Díky moc Jaro, šlo by aspoň ve zkratce napsat co jsem to celou tu dobu dělal? Zalepoval díry v registrech nebo něco jiného? Potřeboval bych tomu alespoň trošku porozumět když ani ESET ani další antiviry nic nenašli a ty jsi tam přesto něco objevil.
Ještě jednou díky moc za to že jsi mě "dalo by se říct až za ruku" dotáhl až na konec..
Pomůže mi prosím někdo s viry? Vyřešeno
-
jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43294
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Pomůže mi prosím někdo s viry?
Není zač, antiviry nemohou být 100%, nákazy se objevují každý den.Odvirovali jsme PC, byly nakažené soubory , drivery a změněná hodnota klíčů..
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Re: Pomůže mi prosím někdo s viry?
Nazdar Jaro,
omlouvám se že Tě zase otravuji, ale zkusil jsem PC projet MWAV a našel mi tam spoustu kritických objektů (Spyware, Adware, Kaza atd). Nevím odkud se to vše může brát, protože jsem max na Seznamu a dalších stránkách tohoto tytu. Žádný čuňačiny :-), stahování nebo instalování, jen prohlížení informačních serverů nic víc.
Měl bych se tím nějak znepokojovat? (viz dole)
Díky za radu
Už jsem přestal úplně důvěřovat i ESETu a doplnil ochranu o Malwarebytes, SpywareBlaster a Windowsdefender, ale jak to tak vidím, tak bude asi nejlepší vytáhnout síťový kabel s PC :-)
25 IV 2009 21:34:19 - ***** Prohledávání registrů a souborů na přítomnost Adware/Spyware *****
25 IV 2009 21:34:20 - Loading Spyware Signatures from new External Database [Name: C:\DOCUME~1\Tomas\LOCALS~1\temp\spydb.avs, Size: 896540]...
25 IV 2009 21:34:20 - Indexed Spyware Databases Successfully Created...
25 IV 2009 21:34:26 - System found infected with MediaAdVantage Spyware/Adware (HKEY_CLASSES_ROOT\clsid\{602D9049-B4AC-4A25-BF75-A9B54D747CBA})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:26 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\clsid\{9BD3A001-42A2-491E-AACA-9512F6CF4CDB})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:26 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\clsid\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:26 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\clsid\{D2129738-6A78-4BCB-915A-412982CAA23D})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:26 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\clsid\{DC90EAA6-69B8-4DE4-9A7B-5B2C5B3FEACD})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:26 - System found infected with MediaAdVantage Spyware/Adware (HKEY_CLASSES_ROOT\AppID\{69E0089F-28BC-4BB5-862B-E2B07C3B83C6})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with MediaAdVantage Spyware/Adware (HKEY_CLASSES_ROOT\typelib\{DABF362D-D442-4402-9208-CA9ED70DD01E})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\interface\{1EDFD7DF-030D-4144-952E-9D7D86691CDB})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\interface\{459A91BC-193F-4A70-959C-BFF69D781142})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\interface\{464D3E06-7D5B-416F-A6EE-0FFB1A5E931B})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\interface\{497B84D4-FB2F-4AB0-A280-8AACFB4B355F})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with MediaAdVantage Spyware/Adware (HKEY_CLASSES_ROOT\interface\{5AC3A9EF-C0F8-41D4-B4E2-B7CEBB794151})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\interface\{66718B8E-A382-4FE2-AA7A-926F9D8C4621})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with MediaAdVantage Spyware/Adware (HKEY_CLASSES_ROOT\interface\{862DEF42-89AA-49FA-AE1F-8A84B1B08A17})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\interface\{BC39A57D-DF2C-45B4-BFFD-7D55E911C1B2})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\interface\{CCA2E620-B807-451F-BAFD-2057AF9025FE})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with MediaAdVantage Spyware/Adware (HKEY_CLASSES_ROOT\interface\{F6E4845D-1D13-4BC0-942D-B9191524CC48})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with MediaAdVantage Spyware/Adware (HKEY_CLASSES_ROOT\AppID\{69E0089F-28BC-4BB5-862B-E2B07C3B83C6})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - Offending Key found: HKCU\Software\Kazaa !!!
25 IV 2009 21:34:59 - Objekt "kazaa Spyware/Adware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - Offending Key found: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\malwareremover.com !!!
25 IV 2009 21:34:59 - Objekt "MalwareScanner Corrupted Adware/Spyware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - Offending Key found: HKCR\MEAD.1 !!!
25 IV 2009 21:34:59 - Objekt "MediaAdVantage Spyware/Adware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - Offending Key found: HKCR\TR.TRFactory !!!
25 IV 2009 21:34:59 - Objekt "MediaAdVantage Spyware/Adware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - Offending Key found: HKCR\TR.TRFactory.1 !!!
25 IV 2009 21:34:59 - Objekt "MediaAdVantage Spyware/Adware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - Offending file found: C:\WINDOWS\iun6002.exe
25 IV 2009 21:34:59 - System found infected with Spyware.NetScreenWatch Spyware/Adware (iun6002.exe)! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:35:03 - Offending Registry Entry found: HKLM\SOFTWARE\MimarSinan
25 IV 2009 21:35:03 - System found infected with CyberSitter Spyware/Adware (HKLM\SOFTWARE\MimarSinan)! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:35:03 - Offending Registry Entry found: HKCU\SOFTWARE\Wget
25 IV 2009 21:35:03 - System found infected with Backdoor (IRCBot) Trojans Spyware/Adware (HKCU\SOFTWARE\Wget)! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:35:03 - Offending Registry Entry found: HKCU\Software\Microsoft\OLE
25 IV 2009 21:35:03 - System found infected with Backdoor (IRCBot) Trojans Spyware/Adware (HKCU\Software\Microsoft\OLE)! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:35:04 - Offending Registry Entry found: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
25 IV 2009 21:35:04 - System found infected with Spyware.ExpressKeylog Corrupted Adware/Spyware (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations)! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:35:04 - Offending Registry Entry found: HKLM\SOFTWARE\Knight
25 IV 2009 21:35:04 - System found infected with DiskKnight Adware (HKLM\SOFTWARE\Knight)! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:35:04 - Offending Registry Entry found: HKCU\Software\Microsoft\Windows\CurrentVersion\Drivers
25 IV 2009 21:35:04 - System found infected with AntiSpyware Pro XP Corrupted Adware/Spyware (HKCU\Software\Microsoft\Windows\CurrentVersion\Drivers)! Action taken: Ponecháno, neodstraněno!.
omlouvám se že Tě zase otravuji, ale zkusil jsem PC projet MWAV a našel mi tam spoustu kritických objektů (Spyware, Adware, Kaza atd). Nevím odkud se to vše může brát, protože jsem max na Seznamu a dalších stránkách tohoto tytu. Žádný čuňačiny :-), stahování nebo instalování, jen prohlížení informačních serverů nic víc.
Měl bych se tím nějak znepokojovat? (viz dole)
Díky za radu
Už jsem přestal úplně důvěřovat i ESETu a doplnil ochranu o Malwarebytes, SpywareBlaster a Windowsdefender, ale jak to tak vidím, tak bude asi nejlepší vytáhnout síťový kabel s PC :-)
25 IV 2009 21:34:19 - ***** Prohledávání registrů a souborů na přítomnost Adware/Spyware *****
25 IV 2009 21:34:20 - Loading Spyware Signatures from new External Database [Name: C:\DOCUME~1\Tomas\LOCALS~1\temp\spydb.avs, Size: 896540]...
25 IV 2009 21:34:20 - Indexed Spyware Databases Successfully Created...
25 IV 2009 21:34:26 - System found infected with MediaAdVantage Spyware/Adware (HKEY_CLASSES_ROOT\clsid\{602D9049-B4AC-4A25-BF75-A9B54D747CBA})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:26 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\clsid\{9BD3A001-42A2-491E-AACA-9512F6CF4CDB})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:26 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\clsid\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:26 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\clsid\{D2129738-6A78-4BCB-915A-412982CAA23D})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:26 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\clsid\{DC90EAA6-69B8-4DE4-9A7B-5B2C5B3FEACD})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:26 - System found infected with MediaAdVantage Spyware/Adware (HKEY_CLASSES_ROOT\AppID\{69E0089F-28BC-4BB5-862B-E2B07C3B83C6})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with MediaAdVantage Spyware/Adware (HKEY_CLASSES_ROOT\typelib\{DABF362D-D442-4402-9208-CA9ED70DD01E})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\interface\{1EDFD7DF-030D-4144-952E-9D7D86691CDB})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\interface\{459A91BC-193F-4A70-959C-BFF69D781142})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\interface\{464D3E06-7D5B-416F-A6EE-0FFB1A5E931B})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\interface\{497B84D4-FB2F-4AB0-A280-8AACFB4B355F})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with MediaAdVantage Spyware/Adware (HKEY_CLASSES_ROOT\interface\{5AC3A9EF-C0F8-41D4-B4E2-B7CEBB794151})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\interface\{66718B8E-A382-4FE2-AA7A-926F9D8C4621})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with MediaAdVantage Spyware/Adware (HKEY_CLASSES_ROOT\interface\{862DEF42-89AA-49FA-AE1F-8A84B1B08A17})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\interface\{BC39A57D-DF2C-45B4-BFFD-7D55E911C1B2})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with Parentis Spyware/Adware (HKEY_CLASSES_ROOT\interface\{CCA2E620-B807-451F-BAFD-2057AF9025FE})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with MediaAdVantage Spyware/Adware (HKEY_CLASSES_ROOT\interface\{F6E4845D-1D13-4BC0-942D-B9191524CC48})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - System found infected with MediaAdVantage Spyware/Adware (HKEY_CLASSES_ROOT\AppID\{69E0089F-28BC-4BB5-862B-E2B07C3B83C6})! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - Offending Key found: HKCU\Software\Kazaa !!!
25 IV 2009 21:34:59 - Objekt "kazaa Spyware/Adware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - Offending Key found: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\malwareremover.com !!!
25 IV 2009 21:34:59 - Objekt "MalwareScanner Corrupted Adware/Spyware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - Offending Key found: HKCR\MEAD.1 !!!
25 IV 2009 21:34:59 - Objekt "MediaAdVantage Spyware/Adware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - Offending Key found: HKCR\TR.TRFactory !!!
25 IV 2009 21:34:59 - Objekt "MediaAdVantage Spyware/Adware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - Offending Key found: HKCR\TR.TRFactory.1 !!!
25 IV 2009 21:34:59 - Objekt "MediaAdVantage Spyware/Adware" nalezen v souborovém systému! Provedené akce: Ponecháno, neodstraněno!.
25 IV 2009 21:34:59 - Offending file found: C:\WINDOWS\iun6002.exe
25 IV 2009 21:34:59 - System found infected with Spyware.NetScreenWatch Spyware/Adware (iun6002.exe)! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:35:03 - Offending Registry Entry found: HKLM\SOFTWARE\MimarSinan
25 IV 2009 21:35:03 - System found infected with CyberSitter Spyware/Adware (HKLM\SOFTWARE\MimarSinan)! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:35:03 - Offending Registry Entry found: HKCU\SOFTWARE\Wget
25 IV 2009 21:35:03 - System found infected with Backdoor (IRCBot) Trojans Spyware/Adware (HKCU\SOFTWARE\Wget)! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:35:03 - Offending Registry Entry found: HKCU\Software\Microsoft\OLE
25 IV 2009 21:35:03 - System found infected with Backdoor (IRCBot) Trojans Spyware/Adware (HKCU\Software\Microsoft\OLE)! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:35:04 - Offending Registry Entry found: HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
25 IV 2009 21:35:04 - System found infected with Spyware.ExpressKeylog Corrupted Adware/Spyware (HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations)! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:35:04 - Offending Registry Entry found: HKLM\SOFTWARE\Knight
25 IV 2009 21:35:04 - System found infected with DiskKnight Adware (HKLM\SOFTWARE\Knight)! Action taken: Ponecháno, neodstraněno!.
25 IV 2009 21:35:04 - Offending Registry Entry found: HKCU\Software\Microsoft\Windows\CurrentVersion\Drivers
25 IV 2009 21:35:04 - System found infected with AntiSpyware Pro XP Corrupted Adware/Spyware (HKCU\Software\Microsoft\Windows\CurrentVersion\Drivers)! Action taken: Ponecháno, neodstraněno!.
-
jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43294
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Pomůže mi prosím někdo s viry?
Nákazy tam máš, v klíčích i v souborech..
Takže:
Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.
Podívám se ale zítra , dnes končím..
