Trojan.Fakealert.12403.origin

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winav.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\neowatchlog.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netarmor.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netd32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netinfo.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netmon.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netscanpro.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netspyhunter-1.2.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netutils.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npssvc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\neomonitor.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ndd32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\normist.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\norton_internet_secu_3.0_407.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notstart.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npf40_tw_98_nt_me_2k.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfmessenger.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nprotect.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npscheck.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nisserv.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nmain.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msdm.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nisum.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\n32scanw.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec16.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mslaugh.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmgt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmsgri32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mssmmc32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mssys.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvxd.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mu0311ad.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navwnt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ncinst4.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nc2000.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navap.navapsvc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapsvc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapw32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navdx.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navlu32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navnt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navstub.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mwatch.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nav.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msdos.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nsched32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavproxy.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavsched.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavw.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccwin98.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcfwallicon.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcip10117_0.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcscan.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pdsetup.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\patch.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavcl.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\periscope.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pf2.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pfwadmin.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pgmonitr.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pingscan.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\platin.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pop3trap.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\poproxy.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\popscan.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\persfw.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perswf.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nstask32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nssys32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpostproinstall.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntrtscan.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntvdm.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntxconfig.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nui.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nupgrade.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvarch16.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvc95.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\padmin.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nsupdate.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\panixk.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvsvc32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ollydbg.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onsrvr.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\optimize.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ostronet.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\otfix.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpost.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpostinstall.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwinst4.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwservice.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwtool16.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portmonitor.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portdetective.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscache.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\inetlnfo.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\infus.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\infwin.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\init.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\intdel.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\intren.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iomon98.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iedriver.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iedll.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ifw2000.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\istsvc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavlite40eng.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavpers40eng.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavpf.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kazza.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\keenvalue.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kerio-pf-213-en-win.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kerio-wrl-421-en-win.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jammer.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jdbgmrg.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jedi.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iface.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kerio-wrp-421-en-win.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msccn32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hbinst.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hbsrv.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hotactio.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hotpatch.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\htlog.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\htpatch.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hwpe.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\idle.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guarddog.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsuppnt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hxdl.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamstats.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ibmasn.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ibmavsp.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icload95.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icloadnt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icmon.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsupp95.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hxiul.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamapp.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamserv.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscman.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\killprocesssetup161.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldpromenu.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfw2en.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfweng3.02d30.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mgavrtcl.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mgavrte.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mghtml.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mgui.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minilog.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsshld.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsrte.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mfin32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmod.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpfagent.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpfservice.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpftray.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mrflux.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msapp.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msbb.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msblast.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monitor.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\moolive.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mostat.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\md.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\launcher.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldnetmon.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldscan.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lnetinfo.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loader.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\localnet.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lockdown.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lockdown2000.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lookout.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcupdate.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldpro.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mctool.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lordpe.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lucomserver.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luinit.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luspt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mapisvc32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcagent.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmnhdlr.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsetup.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luall.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luau.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcsysmon.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerscan.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnlan300.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpc32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpc42.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpfw30s.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vptray.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscan40.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscenu6.02d30.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsched.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\virusmdpersonalfirewall.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vir-help.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vnpc3000.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsecomr.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmon.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsstat.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswin9xe.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswinntse.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vswinperse.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\w32dsm89.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\w9x.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vshwin32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsisetup.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmain.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webdav.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\watchdog.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\titanin.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trjscan.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trjsetup.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trojantrap3.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tsadbot.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tvmd.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tvtmd.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\undoboot.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vfsetup.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\titaninxp.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vettray.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updat.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcons.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbust.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbwin9x.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbwinntw.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsetup.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet95.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\upgrad.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utpost.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcmserv.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trickler.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webtrap.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wimmun32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsbgate.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wupdater.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wupdt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wyvernworksfirewall.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpf202en.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapro.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapsetup3001.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zatutor.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wrctrl.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonealarm.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\b.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\c.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\d.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brw.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msa.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonalm2601.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webscanx.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wradmin.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnad.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wfindv32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-bugsfix.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win32us.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winactive.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\window.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wkufind.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wininetd.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\whoswatchingme.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winupdate.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogin.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winrecon.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winservn.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winssk32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winstart.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winstart001.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wintsk32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wininitx.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tgbob.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmain.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winppr32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tfak5.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tfak.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rescue32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rrguard.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rshell.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rtvscan.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rtvscn95.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rulaunch.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeweb.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reged.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sahagent.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\realmon.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rb32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scam32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan95.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpm.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scrscan.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\serv95.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup_flowprotector_us.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\savenow.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setupvameeval.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sbserv.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pptbc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\purge.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prizesurfer.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prmt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prmvr.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procdump.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\processmonitor.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexplorerv1.0.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\programauditor.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rcsync.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\proport.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sh.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppvstop.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qconsole.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qserver.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rapapp.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav7.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav7win.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rav8win32eng.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ray.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectx.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sgssfw32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pspf.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rescue.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shellspyinstall.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchostc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svshost.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweep95.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweepnet.sweepsrv.sys.swnetsup.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symproxysvc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symtray.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\supporter5.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\system32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stcloader.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchosts.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taumon.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tca.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcm.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds-3.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-98.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-nt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\teekids.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysupd.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\support.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbscan.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\supftrl.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shn.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sms.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smss32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\soap.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sofi.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sperm.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spf.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sphinx.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoler.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\showbehind.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolcv.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spyxx.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srexe.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srng.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ss3edit.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssg_4104.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssgrate.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\st2.