please help - please review

gumgone · March 10, 2009

I believe I have a virus

I have tried to run numerous programs, however unsuccessful to get them to run

I had to rename Hijackthis for it to run .....log below

unsuccessful - will not run

Spybot

Malwarebytes' Anti-Malware

Hijackthis LOG -

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 1:16:15 AM, on 2009-03-10

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Safe mode

Running processes:

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

H:\VIRUS\HJTInstall.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\twex.exe,

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {0ca94ca7-e92c-4601-9247-0d2cd3cef8f6} - (no file)

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: (no name) - {d1bdd88d-f1fa-40d8-995b-e1ea32295682} - (no file)

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /nosplash

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -p 0x08b2 -f video -m logitech -d 10.5.1.2023 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -p 0x08b2 -f video -m logitech -d 10.5.1.2023 (User 'Default user')

O8 - Extra context menu item: Google AdSense Preview Tool - http://pagead2.googlesyndication.com/pagea...en/preview.html

O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1224676719937

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: c:\windows\system32\yiyidaju.dll c:\windows\system32\goveyudi.dll njkjft.dll

O20 - Winlogon Notify: rqRjJyyx - rqRjJyyx.dll (file missing)

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: AST Service (astcc) - Advanced Software Technologies - C:\WINDOWS\SYSTEM32\astsrv.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe

O24 - Desktop Component 1: (no name) - (no file)

--

End of file - 5417 bytes

gumgone · March 10, 2009

I would like to remove all the crap off ... remove all the startup that are not necessary

gumgone · March 10, 2009

LOG -----------

AVZ Antiviral Toolkit log; AVZ version is 4.30

Scanning started at 2009-03-10 12:13:24 AM

Database loaded: signatures - 213646, NN profile(s) - 2, microprograms of healing - 56, signature database released 09.03.2009 22:51

Heuristic microprograms loaded: 372

SPV microprograms loaded: 9

Digital signatures of system files loaded: 100531

Heuristic analyzer mode: Medium heuristics level

Healing mode: enabled

Windows version: 5.1.2600, Service Pack 2 ; AVZ is launched with administrator rights

System Restore: enabled

1. Searching for Rootkits and programs intercepting API functions

1.1 Searching for user-mode API hooks

Analysis: kernel32.dll, export table found in section .text

Analysis: ntdll.dll, export table found in section .text

Function ntdll.dll:LdrGetProcedureAddress (65) intercepted, method ProcAddressHijack.GetProcAddress ->7C919B88->144ECF

Function ntdll.dll:LdrLoadDll (70) intercepted, method ProcAddressHijack.GetProcAddress ->7C9161CA->144F34

Function ntdll.dll:LdrUnloadDll (80) intercepted, method APICodeHijack.JmpTo[00E40000]

Function ntdll.dll:NtCreateThread (140) intercepted, method ProcAddressHijack.GetProcAddress ->7C90D7D2->144E9D

Function ntdll.dll:NtQueryDirectoryFile (234) intercepted, method ProcAddressHijack.GetProcAddress ->7C90DF5E->144FE8

Analysis: user32.dll, export table found in section .text

Function user32.dll:GetClipboardData (258) intercepted, method ProcAddressHijack.GetProcAddress ->7E430D7A->1452A1

Function user32.dll:TranslateMessage (683) intercepted, method ProcAddressHijack.GetProcAddress ->7E418BF6->145556

Analysis: advapi32.dll, export table found in section .text

Analysis: ws2_32.dll, export table found in section .text

Function ws2_32.dll:WSASend (76) intercepted, method ProcAddressHijack.GetProcAddress ->71AB6233->14C998

Function ws2_32.dll:WSASendTo (78) intercepted, method ProcAddressHijack.GetProcAddress ->71AC0A95->14C980

Function ws2_32.dll:closesocket (3) intercepted, method ProcAddressHijack.GetProcAddress ->71AB9639->14C971

Function ws2_32.dll:send (19) intercepted, method ProcAddressHijack.GetProcAddress ->71AB428A->14C9F8

Function ws2_32.dll:sendto (20) intercepted, method ProcAddressHijack.GetProcAddress ->71AB2C69->14C9C8

Analysis: wininet.dll, export table found in section .text

Function wininet.dll:HttpQueryInfoA (206) intercepted, method ProcAddressHijack.GetProcAddress ->78060C6D->14B804

Function wininet.dll:HttpQueryInfoW (207) intercepted, method ProcAddressHijack.GetProcAddress ->78067E4E->14B854

Function wininet.dll:HttpSendRequestA (208) intercepted, method ProcAddressHijack.GetProcAddress ->7806CD40->14C39C

Function wininet.dll:HttpSendRequestExA (209) intercepted, method ProcAddressHijack.GetProcAddress ->780CD3CE->14C47A

Function wininet.dll:HttpSendRequestExW (210) intercepted, method ProcAddressHijack.GetProcAddress ->78073532->14C45D

Function wininet.dll:HttpSendRequestW (211) intercepted, method ProcAddressHijack.GetProcAddress ->78080825->14C37F