Takže:
Stáhni si Malwarebytes' Anti-Malware
Nainstaluj a spusť ho
- na konci instalace se ujisti že máš zvoleny/zatrhnuty obě možnosti:
Aktualizace Malwarebytes' Anti-Malware a Spustit aplikaci Malwarebytes' Anti-Malware, pokud jo tak klikni na tlačítko konec
- pokud bude nalezena aktualizace, tak se stáhne a nainstaluje
- program se po té spustí a nech vybranou možnost Provést rychlý sken a klikni na tlačítko Skenovat
- po proběhnutí programu se ti objeví hláška tak klikni na OK a pak na tlačítko Zobrazit výsledky
- pak zvol možnost uložit log a ulož si log na plochu
- po té klikni na tlačítko Exit, objeví se ti hláška tak zvol Ano
(zatím nic nemaž!).
Vlož sem pak obsah toho logu.
Podívám se ale zítra , dnes končím..
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Re: Pomůže mi prosím někdo s viry?
Ahoj Jaro, takže tady to je. Musím říct že teď moje PC projíždím skoro každý den vším co mám i MbAM. Jo a vzpomněl jsem si že 22.4. mi Malwarebytes našel Adware.Vomba ale pak už žádný ani ESET a ani online Kaspersky nic.
Nevím jestli to s tím má něco společného, ale pořád mi firewall ukazuje ve Skype nějaky divný spojení (viz příloha).
Kolikrát už tam byly i nějaký vzdálený adresy i třeba s koncovkou .ru
Možná už z toho blázním :-) a hledám strašáky tam kde nejsou ale na to že jsi mi to 20.4. dal všechno do kupy a pár dní na to, to je ještě horší než předtím tak se mi to zdá celý nějak podezdřele rychlý.
Malwarebytes' Anti-Malware 1.36
Verze databáze: 2040
Windows 5.1.2600 Service Pack 3
25.4.2009 23:02:59
mbam-log-2009-04-25 (23-02-59).txt
Typ skenu: Rychlý sken
Objektu skenováno: 68468
Uplynulý cas: 1 minute(s), 26 second(s)
Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 0
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 0
Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)
Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)
Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)
Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)
Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)
Infikované složky:
(Žádné zákerné položky nebyly zjišteny)
Infikované soubory:
(Žádné zákerné položky nebyly zjišteny)
Nevím jestli to s tím má něco společného, ale pořád mi firewall ukazuje ve Skype nějaky divný spojení (viz příloha).
Kolikrát už tam byly i nějaký vzdálený adresy i třeba s koncovkou .ru
Možná už z toho blázním :-) a hledám strašáky tam kde nejsou ale na to že jsi mi to 20.4. dal všechno do kupy a pár dní na to, to je ještě horší než předtím tak se mi to zdá celý nějak podezdřele rychlý.
Malwarebytes' Anti-Malware 1.36
Verze databáze: 2040
Windows 5.1.2600 Service Pack 3
25.4.2009 23:02:59
mbam-log-2009-04-25 (23-02-59).txt
Typ skenu: Rychlý sken
Objektu skenováno: 68468
Uplynulý cas: 1 minute(s), 26 second(s)
Infikované procesy pameti: 0
Infikované pametové moduly: 0
Infikované klíce registru: 0
Infikované hodnoty registru: 0
Infikované položky dat registru: 0
Infikované složky: 0
Infikované soubory: 0
Infikované procesy pameti:
(Žádné zákerné položky nebyly zjišteny)
Infikované pametové moduly:
(Žádné zákerné položky nebyly zjišteny)
Infikované klíce registru:
(Žádné zákerné položky nebyly zjišteny)
Infikované hodnoty registru:
(Žádné zákerné položky nebyly zjišteny)
Infikované položky dat registru:
(Žádné zákerné položky nebyly zjišteny)
Infikované složky:
(Žádné zákerné položky nebyly zjišteny)
Infikované soubory:
(Žádné zákerné položky nebyly zjišteny)
-
jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43294
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Pomůže mi prosím někdo s viry?
Takže vypni rez. ochrany a firewall u ESS.
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Toto otestuj na Virustotal
C:\WINDOWS\iun6002.exe
Vlož sem pak odkazy výsledků.
Měl sice patřit ke Codec Pack - All In 1, ale MWAV ukazuje nákazu
Stáhni si ComboFix (by sUBs)
a ulož si ho na plochu.
Ukonči všechna aktivní okna a spusť ho.
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Toto otestuj na Virustotal
C:\WINDOWS\iun6002.exe
Vlož sem pak odkazy výsledků.
Měl sice patřit ke Codec Pack - All In 1, ale MWAV ukazuje nákazu
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Re: Pomůže mi prosím někdo s viry?
Takže provedeno. Měl by být při testování zavřený i SKYPE? Mám ho neustále spuštěný v té liště s ESET, Windefender atd..
ComboFix 09-04-25.A3 - Tomas 26.04.2009 8:33.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1023.563 [GMT 2:00]
Spuštěný z: c:\documents and settings\Tomas\Plocha\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated)
FW: ESET personal firewall *disabled*
* Vytvořen nový Bod Obnovení
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.
((((((((((((((((((((((((( Soubory vytvořené od 2009-05-26 do 2009-4-26 )))))))))))))))))))))))))))))))
.
2009-04-25 20:59 . 2009-04-06 13:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-25 20:59 . 2009-04-06 13:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-25 20:59 . 2009-04-25 21:00 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-25 19:34 . 2009-04-25 19:34 4203096 ----a-w c:\windows\REGBK00.ZIP
2009-04-25 19:17 . 2009-04-25 19:21 -------- d-----w c:\program files\RegCleaner
2009-04-25 19:07 . 2009-04-25 19:22 -------- d-----w c:\program files\SpywareBlaster
2009-04-22 17:56 . 2009-04-22 17:56 -------- d-----w c:\program files\Windows Defender
2009-04-20 19:33 . 2009-04-20 19:32 410984 ----a-w c:\windows\system32\deploytk.dll
2009-04-19 17:54 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-19 17:54 . 2009-03-06 14:23 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-19 17:54 . 2009-02-09 11:25 111104 -c----w c:\windows\system32\dllcache\services.exe
2009-04-19 17:54 . 2009-02-09 10:56 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-19 17:54 . 2009-02-09 10:56 684032 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-19 17:54 . 2009-02-09 10:56 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-19 17:54 . 2009-02-09 10:56 728064 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-04-19 17:54 . 2009-02-09 10:56 709632 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-19 17:54 . 2009-02-09 10:56 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-19 17:53 . 2009-03-27 06:53 1203922 -c----w c:\windows\system32\dllcache\sysmain.sdb
2009-04-19 17:53 . 2008-04-21 21:15 216576 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-04-01 19:03 . 2009-04-01 19:03 -------- d-----w c:\documents and settings\All Users\Data aplikací\NortonInstaller
2009-03-31 18:25 . 2009-03-31 18:25 -------- d-----w c:\documents and settings\Tomas\DoctorWeb
2009-03-30 19:00 . 2009-03-30 19:00 626688 ----a-w c:\windows\system32\msvcr80.dll
2009-03-30 19:00 . 2009-03-30 19:00 548864 ----a-w c:\windows\system32\msvcp80.dll
2009-03-30 19:00 . 2009-03-30 19:00 28672 ----a-w c:\windows\system32\eEmpty.exe
2009-03-30 19:00 . 2005-09-22 21:22 522 ----a-w c:\windows\system32\Microsoft.VC80.CRT.manifest
2009-03-30 19:00 . 2009-03-30 19:00 -------- d-----w c:\program files\Common Files\MicroWorld
2009-03-30 19:00 . 2009-03-30 19:00 -------- d-----w c:\documents and settings\All Users\Data aplikací\MicroWorld
2009-03-27 16:23 . 2009-03-27 16:23 -------- d-----w c:\program files\CCleaner
2009-03-27 16:08 . 2009-04-25 20:41 -------- d---a-w c:\documents and settings\All Users\Data aplikací\TEMP
2009-03-27 15:49 . 2009-03-27 16:06 -------- d-----w c:\program files\Free Windows Registry Cleaner
2009-03-27 15:39 . 2009-03-27 15:39 -------- d-----w c:\windows\$regcmp$
2009-03-27 15:36 . 2009-03-27 15:47 -------- d-----w c:\program files\Registry Clean Expert
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-26 06:27 . 2007-11-12 18:47 -------- d-----w c:\documents and settings\Tomas\Data aplikací\Skype
2009-04-25 20:55 . 2009-02-13 08:08 -------- d-----w c:\program files\Hardcopy
2009-04-22 17:56 . 2007-11-13 16:29 67280 ----a-w c:\documents and settings\Tomas\Local Settings\Data aplikací\GDIPFONTCACHEV1.DAT
2009-04-20 19:34 . 2008-02-15 09:19 -------- d-----w c:\program files\Java
2009-04-19 19:04 . 2004-08-18 12:00 47206 ----a-w c:\windows\system32\perfc005.dat
2009-04-19 19:04 . 2004-08-18 12:00 312970 ----a-w c:\windows\system32\perfh005.dat
2009-04-01 19:03 . 2007-03-16 12:28 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-03-27 16:59 . 2007-12-01 16:16 -------- d-----w c:\program files\Winamp
2009-03-26 20:33 . 2009-03-26 20:33 -------- d-----w c:\documents and settings\Tomas\Data aplikací\Malwarebytes
2009-03-26 20:32 . 2009-03-26 20:32 -------- d-----w c:\documents and settings\All Users\Data aplikací\Malwarebytes
2009-03-20 12:26 . 2007-10-18 17:30 -------- d-----w c:\program files\GameTop.com
2009-03-13 19:37 . 2009-03-13 19:37 -------- d-----w c:\program files\Codec Pack - All In 1
2009-03-13 19:36 . 2009-03-13 19:37 737280 ----a-w c:\windows\iun6002.exe
2009-03-07 17:15 . 2007-11-26 19:40 -------- d-----w c:\documents and settings\Tomas\Data aplikací\BSplayer
2009-03-06 14:23 . 2004-08-18 12:00 284160 ----a-w c:\windows\system32\pdh.dll
2009-02-28 18:45 . 2008-11-10 19:51 -------- d-----w c:\documents and settings\Tomas\Data aplikací\Vso
2009-02-20 08:12 . 2004-08-18 12:00 667136 ----a-w c:\windows\system32\wininet.dll
2009-02-20 08:12 . 2004-08-18 12:00 81920 -c--a-w c:\windows\system32\ieencode.dll
2009-02-09 14:07 . 2004-08-18 12:00 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:26 . 2004-08-17 15:45 2025984 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-09 11:26 . 2004-08-18 12:00 2147328 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-09 11:25 . 2004-08-18 12:00 111104 ----a-w c:\windows\system32\services.exe
2009-02-09 10:56 . 2004-08-18 12:00 728064 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:56 . 2004-08-18 12:00 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:56 . 2004-08-18 12:00 709632 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 10:56 . 2004-08-18 12:00 684032 ----a-w c:\windows\system32\advapi32.dll
2009-02-06 10:39 . 2004-08-18 12:00 35328 ----a-w c:\windows\system32\sc.exe
2009-02-03 19:58 . 2004-08-18 12:00 56832 ----a-w c:\windows\system32\secur32.dll
2009-01-11 18:32 . 2008-11-10 19:51 47360 ----a-w c:\documents and settings\Tomas\Data aplikací\pcouffin.sys
2008-03-02 17:11 . 2008-03-02 17:11 32 ----a-w c:\documents and settings\All Users\Data aplikací\ezsid.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-23 21755688]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-10-24 1451264]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-20 148888]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-02-26 16125440]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Tomas\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Hardcopy.LNK - c:\program files\Hardcopy\hardcopy.exe [2009-2-13 1286656]
Windows Commander 32.lnk - c:\wincmd\WINCMD32.EXE [2007-10-18 1443328]
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
S2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2008-10-24 468224]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
S3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\DRIVERS\psched.sys [2008-04-13 69120]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UlkqaEnpuxv
.
Obsah adresáře 'Naplánované úlohy'
2009-04-26 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Tomas\Data aplikací\Mozilla\Firefox\Profiles\ih5vf0wz.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-26 08:34
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft]
@DACL=(02 0000)
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft\MessengerService]
@DACL=(02 0000)
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs]
@DACL=(02 0000)
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU]
@DACL=(02 0000)
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft\Windows\CurrentVersion\Run]
@DACL=(02 0000)
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft\Windows NT\CurrentVersion\Network\Persistent Connections]
@DACL=(02 0000)
DUMPHIVE0.003 (REGF)
[HKEY_USERS\S-1-5-21-1460304000-3615762775-1979223112-1008\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:9c,99,cf,bd,01,69,ff,0e,a0,3b,3a,9f,bd,5f,ec,a5,c7,78,ea,72,f2,08,cd,
9c,2f,e0,a8,64,3a,b3,c7,89,ab,28,12,20,4b,30,d6,9e,29,3b,9b,4a,34,0b,71,6b,\
"??"=hex:6f,78,d6,80,a5,79,1f,fb,6f,a7,34,1e,1d,9f,8c,96
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(988)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(952)
c:\program files\Hardcopy\HcDLL2_28_Win32.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2009-04-26 8:35
ComboFix-quarantined-files.txt 2009-04-26 06:35
Před spuštěním: Volných bajtů: 89 241 964 544
Po spuštění: Volných bajtů: 89 235 218 432
166 --- E O F --- 2009-04-19 18:58
Soubor iun6002.exe přijatý 2009.04.26 08:40:59 (CET)
Současný stav: Čekejte ... Ve frontě Čekání Testování Dokončeno NENALEZENO ZASTAVENO
Výsledek: 0/40 (0%)
Načítám informace ze serveru...
