WORM_CHIVIPER.K

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Restart in Safe Mode

Step 3

Delete this registry key

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components
  • {random key}

Step 4

Delete this registry value

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{random key}
  • stubpath = "%windir%\ini\shit.vbs"

Step 5

Search and delete these components

• %Windows%\ini\ini.exe
• %Windows%\ini\desktop.ini
• %Windows%\ini\shit.vbs
• %Windows%\ini\wsock32.dll
• %Windows%\Tasks\°²×°.bat
• %Program Files%\Adobe\Reader 10.0\Esl\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Reader\AIR\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Reader\Browser\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Reader\IDTemplates\ENU\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Reader\IDTemplates\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Reader\Javascripts\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Reader\Legal\ENU\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Reader\Legal\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Reader\plug_ins\AcroForm\PMP\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Reader\plug_ins\AcroForm\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\ENU\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Reader\plug_ins\Annotations\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Reader\plug_ins\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Reader\plug_ins3d\prc\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Reader\plug_ins3d\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Reader\Services\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Reader\SPPlugins\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Reader\Tracker\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Reader\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Resource\CMap\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Resource\Font\PFM\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Resource\Font\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Resource\Linguistics\LanguageNames2\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Resource\Linguistics\Providers\Proximity\11.00\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Resource\Linguistics\Providers\Proximity\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Resource\Linguistics\Providers\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Resource\Linguistics\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Resource\SaslPrep\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\ICU\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\Mappings\Adobe\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\Mappings\Mac\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\Mappings\win\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\Mappings\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Resource\TypeSupport\Unicode\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Resource\TypeSupport\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Resource\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Setup Files\{AC76BA86-7AD7-1033-7B44-AA0000000001}\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\Setup Files\wsock32.dll
• %Program Files%\Adobe\Reader 10.0\wsock32.dll
• %Program Files%\Adobe\wsock32.dll
• %Program Files%\Common Files\Adobe\Acrobat\ActiveX\wsock32.dll
• %Program Files%\Common Files\Adobe\Acrobat\wsock32.dll
• %Program Files%\Common Files\Adobe\ARM\1.0\wsock32.dll
• %Program Files%\Common Files\Adobe\ARM\wsock32.dll
• %Program Files%\Common Files\Adobe\HelpCfg\en_US\wsock32.dll
• %Program Files%\Common Files\Adobe\HelpCfg\wsock32.dll
• %Program Files%\Common Files\Adobe\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\DAO\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\DW\1025\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\DW\1028\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\DW\1031\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\DW\1033\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\DW\1036\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\DW\1040\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\DW\1041\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\DW\1042\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\DW\2052\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\DW\3082\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\DW\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\MSInfo\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\Speech\1033\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\Speech\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\Stationery\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\TextConv\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\Triedit\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\VC\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\VGX\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\Web