ThreatExpert Report: Malware.Virut, Virus.Win32.Virut.ce, W32.Virut.CF, W32/Virut.n.gen..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 25 November 2009, 15:24:41
Processing time: 9 min 25 sec
Submitted sample:

File MD5: 0x4B480D7AE584E9473467EEC83ACD1AB3
File SHA-1: 0x04A7F04C289B9ACFFE5FDC5B6DC50DB3B1AC90A8
Filesize: 184,320 bytes
Alias:

Malware.Virut [PCTools]
W32.Virut.CF [Symantec]
Virus.Win32.Virut.ce [Kaspersky Lab]
W32/Virut.n.gen [McAfee]
W32/Scribble-B [Sophos]
Virus:Win32/Virut.BM [Microsoft]
Win32/Virut.F [AhnLab]

Summary of the findings:

What's been found	Severity Level
Hosts file modification that may block access to the security web sites.
Communication with a remote IRC server.
Downloads/requests other files from Internet.
Compromises SafeBoot registry key(s) in an attempt to disable the Safe Mode.
Creates a startup registry entry.
There were some system executable files modified, which might indicate the presence of a PE-file infector.
Contains characteristics of an identified security risk.

Technical Details:

The new window was created, as shown below:

NOTICE: The content shown in the above window is captured automatically and is not controlled or endorsed by ThreatExpert.
Please contact us on this link should any material be offensive or inappropriate and we will ensure any such content is blocked from future viewers of the report.

Possible Security Risk

Attention! Characteristics of the following security risks were identified in the system:

Security Risk	Description
Spyware.Alexa	This is a toolbar installed on your Internet Explorer without warning that if you use it, you will be sending information to MSN and Alexa. If you don't use the toolbar, it is harmless. The general recommendation is to remove it.
Virus.Parite.B	Virus Parite.B will remain in memory after executed, and infecting every SCR and PE file on every drive and network share.
Adware.Component.Unrelated	These common components have files and keys that are in different threats but the threats are not related to one another in that the author of the signature is not the same. It is recommended that all these entries be removed.
Trojan.Obfuscated.GX	Trojan.Obfuscated.GX will try to download other files through the internet to complete it's malicious routines without user's knowledge.
Trojan.Refpron.GEN	Trojan.Refpron.GEN on execution runs in the background and can download other malicious files onto the computer without users knowledge.

Attention! The following threat categories were identified:

Threat Category	Description
	A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
	A virus capable to modify other files by infecting, prepending, or overwriting them them with its own body
	A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)
	A malicious backdoor trojan that runs in the background and allows remote access to the compromised system