Váš soubor čeká ve frontě na pozici: 2.
Odhadovaný čas začátku mezi 44 a 63 sekundami.
Nezavírejte toto okno dokud nebude test dokončen.
Právě testující program byl je zastaven, probíhá čekání na program.
Za chvíli bude proveden další pokus o otestování souboru.
Pokud budete čekat déle než-li pět minut odešlete Váš soubor znovu.
Váš soubor je nyní testován pomocí VirusTotal,
výsledky budou zobrazeny po dokončení.
Formátované Formátované
Vytisknout výsledky Vytisknout výsledky
Váš soubor není platný, nebo neexistuje.
Služba je pozastavena v tuto chvíli, váš soubor čeká na otestování (pozice: ) po nespecifikovanou dobu.
Nyní čekejte na odezvu webu (automatické obnovení), nebo napište email do pole a klikněte na "vyžádat" a systém Vám zašle email s výsledky až bude test hotov.
Email:
Antivirus Verze Poslední aktualizace Výsledek
a-squared 4.0.0.101 2009.04.26 -
AhnLab-V3 5.0.0.2 2009.04.24 -
AntiVir 7.9.0.156 2009.04.25 -
Antiy-AVL 2.0.3.1 2009.04.24 -
Authentium 5.1.2.4 2009.04.25 -
Avast 4.8.1335.0 2009.04.25 -
AVG 8.5.0.287 2009.04.25 -
BitDefender 7.2 2009.04.26 -
CAT-QuickHeal 10.00 2009.04.25 -
ClamAV 0.94.1 2009.04.26 -
Comodo 1135 2009.04.25 -
DrWeb 4.44.0.09170 2009.04.26 -
eSafe 7.0.17.0 2009.04.23 -
eTrust-Vet 31.6.6475 2009.04.24 -
F-Prot 4.4.4.56 2009.04.25 -
F-Secure 8.0.14470.0 2009.04.25 -
Fortinet 3.117.0.0 2009.04.25 -
GData 19 2009.04.26 -
Ikarus T3.1.1.49.0 2009.04.26 -
K7AntiVirus 7.10.716 2009.04.25 -
Kaspersky 7.0.0.125 2009.04.26 -
McAfee 5596 2009.04.25 -
McAfee+Artemis 5596 2009.04.25 -
McAfee-GW-Edition 6.7.6 2009.04.26 -
Microsoft 1.4602 2009.04.26 -
NOD32 4035 2009.04.25 -
Norman 6.00.06 2009.04.24 -
nProtect 2009.1.8.0 2009.04.26 -
Panda 10.0.0.14 2009.04.25 -
PCTools 4.4.2.0 2009.04.25 -
Prevx1 3.0 2009.04.26 -
Rising 21.26.60.00 2009.04.26 -
Sophos 4.41.0 2009.04.26 -
Sunbelt 3.2.1858.2 2009.04.24 -
Symantec 1.4.4.12 2009.04.26 -
TheHacker 6.3.4.1.314 2009.04.26 -
TrendMicro 8.700.0.1004 2009.04.25 -
VBA32 3.12.10.3 2009.04.25 -
ViRobot 2009.4.24.1708 2009.04.24 -
VirusBuster 4.6.5.0 2009.04.25 -
Rozšiřující informace
File size: 737280 bytes
MD5...: 456462905091db042141487fe030e3c9
SHA1..: bb57b4850528c3c8d9bf159fb5b9f414ddc7d5d7
SHA256: a93dc5e28d74ef40dd5d694aff7fb5f24c27dac4b59adae008cfdc5ca65587b0
SHA512: fdd82c126189454352b44c756be06e3e93ee26a93b56d99c3eb5254cac3f6d6e
d71556765b76e65bd75efad461972044ce829443c006fc0816a28f7b4493296f
ssdeep: 12288:n/Kw1mzcOv7j0NRF6u7UvuKkVV3oG2v6urURWRfFW4aikgwsqEKO:n+SIu
fX3oG2v6P0FParsK
PEiD..: Armadillo v1.71
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x5ec75
timedatestamp.....: 0x402aa809 (Wed Feb 11 22:09:13 2004)
machinetype.......: 0x14c (I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x8436e 0x85000 6.52 1237ff6301825d5921b7f9a2f5139816
.rdata 0x86000 0x18156 0x19000 4.42 f6348df4f813de13cfb1e801130e5f79
.data 0x9f000 0x1193c 0xe000 5.13 596eac4f3dcfd1be5b3c6efaf752d891
.rsrc 0xb1000 0x6778 0x7000 3.64 d209a606411a3420b49c6373aa0bc2dc
( 14 imports )
> WINMM.dll: waveOutGetNumDevs
> VERSION.dll: VerLanguageNameA, GetFileVersionInfoA, GetFileVersionInfoSizeA, VerQueryValueA
> KERNEL32.dll: GetCPInfo, GetOEMCP, RtlUnwind, RaiseException, HeapFree, HeapAlloc, HeapReAlloc, GetTimeZoneInformation, GetSystemTime, GetLocalTime, ExitProcess, GetStartupInfoA, GetCommandLineA, GetACP, HeapSize, SetUnhandledExceptionFilter, GetEnvironmentVariableA, GlobalFlags, HeapCreate, VirtualFree, VirtualAlloc, IsBadWritePtr, LCMapStringA, LCMapStringW, UnhandledExceptionFilter, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, GetStringTypeA, GetStringTypeW, IsBadCodePtr, SetStdHandle, CompareStringA, CompareStringW, SetEnvironmentVariableA, SetErrorMode, LocalReAlloc, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSection, GetVersion, GetCurrentThreadId, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, GlobalDeleteAtom, LockResource, FindResourceA, LoadResource, SystemTimeToFileTime, GetFileTime, FileTimeToSystemTime, WideCharToMultiByte, InterlockedDecrement, GetFullPathNameA, MoveFileA, UnlockFile, LockFile, FlushFileBuffers, DuplicateHandle, DosDateTimeToFileTime, LocalFileTimeToFileTime, SetFileTime, GetTickCount, IsBadStringPtrA, FileTimeToLocalFileTime, FileTimeToDosDateTime, lstrcmpiA, LocalAlloc, LocalLock, LocalUnlock, GlobalReAlloc, IsDBCSLeadByte, lstrcatA, TlsGetValue, IsBadReadPtr, TlsFree, TlsSetValue, TlsAlloc, MultiByteToWideChar, GetPrivateProfileIntA, GlobalMemoryStatus, GetVolumeInformationA, GetComputerNameA, MoveFileExA, WritePrivateProfileStringA, GetPrivateProfileStringA, TerminateProcess, Sleep, GetDiskFreeSpaceA, lstrcmpA, GetCurrentDirectoryA, LoadLibraryExA, GetLogicalDriveStringsA, GetShortPathNameA, CopyFileA, FormatMessageA, LocalFree, CreateProcessA, GetPrivateProfileSectionNamesA, GetPrivateProfileSectionA, GlobalAlloc, GlobalLock, GlobalHandle, GlobalUnlock, GlobalFree, GetCurrentThread, GetCurrentProcess, GetWindowsDirectoryA, GetSystemDirectoryA, GetSystemDefaultLangID, GetDriveTypeA, MulDiv, InterlockedIncrement, FindNextFileA, FindFirstFileA, FindClose, RemoveDirectoryA, SetCurrentDirectoryA, CreateDirectoryA, GetFileAttributesA, SetFileAttributesA, WriteFile, ReadFile, CreateFileA, GetFileSize, SetFilePointer, SetEndOfFile, DeleteFileA, GetTempPathA, GetTempFileNameA, lstrcpyA, lstrlenA, lstrcpynA, ExpandEnvironmentStringsA, GetProcessVersion, GetModuleFileNameA, OpenProcess, CloseHandle, GetModuleHandleA, LoadLibraryA, GetProcAddress, GetEnvironmentStrings, FreeEnvironmentStringsA, GetCurrentProcessId, FreeLibrary, GetVersionExA, GetLastError, SetLastError, HeapDestroy
> USER32.dll: UnpackDDElParam, ReuseDDElParam, SetMenu, LoadMenuA, DestroyMenu, ReleaseCapture, TranslateAcceleratorA, LoadAcceleratorsA, SetRectEmpty, GetMessageA, ValidateRect, GetCursorPos, PtInRect, FillRect, DrawFocusRect, GrayStringA, DrawTextA, TabbedTextOutA, EndPaint, BeginPaint, ClientToScreen, GetMenuCheckMarkDimensions, LoadBitmapA, GetMenuState, ModifyMenuA, SetMenuItemBitmaps, CheckMenuItem, EnableMenuItem, MapWindowPoints, GetSysColor, GetFocus, AdjustWindowRectEx, ScreenToClient, EqualRect, DeferWindowPos, BeginDeferWindowPos, CopyRect, EndDeferWindowPos, IsWindowVisible, UnregisterClassA, GetTopWindow, GetCapture, WinHelpA, GetMenu, GetMenuItemCount, GetSubMenu, GetMenuItemID, GetKeyState, SetWindowsHookExA, CallNextHookEx, GetClassLongA, BringWindowToTop, GetPropA, CallWindowProcA, RemovePropA, GetMessageTime, GetMessagePos, GetLastActivePopup, GetForegroundWindow, GetWindow, SystemParametersInfoA, GetWindowPlacement, SetActiveWindow, CreateDialogIndirectParamA, GetParent, SetFocus, IsWindowEnabled, ShowWindow, MoveWindow, GetDlgCtrlID, IsDialogMessageA, SendDlgItemMessageA, GetDlgItem, UnhookWindowsHookEx, GetWindowTextLengthA, LoadStringA, WaitForInputIdle, SetDlgItemTextA, SetWindowTextA, SetForegroundWindow, EndDialog, DialogBoxParamA, GetActiveWindow, GetClassNameA, CharUpperA, OemToCharA, CharNextA, CharPrevA, CharUpperBuffA, SetCursor, IsIconic, DrawIcon, DestroyIcon, ExitWindowsEx, LoadCursorA, UpdateWindow, RedrawWindow, GetDesktopWindow, GetWindowTextA, EnumWindows, GetWindowThreadProcessId, PostMessageA, ShowOwnedPopups, GetSysColorBrush, SetPropA, SetWindowPos, MessageBoxA, MsgWaitForMultipleObjects, GetSystemMetrics, EnableWindow, InvalidateRect, GetClientRect, GetDC, ReleaseDC, GetWindowRect, LoadIconA, SendMessageTimeoutA, TranslateMessage, DispatchMessageA, PeekMessageA, PostQuitMessage, IsWindow, GetWindowLongA, DefWindowProcA, SetWindowLongA, GetClassInfoA, RegisterClassA, CreateWindowExA, SendMessageA, DestroyWindow, wsprintfA, RegisterWindowMessageA, GetNextDlgTabItem
> GDI32.dll: SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, SetMapMode, SelectObject, RestoreDC, SaveDC, CreateCompatibleDC, BitBlt, Escape, ExtTextOutA, TextOutA, RectVisible, PtVisible, ScaleWindowExtEx, SetWindowExtEx, DeleteObject, StretchDIBits, RealizePalette, SelectPalette, Rectangle, GetDeviceCaps, CreateFontA, CreateBitmap, SetTextColor, GetClipBox, GetBkColor, SetBkColor, SetBkMode, CreateICA, DeleteDC, GetTextMetricsA, RemoveFontResourceA, CreatePalette, GetStockObject, AddFontResourceA, CreateSolidBrush, CreateFontIndirectA, GetObjectA, ScaleViewportExtEx
> comdlg32.dll: GetFileTitleA, GetOpenFileNameA, GetSaveFileNameA
> WINSPOOL.DRV: DocumentPropertiesA, OpenPrinterA, ClosePrinter
> ADVAPI32.dll: GetServiceDisplayNameA, RegOpenKeyExA, RegCreateKeyExA, RegDeleteValueA, RegDeleteKeyA, LookupPrivilegeValueA, AdjustTokenPrivileges, LookupAccountSidA, GetUserNameA, OpenThreadToken, OpenProcessToken, GetTokenInformation, AllocateAndInitializeSid, EqualSid, FreeSid, UnlockServiceDatabase, OpenSCManagerA, EnumServicesStatusA, QueryServiceStatus, ControlService, StartServiceA, DeleteService, CloseServiceHandle, CreateServiceA, OpenServiceA, RegCloseKey, RegConnectRegistryA, RegEnumValueA, RegEnumKeyExA, RegQueryInfoKeyA, RegSetValueExA, RegQueryValueExA
> SHELL32.dll: DragFinish, SHChangeNotify, ShellExecuteA, SHBrowseForFolderA, SHGetFileInfoA, SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc, DragQueryFileA
> COMCTL32.dll: -
> ole32.dll: CoInitialize, CoUninitialize, CoCreateInstance
> OLEAUT32.dll: -, -
> WSOCK32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> NETAPI32.dll: Netbios
( 0 exports )
PDFiD.: -
RDS...: NSRL Reference Data Set
-
ComboFix 09-04-25.A3 - Tomas 26.04.2009 8:33.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1023.563 [GMT 2:00]
Spuštěný z: c:\documents and settings\Tomas\Plocha\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated)
FW: ESET personal firewall *disabled*
* Vytvořen nový Bod Obnovení
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
.