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\start.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guard.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hacktracersetup.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gmt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\generics.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gbpoll.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsctool.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rscdwld.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\licmgr.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardgui.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fact.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwsc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avupgsvc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashWebSv.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswUpdSv.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashMaiSv.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnotify.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avmailc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWEBGRD.EXE] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oaview.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OAReg.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oasrv.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OAhlp.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OAcat.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avmcdlg.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avadmin.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfpupdat.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oaui.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfpconfg.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cssurf.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfp.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VisthUpd.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VisthLic.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VisthAux.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswRunDll.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswRegSvr.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashAvast.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cavscan.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashBug.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswChLic.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashSimpl.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashSimp2.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashQuick.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashPopWz.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashLogV.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashCnsnt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashChest.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashUpd.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashSkPck.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashSkPcc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscfxav.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ODSW.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcmgr.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgdumpx.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgchk.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnsx.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcsrvx.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PsImSvc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgsrmax.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgupd.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgiproxy.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavprsrv.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavsrv51.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PskSvc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TPSrv.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WebProxy.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PsCtrls.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McSACore.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmscsvc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PavFnSvr.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avciman.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVENGINE.EXE] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgscanx.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscfxas.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiscan.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\JsRcGen.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\History.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdwizreg.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdtkexec.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDSurvey.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdreinit.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDInProcPatch.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fixcfg.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\signcheck.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fixfp.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\About.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seccenter.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\livesrv.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSANToManager.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSANCU.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bspatch.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSANHost.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSUNMain.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\upgrepl.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdsubwiz.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfplogvw.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\crashrep.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcnasvc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PC_Antispyware2010.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartprotector.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windll32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\homeav2010.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntiVirus_Pro.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Cl.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MalwareRemoval.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Quick Heal.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrustWarrior.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\av360.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveDefense.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tsc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsSvc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsGui.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsAuxs.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsTray.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Anti-Virus Professional.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spywarexpguard.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Security Center.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveKeep.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\~1.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusXP] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\init32.exe ] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirusxppro2009.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agent.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tapinstall.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pav.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PerAvir.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\~2.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SoftSafeness.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusXP.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dop.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpdeluxe.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smart.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smrtdefp.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\W3asbas.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protector.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frmwrk32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gav.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qh.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ozn695m5.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[5].exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mrt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscfxfw.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shield.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Identity.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleanIELow.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[4].exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[2].exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDMsnScan.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setloadorder.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\driverctrl.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deloeminfs.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Arrakis3.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEShow.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cssupdat.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cssconfg.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdfvwiz.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdfvcl.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snetcfg.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[3].exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[1].exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Save.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\securitysoldier.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secureveteran.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Secure Veteran.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveArmor.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QuickHealCleaner.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pdfndr.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SafetyKeeper.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gbn976rl.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\personalguard.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityFighter.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\personalguard] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rwg.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rwg] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows Police Pro.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntispywarXP2009.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xp_antispyware.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brastk.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPro_2010.exe] 'Debugger' = 'svchost.exe'
[\REGISTRY\USER\S-1-5-21-1238866942-1249195528-555854008-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'My Security Engine' = '"C:\ProgramData\847d0\MS471.exe" /s /d'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppinupdt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcproxy.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AluSchedulerSvc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpfnt206.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctrl.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cv.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cwnb181.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cwntdwmo.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\datemanager.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dcomx.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drwatson.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\connectionmonitor.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpf9x206.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\defwatch.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\divx.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dllcache.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dllreg.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\doors.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpf.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpfsetup.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpps2.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\defalert.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bs120.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deputy.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drweb32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpd.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmon016.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccapp.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccevtmgr.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccpxysvc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cdp.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfd.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfgwiz.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfiadmin.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmesys.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmgrdian.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\defscangui.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfinet32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\claw95cf.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clean.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleaner.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleaner3.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleanpc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\click.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfiaudit.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfinet.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\claw95.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bvt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dssagent.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ecengine.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firewall.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fnrb32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fp-win.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fp-win_trial.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fprot.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frw.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsaa.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fch32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\findviru.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav530stbyb.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav95.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsgk32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsm32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsma32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsmb32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gator.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gbmenu.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashServ.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav530wtbyb.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dvp95_0.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fih32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fast.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\efpeadm.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\emsw.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ent.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esafe.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanhnt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanv95.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fameh32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dvp95.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\espwatch.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drwebupw.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\evpn.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\exe.avxw.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\expert.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explore.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-agnt95.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-prot.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-prot95.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ethereal.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\etrustcipe.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-stopw.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\exantivirus-cnet.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bundle.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brasil.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bpc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\amon9x.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\anti-trojan.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirus.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ants.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apimonitor.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aplica32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apvxdwin.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alertsvc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentw.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alogserv.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arr.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atupdater.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atwatch.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\au.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aupdate.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto-protect.nav80try.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autodown.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autotrace.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atcon.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atguard.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atro55en.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alevir.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoupdate.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconsol.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgtray.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgemc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgui.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdmcon.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentsvr.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshell.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\advxdwin.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpcc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpm.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aAvgApi.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ackwin32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adaware.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashDisp.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ad-Aware.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ave32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwupsrv.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxquar.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\backweb.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bargains.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bd_professional.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beagle.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\belt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwupd32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwinnt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bidef.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxmonitornt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bipcpevalsetup.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blackd.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blackice.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blink.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blss.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bootconf.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bootwarn.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bidserver.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bipcp.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\borg2.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bisp.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxmonitor9x.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwupd.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwin95.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv9.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgw.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkpop.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkserv.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkservice.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkwctl9.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgctrl.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avltmain.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpcc.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpdos32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpm.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avptc32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpupd.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsched32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsynmgr.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwin.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnt.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcc32.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPFSrv.exe] 'Debugger' = 'svchost.exe'
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = 'svchost.exe'

