tietojen suorittamisen estäminen - microsoft windows

Viestiketju Virukset ja haittaohjelmat - HijackThis -logit -osiossa. Ketjun avasi pepe1111 09.02.2009.

  1. pepe1111

    pepe1111 Regular member

    Liittynyt:
    12.08.2006
    Viestejä:
    112
    Kiitokset:
    0
    Pisteet:
    26
    mulla on xp ja aina koneen käynnistyessä tulee ilmoitus:

    tietojen suorittamisen estäminen
    tietokoneesi suojaamiseksi windows on sulkenut tämän ohjelman
    resurssienhallinta

    ja samalla aukeaa 2 explorer sivuu

    oon skannannu nortonilla mutta ei lähteny sillä pois

    voisko joku auttaa?????
     
    pepe1111, 09.02.2009
    #1
  2.  
  3. somebodyy

    somebodyy Regular member

    Liittynyt:
    15.07.2007
    Viestejä:
    1,063
    Kiitokset:
    0
    Pisteet:
    46
    Jos luulet että virus; ota hjt -logi ja postaa sille kuuluvalle alueelle.
     
    somebodyy, 10.02.2009
    #2
  4. pepe1111

    pepe1111 Regular member

    Liittynyt:
    12.08.2006
    Viestejä:
    112
    Kiitokset:
    0
    Pisteet:
    26
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:33:48, on 11.2.2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\spoolsv.exe
    c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
    C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\DOCUME~1\oma\LOCALS~1\Temp\RtkBtMnt.exe
    C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
    C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
    C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
    C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\WINDOWS\system32\wbem\unsecapp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\sysmgr.exe
    C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe
    C:\Documents and Settings\All Users\Application Data\Macrovision\FLEXnet Connect\6\ISUSPM.exe
    C:\WINDOWS\System\update.exe
    C:\windows\system\Update.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\windows\system\Update.exe
    C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\WINDOWS\system32\igfxext.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ycomp/defaults/sp/*http://uk.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://fi.intl.acer.yahoo.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,"C:\WINDOWS\server.exe",
    O1 - Hosts: 200.124.131.116 casinocontroller.com
    O1 - Hosts: 200.124.131.116 casinocontroller.com
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\coIEPlg.dll
    O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
    O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
    O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
    O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
    O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
    O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
    O4 - HKLM\..\Run: [Windows Updates] c:\windows\system\Update.exe
    O4 - HKLM\..\Run: [Windows Updates] update.exe
    O4 - HKLM\..\Run: [System Service Manager] sysmgr.exe
    O4 - HKLM\..\RunServices: [Windows Updates] update.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe"
    O4 - HKCU\..\Run: [VMCL] C:\Program Files\vodafone\vmclite\DongleEnumerator.exe
    O4 - HKCU\..\Run: [System] C:\Program Files\Internet Explorer\IEXPLORE.EXE
    O4 - HKCU\..\Run: [Windows Updates] c:\windows\system\Update.exe
    O4 - HKCU\..\Run: [ISUSPM] "C:\Documents and Settings\All Users\Application Data\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
    O4 - HKCU\..\Run: [updates] C:\WINDOWS\server.exe
    O4 - HKCU\..\Policies\Explorer\Run: [server] C:\Program Files\Internet Explorer\IEXPLORE.EXE
    O4 - HKCU\..\Policies\Explorer\Run: [updates.w] C:\WINDOWS\server.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Acer Empowering Technology.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
    O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {3B36B017-7E49-426B-95B0-B5CECD83C2E2} (IfolorUploader Control) - http://fika-web.ifolor.net/OrderingGeneral/LowRes/app_support/ActiveX/IfolorUploader_fika.cab
    O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD5/JS...f/&filename=jinstall-6u11-windows-i586-jc.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://casinoclassic.microgaming.com/casinoclassic/FlashAX2.cab
    O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
    O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
    O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
    O23 - Service: Symantec AppCore Service (SymAppCore) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe (file missing)

    --
    End of file - 13470 bytes
     
    pepe1111, 11.02.2009
    #3
  5. Hujo

    Hujo Guest

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
     
    Hujo, 11.02.2009
    #4
  6. pepe1111

    pepe1111 Regular member

    Liittynyt:
    12.08.2006
    Viestejä:
    112
    Kiitokset:
    0
    Pisteet:
    26
    äijä on kone! kiitti paljon, pelittää taas normisti