((((((((((((((((((((((((( Soubory vytvořené od 2009-05-26 do 2009-4-26 )))))))))))))))))))))))))))))))
.
2009-04-25 20:59 . 2009-04-06 13:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-25 20:59 . 2009-04-06 13:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-25 20:59 . 2009-04-25 21:00 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-25 19:34 . 2009-04-25 19:34 4203096 ----a-w c:\windows\REGBK00.ZIP
2009-04-25 19:17 . 2009-04-25 19:21 -------- d-----w c:\program files\RegCleaner
2009-04-25 19:07 . 2009-04-25 19:22 -------- d-----w c:\program files\SpywareBlaster
2009-04-22 17:56 . 2009-04-22 17:56 -------- d-----w c:\program files\Windows Defender
2009-04-20 19:33 . 2009-04-20 19:32 410984 ----a-w c:\windows\system32\deploytk.dll
2009-04-19 17:54 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-19 17:54 . 2009-03-06 14:23 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-19 17:54 . 2009-02-09 11:25 111104 -c----w c:\windows\system32\dllcache\services.exe
2009-04-19 17:54 . 2009-02-09 10:56 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-19 17:54 . 2009-02-09 10:56 684032 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-19 17:54 . 2009-02-09 10:56 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-19 17:54 . 2009-02-09 10:56 728064 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-04-19 17:54 . 2009-02-09 10:56 709632 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-19 17:54 . 2009-02-09 10:56 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-19 17:53 . 2009-03-27 06:53 1203922 -c----w c:\windows\system32\dllcache\sysmain.sdb
2009-04-19 17:53 . 2008-04-21 21:15 216576 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-04-01 19:03 . 2009-04-01 19:03 -------- d-----w c:\documents and settings\All Users\Data aplikací\NortonInstaller
2009-03-31 18:25 . 2009-03-31 18:25 -------- d-----w c:\documents and settings\Tomas\DoctorWeb
2009-03-30 19:00 . 2009-03-30 19:00 626688 ----a-w c:\windows\system32\msvcr80.dll
2009-03-30 19:00 . 2009-03-30 19:00 548864 ----a-w c:\windows\system32\msvcp80.dll
2009-03-30 19:00 . 2009-03-30 19:00 28672 ----a-w c:\windows\system32\eEmpty.exe
2009-03-30 19:00 . 2005-09-22 21:22 522 ----a-w c:\windows\system32\Microsoft.VC80.CRT.manifest
2009-03-30 19:00 . 2009-03-30 19:00 -------- d-----w c:\program files\Common Files\MicroWorld
2009-03-30 19:00 . 2009-03-30 19:00 -------- d-----w c:\documents and settings\All Users\Data aplikací\MicroWorld
2009-03-27 16:23 . 2009-03-27 16:23 -------- d-----w c:\program files\CCleaner
2009-03-27 16:08 . 2009-04-25 20:41 -------- d---a-w c:\documents and settings\All Users\Data aplikací\TEMP
2009-03-27 15:49 . 2009-03-27 16:06 -------- d-----w c:\program files\Free Windows Registry Cleaner
2009-03-27 15:39 . 2009-03-27 15:39 -------- d-----w c:\windows\$regcmp$
2009-03-27 15:36 . 2009-03-27 15:47 -------- d-----w c:\program files\Registry Clean Expert
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-26 06:27 . 2007-11-12 18:47 -------- d-----w c:\documents and settings\Tomas\Data aplikací\Skype
2009-04-25 20:55 . 2009-02-13 08:08 -------- d-----w c:\program files\Hardcopy
2009-04-22 17:56 . 2007-11-13 16:29 67280 ----a-w c:\documents and settings\Tomas\Local Settings\Data aplikací\GDIPFONTCACHEV1.DAT
2009-04-20 19:34 . 2008-02-15 09:19 -------- d-----w c:\program files\Java
2009-04-19 19:04 . 2004-08-18 12:00 47206 ----a-w c:\windows\system32\perfc005.dat
2009-04-19 19:04 . 2004-08-18 12:00 312970 ----a-w c:\windows\system32\perfh005.dat
2009-04-01 19:03 . 2007-03-16 12:28 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-03-27 16:59 . 2007-12-01 16:16 -------- d-----w c:\program files\Winamp
2009-03-26 20:33 . 2009-03-26 20:33 -------- d-----w c:\documents and settings\Tomas\Data aplikací\Malwarebytes
2009-03-26 20:32 . 2009-03-26 20:32 -------- d-----w c:\documents and settings\All Users\Data aplikací\Malwarebytes
2009-03-20 12:26 . 2007-10-18 17:30 -------- d-----w c:\program files\GameTop.com
2009-03-13 19:37 . 2009-03-13 19:37 -------- d-----w c:\program files\Codec Pack - All In 1
2009-03-13 19:36 . 2009-03-13 19:37 737280 ----a-w c:\windows\iun6002.exe
2009-03-07 17:15 . 2007-11-26 19:40 -------- d-----w c:\documents and settings\Tomas\Data aplikací\BSplayer
2009-03-06 14:23 . 2004-08-18 12:00 284160 ----a-w c:\windows\system32\pdh.dll
2009-02-28 18:45 . 2008-11-10 19:51 -------- d-----w c:\documents and settings\Tomas\Data aplikací\Vso
2009-02-20 08:12 . 2004-08-18 12:00 667136 ----a-w c:\windows\system32\wininet.dll
2009-02-20 08:12 . 2004-08-18 12:00 81920 -c--a-w c:\windows\system32\ieencode.dll
2009-02-09 14:07 . 2004-08-18 12:00 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:26 . 2004-08-17 15:45 2025984 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-09 11:26 . 2004-08-18 12:00 2147328 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-09 11:25 . 2004-08-18 12:00 111104 ----a-w c:\windows\system32\services.exe
2009-02-09 10:56 . 2004-08-18 12:00 728064 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:56 . 2004-08-18 12:00 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:56 . 2004-08-18 12:00 709632 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 10:56 . 2004-08-18 12:00 684032 ----a-w c:\windows\system32\advapi32.dll
2009-02-06 10:39 . 2004-08-18 12:00 35328 ----a-w c:\windows\system32\sc.exe
2009-02-03 19:58 . 2004-08-18 12:00 56832 ----a-w c:\windows\system32\secur32.dll
2009-01-11 18:32 . 2008-11-10 19:51 47360 ----a-w c:\documents and settings\Tomas\Data aplikací\pcouffin.sys
2008-03-02 17:11 . 2008-03-02 17:11 32 ----a-w c:\documents and settings\All Users\Data aplikací\ezsid.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-23 21755688]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-10-24 1451264]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-20 148888]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-02-26 16125440]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Tomas\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Hardcopy.LNK - c:\program files\Hardcopy\hardcopy.exe [2009-2-13 1286656]
Windows Commander 32.lnk - c:\wincmd\WINCMD32.EXE [2007-10-18 1443328]
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
S2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2008-10-24 468224]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
S3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\DRIVERS\psched.sys [2008-04-13 69120]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UlkqaEnpuxv
.
Obsah adresáře 'Naplánované úlohy'
2009-04-26 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Tomas\Data aplikací\Mozilla\Firefox\Profiles\ih5vf0wz.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-26 08:34
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
sken byl úspešně dokončen
skryté soubory: 0
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft]
@DACL=(02 0000)
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft\MessengerService]
@DACL=(02 0000)
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs]
@DACL=(02 0000)
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU]
@DACL=(02 0000)
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft\Windows\CurrentVersion\Run]
@DACL=(02 0000)
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft\Windows NT\CurrentVersion\Network\Persistent Connections]
@DACL=(02 0000)
DUMPHIVE0.003 (REGF)
[HKEY_USERS\S-1-5-21-1460304000-3615762775-1979223112-1008\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:9c,99,cf,bd,01,69,ff,0e,a0,3b,3a,9f,bd,5f,ec,a5,c7,78,ea,72,f2,08,cd,
9c,2f,e0,a8,64,3a,b3,c7,89,ab,28,12,20,4b,30,d6,9e,29,3b,9b,4a,34,0b,71,6b,\
"??"=hex:6f,78,d6,80,a5,79,1f,fb,6f,a7,34,1e,1d,9f,8c,96
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(988)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(952)
c:\program files\Hardcopy\HcDLL2_28_Win32.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Celkový čas: 2009-04-26 8:35
ComboFix-quarantined-files.txt 2009-04-26 06:35
Před spuštěním: Volných bajtů: 89 241 964 544
Po spuštění: Volných bajtů: 89 235 218 432
166 --- E O F --- 2009-04-19 18:58
Soubor iun6002.exe přijatý 2009.04.26 08:40:59 (CET)
Současný stav: Čekejte ... Ve frontě Čekání Testování Dokončeno NENALEZENO ZASTAVENO
Výsledek: 0/40 (0%)
Načítám informace ze serveru...
Váš soubor čeká ve frontě na pozici: 2.
Odhadovaný čas začátku mezi 44 a 63 sekundami.
Nezavírejte toto okno dokud nebude test dokončen.
Právě testující program byl je zastaven, probíhá čekání na program.
Za chvíli bude proveden další pokus o otestování souboru.
Pokud budete čekat déle než-li pět minut odešlete Váš soubor znovu.
Váš soubor je nyní testován pomocí VirusTotal,
výsledky budou zobrazeny po dokončení.
Formátované Formátované
Vytisknout výsledky Vytisknout výsledky
Váš soubor není platný, nebo neexistuje.
Služba je pozastavena v tuto chvíli, váš soubor čeká na otestování (pozice: ) po nespecifikovanou dobu.
Nyní čekejte na odezvu webu (automatické obnovení), nebo napište email do pole a klikněte na "vyžádat" a systém Vám zašle email s výsledky až bude test hotov.