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

Modifies settings of Windows Internet Explorer

[\REGISTRY\USER\S-1-5-21-1238866942-1249195528-555854008-1000\Software\Microsoft\Internet Explorer\Download] 'CheckExeSignatures' = 'no'
[\REGISTRY\USER\S-1-5-21-1238866942-1249195528-555854008-1000\Software\Microsoft\Internet Explorer\Download] 'RunInvalidSignatures' = '00000001'

Modifies file system

Creates the following files

D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\2d657128d83916c0bbfba3bc534493792cc45d71
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\94725ff9fdd0c5dab5b9c97afc327d4639b0284a
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\3ef4c830618c1ac1f052a7fbfeda72562b22cc75
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\d9c6aa59ea7d8b2a3c2a48f280106bcb8a099b77
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\9677086b2e58e223f0d97a570cc20dc20d645470
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\1c3c1ac31c2dd44a03ed7972a671b4e6adb4b161
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\49772358f4de34914803bc63fb7be9acf152ef4d
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\f9a282e207ca2dbd34ad022913a62d0889ac1c00
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\9942fa50700ae581e74b1ef8375742a1de099c2f
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\8556d606fd4bee6a330786f0d13730034c943691
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\f55a60e9f1f8dd35b32ea0a75c5d3cf3134eadee
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\42c578c60b0903411b144f4fe8f0ac15970ba12d
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\975e46e7351b1ee87766961010b1ce54a7e4c8f4
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\555a30c7d621272ee74028365657a74c84f34f1a
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\406421ee1ea3752de381837216a1d0ef0c69fdc3
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\479a9c134706bbbd248f73fc995af3aa265cfc1c
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\6bcfeb3762e112d2542e34a8f05f88a9e4e3fb85
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\df97e7919c55c5d67a31234c6d0022d69ec4e38a
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\cc7809cafbb8c1bee3e1812765fb41d5abc15257
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\c74766ed8982122a06543b474eecf97518f25a17
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\4f3ba046fa4a5bbbc7c850fa07bc8c22f2a14169
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\7102b8e96aa0b61615cfde56763a9ed9b983730a
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\d916403bf73b2f44bf3984b29497aee338068070
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\7d6a12780c1b00a95daa5184dd5e28d24eb1c81d
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\cd391c3709e90f61d7015d22b6ceac7c53bb9c61
D:\windows\serviceprofiles\localservice\ntuser.dat.log1
D:\windows\serviceprofiles\localservice\ntuser.dat
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\8f89f6c04e036909d7fc0f3b22b11caa186992b9
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\87d1e6d2669dbd20c5597f69dadcd3b6066389c2
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\4f0bcc58ae7c662aa8ce337b597266047814b836
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\c2dba39d1f0eff429f004c7ef05413224f92fea8
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\f0e149df5daf99f2e97f63398ed388d61977c530
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\aac5cd3560f3ef36dd96fd63e0b5af18b1f5453a
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\a004dd1a66193831172254a071b5991f6cb482c6
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\0304d734f8f502eb66ef453a17cb9f5b8c43b8b7
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\491ea7e19bb3a36649ff998f8c9954f49342a8b5
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\3b88c79e6ee15f52a2f4b58e24a752a37f3d5909
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\8e637e4b349c09ac5ab9b264b3d5bcc040131f71
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\077083ec3293e9ed7f1e29eb300de3dc579017ec
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\d24635f6a59762e918df89d6f4589f6fac3fda86
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\03a3284413e76ab9ef6155914780932b53a25664
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\ea96e609b604de6e32802827736e4e3fbf8968e1
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\026a91c419276cf4863cd88d801b264a6313a475
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\d02765262ff82856f6b6d6bfe3a3c0adfde1f378
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\8bef30daf9e2434eed4b7575bcd80c38a5a19d6a