Function wininet.dll:InternetCloseHandle (224) intercepted, method ProcAddressHijack.GetProcAddress ->7805DA59->14BC76

Function wininet.dll:InternetQueryDataAvailable (272) intercepted, method ProcAddressHijack.GetProcAddress ->7806ADF5->14BE0F

Function wininet.dll:InternetReadFile (276) intercepted, method ProcAddressHijack.GetProcAddress ->7806ABB4->14BDB6

Function wininet.dll:InternetReadFileExA (277) intercepted, method ProcAddressHijack.GetProcAddress ->78082AE2->14BDF1

Function wininet.dll:InternetReadFileExW (278) intercepted, method ProcAddressHijack.GetProcAddress ->78082AAA->14BDD3

Analysis: rasapi32.dll, export table found in section .text

Analysis: urlmon.dll, export table found in section .text

Analysis: netapi32.dll, export table found in section .text

1.4 Searching for masking processes and drivers

Searching for masking processes and drivers - complete

Driver loaded successfully

1.5 Checking of IRP handlers

Checking - complete

2. Scanning memory

Number of processes found: 29

Number of modules loaded: 288

Scanning memory - complete

3. Scanning disks

4. Checking Winsock Layered Service Provider (SPI/LSP)

LSP settings checked. No errors detected

5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs)

\\?\globalroot\systemroot\system32\UACqquxiuxn.dll --> Suspicion for Keylogger or Trojan DLL

\\?\globalroot\systemroot\system32\UACqquxiuxn.dll>>> Behavioural analysis

Behaviour typical for keyloggers not detected

Quarantine file: failed (error), attempt of direct disk reading (\\?\globalroot\systemroot\system32\UACqquxiuxn.dll)

Note: Do NOT delete suspicious files, send them for analysis (see FAQ for more details), because there are lots of useful hooking DLLs

6. Searching for opened TCP/UDP ports used by malicious programs

Checking disabled by user

7. Heuristic system check

Latent loading of libraries through AppInit_DLLs suspected: "c:\windows\system32\yiyidaju.dll c:\windows\system32\goveyudi.dll njkjft.dll"

Checking - complete

8. Searching for vulnerabilities

>> Services: potentially dangerous service allowed: TermService (Terminal Services)

>> Services: potentially dangerous service allowed: SSDPSRV (SSDP Discovery Service)

>> Services: potentially dangerous service allowed: TlntSvr (Telnet)

>> Services: potentially dangerous service allowed: Schedule (Task Scheduler)

>> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting Remote Desktop Sharing)

>> Services: potentially dangerous service allowed: RDSessMgr (Remote Desktop Help Session Manager)

> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!

>> Security: disk drives' autorun is enabled

>> Security: administrative shares (C$, D$ ...) are enabled

>> Security: anonymous user access is enabled

Checking - complete

9. Troubleshooting wizard

Checking - complete

Files scanned: 317, extracted from archives: 0, malicious software found 0, suspicions - 0

Scanning finished at 2009-03-10 12:13:43 AM

Time of scanning: 00:00:20

If you have a suspicion on presence of viruses or questions on the suspected objects,

gumgone · March 10, 2009

ComboFix 09-03-06.02 - King 2009-03-10 1:52:03.1 - NTFSx86 NETWORK

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2526.2248 [GMT -4:00]

Running from: c:\documents and settings\King.MASTER\Desktop\ComboFix2.exe

AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated)

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Documents

c:\windows\a3kebook.ini

c:\windows\akebook.ini

c:\windows\ANS2000.INI

c:\windows\system32\asolatoh.ini

c:\windows\system32\CMVwaJjl.ini

c:\windows\system32\drivers\UACisimvxke.sys

c:\windows\system32\gqcdxadn.dll

c:\windows\system32\ibobeliz.ini

c:\windows\system32\kmd.exe

c:\windows\system32\lydnaoen.dll

c:\windows\system32\twain32

c:\windows\system32\twain32\local.ds

c:\windows\system32\twain32\user.ds

c:\windows\system32\twex.exe

c:\windows\system32\UACdbipvxwo.dll

c:\windows\system32\UACeewipjlk.log

c:\windows\system32\UACerfldyvi.log

c:\windows\system32\uacinit.dll

c:\windows\system32\UACjimlysdf.dat

c:\windows\system32\UACnycyeyik.dll

c:\windows\system32\UACqlokrgbo.log

c:\windows\system32\UACqquxiuxn.dll

c:\windows\system32\UACrornoaal.dll

c:\windows\system32\UACsr.dat

c:\windows\system32\ufigivas.ini

c:\windows\system32\uvasahed.ini

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_UACd.sys

-------\Legacy_OREANS32

-------\Service_oreans32

((((((((((((((((((((((((( Files Created from 2009-02-10 to 2009-03-10 )))))))))))))))))))))))))))))))

.