Email:
Antivirus Verze Poslední aktualizace Výsledek
a-squared 4.0.0.101 2009.04.26 -
AhnLab-V3 5.0.0.2 2009.04.24 -
AntiVir 7.9.0.156 2009.04.25 -
Antiy-AVL 2.0.3.1 2009.04.24 -
Authentium 5.1.2.4 2009.04.25 -
Avast 4.8.1335.0 2009.04.25 -
AVG 8.5.0.287 2009.04.25 -
BitDefender 7.2 2009.04.26 -
CAT-QuickHeal 10.00 2009.04.25 -
ClamAV 0.94.1 2009.04.26 -
Comodo 1135 2009.04.25 -
DrWeb 4.44.0.09170 2009.04.26 -
eSafe 7.0.17.0 2009.04.23 -
eTrust-Vet 31.6.6475 2009.04.24 -
F-Prot 4.4.4.56 2009.04.25 -
F-Secure 8.0.14470.0 2009.04.25 -
Fortinet 3.117.0.0 2009.04.25 -
GData 19 2009.04.26 -
Ikarus T3.1.1.49.0 2009.04.26 -
K7AntiVirus 7.10.716 2009.04.25 -
Kaspersky 7.0.0.125 2009.04.26 -
McAfee 5596 2009.04.25 -
McAfee+Artemis 5596 2009.04.25 -
McAfee-GW-Edition 6.7.6 2009.04.26 -
Microsoft 1.4602 2009.04.26 -
NOD32 4035 2009.04.25 -
Norman 6.00.06 2009.04.24 -
nProtect 2009.1.8.0 2009.04.26 -
Panda 10.0.0.14 2009.04.25 -
PCTools 4.4.2.0 2009.04.25 -
Prevx1 3.0 2009.04.26 -
Rising 21.26.60.00 2009.04.26 -
Sophos 4.41.0 2009.04.26 -
Sunbelt 3.2.1858.2 2009.04.24 -
Symantec 1.4.4.12 2009.04.26 -
TheHacker 6.3.4.1.314 2009.04.26 -
TrendMicro 8.700.0.1004 2009.04.25 -
VBA32 3.12.10.3 2009.04.25 -
ViRobot 2009.4.24.1708 2009.04.24 -
VirusBuster 4.6.5.0 2009.04.25 -
Rozšiřující informace
File size: 737280 bytes
MD5...: 456462905091db042141487fe030e3c9
SHA1..: bb57b4850528c3c8d9bf159fb5b9f414ddc7d5d7
SHA256: a93dc5e28d74ef40dd5d694aff7fb5f24c27dac4b59adae008cfdc5ca65587b0
SHA512: fdd82c126189454352b44c756be06e3e93ee26a93b56d99c3eb5254cac3f6d6e
d71556765b76e65bd75efad461972044ce829443c006fc0816a28f7b4493296f
ssdeep: 12288:n/Kw1mzcOv7j0NRF6u7UvuKkVV3oG2v6urURWRfFW4aikgwsqEKO:n+SIu
fX3oG2v6P0FParsK
PEiD..: Armadillo v1.71
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x5ec75
timedatestamp.....: 0x402aa809 (Wed Feb 11 22:09:13 2004)
machinetype.......: 0x14c (I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x8436e 0x85000 6.52 1237ff6301825d5921b7f9a2f5139816
.rdata 0x86000 0x18156 0x19000 4.42 f6348df4f813de13cfb1e801130e5f79
.data 0x9f000 0x1193c 0xe000 5.13 596eac4f3dcfd1be5b3c6efaf752d891
.rsrc 0xb1000 0x6778 0x7000 3.64 d209a606411a3420b49c6373aa0bc2dc
( 14 imports )
> WINMM.dll: waveOutGetNumDevs
> VERSION.dll: VerLanguageNameA, GetFileVersionInfoA, GetFileVersionInfoSizeA, VerQueryValueA
> KERNEL32.dll: GetCPInfo, GetOEMCP, RtlUnwind, RaiseException, HeapFree, HeapAlloc, HeapReAlloc, GetTimeZoneInformation, GetSystemTime, GetLocalTime, ExitProcess, GetStartupInfoA, GetCommandLineA, GetACP, HeapSize, SetUnhandledExceptionFilter, GetEnvironmentVariableA, GlobalFlags, HeapCreate, VirtualFree, VirtualAlloc, IsBadWritePtr, LCMapStringA, LCMapStringW, UnhandledExceptionFilter, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, GetStringTypeA, GetStringTypeW, IsBadCodePtr, SetStdHandle, CompareStringA, CompareStringW, SetEnvironmentVariableA, SetErrorMode, LocalReAlloc, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSection, GetVersion, GetCurrentThreadId, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, GlobalDeleteAtom, LockResource, FindResourceA, LoadResource, SystemTimeToFileTime, GetFileTime, FileTimeToSystemTime, WideCharToMultiByte, InterlockedDecrement, GetFullPathNameA, MoveFileA, UnlockFile, LockFile, FlushFileBuffers, DuplicateHandle, DosDateTimeToFileTime, LocalFileTimeToFileTime, SetFileTime, GetTickCount, IsBadStringPtrA, FileTimeToLocalFileTime, FileTimeToDosDateTime, lstrcmpiA, LocalAlloc, LocalLock, LocalUnlock, GlobalReAlloc, IsDBCSLeadByte, lstrcatA, TlsGetValue, IsBadReadPtr, TlsFree, TlsSetValue, TlsAlloc, MultiByteToWideChar, GetPrivateProfileIntA, GlobalMemoryStatus, GetVolumeInformationA, GetComputerNameA, MoveFileExA, WritePrivateProfileStringA, GetPrivateProfileStringA, TerminateProcess, Sleep, GetDiskFreeSpaceA, lstrcmpA, GetCurrentDirectoryA, LoadLibraryExA, GetLogicalDriveStringsA, GetShortPathNameA, CopyFileA, FormatMessageA, LocalFree, CreateProcessA, GetPrivateProfileSectionNamesA, GetPrivateProfileSectionA, GlobalAlloc, GlobalLock, GlobalHandle, GlobalUnlock, GlobalFree, GetCurrentThread, GetCurrentProcess, GetWindowsDirectoryA, GetSystemDirectoryA, GetSystemDefaultLangID, GetDriveTypeA, MulDiv, InterlockedIncrement, FindNextFileA, FindFirstFileA, FindClose, RemoveDirectoryA, SetCurrentDirectoryA, CreateDirectoryA, GetFileAttributesA, SetFileAttributesA, WriteFile, ReadFile, CreateFileA, GetFileSize, SetFilePointer, SetEndOfFile, DeleteFileA, GetTempPathA, GetTempFileNameA, lstrcpyA, lstrlenA, lstrcpynA, ExpandEnvironmentStringsA, GetProcessVersion, GetModuleFileNameA, OpenProcess, CloseHandle, GetModuleHandleA, LoadLibraryA, GetProcAddress, GetEnvironmentStrings, FreeEnvironmentStringsA, GetCurrentProcessId, FreeLibrary, GetVersionExA, GetLastError, SetLastError, HeapDestroy
> USER32.dll: UnpackDDElParam, ReuseDDElParam, SetMenu, LoadMenuA, DestroyMenu, ReleaseCapture, TranslateAcceleratorA, LoadAcceleratorsA, SetRectEmpty, GetMessageA, ValidateRect, GetCursorPos, PtInRect, FillRect, DrawFocusRect, GrayStringA, DrawTextA, TabbedTextOutA, EndPaint, BeginPaint, ClientToScreen, GetMenuCheckMarkDimensions, LoadBitmapA, GetMenuState, ModifyMenuA, SetMenuItemBitmaps, CheckMenuItem, EnableMenuItem, MapWindowPoints, GetSysColor, GetFocus, AdjustWindowRectEx, ScreenToClient, EqualRect, DeferWindowPos, BeginDeferWindowPos, CopyRect, EndDeferWindowPos, IsWindowVisible, UnregisterClassA, GetTopWindow, GetCapture, WinHelpA, GetMenu, GetMenuItemCount, GetSubMenu, GetMenuItemID, GetKeyState, SetWindowsHookExA, CallNextHookEx, GetClassLongA, BringWindowToTop, GetPropA, CallWindowProcA, RemovePropA, GetMessageTime, GetMessagePos, GetLastActivePopup, GetForegroundWindow, GetWindow, SystemParametersInfoA, GetWindowPlacement, SetActiveWindow, CreateDialogIndirectParamA, GetParent, SetFocus, IsWindowEnabled, ShowWindow, MoveWindow, GetDlgCtrlID, IsDialogMessageA, SendDlgItemMessageA, GetDlgItem, UnhookWindowsHookEx, GetWindowTextLengthA, LoadStringA, WaitForInputIdle, SetDlgItemTextA, SetWindowTextA, SetForegroundWindow, EndDialog, DialogBoxParamA, GetActiveWindow, GetClassNameA, CharUpperA, OemToCharA, CharNextA, CharPrevA, CharUpperBuffA, SetCursor, IsIconic, DrawIcon, DestroyIcon, ExitWindowsEx, LoadCursorA, UpdateWindow, RedrawWindow, GetDesktopWindow, GetWindowTextA, EnumWindows, GetWindowThreadProcessId, PostMessageA, ShowOwnedPopups, GetSysColorBrush, SetPropA, SetWindowPos, MessageBoxA, MsgWaitForMultipleObjects, GetSystemMetrics, EnableWindow, InvalidateRect, GetClientRect, GetDC, ReleaseDC, GetWindowRect, LoadIconA, SendMessageTimeoutA, TranslateMessage, DispatchMessageA, PeekMessageA, PostQuitMessage, IsWindow, GetWindowLongA, DefWindowProcA, SetWindowLongA, GetClassInfoA, RegisterClassA, CreateWindowExA, SendMessageA, DestroyWindow, wsprintfA, RegisterWindowMessageA, GetNextDlgTabItem
> GDI32.dll: SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, SetMapMode, SelectObject, RestoreDC, SaveDC, CreateCompatibleDC, BitBlt, Escape, ExtTextOutA, TextOutA, RectVisible, PtVisible, ScaleWindowExtEx, SetWindowExtEx, DeleteObject, StretchDIBits, RealizePalette, SelectPalette, Rectangle, GetDeviceCaps, CreateFontA, CreateBitmap, SetTextColor, GetClipBox, GetBkColor, SetBkColor, SetBkMode, CreateICA, DeleteDC, GetTextMetricsA, RemoveFontResourceA, CreatePalette, GetStockObject, AddFontResourceA, CreateSolidBrush, CreateFontIndirectA, GetObjectA, ScaleViewportExtEx
> comdlg32.dll: GetFileTitleA, GetOpenFileNameA, GetSaveFileNameA
> WINSPOOL.DRV: DocumentPropertiesA, OpenPrinterA, ClosePrinter
> ADVAPI32.dll: GetServiceDisplayNameA, RegOpenKeyExA, RegCreateKeyExA, RegDeleteValueA, RegDeleteKeyA, LookupPrivilegeValueA, AdjustTokenPrivileges, LookupAccountSidA, GetUserNameA, OpenThreadToken, OpenProcessToken, GetTokenInformation, AllocateAndInitializeSid, EqualSid, FreeSid, UnlockServiceDatabase, OpenSCManagerA, EnumServicesStatusA, QueryServiceStatus, ControlService, StartServiceA, DeleteService, CloseServiceHandle, CreateServiceA, OpenServiceA, RegCloseKey, RegConnectRegistryA, RegEnumValueA, RegEnumKeyExA, RegQueryInfoKeyA, RegSetValueExA, RegQueryValueExA
> SHELL32.dll: DragFinish, SHChangeNotify, ShellExecuteA, SHBrowseForFolderA, SHGetFileInfoA, SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc, DragQueryFileA
> COMCTL32.dll: -
> ole32.dll: CoInitialize, CoUninitialize, CoCreateInstance
> OLEAUT32.dll: -, -
> WSOCK32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> NETAPI32.dll: Netbios
( 0 exports )
PDFiD.: -
RDS...: NSRL Reference Data Set
-
-
jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43294
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Pomůže mi prosím někdo s viry?
Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE
Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT
Stáhni si Registry Search
Rozbal si soubor do složky a potom poklepej na regsearch.exe ke startu programu.
Do volné linky(linek) nad Ester search string case independent zkopíruj a vlož:
A klikni na OK.Otevře se notepad s textem a celý text z něho sem vlož.
Zkopíruj do něj následující celý text označený zeleně:
Poznámka: Nepoužij k označení skriptu funkci VYBRAT VŠE
Kód: Vybrat vše
KillAll::
File::
c:\windows\REGBK00.ZIP
c:\windows\system32\eEmpty.exe
NetSvcs::
UlkqaEnpuxvZvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.
Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT
Stáhni si Registry Search
Rozbal si soubor do složky a potom poklepej na regsearch.exe ke startu programu.
Do volné linky(linek) nad Ester search string case independent zkopíruj a vlož:
Kód: Vybrat vše
NetSvcsA klikni na OK.Otevře se notepad s textem a celý text z něho sem vlož.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Re: Pomůže mi prosím někdo s viry?
Nevím jestli to tak mělo být, ale během testu ComboFix se restartovalo PC a naběhly zase rezidentní ochrany. Tak jsem je povypínal a Combo pokračovalo dál.
A nevím jestli to má s tím taky něco společného, ale nefunguje mi ve win úsporný režim a PC se vždy po přechodu do tohoto režimu restartuje. Nevím jak dlouho už to trvá a jestli to tak nebylo již od počátku, protože jsem tento úsporný režim nepoužíval.
ComboFix 09-04-25.A3 - Tomas 26.04.2009 11:15.7 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1023.597 [GMT 2:00]
Spuštěný z: c:\documents and settings\Tomas\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Tomas\Plocha\CFScript.txt
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated)
FW: ESET personal firewall *disabled*
* Vytvořen nový Bod Obnovení
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
FILE ::
c:\windows\REGBK00.ZIP
c:\windows\system32\eEmpty.exe
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\REGBK00.ZIP
c:\windows\system32\eEmpty.exe
.
((((((((((((((((((((((((( Soubory vytvořené od 2009-05-26 do 2009-4-26 )))))))))))))))))))))))))))))))
.
