Gaming Tough Virus Help please

[Hakoda]

If I'm posting in the wrong section, mod please move it.

This is probably one pf the hardest viruses I've ever seen . Very hard to get rid of but something tells me that the members of GBATemp won't be stopped by something like that. This isn't on my computer, its on a neighbor's computer. Her computer is running Windows XP. Unknown which service pack because virus blocks that dialog box.

Virus Description:

- Blocks all programs from executing, unless renamed to a current windows process such as explorer.exe.
- Endless Pop-Ups & Balloons telling us that your system is infected.
- Background has changed to something like this: link
- Fake Antivirus; takes the name "Security Center 4.52"

I've tried to install anti-viruses onto a USB and launch them from the computer that way.

Anti-Viruses that have been tried:

- Malwarebytes: Result - Runtime error 0 then 440. Not blocked by virus if main executable is renamed to explorer.exe. (If the runtime error could be fixed, it would work.)If you have a solution to this runtime error, please make sure that its a patch that patches the .exe itself and does not involve any other program because the virus blocks them. So if you have a patch, I can patch it before hand but a CMD trick or something similar wont work because CMD is blocked on her computer.

- Avast Home Edition: Result: Unable to install on a USB.
- Spybot S&D: Result: SUCCESS. Security Center 4.52 still remains though.
- AVG: Result: Will only install to a hard drive, not USB.
- Dr.CureIt: Result: Failed to execute.
- Avira AV: Result: Failed to execute.
- Dr.Web LiveCD: Result: Still Scanning.

I can try HiJackThis but I won't be able to view the log from from that computer. If I can save the log file and send it to another site that may be a solution.

My neighbor has left for a 4th of July Party and said that I can come back tomorrow and try some new things. Hopefully, some Tempers can give some ideas or even a solution so that I will be able to fix it quickly tomorrow morning.

~ Jon

 

[wchill]

To access 16 bit Command Prompt, try COMMAND.COM.
As for your problem, grab Ubuntu 9.10 and burn it to a disc, boot it, grab + run an AV from there. Or you can try to manually delete whatever's causing the problem.

After Googling, apparently some of these processes are causing the problem:

549344438.exe
788573529.exe
1714292029.exe
1003720520.exe
adobe_flash[1].exe
AdobeFlash[1].exe
TubePlayer.ver.6.exe
cogad.exe
torbjne.exe
mupd1_2_1165664.exe
winscenter.exe
iehelpers[1].exe
iehelper.exe
19329203.exe
ayscjcts.exe
install[1].exe
281681216.exe
~tmpa.exe
bnmio.exe
bd3q0qix.exe
vamsoft.exe
iii[1].exe
load[1].exe
winafoe.exe
ParisHilton[1].exe
winkfmc.exe
TckBX673.exe
card[1].exe
ert51791.exe
AdwarePro.exe
AdwarePro_Setup[1].exe
StartApp.exe
1[1].exe
ntos.exe
new23[1].exe
gr[2].exe
adv111[1].exe
new26[1].exe
SetupAntivirusXP[1].exe
ieupdates.exe
28823330.exe
Test.exe
loader[1].exe
Hyves_Browser.exe
Hyves_Browser_Instalation.exe
9179499.exe
1462403437.exe
winlogin.exe
AntivirusXP.exe
vvunbwrhxa.exe
372561511.exe
svchost.exe
1610380076.exe
800990911.exe
431192516.exe
172939276.exe
240844061.exe
931330021.exe
973260134.exe
3DF7076F.exe
432632312.exe
613622941.exe
1591300478.exe
438978017.exe
1986350760.exe
1977868703.exe
2030350728.exe
install[2].exe
564DB681.exe
1431998300.exe
1947101902.exe
1940874419.exe
1767930182.exe
650526885.exe
695276073.exe
1550536869.exe
1327825314.exe
498278020.exe
2029503323.exe
14894324.exe
1743310514.exe
375534146.exe
1573468717.exe
202150970.exe
370382475.exe
2084498445.exe
801085450.exe
25238076.exe
380679599.exe
1354455340.exe
1690486455.exe
1725032906.exe
2113272685.exe
1255330437.exe
1126514300.exe
554845319.exe
01560265.exe
02686578.exe
00607031.exe
500153984.exe
96484328.exe
52796787.exe
13496218.exe
03326093.exe
14610250.exe
06837430.exe
29192498.exe
03380828.exe
90188702.exe
00184705.exe
93069676.exe
13059684.exe
11120624.exe
97246086.exe
17236094.exe
699415262.exe
94875926.exe
14865934.exe
19378284.exe
99388276.exe
16846714.exe
96856706.exe
18563124.exe
18058594.exe
11447194.exe
91457186.exe
99363896.exe
19353904.exe
90649526.exe
10639534.exe
13779354.exe
93789346.exe
19916874.exe
99926866.exe
94157956.exe
14147964.exe
17722954.exe
94955616.exe
14945624.exe
16692344.exe
96733746.exe
16723754.exe
99825926.exe
19815934.exe
90249366.exe
10239374.exe

