Rootkit.Sirefef.Spy und Trojaner Virus in system32 NT Kernel gefunden

SystemLook 30.07.11 by jpshortstuff
Log created at 23:30 on 27/05/2016 by user
Administrator - Elevation successful

========== regfind ==========

Searching for "nicesearches"
No data found.

Searching for "Elex-tech"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\iSafeKrnlBoot]
"ProgramPath"="C:\Program Files (x86)\Elex-tech\YAC"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\iSafeKrnlBoot]
"ProgramPath"="C:\Program Files (x86)\Elex-tech\YAC"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\iSafeKrnlBoot]
"ProgramPath"="C:\Program Files (x86)\Elex-tech\YAC"

Searching for "iSafe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\iSafeKrnlBoot]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\iSafeKrnlBoot]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\iSafeKrnlBoot]

Searching for "YAC"
[HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\AutoDiscover]
"yahoo.co.th"="C:\PROGRA~2\MICROS~2\Office12\OUTLOO~1\YACB7D~1.XML"
[HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\AutoDiscover]
"yahoo.com.sg"="C:\PROGRA~2\MICROS~2\Office12\OUTLOO~1\YAC50A~1.XML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91f39027-217f-11da-b2a4-000e7bbb2b09}\ProgID]
@="X509Enrollment.CX509EnrollmentPolicyActiveDirectory.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91f39027-217f-11da-b2a4-000e7bbb2b09}\VersionIndependentProgID]
@="X509Enrollment.CX509EnrollmentPolicyActiveDirectory"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\4F33FB1578E100649B629029A307DFB1]
"capsules.inf"="vUpAVX!!!!!!!!!MKKSkThemesTypicalFiles>YaCS-X8nF9@iZshLxJpa[^16]"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2FE9F084-1511-3052-BE7C-9010B522C10E}]
@="_QueryAccessibilityHelpEventArgs"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7197B56B-5FA1-31EF-B38B-62FEE737277F}]
@="IContextPropertyActivator"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Record\{BA99AE52-D539-362F-B78C-4E84C14158BF}\2.0.0.0]
"Class"="System.Security.Permissions.SecurityAction"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Record\{BA99AE52-D539-362F-B78C-4E84C14158BF}\4.0.0.0]
"Class"="System.Security.Permissions.SecurityAction"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91f39027-217f-11da-b2a4-000e7bbb2b09}\ProgID]
@="X509Enrollment.CX509EnrollmentPolicyActiveDirectory.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91f39027-217f-11da-b2a4-000e7bbb2b09}\VersionIndependentProgID]
@="X509Enrollment.CX509EnrollmentPolicyActiveDirectory"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0006302D-0000-0000-C000-000000000046}]
@="_PropertyAccessor"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2FE9F084-1511-3052-BE7C-9010B522C10E}]
@="_QueryAccessibilityHelpEventArgs"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{30642042-9221-4388-9C31-3DA8E1E33C33}]