2009-04-25 20:59 . 2009-04-06 13:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-25 20:59 . 2009-04-06 13:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-25 20:59 . 2009-04-25 21:00 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-25 19:17 . 2009-04-25 19:21 -------- d-----w c:\program files\RegCleaner
2009-04-25 19:07 . 2009-04-25 19:22 -------- d-----w c:\program files\SpywareBlaster
2009-04-22 17:56 . 2009-04-22 17:56 -------- d-----w c:\program files\Windows Defender
2009-04-20 19:33 . 2009-04-20 19:32 410984 ----a-w c:\windows\system32\deploytk.dll
2009-04-19 17:54 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-19 17:54 . 2009-03-06 14:23 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-19 17:54 . 2009-02-09 11:25 111104 -c----w c:\windows\system32\dllcache\services.exe
2009-04-19 17:54 . 2009-02-09 10:56 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-19 17:54 . 2009-02-09 10:56 684032 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-19 17:54 . 2009-02-09 10:56 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-19 17:54 . 2009-02-09 10:56 728064 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-04-19 17:54 . 2009-02-09 10:56 709632 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-19 17:54 . 2009-02-09 10:56 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-19 17:53 . 2009-03-27 06:53 1203922 -c----w c:\windows\system32\dllcache\sysmain.sdb
2009-04-19 17:53 . 2008-04-21 21:15 216576 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-04-01 19:03 . 2009-04-01 19:03 -------- d-----w c:\documents and settings\All Users\Data aplikací\NortonInstaller
2009-03-31 18:25 . 2009-03-31 18:25 -------- d-----w c:\documents and settings\Tomas\DoctorWeb
2009-03-30 19:00 . 2009-03-30 19:00 626688 ----a-w c:\windows\system32\msvcr80.dll
2009-03-30 19:00 . 2009-03-30 19:00 548864 ----a-w c:\windows\system32\msvcp80.dll
2009-03-30 19:00 . 2005-09-22 21:22 522 ----a-w c:\windows\system32\Microsoft.VC80.CRT.manifest
2009-03-30 19:00 . 2009-03-30 19:00 -------- d-----w c:\program files\Common Files\MicroWorld
2009-03-30 19:00 . 2009-03-30 19:00 -------- d-----w c:\documents and settings\All Users\Data aplikací\MicroWorld
2009-03-27 16:23 . 2009-03-27 16:23 -------- d-----w c:\program files\CCleaner
2009-03-27 16:08 . 2009-04-25 20:41 -------- d---a-w c:\documents and settings\All Users\Data aplikací\TEMP
2009-03-27 15:49 . 2009-03-27 16:06 -------- d-----w c:\program files\Free Windows Registry Cleaner
2009-03-27 15:39 . 2009-03-27 15:39 -------- d-----w c:\windows\$regcmp$
2009-03-27 15:36 . 2009-03-27 15:47 -------- d-----w c:\program files\Registry Clean Expert
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-26 09:18 . 2007-11-12 18:47 -------- d-----w c:\documents and settings\Tomas\Data aplikací\Skype
2009-04-26 06:53 . 2009-02-13 08:08 -------- d-----w c:\program files\Hardcopy
2009-04-22 17:56 . 2007-11-13 16:29 67280 ----a-w c:\documents and settings\Tomas\Local Settings\Data aplikací\GDIPFONTCACHEV1.DAT
2009-04-20 19:34 . 2008-02-15 09:19 -------- d-----w c:\program files\Java
2009-04-19 19:04 . 2004-08-18 12:00 47206 ----a-w c:\windows\system32\perfc005.dat
2009-04-19 19:04 . 2004-08-18 12:00 312970 ----a-w c:\windows\system32\perfh005.dat
2009-04-01 19:03 . 2007-03-16 12:28 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-03-27 16:59 . 2007-12-01 16:16 -------- d-----w c:\program files\Winamp
2009-03-26 20:33 . 2009-03-26 20:33 -------- d-----w c:\documents and settings\Tomas\Data aplikací\Malwarebytes
2009-03-26 20:32 . 2009-03-26 20:32 -------- d-----w c:\documents and settings\All Users\Data aplikací\Malwarebytes
2009-03-20 12:26 . 2007-10-18 17:30 -------- d-----w c:\program files\GameTop.com
2009-03-13 19:37 . 2009-03-13 19:37 -------- d-----w c:\program files\Codec Pack - All In 1
2009-03-13 19:36 . 2009-03-13 19:37 737280 ----a-w c:\windows\iun6002.exe
2009-03-07 17:15 . 2007-11-26 19:40 -------- d-----w c:\documents and settings\Tomas\Data aplikací\BSplayer
2009-03-06 14:23 . 2004-08-18 12:00 284160 ----a-w c:\windows\system32\pdh.dll
2009-02-28 18:45 . 2008-11-10 19:51 -------- d-----w c:\documents and settings\Tomas\Data aplikací\Vso
2009-02-20 08:12 . 2004-08-18 12:00 667136 ----a-w c:\windows\system32\wininet.dll
2009-02-20 08:12 . 2004-08-18 12:00 81920 -c--a-w c:\windows\system32\ieencode.dll
2009-02-09 14:07 . 2004-08-18 12:00 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:26 . 2004-08-17 15:45 2025984 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-09 11:26 . 2004-08-18 12:00 2147328 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-09 11:25 . 2004-08-18 12:00 111104 ----a-w c:\windows\system32\services.exe
2009-02-09 10:56 . 2004-08-18 12:00 728064 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:56 . 2004-08-18 12:00 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:56 . 2004-08-18 12:00 709632 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 10:56 . 2004-08-18 12:00 684032 ----a-w c:\windows\system32\advapi32.dll
2009-02-06 10:39 . 2004-08-18 12:00 35328 ----a-w c:\windows\system32\sc.exe
2009-02-03 19:58 . 2004-08-18 12:00 56832 ----a-w c:\windows\system32\secur32.dll
2009-01-11 18:32 . 2008-11-10 19:51 47360 ----a-w c:\documents and settings\Tomas\Data aplikací\pcouffin.sys
2008-03-02 17:11 . 2008-03-02 17:11 32 ----a-w c:\documents and settings\All Users\Data aplikací\ezsid.dat
.
((((((((((((((((((((((((((((( SnapShot@2009-04-26_06.34.13 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-26 09:17 . 2009-04-26 09:17 16384 c:\windows\temp\Perflib_Perfdata_be8.dat
+ 2009-04-26 09:17 . 2009-04-26 09:17 16384 c:\windows\temp\Perflib_Perfdata_2f0.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-23 21755688]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-10-24 1451264]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-20 148888]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-02-26 16125440]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Tomas\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Hardcopy.LNK - c:\program files\Hardcopy\hardcopy.exe [2009-2-13 1286656]
Windows Commander 32.lnk - c:\wincmd\WINCMD32.EXE [2007-10-18 1443328]
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
S2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2008-10-24 468224]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
S3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\DRIVERS\psched.sys [2008-04-13 69120]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UlkqaEnpuxv
.
Obsah adresáře 'Naplánované úlohy'
2009-04-26 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Tomas\Data aplikací\Mozilla\Firefox\Profiles\ih5vf0wz.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-26 11:18
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
c:\windows\TEMP\TMP00000010B968231A34A9DEE6 524288 bytes
sken byl úspešně dokončen
skryté soubory: 1
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft]
@DACL=(02 0000)
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft\MessengerService]
@DACL=(02 0000)
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs]
@DACL=(02 0000)
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU]
@DACL=(02 0000)
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft\Windows\CurrentVersion\Run]
@DACL=(02 0000)
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft\Windows NT\CurrentVersion\Network\Persistent Connections]
@DACL=(02 0000)
DUMPHIVE0.003 (REGF)
[HKEY_USERS\S-1-5-21-1460304000-3615762775-1979223112-1008\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:9c,99,cf,bd,01,69,ff,0e,a0,3b,3a,9f,bd,5f,ec,a5,c7,78,ea,72,f2,08,cd,
9c,2f,e0,a8,64,3a,b3,c7,89,ab,28,12,20,4b,30,d6,9e,29,3b,9b,4a,34,0b,71,6b,\
"??"=hex:6f,78,d6,80,a5,79,1f,fb,6f,a7,34,1e,1d,9f,8c,96
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(1016)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(6976)
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll
c:\program files\Hardcopy\HcDLL2_28_Win32.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2009-04-26 11:20 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-04-26 09:20
ComboFix2.txt 2009-04-26 06:35
Před spuštěním: Volných bajtů: 89 172 353 024
Po spuštění: Volných bajtů: 89 158 467 584
191 --- E O F --- 2009-04-19 18:58
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:24:16, on 26.4.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Hardcopy\hardcopy.exe
C:\WINDOWS\explorer.exe
D:\Hijack\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Hardcopy.LNK = C:\Program Files\Hardcopy\hardcopy.exe
O4 - Startup: Windows Commander 32.lnk = C:\wincmd\WINCMD32.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 2271583734
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
--
End of file - 4837 bytes
A nevím jestli to má s tím taky něco společného, ale nefunguje mi ve win úsporný režim a PC se vždy po přechodu do tohoto režimu restartuje. Nevím jak dlouho už to trvá a jestli to tak nebylo již od počátku, protože jsem tento úsporný režim nepoužíval.
ComboFix 09-04-25.A3 - Tomas 26.04.2009 11:15.7 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.420.1029.18.1023.597 [GMT 2:00]
Spuštěný z: c:\documents and settings\Tomas\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Tomas\Plocha\CFScript.txt
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated)
FW: ESET personal firewall *disabled*
* Vytvořen nový Bod Obnovení
VAROVÁNÍ - NA TOMTO POČÍTAČI NENÍ NAINSTALOVÁNA KONZOLA PRO ZOTAVENÍ !!
FILE ::
c:\windows\REGBK00.ZIP
c:\windows\system32\eEmpty.exe
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\REGBK00.ZIP
c:\windows\system32\eEmpty.exe
.
((((((((((((((((((((((((( Soubory vytvořené od 2009-05-26 do 2009-4-26 )))))))))))))))))))))))))))))))
.
