blue723

October 8, 2010

Thank God i have a laptop!!

I can't get anything to open on my desktop...From WORD files to Excel to ANY basic program!!

I am unconnected myself from the internet and am only using my laptop now.

PLEASE HELP!!! PLEASE!

October 7, 2010

Additionally, I just received these messages upon re-start:

Generic Host Process for Win32 Services has encountered a problem and needs to close. We are sorry for the inconvenience.

2nd One:

DISCover Drop & Play System Executable has encountered a problem and needs to close. We are sorry for the inconvenience.

October 7, 2010

Hello,

I have been getting redirected to different sites automatically. I tried to initiate Malwarebytes, unfortunately it won't start.

You guys saved me in the past, so I figured I have some type of infection again, and i hope you can help again.

Please help me!!!!

August 19, 2009

I'll do everything you suggested...thanks again.

The computer does seem clear now, hopefully I don't get anything crazy like this again!!

August 19, 2009

Hi Maurice,

Here is the log from ESET

ESETSmartInstaller@High as downloader log:

all ok

# version=6

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6048

# api_version=3.0.2

# EOSSerial=bcd31db66f7f36419114e9d24dac7469

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2009-08-19 03:42:41

# local_time=2009-08-18 11:42:41 (-0500, Eastern Daylight Time)

# country="United States"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=5121 37 100 88 494781516250000

# scanned=128181

# found=4

# cleaned=4

# scan_time=4306

D:\I386\APPS\APP17839\src\CompaqPresario_Spring06.exe a variant of Win32/Toolbar.MyWebSearch application (deleted - quarantined) 00000000000000000000000000000000 C

D:\I386\APPS\APP17839\src\HPPavillion_Spring06.exe a variant of Win32/Toolbar.MyWebSearch application (deleted - quarantined) 00000000000000000000000000000000 C

D:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP300\A0066984.exe a variant of Win32/Toolbar.MyWebSearch application (deleted - quarantined) 00000000000000000000000000000000 C

D:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP300\A0066985.exe a variant of Win32/Toolbar.MyWebSearch application (deleted - quarantined) 00000000000000000000000000000000 C

So, what do i do now.....the comp seems ok.....but what about all of these programs and logs?? do i need them or should i delete??? Please let me know what you think i need to do....thanks again

August 19, 2009

Hi Maurice,

Unfortunately Kaspersky is not opening for me, what should i do? Here are the OTL and MBAM that you told me to run......

OTL

All processes killed

========== FILES ==========

c:\windows\system32\drivers\.sys moved successfully.

File\Folder C:\recycler not found.

File\Folder D:\recycler not found.

File\Folder e:\recycler not found.

File\Folder f:\recycler not found.

File\Folder g:\recycler not found.

File\Folder h:\recycler not found.

========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Compaq_Administrator

->Temp folder emptied: 4877 bytes

->Temporary Internet Files folder emptied: 1544335 bytes

->Java cache emptied: 22035830 bytes

->Google Chrome cache emptied: 361163340 bytes

->Apple Safari cache emptied: 263404 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

User: LocalService

->Temp folder emptied: 0 bytes

File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.

->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.

->Temporary Internet Files folder emptied: 32902 bytes

%systemdrive% .tmp files removed: 0 bytes

C:\WINDOWS\msdownld.tmp folder deleted successfully.

%systemroot% .tmp files removed: 19569 bytes

%systemroot%\System32 .tmp files removed: 6871057 bytes

Windows Temp folder emptied: 19096 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 373.83 mb

OTL by OldTimer - Version 3.0.10.7 log created on 08182009_213040

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

MBAM

Malwarebytes' Anti-Malware 1.40

Database version: 2651

Windows 5.1.2600 Service Pack 3

8/18/2009 9:48:46 PM

mbam-log-2009-08-18 (21-48-46).txt

Scan type: Quick Scan

Objects scanned: 107890

Time elapsed: 5 minute(s), 15 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

August 18, 2009

Hi Maurice,

I used the combofix software, and before getting to the log, this is the rootkit window....

Rootkit!!

Combofix has detected the presence of rootkit activity and needs to reboot the machine. Kindly note down on paper, the name of each file. We may need it later.

