq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\MSN Gaming Zone\Windows\xfgqq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\MSN Gaming Zone\Windows\xfgqq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\MSN Gaming Zone\Windows\xfgqq.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\Cookies\bdawe.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\Cookies\bdawe.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\Cookies\bdawe.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\Cookies\bdawe.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\Cookies\bdawe.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\Cookies\bdawe.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Registration\CRMLog\qpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Registration\CRMLog\qpasf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgpm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgpm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgpm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgpm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgpm.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\MSN\MSNCoreFiles\OOBE\daqlgpm.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\Templates\lnurywp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\Templates\lnurywp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\Templates\lnurywp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\Templates\lnurywp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\Templates\lnurywp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\Templates\lnurywp.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Temporary Internet Files%\Content.IE5\X9QQH2D9\jqv.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Temporary Internet Files%\Content.IE5\X9QQH2D9\jqv.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Temporary Internet Files%\Content.IE5\X9QQH2D9\jqv.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Temporary Internet Files%\Content.IE5\X9QQH2D9\jqv.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Temporary Internet Files%\Content.IE5\X9QQH2D9\jqv.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Windows NT\lmc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Windows NT\lmc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Windows NT\lmc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Windows NT\lmc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Windows NT\lmc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Windows NT\lmc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Windows NT\lmc.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Movie Maker\Shared\Profiles\ty.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Movie Maker\Shared\Profiles\ty.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Movie Maker\Shared\Profiles\ty.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Movie Maker\Shared\Profiles\ty.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\mui\ukasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\mui\ukasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\mui\ukasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\mui\ukasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\mui\ukasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\mui\ukasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\mui\ukasf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\repair\ef.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\repair\ef.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\repair\ef.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\repair\ef.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\repair\ef.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Online Services\vc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Online Services\vc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Online Services\vc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Online Services\vc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Online Services\vc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Online Services\vc.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\inf\ukasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\inf\ukasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\inf\ukasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\inf\ukasf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\S-1-5-19\ellifok.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\S-1-5-19\ellifok.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\S-1-5-19\ellifok.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\S-1-5-19\ellifok.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\S-1-5-19\ellifok.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\S-1-5-19\ellifok.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\S-1-5-19\ellifok.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Online Services\vcws.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Online Services\vcws.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Online Services\vcws.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Online Services\vcws.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Online Services\vcws.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Online Services\vcws.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\NetHood\lnu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\NetHood\lnu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\NetHood\lnu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\NetHood\lnu.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\NetHood\lnu.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\vx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\vx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\vx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\vx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\vx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\vx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\vx.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Windows NT\Pinball\fdajr.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Windows NT\Pinball\fdajr.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Windows NT\Pinball\fdajr.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Windows NT\Pinball\fdajr.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Windows NT\Pinball\fdajr.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Windows NT\Pinball\fdajr.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\MSN Gaming Zone\Windows\xfgq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\MSN Gaming Zone\Windows\xfgq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\MSN Gaming Zone\Windows\xfgq.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%System Root%\the_configurator\daphip.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System Root%\the_configurator\daphip.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System Root%\the_configurator\daphip.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System Root%\the_configurator\daphip.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\the_configurator\daphip.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\Local Settings\lnury.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\Local Settings\lnury.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\Local Settings\lnury.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\Local Settings\lnury.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\Local Settings\lnury.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\Local Settings\lnury.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\microsoft frontpage\version3.0\oe.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\microsoft frontpage\version3.0\oe.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\microsoft frontpage\version3.0\oe.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\microsoft frontpage\version3.0\oe.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\NetHood\lnury.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\WinPcap\wqorx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\WinPcap\wqorx.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Registration\CRMLog\qpasfc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Registration\CRMLog\qpasfc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Registration\CRMLog\qpasfc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Registration\CRMLog\qpasfc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Registration\CRMLog\qpasfc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Registration\CRMLog\qpasfc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\Registration\CRMLog\qpasfc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Windows Media Player\Sample Playlists\lmcdakh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Windows Media Player\Sample Playlists\lmcdakh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Windows Media Player\Sample Playlists\lmcdakh.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Windows Media Player\Skins\iubgvp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Windows Media Player\Skins\iubgvp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Windows Media Player\Skins\iubgvp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Windows Media Player\Skins\iubgvp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Windows Media Player\Skins\iubgvp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Windows Media Player\Skins\iubgvp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\microsoft frontpage\version3.0\bin\iubgvp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\microsoft frontpage\version3.0\bin\iubgvp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\microsoft frontpage\version3.0\bin\iubgvp.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\twain_32\daa.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\twain_32\daa.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\twain_32\daa.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\twain_32\daa.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\twain_32\daa.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\twain_32\daa.