@="IGrooveWebNotificationEntryActionData"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7197B56B-5FA1-31EF-B38B-62FEE737277F}]
@="IContextPropertyActivator"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B848D512-62C5-42FB-89B3-126098FCD11B}]
@="IGrooveTransportSecurityAccountDiagnosticsEntryEnum"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2DF7E6A-4D7F-4FF8-A30A-F01481A33268}]
@="IGrooveTransportSecurityAccountDiagnosticsEntry"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\X509Enrollment.CX509EnrollmentPolicyActiveDirectory]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\X509Enrollment.CX509EnrollmentPolicyActiveDirectory\CurVer]
@="X509Enrollment.CX509EnrollmentPolicyActiveDirectory.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\X509Enrollment.CX509EnrollmentPolicyActiveDirectory.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A7A66456F4FEBDF43B3908A64A8BB31B]
"00002109440070400000000000F01FEC"="C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\VBSnippets\1031\WindowsForms\Clipboard\CopyAClassInstanceToTheClipboard.snippet"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00002109030000000000000000F01FEC\Features]
"ThemesTypicalFiles"="bxw0=a+]F9mnkkP2Hm6$]MEU0l_RU@lnYR^6&3Ljc4[z+7M&ZAG+&hLw)33'&+kfoK]aH?%U!`PLGSF^{8o3@W9Oi@$ql,oq+EIgBW20SUnI,?oX,EeU2.h((Iws_6.mI=f.[hpJWu}.YaCS-X8nF9@iZshLxJpaHs01q3&g49DaROul[Q5^xh1~t9O*)?=X@H^fSzUTfLP)[R}~]=`*HC-s%t^r6RS$V.Ce&@JaZ^@+r&s@opc-xSfWu84%R=c)en=Q.^MBg*Ujq@dA3^P1'3IvvF[Q`*npm9P5'*9GtuIN]npHtm}T@A~^zPaK{(Ty?G{KwcoYv?eX&O^m'$`V4+dVX?lv&9HIrsgtrew[WesOi[4Ui9z$-?GSSLRa}71lgD~78@yEl@^=2s+lZD%mxVxx'=P@42z~arqWOjZ^h[tNn?aVDY.MC?84!K%7keYDM98F25q@h!Kl=i7-p.(_m8?3'RF?-KDtAaFWtOi[ZAQ3x@@G%I-FSpqPp}&S+=Uo(Mjl!bLzcI0!b-C'z?=8J{ySPY6k$yoeA0Akq@gh00',kc-mydMd%fu1*ATPGxK1_9%XKe)cVIzUt=Z=N.bf]DF?iIq$wIPU7@B+$5Vt-I$*wpW2sgBCp@xCdG6j(`sFTHEMESFiles"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\1735F6DB1CAD0F03D9EDAC6C97E1823C\Features]
"F_compilers_core_amd64"="`yFM`V.(j?5]i'AKuKOKJQ-fL.MGAAWWvkZC2t!Y(91'3NpGO@ya,]$={]vm(~u-_m8U!AL*w{j!wgZZ-mu'YIdC'AnZb-nwxX'gK?QEZcsQX9?=Z!pPD],5lM4p.ricy@JuL~@&9rDLpn@yjcvcW9{`5Gu3.3))c6N1LYaC!9DW`G*oh(@NNetFx_Full_amd64"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\12.0\Registration\{90120000-0030-0000-0000-0000000FF1CE}]
"Current"="TQBJAEMAUgBPAFMATwBGAFQALQBTAE8ARgBUAFcAQQBSAEUAIABMAEkAWgBFAE4AWgBCAEUAUwBUAEkATQBNAFUATgBHAEUATgANAAoAMgAwADAANwAgAE0ASQBDAFIATwBTAE8ARgBUACAATwBGAEYASQBDAEUAIABTAFkAUwBUAEUATQAtAEQARQBTAEsAVABPAFAALQBBAE4AVwBFAE4ARABVAE4ARwBTAFMATwBGAFQAVwBBAFIARQANAAoATgBhAGMAaABmAG8AbABnAGUAbgBkACAAZgBpAG4AZABlAG4AIABTAGkAZQAgAGQAcgBlAGkAIABzAGUAcABhAHIAYQB0AGUAIABUAGUAaQBsAGUAIABtAGkAdAAgAEwAaQB6AGUAbgB6AGIAZQBkAGkAbgBnAHUAbgBnAGUAbgAuACAATgB1AHIAIABlAGkAbgAgAFQAZQBpAGwAIABnAGkAbAB0ACAAZgD8AHIAIABTAGkAZQAuACAAVQBtACAAegB1ACAAYgBlAHMAdABpAG0AbQBlAG4ALAAgAHcAZQBsAGMAaABlACAATABpAHoAZQBuAHoAYgBlAGQAaQBuAGcAdQBuAGcAZQBuACAAZgD8AHIAIABTAGkAZQAgAGcAZQBsAHQAZQBuACwAIAD8AGIAZQByAHAAcgD8AGYAZQBuACAAUwBpAGUAIABkAGkAZQAgAEwAaQB6AGUAbgB6AGIAZQB6AGUAaQBjAGgAbgB1AG4AZwAsACAAZABpAGUAIABlAG4AdAB3AGUAZABlAHIAIABhAHUAZgAgAEkAaAByAGUAbQAgAFAAcgBvAGQAdQBjAHQAIABLAGUAeQAsACAAaQBuACAAZABlAHIAIABOAOQAaABlACAAZABlAHMA