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\4b90ddaeeeea60534fa3d5f56046728fba5f4989
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\f84b6a34b56cec15c1942664ffab6b65e0d2588f
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\d54da76e598693fed6a7f29197ea9cfafc48c386
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\74faa831a5ad1348de267780d4c0c2f10cbbec39
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\2cb84dd9abb4e1485d83397c59b193094e1abfc7
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\54dc5dc926acfd0f0401949db5cbca5383cb6b77
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\db022c3d5e65699f640d8dea20ee25904d318c2e
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\9bcb0efbbfb5cb5c4bae2f361169e07b5604f4d8
D:\windows\system32\winevt\logs\microsoft-windows-windows firewall with advanced security%4firewall.evtx
D:\users\user\appdata\local\temp\mz_etilqs_rbctanwoma8ilbs
D:\windows\system32\config\default.log1
D:\windows\system32\config\default
D:\windows\serviceprofiles\localservice\appdata\local\lastalive0.dat
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\8d14b7d0efc523b59e3933e14fe44fb72beca8df
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\8221a41daafa532836d3e8eded1aac94d3955d16
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\136a8bd8034c58767248fd9fc2ad68acdd18e0e8
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\a2917ec14a390ebf8c127f40bed1c8139e236dad
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\7e1bdf2c04b6bb8e6516a288be95b19b21d7828a
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\428ce5f79975b5b9386d888b4ccf43c454026772
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\8eea81d3add1db638dd9873efefe50f2c1801c76
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\814c06500f01028c31a455285e090f30795a42b9
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\9fad54a82fe60014d7bb27e2d093f77fcd0c58e7
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\f17b756097ea7730cd30b737575e8e035771440d
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\748a6d21cae584312dd1c1370afea70b0f7dda50
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\a83086528d2c610b97ace39364df9611a9cd75c1
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\ff9cb2bce37ded64cf411113359886d2315b4912
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\5900ec362904c1176f9e26c94e22abd34b7ac911
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\7589846a4928998b49801c20a83de33e66e13f8f
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\2895d329d9cde4eec4507c923e0791bb67db775c
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\da05386b718d82b4f8c10ca4eff547b6865c3743
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\b9733f3de80e43d56dfe3dc1fe77a9ef8264df49
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\8bf87bb7e13934f2648153f6f818cd2f93455f69
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\7150f4ebaff6a9b3313a4538c93d17f0cc4d4995
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\1c071bef2bb8dc67ce789498a903116ea0c85f0a
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\5dc222a516928643f8ed46f83a0a0e72c9bcc556
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\cf675741c1efec8a3183da1a78119c33fc10872a
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\e6f507dcb03a19f901b0794b38bc9db8454fe79b
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\f70b0a6296a37fc9a0471f764ec3d75240edd0a8
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\6c2bc1be899fe3232ad7db3e11e6407b224d7193
D:\system volume information\syscache.hve
D:\users\user\appdata\local\temp\mz_etilqs_lwqiecnuzzmnlxe
D:\cbjytu\msesys\vd952342.bd
D:\windows\system32\winevt\logs\system.evtx
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\cf462cc01526cf7bccc759acb08bff8803c0f8af
D:\users\user\appdata\local\temp\mz_etilqs_q8ianhgih7q3m63
D:\windows\system32\winevt\logs\security.evtx
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\7330b218fe46e63c30e077c3456a7239baaead12
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\9c571ec4d1abdf04dec3542cba1cbcdb49632bf7
D:\cbjytu\212.mof
D:\windows\appcompat\programs\recentfilecache.bcf
D:\programdata\847d0\ms471.exe
D:\users\user\appdata\roaming\my security engine\cookies.sqlite
D:\programdata\847d0\mse.ico
D:\users\user\desktop\my security engine.lnk
D:\users\user\appdata\local\temp\tmp5772.tmp
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\82c47fa9f5f29d08908329a836215460fd85b37b
D:\users\user\appdata\roaming\microsoft\windows\start menu\my security engine.lnk