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Temp%\kc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Temp%\kc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Temp%\kc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Temp%\kc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Temp%\kc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Temp%\kc.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Temp%\bdaweh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Temp%\bdaweh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Temp%\bdaweh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Temp%\bdaweh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Temp%\bdaweh.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\My Pictures\jqvs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\My Pictures\jqvs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\My Pictures\jqvs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\My Pictures\jqvs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\My Pictures\jqvs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\My Pictures\jqvs.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\My Pictures\jqvs.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\java\classes\tf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\java\classes\tf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\java\classes\tf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\java\classes\tf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\java\classes\tf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\java\classes\tf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\java\classes\tf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\inf\uka.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\inf\uka.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\inf\uka.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\inf\uka.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\inf\uka.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\inf\uka.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\inf\uka.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Application Data%\Microsoft\Media Player\ifjgx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Application Data%\Microsoft\Media Player\ifjgx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Application Data%\Microsoft\Media Player\ifjgx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Application Data%\Microsoft\Media Player\ifjgx.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Application Data%\Microsoft\Media Player\ifjgx.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\lifq.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\srchasst\mui\0409\qpas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\srchasst\mui\0409\qpas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\srchasst\mui\0409\qpas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\srchasst\mui\0409\qpas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\srchasst\mui\0409\qpas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\srchasst\mui\0409\qpas.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Outlook Express\vcw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Outlook Express\vcw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Outlook Express\vcw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Outlook Express\vcw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Outlook Express\vcw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Outlook Express\vcw.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\srchasst\chars\wua.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\srchasst\chars\wua.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\srchasst\chars\wua.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\srchasst\chars\wua.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\srchasst\chars\wua.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\srchasst\chars\wua.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Movie Maker\MUI\0409\daq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Movie Maker\MUI\0409\daq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Movie Maker\MUI\0409\daq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Movie Maker\MUI\0409\daq.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Movie Maker\MUI\0409\daq.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Config\efasfw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Config\efasfw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\Config\efasfw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Config\efasfw.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Config\efasfw.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\Cookies\ovgdaek.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\Cookies\ovgdaek.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\Cookies\ovgdaek.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\Cookies\ovgdaek.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\Cookies\ovgdaek.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System%\efas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%System%\efas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%System%\efas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%System%\efas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%System%\efas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%System%\efas.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\DRM\vxpmtmp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\DRM\vxpmtmp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\DRM\vxpmtmp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\DRM\vxpmtmp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\DRM\vxpmtmp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\DRM\vxpmtmp.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Resources\Themes\Luna\Shell\NormalColor\bpasf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\Cookies\bdaweh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\Cookies\bdaweh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\Cookies\bdaweh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\Cookies\bdaweh.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\Cookies\bdaweh.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Program Files%\Messenger\jjsfofc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Program Files%\Messenger\jjsfofc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Program Files%\Messenger\jjsfofc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Program Files%\Messenger\jjsfofc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Program Files%\Messenger\jjsfofc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Program Files%\Messenger\jjsfofc.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Program Files%\Messenger\jjsfofc.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\Recent\tbqn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\Recent\tbqn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%User Profile%\Recent\tbqn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%User Profile%\Recent\tbqn.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\Recent\tbqn.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Cursors\efasfjp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\Cursors\efasfjp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Cursors\efasfjp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Cursors\efasfjp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Cursors\efasfjp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Cursors\efasfjp.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Cursors\efasfjp.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Tasks\yfasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Tasks\yfasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Tasks\yfasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\Tasks\yfasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Tasks\yfasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Tasks\yfasf.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Tasks\yfasf.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\NetHood\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%User Profile%\NetHood\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%User Profile%\NetHood\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%User Profile%\NetHood\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%User Profile%\NetHood\da.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%User Profile%\NetHood\da.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Temp%\History\History.IE5\fkas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Temp%\History\History.IE5\fkas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Temp%\History\History.IE5\fkas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Temp%\History\History.IE5\fkas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Temp%\History\History.IE5\fkas.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Temp%\History\History.IE5\fkas.exe"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • MSN Messenger service spawner. = "%Windows%\Prefetch\daasfda.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Mirosoft Windows Explorer tweaker = "%Windows%\Prefetch\daasfda.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Scheduled Tasks. = "%Windows%\Prefetch\daasfda.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • Adobe Color Palette loader = "%Windows%\Prefetch\daasfda.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • COM+ Server Host Process = "%Windows%\Prefetch\daasfda.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • NTFS backup service. = "%Windows%\Prefetch\daasfda.exe"
  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    • System Cleaner = "%Windows%\Prefetch\daasfda.exe"

Step 4

Search and delete these files

[ Learn More ]
There may be some component files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.
  • %User Startup%\fwxuw.exe
  • %User Startup%\bdaw.scr
  • %User Startup%\bdawe.scr
  • %User Startup%\fwxu.exe
  • %User Startup%\fw.scr
  • %User Startup%\fwxuwi.scr

Step 5

Restart in normal mode and scan your computer with your Trend Micro product for files detected as WORM_SILLY.ABH. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.