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%Temp%\2456094.exe	87,040 bytes	MD5: 0x457A2278A8EDD12FCAB2E117F2BC7023 SHA-1: 0x0544C6F0206A1851696BD4FA0F001E27D0CF7982	Packed.Win32.Koblu.c [Kaspersky Lab] Refpron.gen.i [McAfee] Mal/Refpron-B [Sophos] Backdoor:Win32/Refpron.P [Microsoft]
2	%Temp%\2462815.exe	115,200 bytes	MD5: 0x985F34162F77C45C85532ED307B904A6 SHA-1: 0x1082686B6E3A358BCB4B34916EA5B827B63C57FF	(not available)
3	%Temp%\271xxx.dll	26,112 bytes	MD5: 0x1DCFECB5AA10096BEB337AFBC087AC62 SHA-1: 0x34AA4386E008B44EAE286D08645B40106205A830	Trojan-PSW.Win32.Agent.oll [Kaspersky Lab]
4	%Temp%\3.log	187 bytes	MD5: 0xF5759012306B8ED9282D273935FEA0AB SHA-1: 0xF27DC40CAAE2F0AD3133B675812FF5193351B043	(not available)
5	%Temp%\52725usc.dll	11,776 bytes	MD5: 0xEE3394F042EB539904723EC1C1056717 SHA-1: 0x648036285B33DEAA63D2251D88C768E7C4E592E8	(not available)
6	%Temp%\hdcfhe.dll	6,656 bytes	MD5: 0x1BE1BE10642D543902F4D1C1A074BE70 SHA-1: 0x4E4DA0CF1DAED28653C3F4F8B6F00B9E4D094E35	Downloader-BGO [McAfee]
7	%Temp%\ka.ini	60 bytes	MD5: 0x98DEB5378F4F290120E32BF5D2FB15DA SHA-1: 0xABD566CBF8EACCDB4841CD2337F9CBCB468FDF5E	(not available)
8	%Temp%\mta13187.dll %Temp%\x1c53994.dll %Windir%\Temp\mta13187.dll	612,352 bytes	MD5: 0x3F795D6FB4050C93CBBD0FF699A2635A SHA-1: 0xD6F6FF1E3809C980CA78710E842AC3F1C1697E92	(not available)
9	%Temp%\nia7.tmp %Temp%\qja8.tmp %Windir%\Temp\mja9.tmp %Windir%\Temp\xfa6.tmp	176,128 bytes	MD5: 0x685F1CBD4AF30A1D0C25F252D399A666 SHA-1: 0x6A1B978F5E6150B88C8634146F1406ED97D2F134	Virus.Parite.B [PCTools] W32.Pinfi [Symantec] Trojan.Win32.Genome.cssz [Kaspersky Lab] W32/Pate.b.dll [McAfee] PE_PARITE.A-O [Trend Micro] W32/Parite-B [Sophos] Virus:Win32/Parite.B.dll [Microsoft] Win32/Parite [AhnLab]
10	%UserProfile%\ntuser.dll %Programs%\Startup\scandisk.dll %System%\calc.dll %Windir%\Temp\rundll32.dll	24,064 bytes	MD5: 0x487D788710F5AC5E406BC40748F973BD SHA-1: 0xD268EFD1EA8268949551F7DB1D8BB0D3A2895A7D	Trojan-PSW.Generic [PCTools] Infostealer [Symantec] Packed.Win32.Krap.ah [Kaspersky Lab] Mal/EncPk-MA, Mal/FakeDouf-B [Sophos] Packed.Win32.Krap [Ikarus]
11	%Programs%\Startup\scandisk.lnk	655 bytes	MD5: 0x6DD9F4546AA0A7BCD89C00844B635F53 SHA-1: 0x5A6D36E041C59B1689B6CD62FE32C93369C55FFD	(not available)
12	%Windir%\Install.txt %System%\Install.txt	266 bytes	MD5: 0x5EA154792744C57AAEE317012CD835E4 SHA-1: 0x6E9BD312CECBEB0D8948E53F0D84879C3787A8D1	(not available)
13	%Windir%\isvchost.exe	599,508 bytes	MD5: 0xDECE7E8313561306FABBC2B9CF25C3EA SHA-1: 0xB181E7ED34C2A056FBBCAAC78EAF1CDBD46DE383	Win32.Parite.B [PCTools] W32.Pinfi [Symantec] Virus.Win32.Parite.b [Kaspersky Lab] W32/Pate.b [McAfee] PE_PARITE.A [Trend Micro] W32/Parite-B [Sophos] Virus:Win32/Parite.B [Microsoft] Win32/Parite [AhnLab]
14	%Windir%\svchost.exe	1,166,848 bytes	MD5: 0x48EAF5CD4962747FFCD3473AB3BB1795 SHA-1: 0x1D1114BBE90B70A758153489F80D202884407D21	Malware.Virut [PCTools] W32.Virut.CF [Symantec] Virus.Win32.Virut.ce [Kaspersky Lab] W32/Virut.n.gen [McAfee] W32/Scribble-B [Sophos] Virus:Win32/Virut.BM [Microsoft] Win32/Virut.F [AhnLab]
