WORM_DELF.IFV
TrojanDownloader:Win32/Small.QE (Microsoft); W32/Webbew.worm (McAfee); W32.Dotex (Symantec); PAK:ASPack, Trojan-Downloader.Win32.Agent.jmd (Kaspersky); BehavesLike.Win32.Malware.tsc (mx-v) (Sunbelt); Win32.Worm.Delf.NFZ (FSecure)
Windows 2000, Windows XP, Windows Server 2003
Type de grayware:
Worm
Destructif:
Non
Chiffrement:
In the wild::
Oui
Overview
Löscht Dateien, so dass Programme und Anwendungen nicht ordnungsgemäß ausgeführt werden.
Détails techniques
Installation
Schleust die folgenden Eigenkopien in das betroffene System ein:
- %Program Files%\Common Files\System\unqiisl.exe
- %Program Files%\Common Files\Microsoft Shared\mwbmctu.exe
(Hinweis: %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.)
Andere Systemänderungen
Löscht die folgenden Dateien:
- %Program Files%\DLD.DAT
- %Program Files%\1.hiv
- %Program Files%\2.hiv
- %Program Files%\3.hiv
- %Program Files%\4.hiv
- %Program Files%\2B1.exe
- %Program Files%\3C2.exe
- %Program Files%\4D3.exe
- %Program Files%\5E4.exe
- %Program Files%\6F5.exe
- %Program Files%\7G6.exe
- %Program Files%\8Hxz.exe
- %Program Files%\9I
- %Program Files%\10J
- %Temp%\scs1.tmp
- %Temp%\scs2.tmp
(Hinweis: %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.. %Temp% ist der Windows Ordner für temporäre Dateien, normalerweise C:\Windows\Temp oder C:\WINNT\Temp.)
Fügt die folgenden Registrierungsschlüssel hinzu:
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
Ras.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
avp.com
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
avp.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
runiep.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
PFW.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
FYFireWall.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
rfwmain.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
rfwsrv.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KAVPF.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KPFW32.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
nod32kui.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
nod32.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
Navapsvc.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
Navapw32.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
avconsol.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
webscanx.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
NPFMntor.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
vsstat.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KPfwSvc.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
RavTask.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
Rav.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
RavMon.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
mmsk.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
WoptiClean.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
QQKav.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
QQDoctor.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
EGHOST.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
360Safe.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
iparmo.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
adam.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
IceSword.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
360rpt.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
360tray.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
AgentSvr.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
AppSvc32.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
autoruns.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
avgrssvc.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
AvMonitor.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
CCenter.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
ccSvcHst.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
FileDsty.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
FTCleanerShell.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
HijackThis.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
Iparmor.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
isPwdSvc.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
kabaload.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KaScrScn.SCR
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KASMain.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KASTask.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KAV32.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KAVDX.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KAVPFW.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KAVSetup.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KAVStart.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KISLnchr.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KMailMon.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KMFilter.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KPFW32X.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KRegEx.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KRepair.com
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KsLoader.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KVCenter.kxp
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KvDetect.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KvfwMcl.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KVMonXP.kxp
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KVMonXP_1.kxp
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
kvol.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
kvolself.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KvReport.kxp
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KVScan.kxp
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KVSrvXP.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KVStub.kxp
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
kvupload.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
kvwsc.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KvXP.kxp
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KvXP_1.kxp
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KWatch.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KWatch9x.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KWatchX.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
loaddll.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
MagicSet.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
mcconsol.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
mmqczj.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
nod32krn.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
PFWLiveUpdate.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
QHSET.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
RavMonD.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
RavStub.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
RegClean.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
rfwcfg.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
RsAgent.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
Rsaupd.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
safelive.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
scan32.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
shcfg32.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
SmartUp.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
SREng.EXE
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
symlcsvc.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
SysSafe.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
TrojanDetector.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
Trojanwall.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
TrojDie.kxp
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
UIHost.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
UmxAgent.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
UmxAttachment.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
UmxCfg.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
UmxFwHlp.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
UmxPol.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
UpLive.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
upiea.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
AST.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
ArSwp.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
USBCleaner.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
rstrui.exe
HKEY_CURRENT_USER\Software\mjonht
HKEY_CURRENT_USER\Software\ovwbji
HKEY_CURRENT_USER\Software\nurhnb
HKEY_CURRENT_USER\Software\wtsbjv
HKEY_CURRENT_USER\Software\qvorbg
HKEY_CURRENT_USER\Software\jxlhsq
HKEY_CURRENT_USER\Software\qhtbtj
HKEY_CURRENT_USER\Software\wdenck
HKEY_CURRENT_USER\Software\qfbetu
HKEY_CURRENT_USER\Software\khwtle
HKEY_CURRENT_USER\Software\efclmf
HKEY_CURRENT_USER\Software\xiycep
HKEY_CURRENT_USER\Software\rkvrvy
HKEY_CURRENT_USER\Software\kmrinj
HKEY_CURRENT_USER\Software\epoxft
HKEY_CURRENT_USER\Software\xrkowd
HKEY_CURRENT_USER\Software\rtheon
HKEY_CURRENT_USER\Software\kveugw
HKEY_CURRENT_USER\Software\qxbsqr
HKEY_CURRENT_USER\Software\ywfcai
HKEY_CURRENT_USER\Software\rycsqs
HKEY_CURRENT_USER\Software\lbxiic
HKEY_CURRENT_USER\Software\fduyam
HKEY_CURRENT_USER\Software\ygrorv
HKEY_CURRENT_USER\Software\fpaitp
HKEY_CURRENT_USER\Software\lkkubq
HKEY_CURRENT_USER\Software\emjbfv
HKEY_CURRENT_USER\Software\ylmdub
HKEY_CURRENT_USER\Software\snitml
HKEY_CURRENT_USER\Software\mpfjeu
HKEY_CURRENT_USER\Software\grbauf
HKEY_CURRENT_USER\Software\yuxpmp
HKEY_CURRENT_USER\Software\swugey
HKEY_CURRENT_USER\Software\myqvvj
HKEY_CURRENT_USER\Software\gwvnxk
HKEY_CURRENT_USER\Software\aasept
HKEY_CURRENT_USER\Software\tcothe
HKEY_CURRENT_USER\Software\nelkyo
HKEY_CURRENT_USER\Software\ggiaqx
HKEY_CURRENT_USER\Software\ajeqhi
HKEY_CURRENT_USER\Software\tlbgys
HKEY_CURRENT_USER\Software\nnwwqc
HKEY_CURRENT_USER\Software\hlcosd
HKEY_CURRENT_USER\Software\boyekn
HKEY_CURRENT_USER\Software\gybbjt
Fügt die folgenden Registrierungseinträge hinzu:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
Ras.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
avp.com
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
avp.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
runiep.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
PFW.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
FYFireWall.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
rfwmain.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
rfwsrv.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KAVPF.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KPFW32.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
nod32kui.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
nod32.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
Navapsvc.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
Navapw32.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
avconsol.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
webscanx.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
NPFMntor.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
vsstat.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KPfwSvc.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
RavTask.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
Rav.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
RavMon.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
mmsk.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
WoptiClean.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
QQKav.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
QQDoctor.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
EGHOST.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
360Safe.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
iparmo.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
adam.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
IceSword.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
360rpt.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
360tray.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
AgentSvr.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
AppSvc32.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
autoruns.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
avgrssvc.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
AvMonitor.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
CCenter.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
ccSvcHst.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
FileDsty.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
FTCleanerShell.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
HijackThis.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
Iparmor.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
isPwdSvc.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
kabaload.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KaScrScn.SCR
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KASMain.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KASTask.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KAV32.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KAVDX.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KAVPFW.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KAVSetup.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KAVStart.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KISLnchr.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KMailMon.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KMFilter.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KPFW32X.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KRegEx.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KRepair.com
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KsLoader.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KVCenter.kxp
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KvDetect.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KvfwMcl.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KVMonXP.kxp
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KVMonXP_1.kxp
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
kvol.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
kvolself.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KvReport.kxp
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KVScan.kxp
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KVSrvXP.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KVStub.kxp
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
kvupload.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
kvwsc.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KvXP.kxp
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KvXP_1.kxp
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KWatch.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KWatch9x.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
KWatchX.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
loaddll.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
MagicSet.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
mcconsol.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
mmqczj.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
nod32krn.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
PFWLiveUpdate.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
QHSET.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
RavMonD.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
RavStub.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
RegClean.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
rfwcfg.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
RsAgent.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
Rsaupd.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
safelive.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
scan32.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
shcfg32.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
SmartUp.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
SREng.EXE
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
symlcsvc.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
SysSafe.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
TrojanDetector.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
Trojanwall.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
TrojDie.kxp
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
UIHost.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
UmxAgent.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
UmxAttachment.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
UmxCfg.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
UmxFwHlp.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
UmxPol.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
UpLive.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
upiea.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
AST.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
ArSwp.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
USBCleaner.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
rstrui.exe
Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
HKEY_CURRENT_USER\Software\mjonht
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\ovwbji
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\nurhnb
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\wtsbjv
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\qvorbg
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\jxlhsq
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\qhtbtj
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\wdenck
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\qfbetu
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\khwtle
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\efclmf
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\xiycep
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\rkvrvy
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\kmrinj
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\epoxft
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\xrkowd
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\rtheon
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\kveugw
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\qxbsqr
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\ywfcai
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\rycsqs
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\lbxiic
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\fduyam
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\ygrorv
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\fpaitp
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\lkkubq
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\emjbfv
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\ylmdub
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\snitml
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\mpfjeu
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\grbauf
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\yuxpmp
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\swugey
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\myqvvj
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\gwvnxk
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\aasept
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\tcothe
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\nelkyo
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\ggiaqx
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\ajeqhi
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\tlbgys
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\nnwwqc
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\hlcosd
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\boyekn
hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
HKEY_CURRENT_USER\Software\gybbjt
iovqgfe = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
Ändert die folgenden Registrierungseinträge:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess
Start = "4"
(Note: The default value data of the said registry entry is 2.)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\helpsvc
Start = "4"
(Note: The default value data of the said registry entry is 2.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced\Folder\Hidden\
SHOWALL
CheckedValue = "0"
(Note: The default value data of the said registry entry is 1.)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\wscsvc
Start = "4"
(Note: The default value data of the said registry entry is 2.)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\wuauserv
Start = "4"
(Note: The default value data of the said registry entry is 2.)
Löscht die folgenden Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
unqiisl.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
mwbmctu.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Minimal\
{4D36E967-E325-11CE-BFC1-08002BE10318}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
{4D36E967-E325-11CE-BFC1-08002BE10318}
Einschleusungsroutine
Schleust die folgenden Dateien ein:
- %Program Files%\aurn.inf
- %Program Files%\1A2pk.exe
- %Program Files%\hgrgfkj.inf
- %Program Files%\meex.exe
- %System%\sexit.dat
(Hinweis: %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.. %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows XP und Server 2003.)
Solutions
Step 1
Für Windows ME und XP Benutzer: Stellen Sie vor einer Suche sicher, dass die Systemwiederherstellung deaktiviert ist, damit der gesamte Computer durchsucht werden kann.
Step 2
Diesen Registrierungsschlüssel löschen
Wichtig: Eine nicht ordnungsgemäße Bearbeitung der Windows Registrierung kann zu einer dauerhaften Fehlfunktion des Systems führen. Führen Sie diesen Schritt nur durch, wenn Sie mit der Vorgehensweise vertraut sind oder wenn Sie Ihren Systemadministrator um Unterstützung bitten können. Lesen Sie ansonsten zuerst diesen Microsoft Artikel, bevor Sie die Registrierung Ihres Computers ändern.
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- Ras.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- avp.com
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- avp.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- runiep.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- PFW.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- FYFireWall.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- rfwmain.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- rfwsrv.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KAVPF.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KPFW32.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- nod32kui.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- nod32.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- Navapsvc.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- Navapw32.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- avconsol.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- webscanx.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- NPFMntor.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- vsstat.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KPfwSvc.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- RavTask.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- Rav.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- RavMon.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- mmsk.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- WoptiClean.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- QQKav.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- QQDoctor.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- EGHOST.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- 360Safe.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- iparmo.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- adam.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- IceSword.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- 360rpt.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- 360tray.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- AgentSvr.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- AppSvc32.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- autoruns.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- avgrssvc.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- AvMonitor.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- CCenter.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- ccSvcHst.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- FileDsty.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- FTCleanerShell.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- HijackThis.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- Iparmor.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- isPwdSvc.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- kabaload.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KaScrScn.SCR
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KASMain.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KASTask.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KAV32.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KAVDX.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KAVPFW.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KAVSetup.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KAVStart.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KISLnchr.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KMailMon.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KMFilter.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KPFW32X.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KRegEx.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KRepair.com
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KsLoader.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KVCenter.kxp
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KvDetect.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KvfwMcl.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KVMonXP.kxp
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KVMonXP_1.kxp
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- kvol.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- kvolself.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KvReport.kxp
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KVScan.kxp
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KVSrvXP.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KVStub.kxp
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- kvupload.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- kvwsc.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KvXP.kxp
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KvXP_1.kxp
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KWatch.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KWatch9x.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- KWatchX.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- loaddll.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- MagicSet.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- mcconsol.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- mmqczj.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- nod32krn.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- PFWLiveUpdate.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- QHSET.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- RavMonD.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- RavStub.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- RegClean.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- rfwcfg.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- RsAgent.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- Rsaupd.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- safelive.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- scan32.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- shcfg32.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- SmartUp.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- SREng.EXE
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- symlcsvc.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- SysSafe.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- TrojanDetector.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- Trojanwall.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- TrojDie.kxp
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- UIHost.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- UmxAgent.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- UmxAttachment.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- UmxCfg.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- UmxFwHlp.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- UmxPol.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- UpLive.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- upiea.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- AST.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- ArSwp.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- USBCleaner.exe
- In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- rstrui.exe
- In HKEY_CURRENT_USER\Software
- mjonht
- In HKEY_CURRENT_USER\Software
- ovwbji
- In HKEY_CURRENT_USER\Software
- nurhnb
- In HKEY_CURRENT_USER\Software
- wtsbjv
- In HKEY_CURRENT_USER\Software
- qvorbg
- In HKEY_CURRENT_USER\Software
- jxlhsq
- In HKEY_CURRENT_USER\Software
- qhtbtj
- In HKEY_CURRENT_USER\Software
- wdenck
- In HKEY_CURRENT_USER\Software
- qfbetu
- In HKEY_CURRENT_USER\Software
- khwtle
- In HKEY_CURRENT_USER\Software
- efclmf
- In HKEY_CURRENT_USER\Software
- xiycep
- In HKEY_CURRENT_USER\Software
- rkvrvy
- In HKEY_CURRENT_USER\Software
- kmrinj
- In HKEY_CURRENT_USER\Software
- epoxft
- In HKEY_CURRENT_USER\Software
- xrkowd
- In HKEY_CURRENT_USER\Software
- rtheon
- In HKEY_CURRENT_USER\Software
- kveugw
- In HKEY_CURRENT_USER\Software
- qxbsqr
- In HKEY_CURRENT_USER\Software
- ywfcai
- In HKEY_CURRENT_USER\Software
- rycsqs
- In HKEY_CURRENT_USER\Software
- lbxiic
- In HKEY_CURRENT_USER\Software
- fduyam
- In HKEY_CURRENT_USER\Software
- ygrorv
- In HKEY_CURRENT_USER\Software
- fpaitp
- In HKEY_CURRENT_USER\Software
- lkkubq
- In HKEY_CURRENT_USER\Software
- emjbfv
- In HKEY_CURRENT_USER\Software
- ylmdub
- In HKEY_CURRENT_USER\Software
- snitml
- In HKEY_CURRENT_USER\Software
- mpfjeu
- In HKEY_CURRENT_USER\Software
- grbauf
- In HKEY_CURRENT_USER\Software
- yuxpmp
- In HKEY_CURRENT_USER\Software
- swugey
- In HKEY_CURRENT_USER\Software
- myqvvj
- In HKEY_CURRENT_USER\Software
- gwvnxk
- In HKEY_CURRENT_USER\Software
- aasept
- In HKEY_CURRENT_USER\Software
- tcothe
- In HKEY_CURRENT_USER\Software
- nelkyo
- In HKEY_CURRENT_USER\Software
- ggiaqx
- In HKEY_CURRENT_USER\Software
- ajeqhi
- In HKEY_CURRENT_USER\Software
- tlbgys
- In HKEY_CURRENT_USER\Software
- nnwwqc
- In HKEY_CURRENT_USER\Software
- hlcosd
- In HKEY_CURRENT_USER\Software
- boyekn
- In HKEY_CURRENT_USER\Software
- gybbjt
Step 3
Diesen Registrierungswert löschen
Wichtig: Eine nicht ordnungsgemäße Bearbeitung der Windows Registrierung kann zu einer dauerhaften Fehlfunktion des Systems führen. Führen Sie diesen Schritt nur durch, wenn Sie mit der Vorgehensweise vertraut sind oder wenn Sie Ihren Systemadministrator um Unterstützung bitten können. Lesen Sie ansonsten zuerst diesen Microsoft Artikel, bevor Sie die Registrierung Ihres Computers ändern.
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FYFireWall.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPF.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconsol.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webscanx.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NPFMntor.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsstat.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPfwSvc.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQKav.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EGHOST.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRepair.com
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvfwMcl.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvolself.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shcfg32.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.EXE
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxFwHlp.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\upiea.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AST.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ArSwp.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USBCleaner.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe
- Debugger = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
- In HKEY_CURRENT_USER\Software\mjonht
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\ovwbji
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\nurhnb
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\wtsbjv
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\qvorbg
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\jxlhsq
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\qhtbtj
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\wdenck
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\qfbetu
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\khwtle
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\efclmf
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\xiycep
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\rkvrvy
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\kmrinj
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\epoxft
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\xrkowd
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\rtheon
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\kveugw
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\qxbsqr
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\ywfcai
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\rycsqs
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\lbxiic
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\fduyam
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\ygrorv
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\fpaitp
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\lkkubq
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\emjbfv
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\ylmdub
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\snitml
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\mpfjeu
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\grbauf
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\yuxpmp
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\swugey
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\myqvvj
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\gwvnxk
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\aasept
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\tcothe
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\nelkyo
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\ggiaqx
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\ajeqhi
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\tlbgys
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\nnwwqc
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\hlcosd
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\boyekn
- hgrgfkj = "%Program Files%\Common Files\System\unqiisl.exe"
- In HKEY_CURRENT_USER\Software\gybbjt
- iovqgfe = "%Program Files%\Common Files\Microsoft Shared\mwbmctu.exe"
Step 4
Diesen geänderten Registrierungswert wiederherstellen
Wichtig: Eine nicht ordnungsgemäße Bearbeitung der Windows Registrierung kann zu einer dauerhaften Fehlfunktion des Systems führen. Führen Sie diesen Schritt nur durch, wenn Sie mit der Vorgehensweise vertraut sind oder wenn Sie Ihren Systemadministrator um Unterstützung bitten können. Lesen Sie ansonsten zuerst diesen Microsoft Artikel, bevor Sie die Registrierung Ihres Computers ändern.
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess
- From: Start = "4"
To: Start = ""2""
- From: Start = "4"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\helpsvc
- From: Start = "4"
To: Start = ""2""
- From: Start = "4"
- In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
- From: CheckedValue = "0"
To: CheckedValue = ""1""
- From: CheckedValue = "0"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wscsvc
- From: Start = "4"
To: Start = ""2""
- From: Start = "4"
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wuauserv
- From: Start = "4"
To: Start = ""2""
- From: Start = "4"
Step 5
Diese Dateien suchen und löschen
- %Program Files%\aurn.inf
- %Program Files%\1A2pk.exe
- %Program Files%\hgrgfkj.inf
- %Program Files%\meex.exe
- %System%\sexit.dat
Step 6
Durchsuchen Sie Ihren Computer mit Ihrem Trend Micro Produkt, und löschen Sie Dateien, die als WORM_DELF.IFV entdeckt werden. Falls die entdeckten Dateien bereits von Ihrem Trend Micro Produkt gesäubert, gelöscht oder in Quarantäne verschoben wurden, sind keine weiteren Schritte erforderlich. Dateien in Quarantäne können einfach gelöscht werden. Auf dieser Knowledge-Base-Seite finden Sie weitere Informationen.
Participez à notre enquête!