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\a4bc0c99327d7691ff360f07d11373b5791eb30c
D:\users\user\appdata\local\temp\mz_etilqs_ejammxrxhn5tgut
D:\users\user\appdata\local\temp\mz_etilqs_0ymhiy3q5owjouo
D:\windows\system32\config\software.log1
D:\windows\system32\config\software
D:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat
D:\users\user\ntuser.dat.log1
D:\users\user\ntuser.dat
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\c7511574f457706090c16c56692a1597f9a22001
D:\windows\system32\config\system.log1
D:\windows\system32\config\system
D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\security_state\data.safe.bin
D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\prefs-1.js
D:\programdata\msfquue\mszbvqwe.cfg
D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
D:\users\user\appdata\local\microsoft\windows\usrclass.dat
D:\windows\system32\drivers\etc\host_new
D:\windows\system32\drivers\etc\hosts
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\65db52aa6a12055838112339b1c889b94154f13e
D:\users\user\appdata\roaming\microsoft\windows\start menu\programs\my security engine.lnk
D:\system volume information\syscache.hve.log1
D:\users\user\appdata\roaming\microsoft\internet explorer\quick launch\my security engine.lnk
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\d3897e1aeb68b637239f51d510d9f0e547a752f3
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\ebeab025b0308b792390d53e5bb2ea000d45ffc4
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\9338d221555577260fe668825c60607d85b5b50c
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\d164ebeef07d07ef62bb403ea63bb41075917df8
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\b60f64a467387dbca8a2c834bf8dd0a2f3db0623
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\e4195ef44145edd38853746b3b84b5cb6f4ad6bc
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\23ec873489c253cc38cc03b2695bc5edd8cad481
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\c8aed7b2ba33413bf011db2be8b36010bd5793d5
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\85506f5811d7104eab8ad6163a2590d93bca8aa6
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\7741f7d6c5a3e6680e2e4ab709f127b5c69bf74c
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\dfa441eea97eba0776b70bd50601710784381077
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\1b5b802b1f1d46de3eb57f66d684ba8e2c3228aa
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\bbb7be9b0813fc5104564e06aaf91fa9a955d1c8
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\b188f38156da1917f8c1ee84d678df33eee49b85
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\225db6d136144102bebf8d999082d58148570b22
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\563bf5fb0d494eeb84d971252fd3795b7eb49517
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\177318bf68581524b09134a56a71ba2e6b735c8f
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\4c262fdc61476fa94912a4b3a0750f7019e47c56
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\62b4b79945a87d58d04594ca01c2114858efafe1
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\6e225fbe1582d91b9e1d01b495fdb90e803a5ae0
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\390236572d27e57fb8230ad78178e8560d490c44
D:\cbjytu\615612.reg
D:\users\user\desktop\computer.lnk
D:\windows\system32\wbem\repository\objects.data
D:\windows\system32\wbem\repository\index.btr
D:\windows\system32\wbem\repository\mapping3.map
D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\dfdc36497a0baee2972009ee6deccc06c2e352c6
D:\windows\system32\winevt\logs\application.evtx
D:\programdata\microsoft\search\data\applications\windows\gatherlogs\systemindex\systemindex.3.gthr
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\3abe6035282cf9d17dcb0d733614aca8c2c8cf59
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\bc9a334d14ae8d5cdcf1f5f5128ba1f4cdd083ac
D:\windows\serviceprofiles\networkservice\ntuser.dat
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\39d80535a21e286b3c662765c5f09aceb927e77d
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\f8cbd54dda10f4286a41ec6a537240712d6c2308
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\doomed\4177
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\doomed\30189
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\4ba6c7704e34257e6a157a59db1dd0041e51ea3e
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\69049b2b6c981f970b8f4e0b35d061d198727ad5
D:\cbjytu\mcp.ico
D:\windows\serviceprofiles\networkservice\ntuser.dat.log1
D:\programdata\microsoft\search\data\applications\windows\gatherlogs\systemindex\systemindex.3.crwl