15	%Windir%\svchust.exe	924,126 bytes	MD5: 0x800C8980244B97D1792FF1DFFA37A148 SHA-1: 0xE9522C9CF70F4FA984DCF605CD680E3EB1B8D128	Win32.Parite.B2 [PCTools] W32.Pinfi [Symantec] Virus.Win32.Parite.b [Kaspersky Lab] W32/Pate.b [McAfee] PE_PARITE.A [Trend Micro] W32/Parite-B [Sophos] Virus:Win32/Parite.B [Microsoft] Win32/Parite [AhnLab]
16	%System%\3.tmp	88 bytes	MD5: 0xC366C61C89A3D6CB7201D6E3C9AB16C7 SHA-1: 0x1E4C6122D17C071C879926363C53D9264A83D9F4	(not available)
17	%System%\3cd05.dll	312,525 bytes	MD5: 0xAE01E46F8D06D0A796BAF6C9F55B6B35 SHA-1: 0xA4480FF93CB14BF2B940E6FDB3FAE623BD9A32D8	Mal/Patched-A [Sophos]
18	%System%\5.tmp	88,576 bytes	MD5: 0x1C5E79F5F4CAAB5F5C9A69AB91D478B2 SHA-1: 0x428D52728C29EC557F1E4DF282AB76AF70230823	Trojan.Generic [PCTools] Trojan Horse [Symantec] Packed.Win32.Krap.af [Kaspersky Lab] W32/Rimecud [McAfee] WORM_PALEVO.SMI [Trend Micro] Mal/Rimecud-A, Mal/Zbot-I [Sophos] Trojan:Win32/Sisproc [Microsoft] Trojan.Generic.CJ [Ikarus] Win-Trojan/Obfuscator.88576.B [AhnLab]
19	%System%\6to4v32.dll	61,440 bytes	MD5: 0x065718D0DF31EDF5D5D2B795357A3092 SHA-1: 0x0CF0325C194A4179AC241DD98B15AD4D20140CB1	Backdoor.Win32.Agent.andh [Kaspersky Lab] Troj/Wimpix-Gen [Sophos]
20	%System%\BtwSrv.dll	46,080 bytes	MD5: 0xDD878E8834D4EBFC8625C7B527A8FA8A SHA-1: 0xBC356D17AB62F43D4934DE51EFBF66BEFAC7A94D	Packed.Win32.Koblu.d [Kaspersky Lab] Trojan:Win32/Refpron.F [Microsoft]
21	%System%\damdrv.sys	2,304 bytes	MD5: 0x30305D10BB5D0B6587515ADB2B462866 SHA-1: 0x5E1FDF26B6FA9C5A5FAB5367610F6CB5C4646E1F	(not available)
22	%System%\FastNetSrv.exe	74,240 bytes	MD5: 0x54B88ADE23A6866F65FC8B7757D0A1DC SHA-1: 0x537FA0A043AC7598056006F6410CE3CF3339BAFF	Malware.Virut [PCTools] W32.Virut.CF [Symantec] Virus.Win32.Virut.ce [Kaspersky Lab] W32/Virut.n.gen [McAfee] W32/Scribble-B [Sophos] Virus:Win32/Virut.BM [Microsoft] Win32/Virut.F [AhnLab]
23	%System%\lsm32.sys	36,864 bytes	MD5: 0xFC51DFCA07368E92930FBE7D4B24C932 SHA-1: 0x63744ADFBE3F718BABF5C187EC14ABA37EF64438	Trojan.Win32.Clicker.cr [Kaspersky Lab] Generic AdClicker.p [McAfee] Mal/Bimay-A [Sophos]
24	[file and pathname of the sample #1]	184,320 bytes	MD5: 0x4B480D7AE584E9473467EEC83ACD1AB3 SHA-1: 0x04A7F04C289B9ACFFE5FDC5B6DC50DB3B1AC90A8	Malware.Virut [PCTools] W32.Virut.CF [Symantec] Virus.Win32.Virut.ce [Kaspersky Lab] W32/Virut.n.gen [McAfee] W32/Scribble-B [Sophos] Virus:Win32/Virut.BM [Microsoft] Win32/Virut.F [AhnLab]
25	%System%\win.dll	77,355 bytes	MD5: 0x377C0BE2A5DC6981F9305B55F13A5F00 SHA-1: 0xEAB1DB89137302799EAA9941E4A64844282CED0F	(not available)
26	%System%\winnt.exe	42,392 bytes	MD5: 0x638DF3B1CAA0CE21A312C8E930F61B06 SHA-1: 0x406E08006029655791EF1205C7CD697FDAAD229C	Trojan.Win32.Sasfis.vvs [Kaspersky Lab] Trojan.Win32.Sasfis [Ikarus]
27	%System%\winnts.dll	6,144 bytes	MD5: 0x534EC11E1F0E3797FBD390F64EEAB4DF SHA-1: 0x3B03FF58904C32BCA54C0C5F8032172C675A9F18	(not available)
28	%Windir%\Temp\nsrbgxod.bak	0 bytes	MD5: 0xD41D8CD98F00B204E9800998ECF8427E SHA-1: 0xDA39A3EE5E6B4B0D3255BFEF95601890AFD80709	(not available)