C:\Windows\system32\drivers\SKYNETttrsipxw.sys

C:\Windows\system32\drivers\SKYNETwrqxoyoe.dll

C:\Windows\system32\drivers\SKYNETxumlxyir.dat

C:\Windows\system32\drivers\SKYNETwvogqdpo.dll

C:\Windows\system32\drivers\SKYNETulkbibfh.dat

Secondly, here is the Combofix log you needed:

ComboFix 09-08-10.06 - Compaq_Administrator 08/18/2009 12:14.1.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.520 [GMT -4:00]

Running from: c:\documents and settings\Compaq_Administrator\Desktop\Combo-Fix.exe

AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Compaq_Administrator\Start Menu\Programs\AVI Codec Pack +

c:\documents and settings\Compaq_Administrator\Start Menu\Programs\AVI Codec Pack +\Check For Updates.lnk

c:\documents and settings\Compaq_Administrator\Start Menu\Programs\AVI Codec Pack +\Uninstall.lnk

c:\program files\Altnet

c:\program files\Altnet\My Altnet Shares\Bullguard Protection\plugins.cab.cab

c:\program files\AVI Codec Pack

c:\program files\AVI Codec Pack\AC3\ac3filter.ax

c:\program files\AVI Codec Pack\AC3\dialog_patch.exe

c:\program files\AVI Codec Pack\LAYER-3\L3CODECP.ACM

c:\program files\AVI Codec Pack\LAYER-3\RaMp3Cfg.exe

c:\program files\AVI Codec Pack\uninstall.exe

c:\recycler\S-1-5-21-527237240-179605362-725345543-500

c:\windows\Installer\2afed6.msp

c:\windows\kb913800.exe

c:\windows\system32\bszip.dll

c:\windows\system32\Drivers\nupcqjdw.sys

c:\windows\system32\Drivers\qmgudv.sys

c:\windows\system32\drivers\SKYNETttrsipxw.sys

c:\windows\system32\SKYNETulkbibfh.dat

c:\windows\system32\SKYNETwrqxoyoe.dll

c:\windows\system32\SKYNETwvogqdpo.dll

c:\windows\system32\SKYNETxumlxyir.dat

c:\windows\system32\uniq.tll

D:\Autorun.inf

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_SKYNETnoentmrr

-------\Legacy_SKYNETnoentmrr

((((((((((((((((((((((((( Files Created from 2009-07-18 to 2009-08-18 )))))))))))))))))))))))))))))))

.

2009-08-16 22:50 . 2009-08-17 02:10 0 ----a-w- C:\backup.reg

2009-08-16 21:37 . 2009-08-16 21:37 34816 ----a-w- c:\windows\system32\drivers\.sys

2009-08-16 21:25 . 2009-08-16 21:25 -------- d-----w- c:\program files\ERUNT

2009-08-16 20:10 . 2009-08-16 20:10 -------- d-----w- c:\program files\Trend Micro

2009-08-16 20:03 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-16 20:03 . 2009-08-16 20:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-08-16 20:03 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-08-16 03:51 . 2009-08-16 03:52 -------- d-----w- C:\DVDVideoSoft

2009-08-16 02:52 . 2009-08-16 04:12 -------- d-----w- c:\program files\Total Video Converter

2009-08-16 01:43 . 2009-08-16 01:43 -------- d-----w- c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\Temp

2009-08-16 01:41 . 2009-08-16 01:41 -------- d-----w- c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\Deployment

2009-08-14 00:42 . 2009-08-14 00:42 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

2009-08-13 14:42 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll

2009-08-10 04:06 . 2009-08-10 04:06 74404 ---ha-w- c:\windows\system32\mlfcache.dat

2009-08-10 03:58 . 2009-08-10 03:58 -------- d-----w- c:\program files\Safari

2009-08-10 03:52 . 2009-08-10 03:52 -------- d-----w- c:\program files\iPod

2009-08-10 03:52 . 2009-08-10 03:53 -------- d-----w- c:\program files\iTunes

2009-08-10 03:43 . 2009-08-10 03:43 75040 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe

2009-08-09 16:57 . 2009-08-09 16:57 -------- d-----w- c:\windows\system32\XPSViewer