2009-03-10 00:13 . 2009-03-10 00:13 11,264 --a------ c:\windows\system32\drivers\uzy3nzy2.sys

2009-03-09 15:19 . 2009-03-09 15:19 <DIR> d-------- C:\VundoFix Backups

2009-03-02 07:17 . 2009-03-02 07:17 <DIR> d-------- c:\windows\ERUNT

2009-02-28 14:36 . 2009-02-28 14:36 81,408 --a------ c:\windows\system32\UACevdcikuo.dll

2009-02-25 21:14 . 2009-02-25 21:14 <DIR> d-------- c:\program files\FileZilla FTP Client

2009-02-22 03:30 . 2009-02-22 03:30 <DIR> d-------- c:\windows\Nextgen Server Client

2009-02-22 03:30 . 2009-02-22 03:30 <DIR> d-------- c:\program files\jic technology

2009-02-22 03:30 . 2009-02-22 03:30 33,952 --a------ c:\windows\system32\drivers\oreans32.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-03-10 03:55 --------- d-----w c:\program files\Spybot - Search & Destroy

2009-03-10 03:55 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-03-09 23:16 --------- d-----w c:\program files\Mozilla Thunderbird

2009-03-09 23:03 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-03-09 18:48 --------- d-----w c:\documents and settings\All Users\Application Data\PrevxCSI

2009-03-09 18:00 --------- d-----w c:\documents and settings\King.MASTER\Application Data\FileZilla

2009-03-01 17:09 --------- d-----w c:\program files\Google

2009-02-28 18:36 --------- d-----w c:\documents and settings\King.MASTER\Application Data\Azureus

2009-02-18 21:41 --------- d-----w c:\documents and settings\King.MASTER\Application Data\gtk-2.0

2009-02-03 05:40 --------- d-----w c:\documents and settings\King.MASTER\Application Data\dvdcss

2009-01-24 07:20 --------- d-----w c:\program files\Common Files\Adobe

2009-01-19 03:55 --------- d-----w c:\documents and settings\King.MASTER\Application Data\Safer Networking

2009-01-17 08:32 --------- d-----w c:\documents and settings\King.MASTER\Application Data\R-Wipe&Clean

2009-01-12 12:39 --------- d-----w c:\program files\Affiliate Elite

2009-01-12 12:36 --------- d-----w c:\program files\ClickbankElite

2009-01-12 11:28 --------- d-----w c:\program files\FileZilla FTP Client(2)

2009-01-12 11:28 --------- d-----w c:\documents and settings\All Users\Application Data\R-Wipe&Clean

2009-01-12 11:27 --------- d-----w c:\program files\CCleaner

2007-03-07 00:49 774,144 ------w c:\program files\RngInterstitial.dll

2005-09-10 00:55 35 ------w c:\program files\SCSSDist.ini

2007-01-23 19:07 1,847,296 -c----w c:\program files\mozilla firefox\plugins\Seadragon.dll

2008-09-30 00:20 71,680 --sha-w c:\windows\system32\yonetaso.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-01-24 7311360]

"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"WUAppSetup"="c:\program files\Common Files\logishrd\WUApp32.exe" [2007-02-03 430080]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"SENTINEL"= snti386.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS\0lsdelete

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

R1 uzy3nzy2;AVZ-RK Kernel Driver;c:\windows\system32\drivers\uzy3nzy2.sys [2009-03-10 11264]

S2 trackcam;TrackerCam Video Capture Driver;c:\windows\system32\drivers\trackcam.sys [2008-01-13 70060]

.

Contents of the 'Scheduled Tasks' folder

2009-03-09 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-03-01 c:\windows\Tasks\GBM - New Backup Job 01-Full.job

- c:\program files\Genie-Soft\GBMPro8\GBM8.exe []

2009-03-04 c:\windows\Tasks\GBM - New Backup Job-Full.job

- c:\program files\Genie-Soft\GBMPro8\GBM8.exe []

2009-03-10 c:\windows\Tasks\GoogleUpdateTaskMachine.job

- c:\program files\Google\Update\GoogleUpdate.exe []

2009-03-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1417001333-412668190-682003330-1003.job

- c:\documents and settings\King.MASTER\Local Settings\Application Data\Google\Update\GoogleUpdate.exe []

2009-03-10 c:\windows\Tasks\RegCure Program Check.job

- c:\program files\RegCure\RegCure.exe [2008-06-09 16:45]

2009-02-26 c:\windows\Tasks\RegCure.job

- c:\program files\RegCure\RegCure.exe [2008-06-09 16:45]

2009-03-09 c:\windows\Tasks\User_Feed_Synchronization-{7C95983F-C6C4-464F-AAC5-10A68EABFE8A}.job

- c:\windows\system32\msfeedssync.exe [2007-08-13 19:36]

.

- - - - ORPHANS REMOVED - - - -

Notify-rqRjJyyx - rqRjJyyx.dll

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

FF - ProfilePath - c:\documents and settings\King.MASTER\Application Data\Mozilla\Firefox\Profiles\iucdzqle.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/

FF - prefs.js: network.proxy.type - 4

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\nppsynth.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-10 01:57:46

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1417001333-412668190-682003330-1003\Software\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]

"ThreadingModel"="Apartment"