Notes:

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
%UserProfile% is a variable that specifies the current user's profile folder. By default, this is C:\Documents and Settings\[UserName] (Windows NT/2000/XP).
%Programs% is a variable that refers to the file system directory that contains the user's program groups. A typical path is C:\Documents and Settings\[UserName]\Start Menu\Programs.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

The following files were modified:

c:\Inetpub\wwwroot\index.html
[pathname with a string SHARE]\DW20.EXE
[pathname with a string SHARE]\DWTRIG20.EXE
[pathname with a string SHARE]\msinfo32.exe
[pathname with a string SHARE]\sapisvr.exe
[pathname with a string SHARE]\Blank.htm
[pathname with a string SHARE]\Citrus Punch.htm
[pathname with a string SHARE]\Clear Day.htm
[pathname with a string SHARE]\Fiesta.htm
[pathname with a string SHARE]\Glacier.htm
[pathname with a string SHARE]\Ivy.htm
[pathname with a string SHARE]\Leaves.htm
[pathname with a string SHARE]\Maize.htm
[pathname with a string SHARE]\Nature.htm
[pathname with a string SHARE]\Network Blitz.htm
[pathname with a string SHARE]\Pie Charts.htm
[pathname with a string SHARE]\Sunflower.htm
[pathname with a string SHARE]\Sweets.htm
[pathname with a string SHARE]\Technical.htm
%ProgramFiles%\Common Files\System\ado\MDACReadme.htm
%ProgramFiles%\Internet Explorer\Connection Wizard\icwconn1.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\icwconn2.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\icwrmind.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\icwtutor.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\inetwiz.exe
%ProgramFiles%\Internet Explorer\Connection Wizard\isignup.exe
%ProgramFiles%\Internet Explorer\iedw.exe
%ProgramFiles%\Internet Explorer\IEXPLORE.EXE
%ProgramFiles%\MSN\MSNIA\msniasvc.exe
%ProgramFiles%\MSN\MSNIA\prestp.exe
%ProgramFiles%\MSN\MsnInstaller\msninst.exe
%ProgramFiles%\NetMeeting\cb32.exe
%ProgramFiles%\NetMeeting\conf.exe
%ProgramFiles%\NetMeeting\netmeet.htm
%ProgramFiles%\NetMeeting\wb32.exe
%ProgramFiles%\Outlook Express\msimn.exe
%ProgramFiles%\Outlook Express\oemig50.exe
%ProgramFiles%\Outlook Express\setup50.exe
%ProgramFiles%\Outlook Express\wab.exe
%ProgramFiles%\Outlook Express\wabmig.exe
%ProgramFiles%\Windows Media Player\migrate.exe
%ProgramFiles%\Windows Media Player\setup_wm.exe
%ProgramFiles%\Windows Media Player\wmplayer.exe
%ProgramFiles%\Windows NT\Accessories\wordpad.exe
%ProgramFiles%\Windows NT\dialer.exe
%ProgramFiles%\Windows NT\hypertrm.exe
%ProgramFiles%\Windows NT\Pinball\PINBALL.EXE
%Windir%\Cache\Adobe Reader 6.0.1\ENUBIG\setup.exe
%Windir%\hh.exe
%Windir%\inf\unregmp2.exe
%Windir%\Microsoft.NET\Framework\NETFXSBS10.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\error.aspx
%Windir%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizard.aspx
%Windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\CONFIG\DefaultWsdlHelpGenerator.aspx
%Windir%\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\jsc.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
%Windir%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
%Windir%\msagent\agentsvr.exe
%Windir%\mui\muisetup.exe
%Windir%\NOTEPAD.EXE
%Windir%\pchealth\helpctr\binaries\HelpCtr.exe
%Windir%\pchealth\helpctr\binaries\HelpHost.exe
%Windir%\pchealth\helpctr\binaries\HelpSvc.exe
%Windir%\pchealth\helpctr\binaries\HscUpd.exe
%Windir%\pchealth\helpctr\binaries\msconfig.exe
%Windir%\pchealth\helpctr\binaries\notiflag.exe
%Windir%\pchealth\helpctr\System\blurbs\about_support.htm
%Windir%\pchealth\helpctr\System\blurbs\Favorites.htm
%Windir%\pchealth\helpctr\System\blurbs\ftshelp.htm
%Windir%\pchealth\helpctr\System\blurbs\History.htm
%Windir%\pchealth\helpctr\System\blurbs\Index.htm
%Windir%\pchealth\helpctr\System\blurbs\isupport.htm
%Windir%\pchealth\helpctr\System\blurbs\keywordhelp.htm
%Windir%\pchealth\helpctr\System\blurbs\options.htm
%Windir%\pchealth\helpctr\System\blurbs\searchblurb.htm
%Windir%\pchealth\helpctr\System\blurbs\searchtips.htm
%Windir%\pchealth\helpctr\System\blurbs\tools.htm
%Windir%\pchealth\helpctr\System\blurbs\windows_newsgroups.htm
%Windir%\pchealth\helpctr\System\CompatCtr\AboutCompat.htm
%Windir%\pchealth\helpctr\System\CompatCtr\CompatMode.htm
%Windir%\pchealth\helpctr\System\CompatCtr\CompatOffline.htm
%Windir%\pchealth\helpctr\System\CompatCtr\LearnCompat.htm
%Windir%\pchealth\helpctr\System\DVDUpgrd\dvdupgrd.htm
%Windir%\pchealth\helpctr\System\ErrMsg\ErrorMessagesOffline.htm
%Windir%\pchealth\helpctr\System\errors\badurl.htm
%Windir%\pchealth\helpctr\System\errors\connection.htm
%Windir%\pchealth\helpctr\System\errors\indexfirstlevel.htm
%Windir%\pchealth\helpctr\System\errors\notfound.htm
%Windir%\pchealth\helpctr\System\errors\offline.htm
%Windir%\pchealth\helpctr\System\errors\redirect.htm
%Windir%\pchealth\helpctr\System\errors\unreachable.htm
%Windir%\pchealth\helpctr\System\Headlines.htm