2009-08-09 16:57 . 2009-08-09 16:57 -------- d-----w- c:\program files\Reference Assemblies

2009-08-09 16:56 . 2008-07-06 12:06 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll

2009-08-09 16:56 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll

2009-08-09 16:56 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll

2009-08-09 16:56 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll

2009-08-09 16:56 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe

2009-08-09 16:56 . 2009-08-09 16:56 -------- d-----w- C:\9ca38af1aac035843874fb9365

2009-08-09 16:56 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll

2009-08-09 16:56 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll

2009-08-05 09:01 . 2009-08-05 09:01 204800 ------w- c:\windows\system32\dllcache\mswebdvd.dll

2009-07-31 04:43 . 2009-07-31 04:43 1685856 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\Move Networks\MoveMediaPlayerWinSilent_071503000010.exe

2009-07-26 18:23 . 2009-07-26 18:23 -------- d-----w- c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\MicroVision Applications

2009-07-22 02:20 . 2009-07-22 02:21 -------- dc-h--w- c:\windows\ie8

2009-07-22 02:20 . 2009-07-22 02:24 -------- d--h--w- c:\windows\msdownld.tmp

2009-07-22 02:11 . 2009-07-22 02:11 -------- d--h--r- c:\documents and settings\Compaq_Administrator\Application Data\SecuROM

2009-07-22 02:11 . 2009-07-22 02:11 107888 ----a-w- c:\windows\system32\CmdLineExt.dll

2009-07-21 19:11 . 2008-03-05 19:56 3786760 ----a-w- c:\windows\system32\D3DX9_37.dll

2009-07-21 19:11 . 2007-07-19 22:14 3727720 ----a-w- c:\windows\system32\d3dx9_35.dll

2009-07-21 19:11 . 2007-05-16 20:45 3497832 ----a-w- c:\windows\system32\d3dx9_34.dll

2009-07-21 19:11 . 2007-04-04 22:53 81768 ----a-w- c:\windows\system32\xinput1_3.dll

2009-07-21 19:10 . 2007-03-12 20:42 3495784 ----a-w- c:\windows\system32\d3dx9_33.dll

2009-07-21 19:10 . 2006-11-29 17:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll

2009-07-21 19:10 . 2006-09-28 20:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll

2009-07-21 19:10 . 2005-05-26 19:34 2297552 ----a-w- c:\windows\system32\d3dx9_26.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-08-14 04:02 . 2006-02-14 19:37 -------- d-----w- c:\program files\WildTangent

2009-08-14 04:00 . 2006-02-14 19:10 -------- d-----w- c:\program files\GemMaster

2009-08-10 04:04 . 2007-01-16 05:20 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\Apple Computer

2009-08-10 03:52 . 2009-06-25 19:59 -------- d-----w- c:\program files\Common Files\Apple

2009-08-09 17:40 . 2006-02-14 19:34 94136 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-08-09 16:57 . 2007-09-21 03:53 -------- d-----w- c:\program files\MSBuild

2009-08-08 18:22 . 2008-03-12 02:41 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\U3

2009-08-05 09:01 . 2004-08-09 21:00 204800 ------w- c:\windows\system32\mswebdvd.dll

2009-07-31 04:44 . 2009-04-23 16:55 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\Move Networks

2009-07-31 04:44 . 2009-05-09 20:28 127872 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\Move Networks\uninstall.exe

2009-07-31 04:44 . 2009-06-16 06:35 4183416 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\Move Networks\plugins\npqmp071503000010.dll

2009-07-17 19:01 . 2004-08-09 21:00 58880 ----a-w- c:\windows\system32\atl.dll

2009-07-14 03:43 . 2004-08-09 21:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll

2009-07-12 15:48 . 2009-07-12 15:48 -------- d-----w- c:\program files\Microsoft Silverlight

2009-07-03 17:09 . 2004-08-09 21:00 915456 ----a-w- c:\windows\system32\wininet.dll

2009-07-02 20:10 . 2006-02-14 19:47 -------- d-----w- c:\program files\Quicken

2009-07-02 18:44 . 2009-07-02 18:44 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\HP

2009-06-26 04:51 . 2009-06-25 19:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple

2009-06-25 20:08 . 2009-06-25 20:07 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

2009-06-25 20:07 . 2007-01-16 04:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer

2009-06-25 20:06 . 2008-02-14 03:24 -------- d-----w- c:\program files\Bonjour

2009-06-25 20:05 . 2006-08-01 01:38 -------- d-----w- c:\program files\QuickTime

2009-06-25 20:00 . 2009-06-25 20:00 -------- d-----w- c:\program files\Apple Software Update

2009-06-25 08:25 . 2004-08-09 21:00 730112 ------w- c:\windows\system32\lsasrv.dll

2009-06-25 08:25 . 2004-08-09 21:00 56832 ----a-w- c:\windows\system32\secur32.dll

2009-06-25 08:25 . 2004-08-09 21:00 54272 ----a-w- c:\windows\system32\wdigest.dll

2009-06-25 08:25 . 2004-08-09 21:00 301568 ----a-w- c:\windows\system32\kerberos.dll

2009-06-25 08:25 . 2004-08-09 21:00 147456 ----a-w- c:\windows\system32\schannel.dll

2009-06-25 08:25 . 2004-08-09 21:00 136192 ----a-w- c:\windows\system32\msv1_0.dll

2009-06-24 11:18 . 2004-08-10 04:00 92928 ------w- c:\windows\system32\drivers\ksecdd.sys

2009-06-18 15:07 . 2009-06-18 15:07 390664 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\Real\RealPlayer\Update\realplayer11gold.exe

2009-06-16 14:36 . 2004-08-09 21:00 81920 ------w- c:\windows\system32\fontsub.dll

2009-06-16 14:36 . 2004-08-09 21:00 119808 ------w- c:\windows\system32\t2embed.dll

2009-06-16 06:35 . 2009-06-16 06:35 97144 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\Move Networks\ie_bin\MovePlayerUpgrade.exe

2009-06-12 12:31 . 2004-08-09 21:00 80896 ------w- c:\windows\system32\tlntsess.exe

2009-06-12 12:31 . 2004-08-10 04:00 76288 ------w- c:\windows\system32\telnet.exe

2009-06-10 14:13 . 2004-08-09 21:00 84992 ------w- c:\windows\system32\avifil32.dll

2009-06-10 13:19 . 2004-08-09 21:00 2066432 ------w- c:\windows\system32\mstscax.dll

2009-06-10 06:14 . 2004-08-09 21:00 132096 ----a-w- c:\windows\system32\wkssvc.dll

2009-06-05 15:42 . 2009-06-25 20:00 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys

2009-06-05 15:42 . 2009-06-25 20:00 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll

2009-06-03 19:09 . 2004-08-09 21:00 1291264 ----a-w- c:\windows\system32\quartz.dll

2006-06-07 03:04 . 2006-06-07 03:04 22 --sha-w- c:\windows\SMINST\HPCD.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-06-21 1207080]

"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2009-05-19 3561720]

"Google Update"="c:\documents and settings\Compaq_Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-08-16 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"DISCover"="c:\program files\DISC\DISCover.exe" [2005-11-11 1064960]

"DiscUpdateManager"="c:\program files\DISC\DiscUpdateMgr.exe" [2005-11-11 61440]

"DMAScheduler"="c:\program files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe" [2005-11-01 90112]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]

"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-11-09 249856]

"YBrowser"="c:\progra~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 129536]

"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]

"Motive SmartBridge"="c:\progra~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" [2005-08-24 442455]

"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-02-28 198160]

"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992]

"McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2007-11-30 1164576]

"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-19 136600]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-21 177472]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]

"AlwaysReady Power Message APP"="ARPWRMSG.EXE" - c:\windows\arpwrmsg.exe [2005-08-03 77312]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

AT&T Self Support Tool.lnk - c:\program files\SBC Self Support Tool\bin\matcli.exe [2006-8-29 217088]

hp psc 1000 series.lnk - c:\program files\HP\Digital Imaging\bin\hpohmr08.exe [2003-4-9 147456]

hpoddt01.exe.lnk - c:\program files\HP\Digital Imaging\bin\hpotdd01.exe [2003-4-9 28672]

QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2005-10-26 811008]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]