    SDFix: Version 1.240
    Run by oma on to 12.02.2009 at 17:30

    Microsoft Windows XP [versio 5.1.2600]
    Running From: C:\Documents and Settings\oma\Ty”p”yt„\SDFix\SDFix

    Checking Services :


    Restoring Default Security Values
    Restoring Default Hosts File

    Rebooting


    Checking Files :

    Trojan Files Found:

    C:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\Taquito.exe - Deleted
    C:\WINDOWS\system\Update.exe - Deleted





    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-02-12 17:37:35
    Windows 5.1.2600 Service Pack 3 FAT NTAPI

    scanning hidden processes ...

    scanning hidden services ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0


    Remaining Services :




    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
    "C:\\Program Files\\KCeasy\\giFT\\giFTl.exe"="C:\\Program Files\\KCeasy\\giFT\\giFTl.exe:*:Enabled:giFT Loader for KCeasy"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"

    Remaining Files :


    File Backups: - C:\DOCUME~1\oma\Ty”p”yt„\SDFix\SDFix\backups\backups.zip

    Files with Hidden Attributes :

    Tue 27 Jan 2009 65,536 ..SHR --- "C:\WINDOWS\sysmgr.exe"
    Sat 5 Aug 2006 1,024 ...HR --- "C:\WINDOWS\system32\NTICDMK7.dll"
    Sat 5 Aug 2006 1,024 ...HR --- "C:\WINDOWS\system32\NTIMP3.dll"
    Sat 5 Aug 2006 1,024 ...HR --- "C:\WINDOWS\system32\NTIMPEG2.dll"
    Sat 5 Aug 2006 1,024 ...HR --- "C:\WINDOWS\system32\NTIFCD3.dll"
    Sat 5 Aug 2006 1,024 ...HR --- "C:\WINDOWS\system32\NTIBUN4.dll"
    Wed 9 May 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
    Thu 19 Apr 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
    Fri 18 Jan 2008 403 A..H. --- "C:\Program Files\Common Files\Symantec Shared\COH\COHDLU.reg"
    Fri 18 Jan 2008 400 A..H. --- "C:\Program Files\Common Files\Symantec Shared\COH\COH32LU.reg"

    Finished!



    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:44:42, on 12.2.2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\spoolsv.exe
    c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
    C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
    C:\DOCUME~1\oma\LOCALS~1\Temp\RtkBtMnt.exe
    C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
    C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\system32\wbem\unsecapp.exe
    C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
    C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe
    C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe
    C:\Documents and Settings\All Users\Application Data\Macrovision\FLEXnet Connect\6\ISUSPM.exe
    C:\WINDOWS\sysmgr.exe
    C:\WINDOWS\system32\igfxext.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ycomp/defaults/sp/*http://uk.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://fi.intl.acer.yahoo.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,"C:\WINDOWS\server.exe",
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\coIEPlg.dll
    O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [LaunchApp] Alaunch
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
    O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
    O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
    O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
    O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
    O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
    O4 - HKLM\..\Run: [Windows Updates] c:\windows\system\Update.exe
    O4 - HKLM\..\Run: [System Service Manager] sysmgr.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe"
    O4 - HKCU\..\Run: [VMCL] C:\Program Files\vodafone\vmclite\DongleEnumerator.exe
    O4 - HKCU\..\Run: [Windows Updates] c:\windows\system\Update.exe
    O4 - HKCU\..\Run: [ISUSPM] "C:\Documents and Settings\All Users\Application Data\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
    O4 - HKCU\..\Run: [updates] C:\WINDOWS\server.exe
    O4 - HKCU\..\Policies\Explorer\Run: [updates.w] C:\WINDOWS\server.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Acer Empowering Technology.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
    O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {3B36B017-7E49-426B-95B0-B5CECD83C2E2} (IfolorUploader Control) - http://fika-web.ifolor.net/OrderingGeneral/LowRes/app_support/ActiveX/IfolorUploader_fika.cab
    O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD5/JS...f/&filename=jinstall-6u11-windows-i586-jc.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} (Flash Casino Helper Object) - https://casinoclassic.microgaming.com/casinoclassic/FlashAX2.cab
    O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
    O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe
    O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
    O23 - Service: Symantec AppCore Service (SymAppCore) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe (file missing)