Notes:

%ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.

The following directories were created:

c:\System Volume Information\.
c:\System Volume Information\..

Memory Modifications

There were new processes created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	184,320 bytes
svchost.exe	%Windir%\svchost.exe	577,536 bytes
2456094.exe	%Temp%\2456094.exe	110,592 bytes

There were new memory pages created in the address space of the system process(es):

Process Name	Process Filename	Allocated Size
svchost.exe	%System%\svchost.exe	192,512 bytes
wmiprvse.exe	%System%\wbem\wmiprvse.exe	40,960 bytes

The following modules were loaded into the address space of other process(es):

Module Name	Module Filename	Address Space Details
6to4v32.dll	%System%\6to4v32.dll	Process name: svchost.exe Process filename: %System%\svchost.exe Address space: 0x10000000 - 0x1000F000
rundll32.dll	%Windir%\TEMP\rundll32.dll	Process name: [generic host process] Process filename: [generic host process filename] Address space: 0x10000000 - 0x10000001
win.dll	%System%\win.dll	Process name: svchost.exe Process filename: %System%\svchost.exe Address space: 0x960000 - 0x980000
3cd05.dll	%System%\3cd05.dll	Process name: svchost.exe Process filename: %System%\svchost.exe Address space: 0x960000 - 0xAC7200
rundll32.dll	%Windir%\TEMP\rundll32.dll	Process name: wmiprvse.exe Process filename: %System%\wbem\wmiprvse.exe Address space: 0x700000 - 0x700001

Notes:

[generic host process filename] is a full path filename of [generic host process].

There were new services created in the system:

Service Name	Display Name	Status	Service Filename
NetLogin	Net Login	"Running"	%Windir%\svchost.exe
win	windo	"Running"	%System%\svchost.exe -k netsvcs
6to4	6to4	"Running"	%System%\svchost.exe -k netsvcs
.Net CLR	Microsoft .Net Framework COM+ Support	"Running"	%System%\svchost.exe -k ".Net CLR"