It has the following registry entries:

MicrosoftWindowsCurrentVersionRunSystemSecurity
HKEY_CURRENT_USERSOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUNcogad
MicrosoftWindowsCurrentVersionRun281681216
MicrosoftWindowsCurrentVersionRunkxva
MicrosoftWindowsCurrentVersionUninstallAdwarePro
MicrosoftWindowsCurrentVersionRunAdwareProMFCT
Adware Pro
MicrosoftWindowsCurrentVersionApp PathsAdwarePro.exe
MicrosoftWindowsCurrentVersionRunMmexofumutokara
AntivirusXP
MicrosoftWindowsCurrentVersionExplorerMenuOrderStart Menu2ProgramsAntivirusXP
MicrosoftWindowsCurrentVersionUninstallHyves Browser
MICROSOFTWINDOWSCURRENTVERSIONRUNAntivirusXP.exe
MicrosoftWindowsCurrentVersionRun359F5809-00B8-4455-A73A-9EA62A51101B
MicrosoftWindowsCurrentVersionRun973260134
MicrosoftWindowsCurrentVersionExplorerMenuOrderStart Menu2ProgramsSystem Security
MicrosoftWindowsCurrentVersionRun1690486455
MicrosoftWindowsCurrentVersionRun370382475
MicrosoftWindowsCurrentVersionUninstallSystemSecurity2009
MicrosoftWindowsCurrentVersionRun2215359
MicrosoftWindowsCurrentVersionRun0206953
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 93069676
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 13059684
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 11120624
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 97246086
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 17236094
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 699415262
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 94875926
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 14865934
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 19378284
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 99388276
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 16846714
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 96856706
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 18563124
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 18058594
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 11447194
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 91457186
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 99363896
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 19353904
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 90649526
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 10639534
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 13779354
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 93789346
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 19916874
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 99926866
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 14147964
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 94157956
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 17722954
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 14945624
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 94955616
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 16723754
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 96733746
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 16692344
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 19815934
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 99825926
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 10239374
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 90249366

Registered DLL libraries:
QUOTE

iemodule.dll
ldycgadzmr.dll
setupapi.dll
SSEngine.dll
usp10.dll
Omahonafazeq.dll
uxeqipuzimocin.dll
cvucujahoza.dll
oqarib.dll
imod3.dll
swapdm.dll

 

[Deleted-119707]

try agv 8.xxx go on avg.com and get it. i had a virus that blocked me from viewing sites that talk about how to remove viruses and stuff. i had to reset windows....

 

[WB3000]

I never have to deal with infected PCs, but you did mention that cmd is blocked on the computer? Is this done by the infection or is that due to limited user status, etc.?

If it's the latter, you could try using the patched version of CMD I've made. It will run no matter what the PC settings are regarding CMD.

http://www.mediafire.com/?ernjn0l2mjb

It might be useful if you find out exactly what needs to be removed.

 

[dawn.wan]

here dude

download:
Dr CureIt
http://www.freedrweb.com/cureit/

ATFCleaner
http://www.atribune.org/index.php?option=c...5&Itemid=25

HijackThis
http://download.cnet.com/Trend-Micro-Hijac...4-10227353.html
!!HijackThis Disclaimer - Can fuck up system if you kill legit processes.. take care when doing this or just skip over it... if it still is infected after doing the steps below you may have to run this program... post LOG and i'll try to help you out... FYI i wont reply until 2morrow so try w/o if your not sure!!

And w/e AV you use (Kaspersky, AVG, etc)


Steps
-Run ATF cleaner and clear everything for windows and your web browser
-Run HijackThis and kill processes. You can search for the process on the net if your not sure.. also you check where the file location is (it shows you). IF this does not load go on to next step.
-Run DR CureIT and let it do the Initial quick scan. IF it detects virus delete.
-Do a complete scan of your drives in DR CureIT, delete/quarntine infected files
-Run HijackThis again and close any presistant processes that you know are infected
-Run your anti-virus and do a complete scan. IF you were not able to run it before it should work now.
-Restart and report and a 'thank you' would be nice

 

[Splych]

If none of those work... You'll have to re-install Windows... Bleh. I don't know anything about viruses... All I have done is get rid of em'... With what ever I had. Try Malware Bytes. It's worked for me.