2009-04-25 20:59 . 2009-04-06 13:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-25 20:59 . 2009-04-06 13:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-25 20:59 . 2009-04-25 21:00 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-25 19:17 . 2009-04-25 19:21 -------- d-----w c:\program files\RegCleaner
2009-04-25 19:07 . 2009-04-25 19:22 -------- d-----w c:\program files\SpywareBlaster
2009-04-22 17:56 . 2009-04-22 17:56 -------- d-----w c:\program files\Windows Defender
2009-04-20 19:33 . 2009-04-20 19:32 410984 ----a-w c:\windows\system32\deploytk.dll
2009-04-19 17:54 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-19 17:54 . 2009-03-06 14:23 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-19 17:54 . 2009-02-09 11:25 111104 -c----w c:\windows\system32\dllcache\services.exe
2009-04-19 17:54 . 2009-02-09 10:56 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-19 17:54 . 2009-02-09 10:56 684032 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-19 17:54 . 2009-02-09 10:56 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-19 17:54 . 2009-02-09 10:56 728064 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-04-19 17:54 . 2009-02-09 10:56 709632 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-19 17:54 . 2009-02-09 10:56 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-19 17:53 . 2009-03-27 06:53 1203922 -c----w c:\windows\system32\dllcache\sysmain.sdb
2009-04-19 17:53 . 2008-04-21 21:15 216576 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-04-01 19:03 . 2009-04-01 19:03 -------- d-----w c:\documents and settings\All Users\Data aplikací\NortonInstaller
2009-03-31 18:25 . 2009-03-31 18:25 -------- d-----w c:\documents and settings\Tomas\DoctorWeb
2009-03-30 19:00 . 2009-03-30 19:00 626688 ----a-w c:\windows\system32\msvcr80.dll
2009-03-30 19:00 . 2009-03-30 19:00 548864 ----a-w c:\windows\system32\msvcp80.dll
2009-03-30 19:00 . 2005-09-22 21:22 522 ----a-w c:\windows\system32\Microsoft.VC80.CRT.manifest
2009-03-30 19:00 . 2009-03-30 19:00 -------- d-----w c:\program files\Common Files\MicroWorld
2009-03-30 19:00 . 2009-03-30 19:00 -------- d-----w c:\documents and settings\All Users\Data aplikací\MicroWorld
2009-03-27 16:23 . 2009-03-27 16:23 -------- d-----w c:\program files\CCleaner
2009-03-27 16:08 . 2009-04-25 20:41 -------- d---a-w c:\documents and settings\All Users\Data aplikací\TEMP
2009-03-27 15:49 . 2009-03-27 16:06 -------- d-----w c:\program files\Free Windows Registry Cleaner
2009-03-27 15:39 . 2009-03-27 15:39 -------- d-----w c:\windows\$regcmp$
2009-03-27 15:36 . 2009-03-27 15:47 -------- d-----w c:\program files\Registry Clean Expert
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-26 09:18 . 2007-11-12 18:47 -------- d-----w c:\documents and settings\Tomas\Data aplikací\Skype
2009-04-26 06:53 . 2009-02-13 08:08 -------- d-----w c:\program files\Hardcopy
2009-04-22 17:56 . 2007-11-13 16:29 67280 ----a-w c:\documents and settings\Tomas\Local Settings\Data aplikací\GDIPFONTCACHEV1.DAT
2009-04-20 19:34 . 2008-02-15 09:19 -------- d-----w c:\program files\Java
2009-04-19 19:04 . 2004-08-18 12:00 47206 ----a-w c:\windows\system32\perfc005.dat
2009-04-19 19:04 . 2004-08-18 12:00 312970 ----a-w c:\windows\system32\perfh005.dat
2009-04-01 19:03 . 2007-03-16 12:28 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-03-27 16:59 . 2007-12-01 16:16 -------- d-----w c:\program files\Winamp
2009-03-26 20:33 . 2009-03-26 20:33 -------- d-----w c:\documents and settings\Tomas\Data aplikací\Malwarebytes
2009-03-26 20:32 . 2009-03-26 20:32 -------- d-----w c:\documents and settings\All Users\Data aplikací\Malwarebytes
2009-03-20 12:26 . 2007-10-18 17:30 -------- d-----w c:\program files\GameTop.com
2009-03-13 19:37 . 2009-03-13 19:37 -------- d-----w c:\program files\Codec Pack - All In 1
2009-03-13 19:36 . 2009-03-13 19:37 737280 ----a-w c:\windows\iun6002.exe
2009-03-07 17:15 . 2007-11-26 19:40 -------- d-----w c:\documents and settings\Tomas\Data aplikací\BSplayer
2009-03-06 14:23 . 2004-08-18 12:00 284160 ----a-w c:\windows\system32\pdh.dll
2009-02-28 18:45 . 2008-11-10 19:51 -------- d-----w c:\documents and settings\Tomas\Data aplikací\Vso
2009-02-20 08:12 . 2004-08-18 12:00 667136 ----a-w c:\windows\system32\wininet.dll
2009-02-20 08:12 . 2004-08-18 12:00 81920 -c--a-w c:\windows\system32\ieencode.dll
2009-02-09 14:07 . 2004-08-18 12:00 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:26 . 2004-08-17 15:45 2025984 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-09 11:26 . 2004-08-18 12:00 2147328 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-09 11:25 . 2004-08-18 12:00 111104 ----a-w c:\windows\system32\services.exe
2009-02-09 10:56 . 2004-08-18 12:00 728064 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:56 . 2004-08-18 12:00 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:56 . 2004-08-18 12:00 709632 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 10:56 . 2004-08-18 12:00 684032 ----a-w c:\windows\system32\advapi32.dll
2009-02-06 10:39 . 2004-08-18 12:00 35328 ----a-w c:\windows\system32\sc.exe
2009-02-03 19:58 . 2004-08-18 12:00 56832 ----a-w c:\windows\system32\secur32.dll
2009-01-11 18:32 . 2008-11-10 19:51 47360 ----a-w c:\documents and settings\Tomas\Data aplikací\pcouffin.sys
2008-03-02 17:11 . 2008-03-02 17:11 32 ----a-w c:\documents and settings\All Users\Data aplikací\ezsid.dat
.
((((((((((((((((((((((((((((( SnapShot@2009-04-26_06.34.13 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-26 09:17 . 2009-04-26 09:17 16384 c:\windows\temp\Perflib_Perfdata_be8.dat
+ 2009-04-26 09:17 . 2009-04-26 09:17 16384 c:\windows\temp\Perflib_Perfdata_2f0.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-23 21755688]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-10-24 1451264]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-20 148888]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-02-26 16125440]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Tomas\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Hardcopy.LNK - c:\program files\Hardcopy\hardcopy.exe [2009-2-13 1286656]
Windows Commander 32.lnk - c:\wincmd\WINCMD32.EXE [2007-10-18 1443328]
c:\documents and settings\All Users\Nabˇdka Start\Programy\Po spuçtŘnˇ\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
S2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2008-10-24 468224]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
S3 PSched;Plánovač paketů technologie QoS;c:\windows\system32\DRIVERS\psched.sys [2008-04-13 69120]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UlkqaEnpuxv
.
Obsah adresáře 'Naplánované úlohy'
2009-04-26 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]
.
.
------- Doplňkový sken -------
.
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~1\MICROS~2\Office\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Tomas\Data aplikací\Mozilla\Firefox\Profiles\ih5vf0wz.default\
FF - prefs.js: browser.search.selectedEngine - Seznam
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-26 11:18
Windows 5.1.2600 Service Pack 3 NTFS
skenování skrytých procesů ...
skenování skrytých položek 'Po spuštění' ...
skenování skrytých souborů ...
c:\windows\TEMP\TMP00000010B968231A34A9DEE6 524288 bytes
sken byl úspešně dokončen
skryté soubory: 1
**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft]
@DACL=(02 0000)
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft\MessengerService]
@DACL=(02 0000)
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs]
@DACL=(02 0000)
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU]
@DACL=(02 0000)
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft\Windows\CurrentVersion\Run]
@DACL=(02 0000)
[HKEY_USERS\S-1-5-20_Classes\Software\Microsoft\Windows NT\CurrentVersion\Network\Persistent Connections]
@DACL=(02 0000)
DUMPHIVE0.003 (REGF)
[HKEY_USERS\S-1-5-21-1460304000-3615762775-1979223112-1008\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:9c,99,cf,bd,01,69,ff,0e,a0,3b,3a,9f,bd,5f,ec,a5,c7,78,ea,72,f2,08,cd,
9c,2f,e0,a8,64,3a,b3,c7,89,ab,28,12,20,4b,30,d6,9e,29,3b,9b,4a,34,0b,71,6b,\
"??"=hex:6f,78,d6,80,a5,79,1f,fb,6f,a7,34,1e,1d,9f,8c,96
.
--------------------- Knihovny navázané na běžící procesy ---------------------
- - - - - - - > 'winlogon.exe'(1016)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(6976)
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll
c:\program files\Hardcopy\HcDLL2_28_Win32.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2009-04-26 11:20 - počítač byl restartován
ComboFix-quarantined-files.txt 2009-04-26 09:20
ComboFix2.txt 2009-04-26 06:35
Před spuštěním: Volných bajtů: 89 172 353 024
Po spuštění: Volných bajtů: 89 158 467 584
191 --- E O F --- 2009-04-19 18:58
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:24:16, on 26.4.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Hardcopy\hardcopy.exe
C:\WINDOWS\explorer.exe
D:\Hijack\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Hardcopy.LNK = C:\Program Files\Hardcopy\hardcopy.exe
O4 - Startup: Windows Commander 32.lnk = C:\wincmd\WINCMD32.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 2271583734
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
--
End of file - 4837 bytes
Naposledy upravil(a) Fanthomas dne 26 dub 2009 11:51, celkem upraveno 1 x.
Re: Pomůže mi prosím někdo s viry?
A tady ještě ten log z Windows Registry
Windows Registry Editor Version 5.00
; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.6.0
; Results at 26.4.2009 11:33:00 for strings:
; 'netsvcs'
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
; Contents of value:
; 6to4
; AppMgmt
; AudioSrv
; Browser
; CryptSvc
; DMServer
; DHCP
; ERSvc
; EventSystem
; FastUserSwitchingCompatibility
; HidServ
; Ias
; Iprip
; Irmon
; LanmanServer
; LanmanWorkstation
; Messenger
; Netman
; Nla
; Ntmssvc
; NWCWorkstation
; Nwsapagent
; Rasauto
; Rasman
; Remoteaccess
; Schedule
; Seclogon
; SENS
; Sharedaccess
; SRService
; Tapisrv
; Themes
; TrkWks
; W32Time
; WZCSVC
; Wmi
; WmdmPmSp
; winmgmt
; wscsvc
; xmlprov
; BITS
; wuauserv
; ShellHWDetection
; helpsvc
; WmdmPmSN
; napagent
; hkmsvc
; UlkqaEnpuxv
;
"netsvcs"=hex(7):36,00,74,00,6f,00,34,00,00,00,41,00,70,00,70,00,4d,00,67,00,\
6d,00,74,00,00,00,41,00,75,00,64,00,69,00,6f,00,53,00,72,00,76,00,00,00,42,\
00,72,00,6f,00,77,00,73,00,65,00,72,00,00,00,43,00,72,00,79,00,70,00,74,00,\
53,00,76,00,63,00,00,00,44,00,4d,00,53,00,65,00,72,00,76,00,65,00,72,00,00,\
00,44,00,48,00,43,00,50,00,00,00,45,00,52,00,53,00,76,00,63,00,00,00,45,00,\
76,00,65,00,6e,00,74,00,53,00,79,00,73,00,74,00,65,00,6d,00,00,00,46,00,61,\
00,73,00,74,00,55,00,73,00,65,00,72,00,53,00,77,00,69,00,74,00,63,00,68,00,\
69,00,6e,00,67,00,43,00,6f,00,6d,00,70,00,61,00,74,00,69,00,62,00,69,00,6c,\
00,69,00,74,00,79,00,00,00,48,00,69,00,64,00,53,00,65,00,72,00,76,00,00,00,\
49,00,61,00,73,00,00,00,49,00,70,00,72,00,69,00,70,00,00,00,49,00,72,00,6d,\
00,6f,00,6e,00,00,00,4c,00,61,00,6e,00,6d,00,61,00,6e,00,53,00,65,00,72,00,\
76,00,65,00,72,00,00,00,4c,00,61,00,6e,00,6d,00,61,00,6e,00,57,00,6f,00,72,\
00,6b,00,73,00,74,00,61,00,74,00,69,00,6f,00,6e,00,00,00,4d,00,65,00,73,00,\
73,00,65,00,6e,00,67,00,65,00,72,00,00,00,4e,00,65,00,74,00,6d,00,61,00,6e,\
00,00,00,4e,00,6c,00,61,00,00,00,4e,00,74,00,6d,00,73,00,73,00,76,00,63,00,\
00,00,4e,00,57,00,43,00,57,00,6f,00,72,00,6b,00,73,00,74,00,61,00,74,00,69,\
00,6f,00,6e,00,00,00,4e,00,77,00,73,00,61,00,70,00,61,00,67,00,65,00,6e,00,\
74,00,00,00,52,00,61,00,73,00,61,00,75,00,74,00,6f,00,00,00,52,00,61,00,73,\
00,6d,00,61,00,6e,00,00,00,52,00,65,00,6d,00,6f,00,74,00,65,00,61,00,63,00,\
63,00,65,00,73,00,73,00,00,00,53,00,63,00,68,00,65,00,64,00,75,00,6c,00,65,\
00,00,00,53,00,65,00,63,00,6c,00,6f,00,67,00,6f,00,6e,00,00,00,53,00,45,00,\
4e,00,53,00,00,00,53,00,68,00,61,00,72,00,65,00,64,00,61,00,63,00,63,00,65,\
00,73,00,73,00,00,00,53,00,52,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,\
00,00,54,00,61,00,70,00,69,00,73,00,72,00,76,00,00,00,54,00,68,00,65,00,6d,\
00,65,00,73,00,00,00,54,00,72,00,6b,00,57,00,6b,00,73,00,00,00,57,00,33,00,\
32,00,54,00,69,00,6d,00,65,00,00,00,57,00,5a,00,43,00,53,00,56,00,43,00,00,\
00,57,00,6d,00,69,00,00,00,57,00,6d,00,64,00,6d,00,50,00,6d,00,53,00,70,00,\
00,00,77,00,69,00,6e,00,6d,00,67,00,6d,00,74,00,00,00,77,00,73,00,63,00,73,\
00,76,00,63,00,00,00,78,00,6d,00,6c,00,70,00,72,00,6f,00,76,00,00,00,42,00,\
49,00,54,00,53,00,00,00,77,00,75,00,61,00,75,00,73,00,65,00,72,00,76,00,00,\
00,53,00,68,00,65,00,6c,00,6c,00,48,00,57,00,44,00,65,00,74,00,65,00,63,00,\
74,00,69,00,6f,00,6e,00,00,00,68,00,65,00,6c,00,70,00,73,00,76,00,63,00,00,\
00,57,00,6d,00,64,00,6d,00,50,00,6d,00,53,00,4e,00,00,00,6e,00,61,00,70,00,\
61,00,67,00,65,00,6e,00,74,00,00,00,68,00,6b,00,6d,00,73,00,76,00,63,00,00,\
00,55,00,6c,00,6b,00,71,00,61,00,45,00,6e,00,70,00,75,00,78,00,76,00,00,00,\
00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AppMgmt]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AudioSrv]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITS]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Browser]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CryptSvc]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dhcp]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\dmserver]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ERSvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventSystem]
; Contents of value:
; C:\WINDOWS\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,\
5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,\
00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,\
6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\helpsvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HidServ]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\hkmsvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanserver]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanworkstation]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Messenger]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\napagent]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Netman]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Nla]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NtmsSvc]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PerfNet\Performance]
"Close"="CloseNetSvcsObject"
"Collect"="CollectNetSvcsObjectData"
"Open"="OpenNetSvcsObject"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RasAuto]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RasMan]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RemoteAccess]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Schedule]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\seclogon]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SENS]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ShellHWDetection]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TapiSrv]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Themes]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TrkWks]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\winmgmt]
; Contents of value:
; %systemroot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WmdmPmSN]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wscsvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wuauserv]
; Contents of value:
; %systemroot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WZCSVC]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\xmlprov]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\AppMgmt]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\AudioSrv]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BITS]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Browser]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\CryptSvc]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Dhcp]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\dmserver]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\ERSvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\EventSystem]
; Contents of value:
; C:\WINDOWS\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,\
5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,\
00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,\
6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\FastUserSwitchingCompatibility]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\helpsvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\HidServ]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\hkmsvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\lanmanserver]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\lanmanworkstation]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Messenger]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\napagent]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Netman]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Nla]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\NtmsSvc]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\PerfNet\Performance]
"Close"="CloseNetSvcsObject"
"Collect"="CollectNetSvcsObjectData"
"Open"="OpenNetSvcsObject"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\RasAuto]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\RasMan]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\RemoteAccess]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Schedule]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\seclogon]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SENS]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\ShellHWDetection]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srservice]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\TapiSrv]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Themes]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\TrkWks]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\W32Time]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\winmgmt]
; Contents of value:
; %systemroot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\WmdmPmSN]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\wscsvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\wuauserv]
; Contents of value:
; %systemroot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\WZCSVC]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\xmlprov]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppMgmt]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AudioSrv]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmserver]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ERSvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventSystem]
; Contents of value:
; C:\WINDOWS\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,\
5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,\
00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,\
6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FastUserSwitchingCompatibility]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\helpsvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HidServ]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hkmsvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Messenger]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\napagent]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netman]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nla]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtmsSvc]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfNet\Performance]
"Close"="CloseNetSvcsObject"
"Collect"="CollectNetSvcsObjectData"
"Open"="OpenNetSvcsObject"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAuto]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seclogon]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ShellHWDetection]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srservice]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TapiSrv]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Themes]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winmgmt]
; Contents of value:
; %systemroot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmdmPmSN]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv]
; Contents of value:
; %systemroot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WZCSVC]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
; End Of The Log...