    --
    End of file - 12968 bytes
     
    pepe1111, 12.02.2009
    #5
  7. Hujo

    Hujo Guest

    scannaaa hjt:llä merkkaa paina Fix checked

    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [Windows Updates] c:\windows\system\Update.exe
    O4 - HKCU\..\Run: [Windows Updates] c:\windows\system\Update.exe
    O4 - HKCU\..\Run: [ISUSPM] "C:\Documents and Settings\All Users\Application Data\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
    O4 - HKCU\..\Run: [updates] C:\WINDOWS\server.exe
    O4 - HKCU\..\Policies\Explorer\Run: [updates.w] C:\WINDOWS\server.exe

    ===============

    sammuta käynnistä

    =============

    1.Lataa Combofix.exe työpöydällesi yhdestä linkistä:
    Combofix1
    Combofix2

    Älä asenna palautus consolia
    2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Hujo, 12.02.2009
    #6
  8. pepe1111

    pepe1111 Regular member

    Liittynyt:
    12.08.2006
    Viestejä:
    112
    Kiitokset:
    0
    Pisteet:
    26
    ComboFix 09-02-12.03 - oma 2009-02-13 12:11:23.1 - FAT32x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.358.1035.18.502.218 [GMT 2:00]
    Sijainti: c:\documents and settings\oma\Työpöytä\ComboFix.exe
    * Uusi palautuspiste luotu

    VAROITUS - PALAUTUSKONSOLIA EI OLE ASENNETTU !!
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\restore\S-1-5-21-1482476501-1644491937-682003330-1013
    c:\restore\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini
    c:\windows\server.exe

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-01-13 to 2009-02-13 )))))))))))))))))
    .

    2009-02-13 12:05 . 2009-02-13 12:05 <KANSIO> d-------- c:\windows\LastGood
    2009-02-13 12:05 . 2009-02-13 12:05 <KANSIO> d-------- c:\windows\E80F62FF5D3C4A1984099721F2928206.TMP
    2009-02-12 17:29 . 2009-02-12 17:29 579,072 --a------ c:\windows\system32\dllcache\user32.dll
    2009-02-12 17:27 . 2009-02-12 17:27 <KANSIO> d-------- c:\windows\ERUNT
    2009-02-11 11:32 . 2009-02-11 11:32 <KANSIO> d-------- c:\program files\Trend Micro
    2009-01-27 22:20 . 2009-01-27 22:22 65,536 -r-hs---- c:\windows\sysmgr.exe
    2009-01-27 08:51 . 2009-01-27 08:51 <KANSIO> d-------- c:\documents and settings\oma\Application Data\Macrovision
    2009-01-26 19:33 . 2009-01-26 19:33 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Macrovision
    2009-01-26 12:15 . 2009-01-26 12:15 <KANSIO> d-------- c:\program files\Vodafone
    2009-01-24 17:43 . 2009-01-24 17:43 <KANSIO> dr-hs---- C:\RESTORE
    2009-01-24 17:21 . 2009-01-24 17:21 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\NortonInstaller

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-01-26 10:16 1,755,374 ----a-w c:\windows\E220AutoRunLog.tmp
    2009-01-26 10:15 --------- d-----w c:\program files\Vodafone
    2008-12-21 19:49 410,984 ----a-w c:\windows\system32\deploytk.dll
    2008-12-13 06:37 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll
    2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
    2008-09-14 17:19 39,440 ----a-w c:\documents and settings\oma\Application Data\GDIPFONTCACHEV1.DAT
    2008-09-16 18:23 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Sivuhistoria\History.IE5\MSHist012008091620080917\index.dat
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    "OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2007-02-08 95800]
    "VMCL"="c:\program files\vodafone\vmclite\DongleEnumerator.exe" [2007-10-17 131072]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LaunchApp"="Alaunch" [X]
    "AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2006-07-19 53248]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-29 766041]
    "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
    "ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2006-05-15 45056]
    "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-09-15 455168]
    "eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2006-03-17 345088]
    "Acer ePresentation HPD"="c:\acer\Empowering Technology\ePresentation\ePresentation.exe" [2006-06-07 208896]
    "igfxtray"="c:\windows\system32\igfxtray.exe" [2006-06-13 94208]
    "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-06-13 77824]
    "igfxpers"="c:\windows\system32\igfxpers.exe" [2006-06-13 118784]
    "ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-07-12 438272]
    "Boot"="c:\acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 579584]
    "LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2006-07-14 471040]
    "eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 413696]
    "LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 488984]
    "LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 774168]
    "Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe" [2008-01-29 583048]
    "BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 c:\windows\system32\bthprops.cpl]
    "AGRSMMSG"="AGRSMMSG.exe" [2005-12-13 c:\windows\AGRSMMSG.exe]
    "RTHDCPL"="RTHDCPL.EXE" [2006-07-19 c:\windows\RTHDCPL.exe]
    "SkyTel"="SkyTel.EXE" [2006-07-19 c:\windows\SkyTel.exe]
    "System Service Manager"="sysmgr.exe" [2009-01-27 c:\windows\sysmgr.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

    c:\documents and settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
    Acer Empowering Technology.lnk - c:\acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2006-06-29 45056]
    Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624]