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{43f872BA-82h9-1381-b8bf-eaKf8836g8l5}
HKEY_LOCAL_MACHINE\SOFTWARE\Alexa Internet
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_.NET_CLR
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_.NET_CLR\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_.NET_CLR\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_6TO4
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_6TO4\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_6TO4\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BTWSRV
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BTWSRV\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BTWSRV\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_DAMDRV
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_DAMDRV\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_DAMDRV\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NETLOGIN
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NETLOGIN\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NETLOGIN\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WIN
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WIN\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WIN\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.Net CLR
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.Net CLR\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.Net CLR\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.Net CLR\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6to4
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6to4\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6to4\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6to4\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BtwSrv
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BtwSrv\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BtwSrv\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BtwSrv\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\damdrv
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\damdrv\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\damdrv\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetLogin
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetLogin\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetLogin\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\win
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\win\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\win\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\win\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_.NET_CLR
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_.NET_CLR\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_.NET_CLR\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_6TO4
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_6TO4\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_6TO4\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BTWSRV
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BTWSRV\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BTWSRV\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DAMDRV
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DAMDRV\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DAMDRV\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETLOGIN
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETLOGIN\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETLOGIN\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WIN
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WIN\0000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WIN\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.Net CLR
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.Net CLR\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.Net CLR\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.Net CLR\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\6to4
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\6to4\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\6to4\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\6to4\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BtwSrv
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BtwSrv\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BtwSrv\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BtwSrv\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\damdrv
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\damdrv\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\damdrv\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetLogin
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetLogin\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetLogin\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\win
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\win\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\win\Security
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\win\Enum
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\New Windows
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
HKEY_USERS\.DEFAULT\Software\Microsoft\IEAK
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Connection Wizard
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_FASTNETSRV
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_FASTNETSRV\0000
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\fastnetsrv
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\fastnetsrv\Security

The following Registry Keys were deleted:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\AppMgmt
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Base
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Boot Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Boot file system
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CryptSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\DcomLaunch
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\dmadmin
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\dmboot.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\dmio.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\dmload.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\dmserver
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\EventLog
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\File system
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Filter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\HelpSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Netlogon
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\PCI Configuration
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\PlugPlay
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\PNP Filter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Primary disk
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\RpcSs
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SCSI Class
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\sermouse.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\sr.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SRService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\System Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\vga.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\vgasave.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinMgmt
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\AFD
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\AppMgmt
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Base
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Boot Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Boot file system
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Browser
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\CryptSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\DcomLaunch
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Dhcp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\dmadmin
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\dmboot.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\dmio.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\dmload.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\dmserver
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\DnsCache
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\EventLog
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\File system
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Filter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\HelpSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\ip6fw.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\ipnat.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\LanmanServer
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\LanmanWorkstation
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\LmHosts
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Messenger
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\NDIS
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\NDIS Wrapper
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Ndisuio
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\NetBIOS
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\NetBIOSGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\NetBT
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\NetDDEGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Netlogon
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\NetMan
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Network
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\NetworkProvider
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\nm
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\nm.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\NtLmSsp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\PCI Configuration
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\PlugPlay
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\PNP Filter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\PNP_TDI
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Primary disk
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\rdpcdd.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\rdpdd.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\rdpwd.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\rdsessmgr
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\RpcSs
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\SCSI Class
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\sermouse.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\SharedAccess
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\sr.sys
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\SRService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Streams Drivers

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{43f872BA-82h9-1381-b8bf-eaKf8836g8l5}]

(Default) = "FileManage"
stubpath = "%System%\winnt.exe"

so that winnt.exe runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]

DEPOff = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]

EnableLUA = 0x00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

calc = "rundll32.exe %System%\calc.dll,_IWMPEvents@0"

so that calc.dll runs every time Windows starts

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]

.Net CLR = 2E 4E 65 74 20 43 4C 52 00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_.NET_CLR\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = ".Net CLR"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_.NET_CLR\0000]

Service = ".Net CLR"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "Microsoft .Net Framework COM+ Support"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_.NET_CLR]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_6TO4\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "6to4"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_6TO4\0000]

Service = "6to4"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "6to4"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_6TO4]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BTWSRV\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "BtwSrv"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BTWSRV\0000]

Service = "BtwSrv"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "BtwSrv"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BTWSRV]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_DAMDRV\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "damdrv"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_DAMDRV\0000]

Service = "damdrv"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "damdrv"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_DAMDRV]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NETLOGIN\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "NetLogin"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NETLOGIN\0000]

Service = "NetLogin"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "Net Login"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NETLOGIN]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WIN\0000\Control]

*NewlyCreated* = 0x00000000
ActiveService = "win"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WIN\0000]

Service = "win"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "windo"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WIN]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.Net CLR\Enum]

0 = "Root\LEGACY_.NET_CLR\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.Net CLR\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.Net CLR\Parameters]

ServiceDll = "%System%\3cd05.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\.Net CLR]

Type = 0x00000110
Start = 0x00000002
ErrorControl = 0x00000001
ImagePath = "%System%\svchost.exe -k ".Net CLR""
DisplayName = "Microsoft .Net Framework COM+ Support"
ObjectName = "LocalSystem"
Description = "Microsoft .NET and Windows XP COM+ Integration with SOAP"
FailureActions = 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 88 13 00 00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6to4\Enum]