Windows Registry Editor Version 5.00
; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.6.0
; Results at 26.4.2009 11:33:00 for strings:
; 'netsvcs'
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
; Contents of value:
; 6to4
; AppMgmt
; AudioSrv
; Browser
; CryptSvc
; DMServer
; DHCP
; ERSvc
; EventSystem
; FastUserSwitchingCompatibility
; HidServ
; Ias
; Iprip
; Irmon
; LanmanServer
; LanmanWorkstation
; Messenger
; Netman
; Nla
; Ntmssvc
; NWCWorkstation
; Nwsapagent
; Rasauto
; Rasman
; Remoteaccess
; Schedule
; Seclogon
; SENS
; Sharedaccess
; SRService
; Tapisrv
; Themes
; TrkWks
; W32Time
; WZCSVC
; Wmi
; WmdmPmSp
; winmgmt
; wscsvc
; xmlprov
; BITS
; wuauserv
; ShellHWDetection
; helpsvc
; WmdmPmSN
; napagent
; hkmsvc
; UlkqaEnpuxv
;
"netsvcs"=hex(7):36,00,74,00,6f,00,34,00,00,00,41,00,70,00,70,00,4d,00,67,00,\
6d,00,74,00,00,00,41,00,75,00,64,00,69,00,6f,00,53,00,72,00,76,00,00,00,42,\
00,72,00,6f,00,77,00,73,00,65,00,72,00,00,00,43,00,72,00,79,00,70,00,74,00,\
53,00,76,00,63,00,00,00,44,00,4d,00,53,00,65,00,72,00,76,00,65,00,72,00,00,\
00,44,00,48,00,43,00,50,00,00,00,45,00,52,00,53,00,76,00,63,00,00,00,45,00,\
76,00,65,00,6e,00,74,00,53,00,79,00,73,00,74,00,65,00,6d,00,00,00,46,00,61,\
00,73,00,74,00,55,00,73,00,65,00,72,00,53,00,77,00,69,00,74,00,63,00,68,00,\
69,00,6e,00,67,00,43,00,6f,00,6d,00,70,00,61,00,74,00,69,00,62,00,69,00,6c,\
00,69,00,74,00,79,00,00,00,48,00,69,00,64,00,53,00,65,00,72,00,76,00,00,00,\
49,00,61,00,73,00,00,00,49,00,70,00,72,00,69,00,70,00,00,00,49,00,72,00,6d,\
00,6f,00,6e,00,00,00,4c,00,61,00,6e,00,6d,00,61,00,6e,00,53,00,65,00,72,00,\
76,00,65,00,72,00,00,00,4c,00,61,00,6e,00,6d,00,61,00,6e,00,57,00,6f,00,72,\
00,6b,00,73,00,74,00,61,00,74,00,69,00,6f,00,6e,00,00,00,4d,00,65,00,73,00,\
73,00,65,00,6e,00,67,00,65,00,72,00,00,00,4e,00,65,00,74,00,6d,00,61,00,6e,\
00,00,00,4e,00,6c,00,61,00,00,00,4e,00,74,00,6d,00,73,00,73,00,76,00,63,00,\
00,00,4e,00,57,00,43,00,57,00,6f,00,72,00,6b,00,73,00,74,00,61,00,74,00,69,\
00,6f,00,6e,00,00,00,4e,00,77,00,73,00,61,00,70,00,61,00,67,00,65,00,6e,00,\
74,00,00,00,52,00,61,00,73,00,61,00,75,00,74,00,6f,00,00,00,52,00,61,00,73,\
00,6d,00,61,00,6e,00,00,00,52,00,65,00,6d,00,6f,00,74,00,65,00,61,00,63,00,\
63,00,65,00,73,00,73,00,00,00,53,00,63,00,68,00,65,00,64,00,75,00,6c,00,65,\
00,00,00,53,00,65,00,63,00,6c,00,6f,00,67,00,6f,00,6e,00,00,00,53,00,45,00,\
4e,00,53,00,00,00,53,00,68,00,61,00,72,00,65,00,64,00,61,00,63,00,63,00,65,\
00,73,00,73,00,00,00,53,00,52,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,\
00,00,54,00,61,00,70,00,69,00,73,00,72,00,76,00,00,00,54,00,68,00,65,00,6d,\
00,65,00,73,00,00,00,54,00,72,00,6b,00,57,00,6b,00,73,00,00,00,57,00,33,00,\
32,00,54,00,69,00,6d,00,65,00,00,00,57,00,5a,00,43,00,53,00,56,00,43,00,00,\
00,57,00,6d,00,69,00,00,00,57,00,6d,00,64,00,6d,00,50,00,6d,00,53,00,70,00,\
00,00,77,00,69,00,6e,00,6d,00,67,00,6d,00,74,00,00,00,77,00,73,00,63,00,73,\
00,76,00,63,00,00,00,78,00,6d,00,6c,00,70,00,72,00,6f,00,76,00,00,00,42,00,\
49,00,54,00,53,00,00,00,77,00,75,00,61,00,75,00,73,00,65,00,72,00,76,00,00,\
00,53,00,68,00,65,00,6c,00,6c,00,48,00,57,00,44,00,65,00,74,00,65,00,63,00,\
74,00,69,00,6f,00,6e,00,00,00,68,00,65,00,6c,00,70,00,73,00,76,00,63,00,00,\
00,57,00,6d,00,64,00,6d,00,50,00,6d,00,53,00,4e,00,00,00,6e,00,61,00,70,00,\
61,00,67,00,65,00,6e,00,74,00,00,00,68,00,6b,00,6d,00,73,00,76,00,63,00,00,\
00,55,00,6c,00,6b,00,71,00,61,00,45,00,6e,00,70,00,75,00,78,00,76,00,00,00,\
00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AppMgmt]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AudioSrv]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITS]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Browser]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CryptSvc]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dhcp]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\dmserver]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ERSvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventSystem]
; Contents of value:
; C:\WINDOWS\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,\
5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,\
00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,\
6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\helpsvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HidServ]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\hkmsvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanserver]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanworkstation]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Messenger]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\napagent]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Netman]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Nla]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NtmsSvc]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PerfNet\Performance]
"Close"="CloseNetSvcsObject"
"Collect"="CollectNetSvcsObjectData"
"Open"="OpenNetSvcsObject"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RasAuto]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RasMan]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RemoteAccess]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Schedule]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\seclogon]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SENS]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ShellHWDetection]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srservice]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TapiSrv]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Themes]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TrkWks]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\winmgmt]
; Contents of value:
; %systemroot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WmdmPmSN]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wscsvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wuauserv]
; Contents of value:
; %systemroot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WZCSVC]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\xmlprov]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\AppMgmt]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\AudioSrv]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BITS]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Browser]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\CryptSvc]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Dhcp]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\dmserver]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\ERSvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\EventSystem]
; Contents of value:
; C:\WINDOWS\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,\
5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,\
00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,\
6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\FastUserSwitchingCompatibility]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\helpsvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\HidServ]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\hkmsvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\lanmanserver]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\lanmanworkstation]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Messenger]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\napagent]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Netman]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Nla]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\NtmsSvc]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\PerfNet\Performance]
"Close"="CloseNetSvcsObject"
"Collect"="CollectNetSvcsObjectData"
"Open"="OpenNetSvcsObject"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\RasAuto]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\RasMan]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\RemoteAccess]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Schedule]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\seclogon]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SENS]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\ShellHWDetection]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srservice]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\TapiSrv]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Themes]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\TrkWks]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\W32Time]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\winmgmt]
; Contents of value:
; %systemroot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\WmdmPmSN]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\wscsvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\wuauserv]
; Contents of value:
; %systemroot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\WZCSVC]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\xmlprov]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppMgmt]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AudioSrv]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmserver]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ERSvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventSystem]
; Contents of value:
; C:\WINDOWS\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,\
5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,76,00,63,\
00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,6b,00,20,00,\
6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FastUserSwitchingCompatibility]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\helpsvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HidServ]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hkmsvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Messenger]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\napagent]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netman]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Nla]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtmsSvc]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfNet\Performance]
"Close"="CloseNetSvcsObject"
"Collect"="CollectNetSvcsObjectData"
"Open"="OpenNetSvcsObject"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAuto]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seclogon]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ShellHWDetection]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srservice]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TapiSrv]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Themes]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks]
; Contents of value:
; %SystemRoot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winmgmt]
; Contents of value:
; %systemroot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmdmPmSN]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv]
; Contents of value:
; %systemroot%\system32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WZCSVC]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xmlprov]
; Contents of value:
; %SystemRoot%\System32\svchost.exe -k netsvcs
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
; End Of The Log...
-
jaro3
- člen Security týmu
-
Guru Level 15
- Příspěvky: 43294
- Registrován: červen 07
- Bydliště: Jižní Čechy
- Pohlaví:
- Stav:
Offline
Re: Pomůže mi prosím někdo s viry?
START- spustit- napiš: regedit a potvrď
V okně vlevo postupně rozklikni tyto složky:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Po rozkliku NetSvcs najdi v pravé části okna UlkqaEnpuxv ,pravým na něj klikni a vyber odstranit.
Zavři editor registru.
******************************************************************************************************************************************
Stáhni si OTListIt2.exe
-spusť
-oznac "Scan All Users
-oznac Purity i Lop
-klik na "Run Scan"
-otevre se ti textovy soubor, jeho obsah mi sem zkopíruj.
V okně vlevo postupně rozklikni tyto složky:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Po rozkliku NetSvcs najdi v pravé části okna UlkqaEnpuxv ,pravým na něj klikni a vyber odstranit.
Zavři editor registru.
******************************************************************************************************************************************
Stáhni si OTListIt2.exe
-spusť
-oznac "Scan All Users
-oznac Purity i Lop
-klik na "Run Scan"
-otevre se ti textovy soubor, jeho obsah mi sem zkopíruj.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra
Kdo je online
Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 56 hostů