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
    "c:\\Program Files\\KCeasy\\giFT\\giFTl.exe"=

    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2007-04-02 99376]
    S2 Automaattinen LiveUpdate-ajastustoiminto;Automaattinen LiveUpdate-ajastustoiminto;c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe [2008-02-09 238968]
    S3 lv321av;Logitech USB PC Camera (VC0321);c:\windows\system32\drivers\lv321av.sys [2006-06-19 1097728]

    --- Muut muistissa olevat ajurit/palvelut ---

    *Deregistered* - NAVENG
    *Deregistered* - NAVEX15
    *Deregistered* - SPBBCDrv
    *Deregistered* - SRTSPX

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0174bc9c-c208-11dd-8915-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0174bc9d-c208-11dd-8915-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0174bc9f-c208-11dd-8915-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{046ca016-a59f-11dd-88f2-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{046ca017-a59f-11dd-88f2-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{046ca018-a59f-11dd-88f2-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09a6d7b8-b17f-11dd-88fe-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09a6d7b9-b17f-11dd-88fe-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0cb45708-e0ac-11dd-8945-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0cb45709-e0ac-11dd-8945-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0cb4570a-e0ac-11dd-8945-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0cb4570b-e0ac-11dd-8945-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0e1b3692-d1b2-11dd-892e-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0e1b3693-d1b2-11dd-892e-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0e1b3694-d1b2-11dd-892e-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0e1b3695-d1b2-11dd-892e-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11830f18-bafa-11dd-890b-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11830f19-bafa-11dd-890b-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11830f1a-bafa-11dd-890b-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11830f1b-bafa-11dd-890b-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11830f1c-bafa-11dd-890b-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11830f1d-bafa-11dd-890b-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11830f1e-bafa-11dd-890b-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{127f3ec7-df3c-11dd-8942-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{127f3ec8-df3c-11dd-8942-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{13dae106-a0dc-11dd-88e9-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1709fd72-9f37-11dd-88e7-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{19d576ca-b932-11dd-8909-0016369abaef}]
    \Shell\AutoRun\command - G:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1fa84f8e-be1c-11dd-890f-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{22f75d28-a347-11dd-88ed-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2c86e144-e021-11dd-8944-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2c86e145-e021-11dd-8944-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2c86e146-e021-11dd-8944-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2fcfe118-c685-11dc-86f6-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3072d300-d642-11dd-8935-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3072d301-d642-11dd-8935-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{30876046-e8a7-11dd-8950-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{30876047-e8a7-11dd-8950-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{30876048-e8a7-11dd-8950-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{30876049-e8a7-11dd-8950-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3087604a-e8a7-11dd-8950-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{331c3db8-b229-11dd-88ff-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{331c3db9-b229-11dd-88ff-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{331c3dba-b229-11dd-88ff-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{35e82ed2-bc86-11dd-890d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{35e82ed3-bc86-11dd-890d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{35e82ed4-bc86-11dd-890d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{35e82ed5-bc86-11dd-890d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{35e82ed6-bc86-11dd-890d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{393149b2-ed36-11dd-895d-0016369abaef}]
    \Shell\AutoRun\command - F:\StartVMCLite.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{393149b3-ed36-11dd-895d-0016369abaef}]
    \Shell\AutoRun\command - F:\StartVMCLite.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3931fc86-aa97-11dd-88f9-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3931fc87-aa97-11dd-88f9-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3931fc88-aa97-11dd-88f9-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3931fc89-aa97-11dd-88f9-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3931fc8a-aa97-11dd-88f9-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3943e698-c8f2-11dd-891e-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3c16f558-c73c-11dc-86f7-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3cfde9e6-e7a6-11dd-894f-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3cfde9e7-e7a6-11dd-894f-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3cfde9e8-e7a6-11dd-894f-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3e13ab54-d8bf-11dd-8939-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3e13ab55-d8bf-11dd-8939-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4016551e-a728-11dd-88f5-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4016551f-a728-11dd-88f5-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40165520-a728-11dd-88f5-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40165521-a728-11dd-88f5-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40165522-a728-11dd-88f5-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40165523-a728-11dd-88f5-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45ca5fbc-d33a-11dd-8930-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45ca5fbd-d33a-11dd-8930-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45ca5fbe-d33a-11dd-8930-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45ca5fbf-d33a-11dd-8930-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45ca5fc0-d33a-11dd-8930-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45ca5fc1-d33a-11dd-8930-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45ca5fc2-d33a-11dd-8930-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45ca5fc3-d33a-11dd-8930-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45ca5fc4-d33a-11dd-8930-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{45ca5fc5-d33a-11dd-8930-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46af42cc-d5bf-11dd-8934-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46af42d0-d5bf-11dd-8934-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46af42d1-d5bf-11dd-8934-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46af42d2-d5bf-11dd-8934-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46af42d3-d5bf-11dd-8934-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46af42d4-d5bf-11dd-8934-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46af42d5-d5bf-11dd-8934-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46af42d6-d5bf-11dd-8934-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46af42d7-d5bf-11dd-8934-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46af42d8-d5bf-11dd-8934-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{482e37c0-461c-11dd-8845-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{48968744-a184-11dd-88ea-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{515655fc-a34c-11dd-88ee-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{515655fd-a34c-11dd-88ee-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{53c3531a-d689-11dd-8936-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{53c3531b-d689-11dd-8936-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{64708bee-d2c2-11dd-892f-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{64708bef-d2c2-11dd-892f-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{64708bf0-d2c2-11dd-892f-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{64708bf1-d2c2-11dd-892f-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{663520ca-be22-11dd-8911-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{663520cb-be22-11dd-8911-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{663520cc-be22-11dd-8911-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6705e59e-e0e0-11dd-8947-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6705e59f-e0e0-11dd-8947-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6705e5a0-e0e0-11dd-8947-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{670eebec-da52-11dd-893b-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{670eebed-da52-11dd-893b-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{670eebee-da52-11dd-893b-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{670eebef-da52-11dd-893b-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{670eebf0-da52-11dd-893b-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{67e17ab0-ccda-11dd-8923-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{67e17ab1-ccda-11dd-8923-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{67e17ab2-ccda-11dd-8923-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6b13825c-a59b-11dd-88f1-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6b13825d-a59b-11dd-88f1-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6b13825e-a59b-11dd-88f1-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6b13825f-a59b-11dd-88f1-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6decf9b6-e53a-11dd-894c-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6decf9b7-e53a-11dd-894c-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6decf9b8-e53a-11dd-894c-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6decf9b9-e53a-11dd-894c-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6decf9ba-e53a-11dd-894c-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6decf9bb-e53a-11dd-894c-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6decf9bc-e53a-11dd-894c-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6decf9bd-e53a-11dd-894c-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6decf9be-e53a-11dd-894c-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6decf9bf-e53a-11dd-894c-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6decf9c0-e53a-11dd-894c-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6decf9c1-e53a-11dd-894c-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6decf9c2-e53a-11dd-894c-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6decf9c3-e53a-11dd-894c-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6decf9c4-e53a-11dd-894c-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6decf9c5-e53a-11dd-894c-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6decf9c6-e53a-11dd-894c-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6decf9c7-e53a-11dd-894c-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7083ed0e-a405-11dd-88ef-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{70d687c0-9ec0-11dd-88e6-d61bd0457324}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{70d687c1-9ec0-11dd-88e6-d61bd0457324}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{70d687c2-9ec0-11dd-88e6-d61bd0457324}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{70d687c3-9ec0-11dd-88e6-d61bd0457324}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{70d687c4-9ec0-11dd-88e6-d61bd0457324}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{71c91eec-c13c-11dd-8914-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{73118f64-bb9d-11dc-86e8-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{73118f65-bb9d-11dc-86e8-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{73f274aa-d3fe-11dd-8931-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{752f15d0-c828-11dd-891d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{752f15d1-c828-11dd-891d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{752f15d2-c828-11dd-891d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{752f15d3-c828-11dd-891d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{752f15d4-c828-11dd-891d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{752f15d5-c828-11dd-891d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{752f15d6-c828-11dd-891d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{752f15d7-c828-11dd-891d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{75f9b750-9ff0-11dd-88e8-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{75f9b751-9ff0-11dd-88e8-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{75f9b752-9ff0-11dd-88e8-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7bca4ae6-a662-11dd-88f4-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7bca4ae7-a662-11dd-88f4-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7bca4ae8-a662-11dd-88f4-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7d6b62be-b3e0-11dd-8902-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7d6b62bf-b3e0-11dd-8902-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7d6b62c0-b3e0-11dd-8902-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7d6b62c1-b3e0-11dd-8902-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7d6b62c2-b3e0-11dd-8902-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7d6b62c3-b3e0-11dd-8902-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7d6b62c4-b3e0-11dd-8902-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7d6b62c5-b3e0-11dd-8902-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7d6b62c6-b3e0-11dd-8902-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7d6b62c7-b3e0-11dd-8902-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7ed00ce4-a98c-11dd-88f8-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7ed00ce5-a98c-11dd-88f8-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f02f420-e2de-11dd-8949-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f02f421-e2de-11dd-8949-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f02f422-e2de-11dd-8949-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f02f423-e2de-11dd-8949-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f3f67c2-4417-11dd-8841-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f43a68e-c2c5-11dd-8916-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f43a68f-c2c5-11dd-8916-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f43a690-c2c5-11dd-8916-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f43a691-c2c5-11dd-8916-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f43a692-c2c5-11dd-8916-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{854df013-eafb-11dd-895a-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{854df014-eafb-11dd-895a-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{855fbbb4-df28-11dd-8941-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{855fbbb5-df28-11dd-8941-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{855fbbb6-df28-11dd-8941-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{855fbbb7-df28-11dd-8941-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{855fbbb8-df28-11dd-8941-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{87a5876c-a72b-11dd-88f6-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{87a5876d-a72b-11dd-88f6-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{87a5876e-a72b-11dd-88f6-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8d471696-e5a5-11dd-894d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8d471697-e5a5-11dd-894d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8d471698-e5a5-11dd-894d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8d471699-e5a5-11dd-894d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8dab2866-a8c4-11dd-88f7-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8dab2867-a8c4-11dd-88f7-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8dab2868-a8c4-11dd-88f7-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8dab2869-a8c4-11dd-88f7-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8dab286a-a8c4-11dd-88f7-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8dab286b-a8c4-11dd-88f7-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8dab286c-a8c4-11dd-88f7-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8f81e798-e4a5-11dd-894b-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8f81e799-e4a5-11dd-894b-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{917db82e-dc3f-11dd-893e-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9989c908-c9b7-11dd-8920-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9989c909-c9b7-11dd-8920-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9989c90a-c9b7-11dd-8920-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9c08c748-a1ed-11dd-88eb-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9c08c749-a1ed-11dd-88eb-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9c08c74a-a1ed-11dd-88eb-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9c08c74b-a1ed-11dd-88eb-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9c08c74c-a1ed-11dd-88eb-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9d59f680-c5c9-11dd-891a-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9fd59522-a25b-11dd-88ec-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1cb0bba-a65b-11dd-88f3-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1cb0bbb-a65b-11dd-88f3-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a1cb0bbc-a65b-11dd-88f3-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a200db50-d027-11dd-8928-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a200db51-d027-11dd-8928-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a46411f8-c38b-11dd-8917-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a46411f9-c38b-11dd-8917-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a46411fa-c38b-11dd-8917-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a46411fb-c38b-11dd-8917-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a46411fc-c38b-11dd-8917-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a87117d4-ae49-11dd-88fb-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa1245a0-af33-11dd-88fc-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{add37b06-abfe-11dd-88fa-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{add37b07-abfe-11dd-88fa-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{add37b08-abfe-11dd-88fa-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b11c098a-dfc6-11dd-8943-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b11c098b-dfc6-11dd-8943-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b11c098c-dfc6-11dd-8943-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b11c098d-dfc6-11dd-8943-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b11c098e-dfc6-11dd-8943-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b11c098f-dfc6-11dd-8943-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b11c0990-dfc6-11dd-8943-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b11c0991-dfc6-11dd-8943-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b241216e-e22e-11dd-8948-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b241216f-e22e-11dd-8948-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b2412170-e22e-11dd-8948-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b2412171-e22e-11dd-8948-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b2412172-e22e-11dd-8948-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b26c82ce-b56e-11dd-8904-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b6a47f06-b7b0-11dd-8906-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bb0a6730-dbce-11dd-893d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bb0a6731-dbce-11dd-893d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bb0a6732-dbce-11dd-893d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bb0a6733-dbce-11dd-893d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bb0a6734-dbce-11dd-893d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c09e093a-de27-11dd-8940-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c09e093b-de27-11dd-8940-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c09e093c-de27-11dd-8940-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c18b0d26-d598-11dd-8933-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c18b0d27-d598-11dd-8933-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c18b0d28-d598-11dd-8933-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c18b0d29-d598-11dd-8933-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c18b0d2a-d598-11dd-8933-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c18b0d2b-d598-11dd-8933-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c2350c08-b8ac-11dd-8908-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c2350c09-b8ac-11dd-8908-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c2350c0a-b8ac-11dd-8908-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c2350c0b-b8ac-11dd-8908-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c2d105c8-d728-11dd-8937-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c2d105c9-d728-11dd-8937-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c2d105ca-d728-11dd-8937-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c4668954-42ad-11dd-883d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c4668955-42ad-11dd-883d-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8d1b0c6-afeb-11dd-88fd-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8d1b0c7-afeb-11dd-88fd-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c8d1b0c8-afeb-11dd-88fd-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cd5b62be-e0cd-11dd-8946-0016369abaef}]
    \Shell\AutoRun\command - G:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cd5b62bf-e0cd-11dd-8946-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cd5b62c0-e0cd-11dd-8946-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cd5b62c1-e0cd-11dd-8946-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cd5b62c2-e0cd-11dd-8946-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce27f91a-a4c7-11dd-88f0-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce27f91b-a4c7-11dd-88f0-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cf706024-d9a5-11dd-893a-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cf706025-d9a5-11dd-893a-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cf706026-d9a5-11dd-893a-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cf706027-d9a5-11dd-893a-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cf706028-d9a5-11dd-893a-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfa9d102-bd39-11dd-890e-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfa9d103-bd39-11dd-890e-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfa9d104-bd39-11dd-890e-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfa9d105-bd39-11dd-890e-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfa9d106-bd39-11dd-890e-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfa9d107-bd39-11dd-890e-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfa9d108-bd39-11dd-890e-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cffb0d26-c05c-11dd-8913-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cffb0d27-c05c-11dd-8913-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cffb0d28-c05c-11dd-8913-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d253c86a-e9e7-11dd-8952-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d253c86b-e9e7-11dd-8952-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d253c86c-e9e7-11dd-8952-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d253c86d-e9e7-11dd-8952-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d253c86e-e9e7-11dd-8952-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d253c86f-e9e7-11dd-8952-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d367595a-e939-11dd-8951-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d367595b-e939-11dd-8951-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d367595c-e939-11dd-8951-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d367595e-e939-11dd-8951-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d367595f-e939-11dd-8951-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d3675960-e939-11dd-8951-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d3675961-e939-11dd-8951-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d4e5705e-b6e0-11dd-8905-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d4e5705f-b6e0-11dd-8905-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d4e57060-b6e0-11dd-8905-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d4e57061-b6e0-11dd-8905-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d4e57062-b6e0-11dd-8905-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d4e57063-b6e0-11dd-8905-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d4e57064-b6e0-11dd-8905-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dd2e4e0e-b3eb-11dd-8903-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df6f7cdc-c9b3-11dd-891f-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df6f7cdd-c9b3-11dd-891f-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df6f7cde-c9b3-11dd-891f-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e0342018-bab4-11dd-890a-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e0342019-bab4-11dd-890a-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e034201a-bab4-11dd-890a-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e21755ec-d4d8-11dd-8932-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e47927aa-c436-11dd-8918-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e47927ab-c436-11dd-8918-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e47927ac-c436-11dd-8918-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e56e5870-e3b6-11dd-894a-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e56e5871-e3b6-11dd-894a-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e56e5872-e3b6-11dd-894a-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e56e5873-e3b6-11dd-894a-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e56e5874-e3b6-11dd-894a-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e56e5875-e3b6-11dd-894a-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e6ca8bf8-c79b-11dd-891c-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e6ca8bf9-c79b-11dd-891c-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e6ca8bfa-c79b-11dd-891c-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9d93d32-ce9c-11dd-8925-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9d93d33-ce9c-11dd-8925-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9d93d34-ce9c-11dd-8925-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e9d93d35-ce9c-11dd-8925-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ebc22ea2-d7f6-11dd-8938-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f13c8e3a-ca87-11dd-8921-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f13c8e3b-ca87-11dd-8921-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f13c8e3c-ca87-11dd-8921-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f13c8e3d-ca87-11dd-8921-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f207a7fc-e6e6-11dd-894e-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f207a7fd-e6e6-11dd-894e-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f207a7fe-e6e6-11dd-894e-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f207a7ff-e6e6-11dd-894e-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3786fb0-eb8f-11dd-895b-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3786fb1-eb8f-11dd-895b-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3786fb2-eb8f-11dd-895b-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3786fb3-eb8f-11dd-895b-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3786fb4-eb8f-11dd-895b-0016369abaef}]
    \Shell\AutoRun\command - F:\StartVMCLite.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3786fb5-eb8f-11dd-895b-0016369abaef}]
    \Shell\AutoRun\command - F:\StartVMCLite.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3786fb6-eb8f-11dd-895b-0016369abaef}]
    \Shell\AutoRun\command - F:\StartVMCLite.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3786fb7-eb8f-11dd-895b-0016369abaef}]
    \Shell\AutoRun\command - F:\StartVMCLite.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3786fb8-eb8f-11dd-895b-0016369abaef}]
    \Shell\AutoRun\command - F:\StartVMCLite.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f7f0efce-c51d-11dd-8919-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f8354472-b3d8-11dd-8900-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f8354473-b3d8-11dd-8900-0016369abaef}]
    \Shell\AutoRun\command - F:\VMC_PBStarter.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{N72A0867-Y1UI-870O-2R12-85260D14F284}]
    "c:\windows\server.exe"

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{VMXX3UN7-P3WW-4OU5-EH31-24Y64C2S371O}]
    "c:\program files\Internet Explorer\IEXPLORE.EXE"
    .
    - - - - POISTETUT JÄMÄRIVIT - - - -

    HKCU-Run-updates - c:\windows\server.exe
    HKLM-RunOnce-isDeleteMe - c:\docume~1\oma\LOCALS~1\Temp\isDel.bat
    HKCU-Explorer_Run-updates.w - c:\windows\server.exe


    .
    ------- Täydentävä tarkistus -------
    .
    uStart Page = hxxp://www.suomi24.fi/
    uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
    uInternet Connection Wizard,ShellNext = hxxp://fi.intl.acer.yahoo.com/
    uSearchURL,(Default) = hxxp://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com
    IE: Vie Microsoft E&xceliin - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
    DPF: {3B36B017-7E49-426B-95B0-B5CECD83C2E2} - hxxp://fika-web.ifolor.net/OrderingGeneral/LowRes/app_support/ActiveX/IfolorUploader_fika.cab
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-02-13 12:12:58
    Windows 5.1.2600 Service Pack 3 FAT NTAPI

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja käynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...

    tarkistus on valmis
    piilotetut tiedostot: 0

    **************************************************************************
    .
    --------------------- LUKITUT REKISTERIAVAIMET ---------------------

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\�•€|ÿÿÿÿ"•€|þ»Ów*]
    "b049C053C7D38EE4AB9A00CB3B5D2472"="C?\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\PUBPLACE.HTT"
    .
    Valmistumisajankohta: 2009-02-13 12:14:01
    ComboFix-quarantined-files.txt 2009-02-13 10:14:00

    Ennen ajoa: 17 765 793 792 tavua vapaana
    Ajon jälkeen: 18,456,117,248 tavua vapaana

    864 --- E O F --- 2009-01-14 12:44:04
     
    pepe1111, 13.02.2009
    #7
  9. Hujo

    Hujo Guest

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi
     
    Hujo, 13.02.2009
    #8
  10. pepe1111

    pepe1111 Regular member

    Liittynyt:
    12.08.2006
    Viestejä:
    112
    Kiitokset:
    0
    Pisteet:
    26
    Malwarebytes' Anti-Malware 1.34
    Tietokantaversio: 1749
    Windows 5.1.2600 Service Pack 3

    16.2.2009 16:00:45
    mbam-log-2009-02-16 (16-00-45).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
    Tarkistetut kohteet: 120184
    Kulunut aika: 41 minute(s), 42 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)
     
    pepe1111, 16.02.2009
    #9
  11. Hujo

    Hujo Guest

    Hujo, 16.02.2009
    #10

Jaa tämä sivu