 

[Hakoda]

I never have to deal with infected PCs, but you did mention that cmd is blocked on the computer? Is this done by the infection or is that due to limited user status, etc.?

If it's the latter, you could try using the patched version of CMD I've made. It will run no matter what the PC settings are regarding CMD.

http://www.mediafire.com/?ernjn0l2mjb

It might be useful if you find out exactly what needs to be removed.

Although the user has full access to the CMD, it is blocked by the virus. Then after re-thinking this, your custom CMD would be very helpful because I could rename to an existing windows process so that it won't be blocked, fix the Malwarebytes Runtime error, then run a scan.

If none of those work... You'll have to re-install Windows... Bleh. I don't know anything about viruses... All I have done is get rid of em'... With what ever I had. Try Malware Bytes. It's worked for me.
That's the plan, just gotta fix that runtime error. So far, its the only anti-virus that hasn't been blocked when renamed to explorer.exe.

QUOTE(dawn.wan @ Jul 3 2009, 04:29 PM)

here dude

download:
Dr CureIt
http://www.freedrweb.com/cureit/

This will be my backup next to a couple of other things. Thanks.


Thank you everyone I will reply back tomorrow on how it went. Please keep submitting suggestions as they may become back-up solutions if my main solution won't work. My last resort will be HijackThis which may work with the help of dawn.wan.

Thanks again,

~ Jon

 

[Athlon-pv]

"Rip" the HD from her computer if needed buy an external enclosure and fix it from another computer. Dont copy any files until the damn thing is clean!! check and double check!

The whole "let me take another few shots at trying it from her PC" is so futile

.

 

[Tokiopop]

Guys, how is she going to run the programs your giving links to if she cannot run .exes?

Your best bet is to try what wchill said, and manually delete it with Ubuntu. If you can even get that working.

 

[Splych]

Install the programs on a flashdrive? It never really hurt to try that... Since you can install some programs on them and they will run. I think Firefox portable was one of them, but not sure.

 

[Hakoda]

"Rip" the HD from her computer if needed buy an external enclosure and fix it from another computer. Dont copy any files until the damn thing is clean!! check and double check!

The whole "let me take another few shots at trying it from her PC" is so futile

.
That's true, it may be futile and I do happen to have an external enclosure so I may be able to plug it into my computer and have Bitdefender 2009 Total Security take a look at. But like you said, I'll double check with AVG, Avast!, MalwareBytes, ect.

QUOTE(ShatteredScreens @ Jul 4 2009, 03:55 AM) Guys, how is she going to run the programs your giving links to if she cannot run .exes?

Your best bet is to try what wchill said, and manually delete it with Ubuntu. If you can even get that working.

I'm a bit familiar with Ubuntu Linux but since its not my computer and I've never tried it, I don't want to mess something up. I CAN run .exe's its just that the program has to be renamed a current windows process like Explorer.exe. Obviously, the virus can't block a windows process because without the actual windows process, it wouldn't function correctly.

Thanks for the help guys, I'll be goin over to her house in about an hour or so, I'll come back and leave a reply.

~ Jon

 

[kobykaan]

use trend housecall online browser based antivirus/trojan removal tool here

there are many other online virus scans too that will scan your hd and remove stuff!

heres MANUAL instructions how to remove it

link

more info here

and if its blocking .exe files try rename the file extension to .msi (which is also an installer file)

 

[Hakoda]

use trend housecall online browser based antivirus/trojan removal tool here

there are many other online virus scans too that will scan your hd and remove stuff!

heres MANUAL instructions how to remove it

link

more info here

and if its blocking .exe files try rename the file extension to .msi (which is also an installer file)

That may work since S&D removed the sites in which the virus was blocking (Symantec, Mcafee, Kaspersky, ect)

If the Dr.Web LiveCD doesn't work I'm going to use HiJackThis then post a log somewhere. Then if that doesn't work I'm going to take out the HD and have my computer use Bitdefender to scan it.

Of course if that doesn't work, I can always call Megaman to jump into its CyberCore and delete the viruses

~ Jon

 

[kobykaan]

use trend housecall online browser based antivirus/trojan removal tool here

there are many other online virus scans too that will scan your hd and remove stuff!

heres MANUAL instructions how to remove it

link

more info here

and if its blocking .exe files try rename the file extension to .msi (which is also an installer file)

That ware work since S&D removed the sites in which the virus was blocking (Symantec, Mcafee, Kaspersky, ect)

If the Dr.Web LiveCD doesn't work I'm going to use HiJackThis then post a log somewhere. Then if that doesn't work I'm going to take out the HD and have my computer use Bitdefender to scan it.

Of course if that doesn't work, I can always call Megaman to jump into its CyberCore and delete the viruses

~ Jon

Use a LINUX LIVE disk and then scan with the ONLINE scan print the instructions out and remove the files manually through the linux filesystem browsing through the folders like you do with windows! .... also you should be able to use the web browser fine on the LINUX machine they mostly use FIREFOX and its virtually the same anyhow!

If its blocking the websites then find your HOSTS.ini file in your windows folder and delete any sites that are in
there relating to anti virus sites etc

infact there shouldn't be any sites in there apart from your local machine ip


127.0.0.1 localhost


and that's it any other sites that are listed are blocked via this hosts file!

you may want to temporarily make this file READ ONLY while you work on the system to stop any new entries being added

if internet explorer is being blocked use firefox if you have it installed or opera see if you can get to any sites

did you try the housecall website if you could get to it !?

try the manual steps removal ... remove all the files listed and the registry entries ..yes it may take a while but if thats your only option and basically FREE way of doing it then do so!


remember once you get this off the system delete all your restore points as it could hide out in there and be reinstalled if you restore

all the information is in the links above print them out (use another machine if you have to to print them)

 

[Hakoda]

Do you mean an Install CD from here and then just choosing "Try Ubuntu" when you allow the computer to boot from the CD or something else? If its something else could specify with a link?

~ Jon

EDIT: Just finished burning Ubuntu Desktop 9.04. I hit ENTER on the Try Ubuntu on my own computer. Perfect solution. Should have listened to that from the start. Thanks again guys. I'll do the online scan, then if that doesn't work i can always use WINE to run a windows antivirus.

 

[jaxxster]

Have you even ooted into safe mood then installing avast from a memory stick? Thats what i done when i had a similar virus.

 

[Hakoda]

jaxxster, I don't think it would make a difference since the virus would still be there in safe mode? or maybe it wouldn't.... well I don't know.

Anyways, thinking the Linux solution was going to work i thought i had everything solved butttt not exactly.

When testing linux on my own computer everything worked fine: internet, file browser, WINE, Firefox 3.5, the works... But when booted it on her computer, Linux wasn't able to establish an internet connection since it was a wireless LAN with a WEP encryption. We had to insert the WEP key again, which they didn't remember. Linux wasn't able to use the connection windows does. SO then i thought, well then use NDSIWrapper.Of course it requires an internet connection to install or something. I couldn't get it to work. Neither did WINE since it needed internet connection....

Thats when I gave up and left. I had a birthday party to go to. I just got back and i stubbled upon the Bitdefender 2009 RescueCD v2.0.0 - 6/30/09. Its up-to-date and I'm willing to try it tomorrow or any other free antvirus RescueCD from this site: Free Antivirus RescueCD's

Thanks everyone!!! Tempers rule

EDIT: Just got back from neighbor's. The BitDefender 2009 RescueCD was working perfectly and it found a couple of infected files. Then when it got near the end the window just disappeared. It didn't show which files where infected or anything it was just like in the middle of the scan and the window closed. I'll try again later.

~ Jon

 

[dragon574444]

My uncle had this exact virus. I ended up having to use the recovery partition on his PC and all that jazz.

 

[jaxxster]

Like i said, make sure you're running this stuff in safe mode.

 

[tal32123]

To access 16 bit Command Prompt, try COMMAND.COM.
As for your problem, grab Ubuntu 9.10 and burn it to a disc, boot it, grab + run an AV from there. Or you can try to manually delete whatever's causing the problem.

After Googling, apparently some of these processes are causing the problem:

549344438.exe
788573529.exe
1714292029.exe
1003720520.exe
adobe_flash[1].exe
AdobeFlash[1].exe
TubePlayer.ver.6.exe
cogad.exe
torbjne.exe
mupd1_2_1165664.exe
winscenter.exe
iehelpers[1].exe
iehelper.exe
19329203.exe
ayscjcts.exe
install[1].exe
281681216.exe
~tmpa.exe
bnmio.exe
bd3q0qix.exe
vamsoft.exe
iii[1].exe
load[1].exe
winafoe.exe
ParisHilton[1].exe
winkfmc.exe
TckBX673.exe
card[1].exe
ert51791.exe
AdwarePro.exe
AdwarePro_Setup[1].exe
StartApp.exe
1[1].exe
ntos.exe
new23[1].exe
gr[2].exe
adv111[1].exe
new26[1].exe
SetupAntivirusXP[1].exe
ieupdates.exe
28823330.exe
Test.exe
loader[1].exe
Hyves_Browser.exe
Hyves_Browser_Instalation.exe
9179499.exe
1462403437.exe
winlogin.exe
AntivirusXP.exe
vvunbwrhxa.exe
372561511.exe
svchost.exe
1610380076.exe
800990911.exe
431192516.exe
172939276.exe
240844061.exe
931330021.exe
973260134.exe
3DF7076F.exe
432632312.exe
613622941.exe
1591300478.exe
438978017.exe
1986350760.exe
1977868703.exe
2030350728.exe
install[2].exe
564DB681.exe
1431998300.exe
1947101902.exe
1940874419.exe
1767930182.exe
650526885.exe
695276073.exe
1550536869.exe
1327825314.exe
498278020.exe
2029503323.exe
14894324.exe
1743310514.exe
375534146.exe
1573468717.exe
202150970.exe
370382475.exe
2084498445.exe
801085450.exe
25238076.exe
380679599.exe
1354455340.exe
1690486455.exe
1725032906.exe
2113272685.exe
1255330437.exe
1126514300.exe
554845319.exe
01560265.exe
02686578.exe
00607031.exe
500153984.exe
96484328.exe
52796787.exe
13496218.exe
03326093.exe
14610250.exe
06837430.exe
29192498.exe
03380828.exe
90188702.exe
00184705.exe
93069676.exe
13059684.exe
11120624.exe
97246086.exe
17236094.exe
699415262.exe
94875926.exe
14865934.exe
19378284.exe
99388276.exe
16846714.exe
96856706.exe
18563124.exe
18058594.exe
11447194.exe
91457186.exe
99363896.exe
19353904.exe
90649526.exe
10639534.exe
13779354.exe
93789346.exe
19916874.exe
99926866.exe
94157956.exe
14147964.exe
17722954.exe
94955616.exe
14945624.exe
16692344.exe
96733746.exe
16723754.exe
99825926.exe
19815934.exe
90249366.exe
10239374.exe

It has the following registry entries:

MicrosoftWindowsCurrentVersionRunSystemSecurity
HKEY_CURRENT_USERSOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUNcogad
MicrosoftWindowsCurrentVersionRun281681216
MicrosoftWindowsCurrentVersionRunkxva
MicrosoftWindowsCurrentVersionUninstallAdwarePro
MicrosoftWindowsCurrentVersionRunAdwareProMFCT
Adware Pro
MicrosoftWindowsCurrentVersionApp PathsAdwarePro.exe
MicrosoftWindowsCurrentVersionRunMmexofumutokara
AntivirusXP
MicrosoftWindowsCurrentVersionExplorerMenuOrderStart Menu2ProgramsAntivirusXP
MicrosoftWindowsCurrentVersionUninstallHyves Browser
MICROSOFTWINDOWSCURRENTVERSIONRUNAntivirusXP.exe
MicrosoftWindowsCurrentVersionRun359F5809-00B8-4455-A73A-9EA62A51101B
MicrosoftWindowsCurrentVersionRun973260134
MicrosoftWindowsCurrentVersionExplorerMenuOrderStart Menu2ProgramsSystem Security
MicrosoftWindowsCurrentVersionRun1690486455
MicrosoftWindowsCurrentVersionRun370382475
MicrosoftWindowsCurrentVersionUninstallSystemSecurity2009
MicrosoftWindowsCurrentVersionRun2215359
MicrosoftWindowsCurrentVersionRun0206953
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 93069676
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 13059684
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 11120624
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 97246086
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 17236094
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 699415262
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 94875926
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 14865934
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 19378284
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 99388276
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 16846714
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 96856706
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 18563124
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 18058594
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 11447194
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 91457186
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 99363896
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 19353904
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 90649526
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 10639534
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 13779354
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 93789346
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 19916874
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 99926866
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 14147964
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 94157956
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 17722954
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 14945624
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 94955616
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 16723754
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 96733746
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 16692344
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 19815934
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 99825926
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 10239374
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN 90249366

Registered DLL libraries:
QUOTE

iemodule.dll
ldycgadzmr.dll
setupapi.dll
SSEngine.dll
usp10.dll
Omahonafazeq.dll
uxeqipuzimocin.dll
cvucujahoza.dll
oqarib.dll
imod3.dll
swapdm.dll

thats a huge friggen list