Sets the 'hidden' attribute to the following files

D:\programdata\msfquue\mszbvqwe.cfg
D:\windows\system32\drivers\etc\hosts

Deletes the following files

D:\windows\system32\drivers\etc\host_new
D:\windows\system32\drivers\etc\hosts
D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
D:\users\user\appdata\local\temp\tmp5772.tmp

Moves the following files

from D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\prefs-1.js to D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\prefs.js
from D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\f8cbd54dda10f4286a41ec6a537240712d6c2308 to D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\doomed\4177

Substitutes the following files

D:\windows\system32\drivers\etc\host_new
D:\windows\system32\drivers\etc\hosts
D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\prefs-1.js
D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\prefs.js
D:\users\user\appdata\local\mozilla\firefox\profiles\0j9e9tku.default-release\cache2\entries\f8cbd54dda10f4286a41ec6a537240712d6c2308

Network activity

Connects to

'co########gnature-2.cdn.mozilla.net':443
'pr##.###########nature-chains.prod.webservices.mozgcp.net':443
'17#.#32.149.92':80
'fi###########ngs-attachments.cdn.mozilla.net':443
'localhost':27777

TCP

HTTP GET requests

http://17#.#32.149.92/chrome/report.html?ui########################################################################
http://12#.#.0.1:27777/?te#########

Other

'localhost':49158
'co########gnature-2.cdn.mozilla.net':443
'fi#####.###tings.services.mozilla.com':443
'fi###########ngs-attachments.cdn.mozilla.net':443

UDP

DNS ASK co########gnature-2.cdn.mozilla.net
DNS ASK pr##.###########nature-chains.prod.webservices.mozgcp.net
DNS ASK fi#####.###tings.services.mozilla.com
DNS ASK se#####.cleanpayzone.com
DNS ASK se#####.cleanpayzone.net
DNS ASK re####.goodguardz.com
DNS ASK ww##.###security-engine.net
DNS ASK up#####.safelinkhere.net
DNS ASK re####.#and-protection.net
DNS ASK fi###########ngs-attachments.cdn.mozilla.net
DNS ASK fe########alog-cdn.prod.mozaws.net

Miscellaneous

Searches for the following windows

ClassName: 'SystemTray_Main' WindowName: ''
ClassName: 'TMainWindowMSE' WindowName: ''
ClassName: '' WindowName: ''

Creates and executes the following

'D:\windows\syswow64\taskkill.exe' /F /IM MSASCui* /IM avg* /IM ash* /IM McSA*' (with hidden window)
'D:\windows\syswow64\wbem\mofcomp.exe' "<Current directory>\212.mof"' (with hidden window)
'D:\windows\syswow64\netsh.exe' "firewall" add allowedprogram "<Full path to file>" "My Security Engine" ENABLE' (with hidden window)

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial