Trojan.Dropper.Cutwail

Just when I thought it was safe to return to the World Wide Web, the latest infection rears its menacing head: Trojan.Dropper.Cutwail.

Trojan.Dropper.Cutwail is a Trojan infection which was created for the sole purpose of ‘dropping’ malware, backdoor downloader’s, backdoor Trojan horses and the likes of, onto an infected computer system.

Trojan.Dropper.Cutwail will extract and activate compressed infections to a temporary windows folder, or directly to the memory of the system, so that it may remain hidden from all anti=virus and anti-malware applications present within the infiltrated system.

Signs which usually indicate the presence of Trojan.Dropper.Cutwail include:

• Loss of data, generic bugs and system crashes (Blue screen of death)
• Drops system startup and re boot speed and freeze Windows
• Abnormal processes running in windows task list
• Inactivates pop up blockers
• Initiate bandwidth glitch - slow surfing speed and browser shot-downs
• Trojan.Dropper.Cutwail is difficult to remove manually
• Fake desktop tray icons and shortcuts
Trojan.Dropper.Cutwail tends to behave the following way:
• Record surfing habits and generates matching pop up advertisements
• Trojan.Dropper.Cutwail drops and activates third party Trojans through security loopholes
• Records active security utility, deactivate antivirus and firewall
• Tracks and send access times, path names and visited urls to outlying hacker

In order to safeguard a computer system against these type of Trojan infections, there are a few steps one can take to ensure the safety of a computer system:

1. Use a firewall to block all dubious connections from the internet.
2. Enforce a password policy. Ensure the passwords implemented are complex, so as to prevent and limit damage to a compromised system.
3. Ensure that programs and users are at its lowest level of privileges – this way access is limited to the administrator.
4. Disable AutoPlay – this way you prevent the automatic launching of executable files on networks and removal drives.
5. Turn off File Sharing if it is not needed.
6. Turn off and remove all unnecessary services.
7. Always keep patch-levels up-to-date
8. Configure your server to block and remove all email attachments that have the file extensions: .vbs, .bat, .exe, .pif, .scr – as these type files are usually affiliated with malicious applications.
9. So, how would one remove this dubious infection from a computer system?

IT experts are of the opinion that manual removal of Trojan.Dropper.Cutwail is not the best solution, as the manual removal process is rather complicated and cumbersome, and should not be attempted by someone that is not familiar with the registry files of a computer system.

The best way to ensure your system is safe, and in order to avoid any unneeded risks of damage to your computer system, it is highly recommended to make use of a reliable and legitimate anti-spyware application, to remove Trojan.Dropper.Cutwail and all its components from the infected computer system.

Download Spyware Removal Tool to Remove* Trojan.Dropper.Cutwail

Quick & tested solution for Trojan.Dropper.Cutwail removal.
100% Free Scan for Windows

How to manually remove Trojan.Dropper.Cutwail

Files associated with Trojan.Dropper.Cutwail infection:

fmp98.exe
dhdh.exe
nbt.exe
syshost.exe
ClamAVFile
Jureeeee.exe
yabxyx.dll
yabcde.dll
yaaawu.dll
xxvvwt.dll
wvvutu.dll
vtutqr.dll
vtuspp.dll
vttuvt.dll
vttutt.dll
vtrrop.dll
vtrrom.dll
vtromm.dll
tuvvur.dll
sstuuv.dll
ssqpmk.dll
rqoomm.dll
qopppm.dll
qonopm.dll
qommjg.dll
pmkhge.dll
nnonnn.dll
nnmnmm.dll
nnklkj.dll
ljkkkj.dll
ljihef.dll
ljgddb.dll
khihih.dll
khiggd.dll
khgfca.dll
jkkkjk.dll
jkkigd.dll
jkhijj.dll
iiihfd.dll
iihfee.dll
iifeda.dll
hggffe.dll
hgdcca.dll
geecdb.dll
gedeed.dll
gedcdc.dll
gedccd.dll
gedcca.dll
gedaax.dll
fccdee.dll
fcccdc.dll
efffda.dll
effeff.dll
effccy.dll
ddbyvv.dll
ddbxvw.dll
ddawur.dll
cbywwt.dll
cbyayy.dll
cbxxxu.dll
cbbbcd.dll
byyayv.dll
bywuut.dll
bywtrs.dll
awtqqo.dll
XP-F04621CC.EXE
B32E2E.EXE
csc.sys
3cp4PQ86B.exe
XP-D41D8CD9.EXE
XP-65281CD5.EXE
XP-376211AD.EXE
XP-306E6578.EXE
XP-12DE8FDE.EXE
marianyela.exe
COMPUFIX.exe
AE3782.EXE
A9EF3C.EXE
A9780E.EXE
A3EF6E.EXE
94C687.EXE
578492.EXE
mmqrUR.exe
rdr_1271157730.exe
rdr_1271116465.exe
rdr_1271038255.exe
rdr_1270053676.exe
smb.sys
avgtdix.sys
mfb.exe
xmlrpw32.dll
sfw.exe
privacy.exe
POLStitgmwobI.exe
opu.exe
lvy.exe
JFhHPRcFiCtyNEO.exe
IoWwDnqsYPU.exe
hut.exe
EVjtFp5z481nVI.exe
DqSeoCbFrTc.exe
8E9.exe
Q2BJfuWAfeOaih.exe
psi.exe
MgKPyEORiQUvGj.exe
lsu.exe
KFfVaylJyVw.exe
kesinfoi.dll
javaw.exe
IKMwBROEshe.exe
I2cQwXb6rzBrB8.exe
EBook V1.0.0.7(2).exe
9.exe
zO5RnmgT8UdTIl.exe
YPfdbKQmYWnOqAL.exe
ablkma.exe
server.exe
E1D.exe
autoclicker_1233129530.exe
Demokratska.exe
E9A3.exe
dat.exe
9E82.exe
97C0.exe
43.exe
11C6.exe
dn.exe
9A0D2F91603.exe
WMSPoa.dll
tdx.sys
serial.sys
sdbus.sys
redbook.sys
rdpdr.sys
rasl2tp.sys
parport.sys
nic1394.sys
imapi.sys
i8042prt.sys
h32csht.dll
dfsc.sys
arp1394.sys
afd.sys
updpxe32.exe
1A.exe
csrss.exe
COHServer.exe
B6232F3A42A.exe
wpbt0.dll
SystemPropertiesAdvancedViewer.exe
nvvsvc.exe
Music System.exe
IntelVerifierOnline.dll
igfxtray.exe
aruqt.exe
agp440.sys
adp94xx.sys
1930.exe
nporbit.dll
svchos.exe
qmgr.dll
tplsub700jk.exe
Security Solution.exe
mscj2.exe
winsvc.exe
bswuwntossplhd.exe
ipsec.sys
usbhub.sys
mrxsmb.sys
bdlpfx.dll
cdrom.sys
itlnfw32.dll
ntdel.exe
ndiswan.sys
msvcirt32.dll
update.sys
ipnat.sys
netbt.sys
o_W-o4KLc--8M.dll
o81CKql_MiohZ-.dll
9dace4f8.dll
nsy4415.dll
M-C2-GcrHu7.dll
KillEXE.exe
kbaserpi.dll
ipdili.dll
hkicmd.exe
api-ms-win-core-localregistry-l1-1-032.dll
acleaner.exe
rqcovth.exe
lde1.exe
cryptnet32.dll
realupgrade.exe
winhelp.exe
facebook-pic0009696904901.exe
KB11657984.exe
arking.exe
uetcilehmof.exe
SynNglp.exe
zyachzf.dll
wnzip32.exe
thunder.exe
TCodecLite.exe
sXeInjectedSetup.8.9.exe
RMVTRJAN.EXE
pcxvqhjtteqc.dll
nvsvc32.exe
jsi.dll
GoogleDownload.exe
gabpath.exe
fpload1E.dll
CurseClient.exe
CronikalNewLouncher.exe
bootwiz.dll
flash_player_installer.exe
dpvvox32.dll
KILL ALL .dll
geurge.exe
winmx32.EXE
tskhelp32.exe
qaovyciydw.exe
NTsrv.exe
malware.exe
iexplore.exe
IEBrowserEvents.dll
deskctl3dClient.dll
2025.exe
imm32oko.dll
certoko.dll
aokomon.dll
btw_oko.dll
scvhost.exe
vsbntlo.exe
servicelayer.exe
pdfupd.exe
FFP.exe
ope462D.exe
ope27.exe
ope1F9A.exe
ope16.exe
ope99.exe
ope8578.exe
ope7F.exe
ope68.exe
ope435.exe
ope1B.exe
ope52.exe
Win-Update-KB090210.exe
wdsxssqb.sys
uwgph.exe
umbeea.exe
lkamw.exe
cjgy.exe
vxtdbgo.exe
idof.exe
init.exe
msxsltsso.dll
kta27MG.exe
userini.exe
Update.exe
svx.exe
MagicISO.exe
ctfmun.exe
retadpu72.exe
maxpaynowti1.exe
CbEvtSvc.exe
algg.exe
live.scr
KGootkit.sys
CC3161.EXE
wcode[1].exe
acode[1].exe
svchost.exe or Quake 4.exe
.//..//~tmp1174.exe
CDAlrt.dll
mcjudxmlx.exe
bldjad.exe
explorer.exe
msng.exe
GbjozpG.exe
ebpvlmvat.exe
yblxrhoj.exe
xapvlmvat.exe
VI6JF33.exe
yhghpgxnt.exe
twkqxqvat.exe
eyhs8Hu.exe
gmlkafwc^.exe
zychok.exe
2128a6dc.exe
7Nd9gBm.exe
_ex-08.exe
aecces.exe
ms1208817371.exe
services.exe
nsvsc32.exe
JHM4hhX.exe
dzn4cmD.exe
adgamma.exe
imPlayok.exe
wini1087100.exe
alg.exe
csrssc.exe
spool.exe
ctfmon.exe
av_md.exe
31668.exe
6to4svcw.exe
473083.dll
msword98.exe
vvuxq62447.exe
win.exe
8.tmp
restorer64_a.exe
sys64_nov.exe
restorer32_a.exe
vksaver.dll
276177.dll
sys32_nov.exe
mset.exe
hp32_nword.exe
ms18_word.exe
loader.exe
ati64si.sys
wdmon.exe
vlc.exe
wuauclt10.exe
install.exe
dat11.tmp
lsass.exe
Win_Update_KB081113.exe
WinNt32.dll
WLCtrl32.dll
hgcheck.exe
F323AF.EXE
o2s4nsh.exe
gbhy.dll
2052l.exe
userinit.exe
washidx.exe
protect.dll
autochk.dll
13.tmp
wJQs.exe
BNA.tmp
msprint.exe
584DFC.EXE
svchost.exe
daica.exe
Me.exe
jtyxewnu.exe
molocha.exe
WinCtrl32.dll
abytunud.exe
Rgdet.exe
reader_s.exe
stdcons.exe
BN9.tmp
Cpl32ver.exe
rs32net.exe
securentm.sys
bn4.tmp

Trojan.Dropper.Cutwail DLL's to remove:

yabxyx.dll
yabcde.dll
yaaawu.dll
xxvvwt.dll
wvvutu.dll
vtutqr.dll
vtuspp.dll
vttuvt.dll
vttutt.dll
vtrrop.dll
vtrrom.dll
vtromm.dll
tuvvur.dll
sstuuv.dll
ssqpmk.dll
rqoomm.dll
qopppm.dll
qonopm.dll
qommjg.dll
pmkhge.dll
nnonnn.dll
nnmnmm.dll
nnklkj.dll
ljkkkj.dll
ljihef.dll
ljgddb.dll
khihih.dll
khiggd.dll
khgfca.dll
jkkkjk.dll
jkkigd.dll
jkhijj.dll
iiihfd.dll
iihfee.dll
iifeda.dll
hggffe.dll
hgdcca.dll
geecdb.dll
gedeed.dll
gedcdc.dll
gedccd.dll
gedcca.dll
gedaax.dll
fccdee.dll
fcccdc.dll
efffda.dll
effeff.dll
effccy.dll
ddbyvv.dll
ddbxvw.dll
ddawur.dll
cbywwt.dll
cbyayy.dll
cbxxxu.dll
cbbbcd.dll
byyayv.dll
bywuut.dll
bywtrs.dll
awtqqo.dll
xmlrpw32.dll
kesinfoi.dll
WMSPoa.dll
h32csht.dll
wpbt0.dll
IntelVerifierOnline.dll
nporbit.dll
qmgr.dll
bdlpfx.dll
itlnfw32.dll
msvcirt32.dll
o_W-o4KLc--8M.dll
o81CKql_MiohZ-.dll
9dace4f8.dll
nsy4415.dll
M-C2-GcrHu7.dll
kbaserpi.dll
ipdili.dll
api-ms-win-core-localregistry-l1-1-032.dll
cryptnet32.dll
zyachzf.dll
pcxvqhjtteqc.dll
jsi.dll
fpload1E.dll
bootwiz.dll
dpvvox32.dll
KILL ALL .dll
IEBrowserEvents.dll
deskctl3dClient.dll
imm32oko.dll
certoko.dll
aokomon.dll
btw_oko.dll
msxsltsso.dll
CDAlrt.dll
473083.dll
vksaver.dll
276177.dll
WinNt32.dll
WLCtrl32.dll
gbhy.dll
protect.dll
autochk.dll
WinCtrl32.dll

Trojan.Dropper.Cutwail processes to kill:

fmp98.exe
dhdh.exe
nbt.exe
syshost.exe
XP-F04621CC.EXE
B32E2E.EXE
XP-D41D8CD9.EXE
XP-65281CD5.EXE
XP-376211AD.EXE
XP-306E6578.EXE
XP-12DE8FDE.EXE
AE3782.EXE
A9EF3C.EXE
A9780E.EXE
A3EF6E.EXE
94C687.EXE
578492.EXE
Jureeeee.exe
RMVTRJAN.EXE
winmx32.EXE
ope462D.exe
ope27.exe
ope1F9A.exe
ope16.exe
ope99.exe
ope8578.exe
ope7F.exe
ope68.exe
ope435.exe
ope1B.exe
CC3161.EXE
F323AF.EXE
584DFC.EXE
3cp4PQ86B.exe
marianyela.exe
COMPUFIX.exe
mmqrUR.exe
rdr_1271157730.exe
rdr_1271116465.exe
rdr_1271038255.exe
rdr_1270053676.exe
mfb.exe
sfw.exe
privacy.exe
POLStitgmwobI.exe
opu.exe
lvy.exe
JFhHPRcFiCtyNEO.exe
IoWwDnqsYPU.exe
hut.exe
EVjtFp5z481nVI.exe
DqSeoCbFrTc.exe
8E9.exe
Q2BJfuWAfeOaih.exe
psi.exe
MgKPyEORiQUvGj.exe
lsu.exe
KFfVaylJyVw.exe
javaw.exe
IKMwBROEshe.exe
I2cQwXb6rzBrB8.exe
EBook V1.0.0.7(2).exe
9.exe
zO5RnmgT8UdTIl.exe
YPfdbKQmYWnOqAL.exe
ablkma.exe
server.exe
E1D.exe
autoclicker_1233129530.exe
Demokratska.exe
E9A3.exe
dat.exe
9E82.exe
97C0.exe
43.exe
11C6.exe
dn.exe
9A0D2F91603.exe
updpxe32.exe
1A.exe
csrss.exe
COHServer.exe
B6232F3A42A.exe
SystemPropertiesAdvancedViewer.exe
nvvsvc.exe
Music System.exe
igfxtray.exe
aruqt.exe
1930.exe
svchos.exe
tplsub700jk.exe
Security Solution.exe
mscj2.exe
winsvc.exe
bswuwntossplhd.exe
ntdel.exe
KillEXE.exe
hkicmd.exe
acleaner.exe
rqcovth.exe
lde1.exe
realupgrade.exe
winhelp.exe
facebook-pic0009696904901.exe
KB11657984.exe
arking.exe
uetcilehmof.exe
SynNglp.exe
wnzip32.exe
thunder.exe
TCodecLite.exe
sXeInjectedSetup.8.9.exe
nvsvc32.exe
GoogleDownload.exe
gabpath.exe
CurseClient.exe
CronikalNewLouncher.exe
flash_player_installer.exe
geurge.exe
tskhelp32.exe
qaovyciydw.exe
NTsrv.exe
malware.exe
iexplore.exe
2025.exe
scvhost.exe
vsbntlo.exe
servicelayer.exe
pdfupd.exe
FFP.exe
ope462D.exe
ope27.exe
ope1F9A.exe
ope16.exe
ope99.exe
ope8578.exe
ope7F.exe
ope68.exe
ope435.exe
ope1B.exe
ope52.exe
Win-Update-KB090210.exe
uwgph.exe
umbeea.exe
lkamw.exe
cjgy.exe
vxtdbgo.exe
idof.exe
init.exe
SearchSettingsProtection.exe
kta27MG.exe
userini.exe
Update.exe
svx.exe
MagicISO.exe
ctfmun.exe
retadpu72.exe
maxpaynowti1.exe
CbEvtSvc.exe
algg.exe
wcode[1].exe
acode[1].exe
svchost.exe or Quake 4.exe
.//..//~tmp1174.exe
mcjudxmlx.exe
bldjad.exe
explorer.exe
msng.exe
GbjozpG.exe
ebpvlmvat.exe
yblxrhoj.exe
xapvlmvat.exe
VI6JF33.exe
yhghpgxnt.exe
twkqxqvat.exe
eyhs8Hu.exe
gmlkafwc^.exe
zychok.exe
2128a6dc.exe
7Nd9gBm.exe
_ex-08.exe
aecces.exe
ms1208817371.exe
services.exe
nsvsc32.exe
JHM4hhX.exe
dzn4cmD.exe
adgamma.exe
imPlayok.exe
wini1087100.exe
alg.exe
csrssc.exe
spool.exe
ctfmon.exe
av_md.exe
31668.exe
6to4svcw.exe
msword98.exe
vvuxq62447.exe
win.exe
restorer64_a.exe
sys64_nov.exe
restorer32_a.exe
sys32_nov.exe
mset.exe
hp32_nword.exe
ms18_word.exe
loader.exe
wdmon.exe
vlc.exe
wuauclt10.exe
install.exe
lsass.exe
Win_Update_KB081113.exe
hgcheck.exe
o2s4nsh.exe
2052l.exe
userinit.exe
washidx.exe
wJQs.exe
msprint.exe
svchost.exe
daica.exe
Me.exe
jtyxewnu.exe
molocha.exe
abytunud.exe
Rgdet.exe
reader_s.exe
stdcons.exe
Cpl32ver.exe
rs32net.exe

Remove Trojan.Dropper.Cutwail registry entries:

HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ InetChk
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ Microsoft Windows Installer
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ reader_s
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ Windows Resurections
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\molocha
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN userini
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSNTCURRENTVERSIONWINLOGONUSERINIT userinit
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWSNT\CURRENTVERSION\WINDOWS\APPINIT_DLLS\ AppInit_DLLs
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWSNT\CURRENTVERSION\WINLOGON\NOTIFY\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\WLCtrl32
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWSNT\CURRENTVERSION\WINLOGON\SHELL\ userinit
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWSNT\CURRENTVERSION\WINLOGON\USERINIT\ userinit
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser HelperObjects\{7B7A5443-2586-4118-804C-CB4A90A00524}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser HelperObjects\{7DC3E763-855E-4B27-BD7F-6E67B533EB4C}
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\ ms18_word
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\ reader_s
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\washindex
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ *svchostBoot
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ 584DFC
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ advap32
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ anhao
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ AnName = msword98
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ Application Layer Gateway
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ autoload
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ av_md
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ Cpl32ver
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ DelayLoad
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ ebpvlmvat
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ F323AF
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ gmlkafwc^
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ hgcheck
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ HKLM
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ hp32_nword
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ IEUpdate
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ imPlayok
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ install
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ loader.exe
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ lsass
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ Machine Works, Inc.
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ mcjudxmlx
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ ms18_word
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ mset
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ msword98
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ ntuser
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ reader_s
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ regdiit
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ restorer32_a
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ restorer64_a
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ rs32net
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ services
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ shell32
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ sniffer
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ sys32_nov
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ sys64_nov
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ twkqxqvat
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ vlc
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ wdmon
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ Windows DLL Driver
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ Windows System Guard
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ Windows Update
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ xapvlmvat
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ yblxrhoj
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ yhghpgxnt
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ zychok
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ati64si
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\securentm
MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\WinCtrl32
RUNNING PROGRAM\13.tmp
RUNNING PROGRAM\8.tmp
RUNNING PROGRAM\BN9.tmp
RUNNING PROGRAM\BNA.tmp
RUNNING PROGRAM\csrssc.exe
RUNNING PROGRAM\Explorer.EXE
RUNNING PROGRAM\MagicISO.exe
RUNNING PROGRAM\svchost.exe
RUNNING PROGRAM\vlc.exe
RUNNING PROGRAM\wini1087100.exe
RUNNING PROGRAM\winlogon.exe
RUNNING PROGRAM\Win_Update_KB081113.exe
RUNNING PROGRAM\wJQs.exe
Software\Microsoft\OLE "MICROSFT MX UPDATE SUPPORT"
SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices "LI`WSQSMM^"
SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices "MICROSFT MX UPDATE SUPPORT"
SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices "NTsrv.exe"
SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices "Sagate Security Firewall"
SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices "TaskHelp"

Post comment — WE NEED YOUR OPINION!