0 = "Root\LEGACY_6TO4\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6to4\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6to4\Parameters]

ServiceDll = "%System%\6to4v32.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6to4]

Type = 0x00000120
Start = 0x00000002
ErrorControl = 0x00000001
ImagePath = "%System%\svchost.exe -k netsvcs"
DisplayName = "Network Security"
ObjectName = "LocalSystem"
Description = "Windows Network Security Management Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BtwSrv\Enum]

0 = "Root\LEGACY_BTWSRV\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BtwSrv\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BtwSrv\Parameters]

ServiceDll = 43 3A 5C 57 49 4E 44 4F 57 53 5C 73 79 73 74 65 6D 33 32 5C 42 74 77 53 72 76 2E 64 6C 6C 00 65 6D 70 5C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BtwSrv]

Type = 0x00000010
Start = 0x00000002
ErrorControl = 0x00000001
ImagePath = "%System%\svchost.exe -k netsvcs"
ObjectName = "LocalSystem"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\damdrv\Enum]

0 = "Root\LEGACY_DAMDRV\0000"
Count = 0x00000001
NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\damdrv\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\damdrv]

Type = 0x00000001
Start = 0x00000003
ErrorControl = 0x00000000
ImagePath = "%System%\damdrv.sys"
DisplayName = "damdrv"
Description = "damdrv"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_FASTNETSRV\0000]

Service = "fastnetsrv"
Legacy = 0x00000001
ConfigFlags = 0x00000000
Class = "LegacyDriver"
ClassGUID = "{8ECC055D-047F-11D1-A537-0000F8753ED1}"
DeviceDesc = "fastnetsrv Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_FASTNETSRV]

NextInstance = 0x00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\fastnetsrv\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\fastnetsrv]

Type = 0x00000010
Start = 0x00000002
ErrorControl = 0x00000001
ImagePath = "%System%\FastNetSrv.exe"
DisplayName = "fastnetsrv Service"
ObjectName = "LocalSystem"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetLogin\Security]

Security = 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 0

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetLogin]

Type = 0x00000010
Start = 0x00000004
ErrorControl = 0x00000001
ImagePath = "%Windir%\svchost.exe"

The following Registry Values were deleted:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]

(Default) = "Human Interface Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

(Default) = "Volume"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]

(Default) = "Floppy disk drive"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

(Default) = "System"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]

(Default) = "SCSIAdapter"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]

(Default) = "PCMCIA Adapters"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

(Default) = "Mouse"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

(Default) = "Keyboard"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

(Default) = "Hdc"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]

(Default) = "Standard floppy disk controller"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]

(Default) = "DiskDrive"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]

(Default) = "CD-ROM Drive"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]

(Default) = "Universal Serial Bus controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinMgmt]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\vgasave.sys]

(Default) = "Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\vga.sys]

(Default) = "Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\System Bus Extender]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SRService]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\sr.sys]

(Default) = "FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\sermouse.sys]

(Default) = "Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SCSI Class]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\RpcSs]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Primary disk]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\PNP Filter]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\PlugPlay]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\PCI Configuration]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Netlogon]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\HelpSvc]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Filter]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\File system]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\EventLog]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\dmserver]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\dmload.sys]

(Default) = "Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\dmio.sys]

(Default) = "Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\dmboot.sys]

(Default) = "Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\dmadmin]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\DcomLaunch]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CryptSvc]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Boot file system]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Boot Bus Extender]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Base]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\AppMgmt]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]

(Default) = "Human Interface Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

(Default) = "Volume"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E980-E325-11CE-BFC1-08002BE10318}]

(Default) = "Floppy disk drive"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

(Default) = "System"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}]

(Default) = "SCSIAdapter"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E977-E325-11CE-BFC1-08002BE10318}]

(Default) = "PCMCIA Adapters"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}]

(Default) = "NetTrans"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}]

(Default) = "NetService"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E973-E325-11CE-BFC1-08002BE10318}]

(Default) = "NetClient"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}]

(Default) = "Net"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

(Default) = "Mouse"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

(Default) = "Keyboard"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

(Default) = "Hdc"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}]

(Default) = "Standard floppy disk controller"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}]

(Default) = "DiskDrive"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E965-E325-11CE-BFC1-08002BE10318}]

(Default) = "CD-ROM Drive"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\{36FC9E60-C465-11CF-8056-444553540000}]

(Default) = "Universal Serial Bus controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\WZCSVC]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\WinMgmt]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\vgasave.sys]

(Default) = "Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\vga.sys]

(Default) = "Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\termservice]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\tdtcp.sys]

(Default) = "Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\tdpipe.sys]

(Default) = "Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\TDI]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Tcpip]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\System Bus Extender]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Streams Drivers]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\SRService]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\sr.sys]

(Default) = "FSFilter System Recovery"

[[pathname with a string SHARE]\SharedAccess]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\sermouse.sys]

(Default) = "Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\SCSI Class]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\RpcSs]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\rdsessmgr]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\rdpwd.sys]

(Default) = "Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\rdpdd.sys]

(Default) = "Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\rdpcdd.sys]

(Default) = "Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Primary disk]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\PNP_TDI]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\PNP Filter]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\PlugPlay]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\PCI Configuration]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\NtLmSsp]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\nm.sys]

(Default) = "Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\nm]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\NetworkProvider]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Network]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\NetMan]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Netlogon]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\NetDDEGroup]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\NetBT]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\NetBIOSGroup]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\NetBIOS]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Ndisuio]

(Default) = "Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\NDIS Wrapper]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\NDIS]

(Default) = "Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\Messenger]

(Default) = "Service"

The following Registry Values were modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]

netsvcs =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

AppInit_DLLs =

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent]

(Default) =

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceCurrent]

(Default) =

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]

AppData =
Cookies =
Desktop =
Favorites =
Personal =
Start Menu =
Cache =
History =

Other details

Analysis of the file resources indicate the following possible countries of origin:

	China
	Russian Federation

The HOSTS file was updated with the following URL-to-IP mappings:

There were registered attempts to establish connection with the remote hosts. The connection details are:

Remote Host	Port Number
174.123.160.146	80
193.104.94.11	80
212.117.177.140	80
91.206.201.39	80
202.97.184.196	81

The data identified by the following URLs was then requested from the remote web server:

http://www.entertainmenttrend.com/category/events/page/2/
http://www.entertainmenttrend.com/wp-content/plugins/wp-paginate/wp-paginate.css?ver=1.1.1
http://www.entertainmenttrend.com/wp-includes/js/jquery/jquery.js?ver=1.3.2
http://www.entertainmenttrend.com/wp-content/plugins/Viva-ThumbZoom/lib/v-zoom/viva-zoom.css
http://www.entertainmenttrend.com/wp-content/plugins/Viva-ThumbZoom/lib/v-zoom/viva-zoom-mini.js
http://www.entertainmenttrend.com/wp-content/plugins/commentluv/style/cl_style.css
http://www.entertainmenttrend.com/wp-content/plugins/contact-form-7/stylesheet.css
http://www.entertainmenttrend.com/wp-content/plugins/contact-form-7/contact-form-7.js
http://www.entertainmenttrend.com/wp-content/plugins/featured-content-gallery/css/jd.gallery.css.php
http://www.entertainmenttrend.com/wp-content/plugins/featured-content-gallery/css/jd.gallery.css
http://www.entertainmenttrend.com/wp-content/plugins/featured-content-gallery/scripts/mootools.v1.11.js
http://www.entertainmenttrend.com/wp-content/plugins/featured-content-gallery/scripts/jd.gallery.js.php
http://www.entertainmenttrend.com/wp-content/plugins/featured-content-gallery/scripts/jd.gallery.transitions.js
http://www.petdoso.com:81/svc.php?file=svchost.exe
http://www.petdoso.com:81/svc.php?file=svchust.exe
http://www.petdoso.com:81/svc.php?file=sv1.exe
http://www.petdoso.com:81/svc.php?file=isvchost.exe
http://www.petdoso.com:81/svc.php?d=00000000000000000001&i=svchost.exe
http://www.businesstomb.com/svc.php?ver=5.2.3790.4000&p=&a=&ua=Mozilla/4.0%20(compatible;%20MSIE%206.0;%20Win32)&alex=
http://colopin.cn/oc/box.txt
http://colopin.cn/op/lgate.php?n=39840325379C188F
http://colopin.cn/lib/pm.txt
http://colopin.cn/lib/ssv.txt

Outbound traffic (potentially malicious)

Attention! There was a new connection established with a remote IRC Server. The generated outbound IRC traffic is provided below:

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.