Folders\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\admcgi\scripts\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\admcgi\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\admisapi\scripts\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\admisapi\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\bin\1033\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\bin\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\bots\vinavbar\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\bots\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\isapi\_vti_adm\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\isapi\_vti_aut\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\isapi\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\servsupp\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\_vti_bin\_vti_adm\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\_vti_bin\_vti_aut\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\_vti_bin\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\web server extensions\wsock32.dll
• %Program Files%\Common Files\Microsoft Shared\wsock32.dll
• %Program Files%\Common Files\MSSoap\Binaries\Resources\1033\wsock32.dll
• %Program Files%\Common Files\MSSoap\Binaries\Resources\wsock32.dll
• %Program Files%\Common Files\MSSoap\Binaries\wsock32.dll
• %Program Files%\Common Files\MSSoap\wsock32.dll
• %Program Files%\Common Files\ODBC\Data Sources\wsock32.dll
• %Program Files%\Common Files\ODBC\wsock32.dll
• %Program Files%\Common Files\Services\wsock32.dll
• %Program Files%\Common Files\SpeechEngines\Microsoft\Lexicon\1033\wsock32.dll
• %Program Files%\Common Files\SpeechEngines\Microsoft\Lexicon\wsock32.dll
• %Program Files%\Common Files\SpeechEngines\Microsoft\TTS\1033\wsock32.dll
• %Program Files%\Common Files\SpeechEngines\Microsoft\TTS\wsock32.dll
• %Program Files%\Common Files\SpeechEngines\Microsoft\wsock32.dll
• %Program Files%\Common Files\SpeechEngines\wsock32.dll
• %Program Files%\Common Files\System\ado\wsock32.dll
• %Program Files%\Common Files\System\msadc\wsock32.dll
• %Program Files%\Common Files\System\Ole DB\wsock32.dll
• %Program Files%\Common Files\System\wsock32.dll
• %Program Files%\Common Files\wsock32.dll
• %Program Files%\ComPlus Applications\wsock32.dll
• %Program Files%\Internet Explorer\Connection Wizard\wsock32.dll
• %Program Files%\Internet Explorer\MUI\0409\wsock32.dll
• %Program Files%\Internet Explorer\MUI\wsock32.dll
• %Program Files%\Internet Explorer\PLUGINS\wsock32.dll
• %Program Files%\Internet Explorer\SIGNUP\wsock32.dll
• %Program Files%\Internet Explorer\wsock32.dll
• %Program Files%\Messenger\wsock32.dll
• %Program Files%\microsoft frontpage\version3.0\bin\wsock32.dll
• %Program Files%\microsoft frontpage\version3.0\wsock32.dll
• %Program Files%\microsoft frontpage\wsock32.dll
• %Program Files%\Microsoft.NET\RedistList\wsock32.dll
• %Program Files%\Microsoft.NET\wsock32.dll
• %Program Files%\Movie Maker\MUI\0409\wsock32.dll
• %Program Files%\Movie Maker\MUI\wsock32.dll
• %Program Files%\Movie Maker\Shared\Profiles\wsock32.dll
• %Program Files%\Movie Maker\Shared\wsock32.dll
• %Program Files%\Movie Maker\wsock32.dll
• %Program Files%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\wsock32.dll
• %Program Files%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\wsock32.dll
• %Program Files%\MSBuild\Microsoft\Windows Workflow Foundation\wsock32.dll
• %Program Files%\MSBuild\Microsoft\wsock32.dll
• %Program Files%\MSBuild\wsock32.dll
• %Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\wsock32.dll
• %Program Files%\MSN\MSNCoreFiles\Install\wsock32.dll
• %Program Files%\MSN\MSNCoreFiles\OOBE\wsock32.dll
• %Program Files%\MSN\MSNCoreFiles\wsock32.dll
• %Program Files%\MSN\wsock32.dll
• %Program Files%\MSN Gaming Zone\Windows\wsock32.dll
• %Program Files%\MSN Gaming Zone\wsock32.dll
• %Program Files%\MSXML 6.0\EULA\wsock32.dll
• %Program Files%\MSXML 6.0\wsock32.dll
• %Program Files%\NetMeeting\wsock32.dll
• %Program Files%\Online Services\wsock32.dll
• %Program Files%\Outlook Express\wsock32.dll
• %Program Files%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\wsock32.dll
• %Program Files%\Reference Assemblies\Microsoft\Framework\v3.0\wsock32.dll
• %Program Files%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\wsock32.dll
• %Program Files%\Reference Assemblies\Microsoft\Framework\v3.5\wsock32.dll
• \192.168.0.1\admin$\kav32.exe
• \192.168.0.1\C$\kav32.exe
• \192.168.0.1\D$\kav32.exe
• \192.168.0.1\E$\kav32.exe
• \192.168.0.1\F$\kav32.exe
• %Program Files%\Reference Assemblies\Microsoft\Framework\wsock32.dll
• %Program Files%\Reference Assemblies\Microsoft\wsock32.dll
• %Program Files%\Reference Assemblies\wsock32.dll
• %Program Files%\Uninstall Information\wsock32.dll
• %Program Files%\Windows Media Player\Icons\wsock32.dll
• %Program Files%\Windows Media Player\Sample Playlists\wsock32.dll
• %Program Files%\Windows Media Player\Skins\wsock32.dll
• %Program Files%\Windows Media Player\Visualizations\wsock32.dll
• %Program Files%\Windows Media Player\wsock32.dll
• %Program Files%\Windows NT\Accessories\wsock32.dll
• %Program Files%\Windows NT\Pinball\wsock32.dll
• %Program Files%\Windows NT\wsock32.dll
• %Program Files%\WindowsUpdate\wsock32.dll
• %Program Files%\WinPcap\wsock32.dll
• %Program Files%\xerox\nwwia\wsock32.dll
• %Program Files%\xerox\wsock32.dll
• %Program Files%\wsock32.dll
• %System Root%\System Volume Information\wsock32.dll

Step 6

Search and delete these folders

• %Windows%\ini
• %User Profile%\KIS\Log.DAT
• %User Profile%\KIS\User.DAT

Step 7

Restart in normal mode and scan your computer with your Trend Micro product for files detected as WORM_CHIVIPER.K. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Step 8

Restore deleted/modified files and/or registry entries from backup

*Note: Only Microsoft-related files/keys/values will be restored. If this malware/grayware also deleted registry keys/values related to programs that are not from Microsoft, please reinstall those programs on your computer.

• %System%\drivers\etc\hosts

Step 9

Restore this file from backup only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on you computer again.

• %User Temp%\58e0ef.mst
• %User Temp%\AdobeARM.log
• %User Temp%\AdobeSFX.log
• %User Temp%\ASPNETSetup_00000.log
• %User Temp%\ASPNETSetup_00001.log
• %User Temp%\ASPNETSetup_00002.log
• %User Temp%\dd_depcheck_NETFX_EXP_35.txt
• %User Temp%\dd_dotnetfx35error.txt
• %User Temp%\dd_dotnetfx35install.txt
• %User Temp%\dd_dotNetFx40_Full_x86_x64_decompression_log.txt
• %User Temp%\dd_MSXML6_MSI0686.txt
• %User Profile%\KIS\Log.DAT
• %User Profile%\KIS\User.DAT
• %User Temp%\dd_netfx20MSI7F16.txt
• %User Temp%\dd_netfx20UI7F16.txt
• %User Temp%\dd_NET_Framework20_Setup06A7.txt
• %User Temp%\dd_NET_Framework30_Setup0775.txt
• %User Temp%\dd_NET_Framework35_MSI07B9.txt
• %User Temp%\dd_RGB9RAST_x86.msi0683.txt
• %User Temp%\dd_vcredistMSI3CAA.txt
• %User Temp%\dd_vcredistMSI7C21.txt
• %User Temp%\dd_vcredistUI3CAA.txt
• %User Temp%\dd_vcredistUI7C21.txt
• %User Temp%\dd_wcf_CA_smci_20111017_044900_062.txt
• %User Temp%\dd_wcf_retCA29BA.txt
• %User Temp%\dd_WIC.txt
• %User Temp%\dd_XPS.txt
• %User Temp%\Microsoft .NET Framework 4 Setup_20111016_234618578-MSI_netfx_Core_x86.msi.txt
• %User Temp%\Microsoft .NET Framework 4 Setup_20111016_234618578-MSI_netfx_Extended_x86.msi.txt
• %User Temp%\Microsoft .NET Framework 4 Setup_20111016_234618578.html
• %User Temp%\Microsoft .NET Framework 4 Setup_4.0.30319
• %User Temp%\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.30319
• %User Temp%\Microsoft Visual C++ 2010 x86 Redistributable Setup_20111020_000954642-MSI_vc_red.msi.txt
• %User Temp%\Microsoft Visual C++ 2010 x86 Redistributable Setup_20111020_000954642.html
• %User Temp%\uxeventlog.txt
• %User Temp%\vminst.log_20111016_212239_Failed.log
• %User Temp%\vminst.log_20130313_012028.log
• %User Temp%\vminst.log_20130313_012352_Failed.log
• %User Temp%\vmmsi.log_20111016_212246_Failed.log
• %User Temp%\vmmsi.log_20130313_012028.log
• %User Temp%\vmmsi.log_20130313_012352_Failed.log
• %User Temp%\WSFF8.tmp
• %User Temp%\WSFF9.tmp
• %User Temp%\{835818DD-220C-4ABD-946E-0D8660B95E29}
• %Windows%\help\access.chm
• %Windows%\help\access.hlp
• %Windows%\help\accessib.chm
• %Windows%\help\acc_dis.chm
• %Windows%\help\aclui.chm
• %Windows%\help\aclui.hlp
• %Windows%\help\addremov.chm
• %Windows%\help\ade.hlp
• %Windows%\help\admtools.chm
• %Windows%\help\adprop.hlp
• %Windows%\help\agt0405.hlp
• %Windows%\help\agt0406.hlp
• %Windows%\help\agt0407.hlp
• %Windows%\help\agt0408.hlp
• %Windows%\help\agt0409.hlp
• %Windows%\help\agt040b.hlp
• %Windows%\help\agt040c.hlp
• %Windows%\help\agt040e.hlp
• %Windows%\help\agt0410.hlp
• %Windows%\help\agt0413.hlp
• %Windows%\help\agt0414.hlp
• %Windows%\help\agt0415.hlp
• %Windows%\help\agt0416.hlp
• %Windows%\help\agt0419.hlp
• %Windows%\help\agt041d.hlp
• %Windows%\help\agt041f.hlp
• %Windows%\help\agt0816.hlp
• %Windows%\help\agt0c0a.hlp
• %Windows%\help\apps.chm
• %Windows%\help\apps_sp.chm
• %Windows%\help\article.chm
• %Windows%\help\atm.chm
• %Windows%\help\audiocdc.hlp
• %Windows%\help\audit.chm
• %Windows%\help\bckg.chm
• %Windows%\help\blurbs.chm
• %Windows%\help\blutooth.chm
• %Windows%\help\bnts.dll
• %Windows%\help\bootcons.chm
• %Windows%\help\brief.chm
• %Windows%\help\calc.chm
• %Windows%\help\calc.hlp
• %Windows%\help\camera.chm
• %Windows%\help\camera.hlp
• %Windows%\help\cdmedia.chm
• %Windows%\help\cdmedia.hlp
• %Windows%\help\certmgr.chm
• %Windows%\help\certmgr.hlp
• %Windows%\help\charmap.chm
• %Windows%\help\charmap.hlp
• %Windows%\help\chkr.chm
• %Windows%\help\chnscsvr.hlp
• %Windows%\help\chooser.hlp
• %Windows%\help\ciadmin.htm
• %Windows%\help\ciquery.htm
• %Windows%\help\clipbrd.chm
• %Windows%\help\clipbrd.hlp
• %Windows%\help\cmconcepts.chm
• %Windows%\help\colormgt.chm
• %Windows%\help\comexp.chm
• %Windows%\help\comexp.hlp
• %Windows%\help\common.chm
• %Windows%\help\compfldr.chm
• %Windows%\help\compmgmt.chm
• %Windows%\help\compstui.hlp
• %Windows%\help\conf.chm
• %Windows%\help\conf.cnt
• %Windows%\help\conf.hlp
• %Windows%\help\conf1.chm
• %Windows%\help\connect.cnt
• %Windows%\help\connect.hlp
• %Windows%\help\cpanel.chm
• %Windows%\help\cpanel.chq
• %Windows%\help\cscui.hlp
• %Windows%\help\cyycoins.chm
• %Windows%\help\cyzcoins.chm
• %Windows%\help\datetime.chm
• %Windows%\help\ddeshare.chm
• %Windows%\help\ddeshare.hlp
• %Windows%\help\defrag.chm
• %Windows%\help\defrag.hlp
• %Windows%\help\devmgr.chm
• %Windows%\help\devmgr.hlp
• %Windows%\help\dfs.hlp
• %Windows%\help\diagboot.chm
• %Windows%\help\dialer.chm
• %Windows%\help\dialer.hlp
• %Windows%\help\digiras.chm
• %Windows%\help\dijoy.hlp
• %Windows%\help\diskmgmt.chm
• %Windows%\help\diskmgmt.hlp
• %Windows%\help\display.chm
• %Windows%\help\display.hlp
• %Windows%\help\dkconcepts.chm
• %Windows%\help\drvvfp.chm
• %Windows%\help\drwtsn32.chm
• %Windows%\help\drwtsn32.hlp
• %Windows%\help\dsclient.hlp
• %Windows%\help\dskquoui.chm
• %Windows%\help\dskquoui.hlp
• %Windows%\help\dxdiag.chm
• %Windows%\help\els.chm
• %Windows%\help\els.hlp
• %Windows%\help\encrypt.chm
• %Windows%\help\eudcedit.chm
• %Windows%\help\eudcedit.hlp
• %Windows%\help\evconcepts.chm
• %Windows%\help\evntwin.hlp
• %Windows%\help\fde.hlp
• %Windows%\help\filefold.chm
• %Windows%\help\filefold.hlp
• %Windows%\help\filemgmt.hlp
• %Windows%\help\file_srv.chm
• %Windows%\help\find.chm
• %Windows%\help\folderop.chm
• %Windows%\help\fonts.chm
• %Windows%\help\fonts.hlp
• %Windows%\help\freecell.chm
• %Windows%\help\freecell.hlp
• %Windows%\help\fxsclnt.chm
• %Windows%\help\fxsclnt.hlp
• %Windows%\help\fxscover.chm
• %Windows%\help\fxsshare.chm
• %Windows%\help\gen.chm
• %Windows%\help\Glossary.chm
• %Windows%\help\gpedit.chm
• %Windows%\help\gpedit.hlp
• %Windows%\help\gptext.hlp
• %Windows%\help\halftone.hlp
• %Windows%\help\hardware.chm
• %Windows%\help\hardware.hlp
• %Windows%\help\howto.chm
• %Windows%\help\hrtz.chm
• %Windows%\help\hs.chm
• %Windows%\help\hschelp.chm
• %Windows%\help\hypertrm.chm
• %Windows%\help\hypertrm.hlp
• %Windows%\help\icwdial.chm
• %Windows%\help\ident.hlp
• %Windows%\help\ieakmmc.chm
• %Windows%\help\ieeula.chm
• %Windows%\help\ieos.chm
• %Windows%\help\ieshared.chm
• %Windows%\help\iesupp.chm
• %Windows%\help\iewebhlp.chm
• %Windows%\help\iexplore.chm
• %Windows%\help\iexplore.hlp
• %Windows%\help\iis.chm
• %Windows%\help\iismmc.chm
• %Windows%\help\imgprev.chm
• %Windows%\help\inetres.chm
• %Windows%\help\infrared.chm
• %Windows%\help\infrared.hlp
• %Windows%\help\input.chm
• %Windows%\help\input.hlp
• %Windows%\help\intellimirror.chm
• %Windows%\help\ipsecconcepts.chm
• %Windows%\help\ipsecsnp.chm
• %Windows%\help\ipsecsnp.hlp
• %Windows%\help\Ipv6.chm
• %Windows%\help\is.chm
• %Windows%\help\isconcepts.chm
• %Windows%\help\ixhelp.hlp
• %Windows%\help\ixqlang.htm
• %Windows%\help\joy.chm
• %Windows%\help\key.chm
• %Windows%\help\keyb.chm
• %Windows%\help\keyshort.chm
• %Windows%\help\lang.chm
• %Windows%\help\langbar.chm
• %Windows%\help\license.chm
• %Windows%\help\localsec.chm
• %Windows%\help\localsec.hlp
• %Windows%\help\lpe.chm
• %Windows%\help\lpeconcepts.chm
• %Windows%\help\magnify.chm
• %Windows%\help\magnify.hlp
• %Windows%\help\mail.chm
• %Windows%\help\mfcuix.hlp
• %Windows%\help\migwiz.htm
• %Windows%\help\migwiz2.htm
• %Windows%\help\misc.chm
• %Windows%\help\mls_trb.chm
• %Windows%\help\mmc.chm
• %Windows%\help\mmc_dlg.hlp
• %Windows%\help\mobsync.chm
• %Windows%\help\mobsync.hlp
• %Windows%\help\mode.chm
• %Windows%\help\modem.hlp
• %Windows%\help\mouse.chm
• %Windows%\help\mouse.hlp
• %Windows%\help\mpconcepts.chm
• %Windows%\help\mplayer2.cnt
• %Windows%\help\mplayer2.hlp
• %Windows%\help\mpnetwrk.hlp
• %Windows%\help\mqsnap.hlp
• %Windows%\help\msconfig.chm
• %Windows%\help\msdasc.chm
• %Windows%\help\mshearts.chm
• %Windows%\help\mshearts.cnt
• %Windows%\help\mshearts.hlp
• %Windows%\help\msinfo32.chm
• %Windows%\help\msmq.chm
• %Windows%\help\msmqconcepts.chm
• %Windows%\help\msnauth.cnt
• %Windows%\help\msnauth.hlp
• %Windows%\help\msoe.chm
• %Windows%\help\msoe.hlp
• %Windows%\help\msoeacct.hlp
• %Windows%\help\msorcl32.chm
• %Windows%\help\mspaint.chm
• %Windows%\help\mspaint.hlp
• %Windows%\help\mstask.chm
• %Windows%\help\mstask.hlp
• %Windows%\help\mstsc.chm
• %Windows%\help\netcfg.chm
• %Windows%\help\netcfg.hlp
• %Windows%\help\network.chm
• %Windows%\help\newfeat1.chm
• %Windows%\help\newfeat1.hlp
• %Windows%\help\newfeat2.chm
• %Windows%\help\newfeat2.hlp
• %Windows%\help\newfeat3.chm
• %Windows%\help\newfeat3.hlp
• %Windows%\help\newfeat4.chm
• %Windows%\help\newfeat4.hlp
• %Windows%\help\newfeat5.chm
• %Windows%\help\newfeat5.hlp
• %Windows%\help\nmchat.chm
• %Windows%\help\nmwhiteb.chm
• %Windows%\help\nocontnt.cnt
• %Windows%\help\nofts.chm
• %Windows%\help\notepad.chm
• %Windows%\help\notepad.hlp
• %Windows%\help\ntart.chm
• %Windows%\help\ntbackup.chm
• %Windows%\help\ntbackup.hlp
• %Windows%\help\ntchowto.chm
• %Windows%\help\ntcmds.chm
• %Windows%\help\ntdef.chm
• %Windows%\help\nthelp.chm
• %Windows%\help\ntshared.chm
• %Windows%\help\ntshrui.hlp
• %Windows%\help\nusrmgr.chm
• %Windows%\help\nwdoc.chm
• %Windows%\help\nwdoc.hlp
• %Windows%\help\objsel.hlp
• %Windows%\help\odbcinst.chm
• %Windows%\help\odbcjet.chm
• %Windows%\help\oe_msgr.chm
• %Windows%\help\offlinefolders.chm
• %Windows%\help\omc.chm
• %Windows%\help\osk.chm
• %Windows%\help\osk.hlp
• %Windows%\help\packager.chm
• %Windows%\help\password.chm
• %Windows%\help\phowto.chm
• %Windows%\help\pinball.chm
• %Windows%\help\pinball.hlp
• %Windows%\help\plyr_err.chm
• %Windows%\help\printfnd.chm
• %Windows%\help\printing.chm
• %Windows%\help\progman.cnt
• %Windows%\help\progman.hlp
• %Windows%\help\pwrmn.chm
• %Windows%\help\pwrmn.hlp
• %Windows%\help\qosconcepts.chm
• %Windows%\help\ratings.chm
• %Windows%\help\ratings.cnt
• %Windows%\help\ratings.hlp
• %Windows%\help\rdesktop.chm
• %Windows%\help\reader.chm
• %Windows%\help\reader.hlp
• %Windows%\help\recycle.chm
• %Windows%\help\regedit.chm
• %Windows%\help\regedit.hlp
• %Windows%\help\regopt.chm
• %Windows%\help\remasst.chm
• %Windows%\help\reskit.chm
• %Windows%\help\rktools.chm
• %Windows%\help\rrc.chm
• %Windows%\help\rsm.chm
• %Windows%\help\rsm.hlp
• %Windows%\help\rsmconcepts.chm
• %Windows%\help\rsop.chm
• %Windows%\help\rsopsnp.chm
• %Windows%\help\rvse.chm
• %Windows%\help\safer.chm
• %Windows%\help\saferconcepts.chm
• %Windows%\help\sapicpl.hlp
• %Windows%\help\sc.chm
• %Windows%\help\scarddlg.hlp
• %Windows%\help\sce.chm
• %Windows%\help\sceconcepts.chm
• %Windows%\help\scm.chm
• %Windows%\help\scmconcepts.chm
• %Windows%\help\secauth.hlp
• %Windows%\help\secedit.chm
• %Windows%\help\secsetconcepts.chm
• %Windows%\help\secsettings.chm
• %Windows%\help\sendcmsg.chm
• %Windows%\help\sendcmsg.hlp
• %Windows%\help\sfmmgr.hlp
• %Windows%\help\shell.hlp
• %Windows%\help\shvl.chm
• %Windows%\help\signin.hlp
• %Windows%\help\sigverif.hlp
• %Windows%\help\smlogcfg.chm
• %Windows%\help\sndvol32.chm
• %Windows%\help\sndvol32.hlp
• %Windows%\help\sniffpol.dll
• %Windows%\help\snmpconcepts.chm
• %Windows%\help\snmpsnap.hlp
• %Windows%\help\sol.chm
• %Windows%\help\sol.hlp
• %Windows%\help\soundrec.chm
• %Windows%\help\soundrec.hlp
• %Windows%\help\sounds.chm
• %Windows%\help\spad.chm
• %Windows%\help\spconcepts.chm
• %Windows%\help\speech.chm
• %Windows%\help\spider.chm
• %Windows%\help\spider.hlp
• %Windows%\help\splash.chm
• %Windows%\help\spolsconcepts.chm
• %Windows%\help\sr_ui.chm
• %Windows%\help\sstub.dll
• %Windows%\help\supp_ed.chm
• %Windows%\help\suptools.chm
• %Windows%\help\sysdm.chm
• %Windows%\help\sysdm.hlp
• %Windows%\help\sysmon.chm
• %Windows%\help\sysmon.hlp
• %Windows%\help\sysprop.chm
• %Windows%\help\sysrestore.chm
• %Windows%\help\sysrestore.hlp
• %Windows%\help\system.chm
• %Windows%\help\sys_srv.chm
• %Windows%\help\tapi.chm
• %Windows%\help\tapi.hlp
• %Windows%\help\taskbar.chm
• %Windows%\help\taskmgr.chm
• %Windows%\help\taskmgr.hlp
• %Windows%\help\tcpip.chm
• %Windows%\help\tcpmon.hlp
• %Windows%\help\telnet.chm
• %Windows%\help\telnet.hlp
• %Windows%\help\timesrv.chm
• %Windows%\help\Tours
• %Windows%\help\tshoot.chm
• %Windows%\help\tshoot.dll
• %Windows%\help\twclient.chm
• %Windows%\help\twclient.hlp
• %Windows%\help\update.cnt
• %Windows%\help\update1.chm
• %Windows%\help\usercpl.chm
• %Windows%\help\users.hlp
• %Windows%\help\utilmgr.chm
• %Windows%\help\utilmgr.hlp
• %Windows%\help\verifier.hlp
• %Windows%\help\wab.chm
• %Windows%\help\wab.hlp
• %Windows%\help\wbemtest.chm
• %Windows%\help\webpub.chm
• %Windows%\help\whatsnew.chm
• %Windows%\help\winchat.chm
• %Windows%\help\winchat.hlp
• %Windows%\help\windows.chm
• %Windows%\help\windows.chq
• %Windows%\help\windows.cnt
• %Windows%\help\windows.hlp
• %Windows%\help\winhlp32.cnt
• %Windows%\help\winhlp32.hlp
• %Windows%\help\wininstl.chm
• %Windows%\help\winmine.chm
• %Windows%\help\winmine.hlp
• %Windows%\help\win_dos.chm
• %Windows%\help\wmic.chm
• %Windows%\help\wmifltr.chm
• %Windows%\help\wmplay.chm
• %Windows%\help\wmplayer.chm
• %Windows%\help\wordpad.chm
• %Windows%\help\wordpad.hlp
• %Windows%\help\wpa.chm
• %Windows%\help\wschelp.chm
• %Windows%\help\wscript.chm
• %Windows%\help\wscript.hlp
• %Windows%\help\wsecedit.hlp
• %Windows%\help\wshconcepts.chm
• %Windows%\help\wuau.chm
• %Windows%\help\wuauhelp.chm

Step 10

Restore these deleted registry keys/values from backup

*Note: Only Microsoft-related keys/values will be restored. If the malware/grayware also deleted registry keys/values related to programs that are not from Microsoft, please reinstall those programs on your computer.

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host
  • Settings

• In HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components
  • {random key}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • AFD

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Base

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Boot file system

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • CryptSvc

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Dhcp

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • dmboot.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • dmload.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • DnsCache

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • File system

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • HelpSvc

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • ipnat.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • LanmanWorkstation

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Messenger

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • NDIS Wrapper

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • NetBIOS

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • NetBT

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Netlogon

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot
  • Network

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • NtLmSsp

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • PlugPlay

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • PNP_TDI

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • rdpcdd.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • rdpwd.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • RpcSs

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • sermouse.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • sr.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Streams Drivers

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Tcpip

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • tdpipe.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • termservice

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • vgasave.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • WZCSVC

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E965-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E969-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E96B-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E972-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E974-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E977-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E97D-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {71A27CDD-812A-11D0-BEC7-08002BE2092F}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • AppMgmt

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • Boot Bus Extender

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • CryptSvc

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • dmadmin

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • dmio.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • dmserver

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • File system

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • HelpSvc

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • PCI Configuration

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • PNP Filter

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • RpcSs

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • sermouse.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • SRService

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • vga.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • WinMgmt

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {4D36E965-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {4D36E969-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {4D36E96B-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {4D36E977-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {4D36E97D-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {71A27CDD-812A-11D0-BEC7-08002BE2092F}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • AppMgmt

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Browser

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • dmadmin

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • dmserver

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Filter

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • LanmanServer

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • NDIS

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • NetBIOSGroup

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • NetMan

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • PCI Configuration

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Primary disk

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • rdsessmgr

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • SharedAccess

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • System Bus Extender

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • tdtcp.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • WinMgmt

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E967-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E96F-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E975-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E980-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • Base

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • DcomLaunch

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • dmload.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • Filter

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • PlugPlay

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • SCSI Class

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • System Bus Extender

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {36FC9E60-C465-11CF-8056-444553540000}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {4D36E96A-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {4D36E97B-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {745A17A0-74D3-11D0-B6FE-00A0C90F57DA}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Boot Bus Extender

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • dmio.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • ip6fw.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • Ndisuio

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • NetworkProvider

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • rdpdd.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • SRService

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • vga.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E96A-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E97B-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • Boot file system

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • EventLog

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • Primary disk

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • vgasave.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {4D36E96F-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • DcomLaunch

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • LmHosts

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • PNP Filter

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • TDI

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {4D36E973-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • dmboot.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • sr.sys

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {4D36E980-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • EventLog

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • SCSI Class

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {745A17A0-74D3-11D0-B6FE-00A0C90F57DA}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • Netlogon

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • NetDDEGroup

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal
  • {4D36E967-E325-11CE-BFC1-08002BE10318}

• In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network
  • {36FC9E60-C465-11CF-8056-444553540000}

• In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
  • Run