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\12.0\User Settings\Outlook_AutoDiscover\Create\Software\Microsoft\Office\12.0\Outlook\AutoDiscover]
"yahoo.com.sg"="C:\PROGRA~2\MICROS~2\Office12\OUTLOO~1\YAC50A~1.XML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\12.0\User Settings\Outlook_AutoDiscover\Create\Software\Microsoft\Office\12.0\Outlook\AutoDiscover]
"yahoo.co.th"="C:\PROGRA~2\MICROS~2\Office12\OUTLOO~1\YACB7D~1.XML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{91f39027-217f-11da-b2a4-000e7bbb2b09}\ProgID]
@="X509Enrollment.CX509EnrollmentPolicyActiveDirectory.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{91f39027-217f-11da-b2a4-000e7bbb2b09}\VersionIndependentProgID]
@="X509Enrollment.CX509EnrollmentPolicyActiveDirectory"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{0006302D-0000-0000-C000-000000000046}]
@="_PropertyAccessor"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{2FE9F084-1511-3052-BE7C-9010B522C10E}]
@="_QueryAccessibilityHelpEventArgs"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{30642042-9221-4388-9C31-3DA8E1E33C33}]
@="IGrooveWebNotificationEntryActionData"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{7197B56B-5FA1-31EF-B38B-62FEE737277F}]
@="IContextPropertyActivator"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{B848D512-62C5-42FB-89B3-126098FCD11B}]
@="IGrooveTransportSecurityAccountDiagnosticsEntryEnum"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{E2DF7E6A-4D7F-4FF8-A30A-F01481A33268}]
@="IGrooveTransportSecurityAccountDiagnosticsEntry"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\iSafeKrnlBoot]
"ProgramPath"="C:\Program Files (x86)\Elex-tech\YAC"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\iSafeKrnlBoot]
"ProgramPath"="C:\Program Files (x86)\Elex-tech\YAC"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\iSafeKrnlBoot]
"ProgramPath"="C:\Program Files (x86)\Elex-tech\YAC"
[HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\0186KSEBY5amu_a85OiPeBQA]
"Response Wednesday, June 25, 2014 21:45:52"="AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA+YsHHWPl3EeBLwVEU/RAXgQAAAACAAAAAAAQZgAAAAEAACAAAAC043qA45cl+5AaqdoD4Y5xs1fbhgQ5ihunZbFUmp95IgAAAAAOgAAAAAIAACAAAADHdNYm+jY4ROVB2Ks+9DdHF6qwINTSSCVb1RhIXZuYfjAFAAAZix5t9B+lGutiENhzL6qx6eYq05Y67t2uuovkzhAANgYcir+Wv6rNt7tXgAEHK962CP2YbLuFtUM73ArhBXFpV9d+CU3CxnwWoOuUXBN1cyMXiHih0TIRaxJIvi+g6pl6VbN+V1sYi/wUwP7eOamVNimYkpy1xAz7GSywFP6WNM389fzN1SGf8nPhVcyEFu7pYeCCSi0R8i5T2TgmzKqO/giADVyUZl37MxXV5+ZbzZeSxVXb5QkuZkaQ7ydzJjXjr0sRQ/YaCZGgOWgUHjNtjx4H+pY10ZUl4jYt0iFK4RvNvwVu93UGR+j7MD1TSPXICy2IZU9tGvnSpAIh7JBHg1LWoi+1vSvRm9nP7bpGqOyaMn/djFoWhA4UdYk2pEg0mFBsvKn5euuQcHloyLWRXpOwoCvfrnddcF0PVAVDoh2mucotVwmpZnoHGtdA59Dak0AvEkcpfkgiInZLyjMLNH8ynftRSJSMWjccgbf8Hh9vL61NK4bFQ+7DGxcDhTJoY4e8qBZt/IDYKGiTqaXs/BqNa4znIJB1Z7uQ2obx+gIQUi9psd0JfqmEeXSUk/+eYiGLtF5UXshcwdG/PZx8Qy1re1owZJ+VIQXWBcekUj3JaAfhyPtD454rUkttLJX+5KNAM6vMAVmUDTIBNWK5Ip+QBpV2O+
[HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-1718339690-3013972182-446857107-1000\02lzqnfanptv]
"DeviceId"="<Data><User username="02LZQNFANPTV"><Pwd Det="false">AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA+YsHHWPl3EeBLwVEU/RAXgQAAAACAAAAAAAQZgAAAAEAACAAAADzyk8ckg+Z/fkcz6L5WEEUZzV/OEIT33FcbexAq4OUIgAAAAAOgAAAAAIAACAAAAByJLWSdSQwSESFJpT0iq5k/8/BNimZ2rza35zY9YkOzTAAAADSBfHgxuqO0zuY92uuZu2hr+kJBHlqmlUi+29UM9jom6+gkBCXl14CjYL5xwxotoRAAAAAoYnMi9ZzU/bzhoJLBvO7BkH2upHxjhA4/ZpzVcqWWjh93nPDkKZ7seGbDuj5TVgTo1/DxAu0jCUKHu9ERleixg==</Pwd><Certificate targetname="WindowsLive:(cert):name=02lzqnfanptv;serviceuri=msn-messenger-didc" keyword="Microsoft_WindowsLive:certificate:" type="1">PABDAGUAcgB0AEkAbgBmAG8APgA8AEsAZQB5AHAAYQBpAHIAPgBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAdwBaAFoAbwBXAFQAZABYAGwARQBtAEUAdQBBADgAcQA4AEwATQB3AFMAdwBRAEEAQQBBAEEAQwBBAEEAQQBBAEEAQQBBAFEAWgBnAEEAQQBBAEEARQBBAEEAQwBBAEEAQQBBAEIASAB0ADQAcwBqAGUAUwBwADIARQA4AFkAZwB0AEsAO
[HKEY_USERS\S-1-5-21-1718339690-3013972182-446857107-1000\Software\Microsoft\Office\12.0\Outlook\AutoDiscover]
"yahoo.co.th"="C:\PROGRA~2\MICROS~2\Office12\OUTLOO~1\YACB7D~1.XML"
[HKEY_USERS\S-1-5-21-1718339690-3013972182-446857107-1000\Software\Microsoft\Office\12.0\Outlook\AutoDiscover]
"yahoo.com.sg"="C:\PROGRA~2\MICROS~2\Office12\OUTLOO~1\YAC50A~1.XML"
[HKEY_USERS\S-1-5-18\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\0186KSEBY5amu_a85OiPeBQA]
"Response Wednesday, June 25, 2014 21:45:52"="AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA+YsHHWPl3EeBLwVEU/RAXgQAAAACAAAAAAAQZgAAAAEAACAAAAC043qA45cl+5AaqdoD4Y5xs1fbhgQ5ihunZbFUmp95IgAAAAAOgAAAAAIAACAAAADHdNYm+jY4ROVB2Ks+9DdHF6qwINTSSCVb1RhIXZuYfjAFAAAZix5t9B+lGutiENhzL6qx6eYq05Y67t2uuovkzhAANgYcir+Wv6rNt7tXgAEHK962CP2YbLuFtUM73ArhBXFpV9d+CU3CxnwWoOuUXBN1cyMXiHih0TIRaxJIvi+g6pl6VbN+V1sYi/wUwP7eOamVNimYkpy1xAz7GSywFP6WNM389fzN1SGf8nPhVcyEFu7pYeCCSi0R8i5T2TgmzKqO/giADVyUZl37MxXV5+ZbzZeSxVXb5QkuZkaQ7ydzJjXjr0sRQ/YaCZGgOWgUHjNtjx4H+pY10ZUl4jYt0iFK4RvNvwVu93UGR+j7MD1TSPXICy2IZU9tGvnSpAIh7JBHg1LWoi+1vSvRm9nP7bpGqOyaMn/djFoWhA4UdYk2pEg0mFBsvKn5euuQcHloyLWRXpOwoCvfrnddcF0PVAVDoh2mucotVwmpZnoHGtdA59Dak0AvEkcpfkgiInZLyjMLNH8ynftRSJSMWjccgbf8Hh9vL61NK4bFQ+7DGxcDhTJoY4e8qBZt/IDYKGiTqaXs/BqNa4znIJB1Z7uQ2obx+gIQUi9psd0JfqmEeXSUk/+eYiGLtF5UXshcwdG/PZx8Qy1re1owZJ+VIQXWBcekUj3JaAfhyPtD454rUkttLJX+5KNAM6vMAVmUDTIBNWK5Ip+QBpV2O+
[HKEY_USERS\S-1-5-18\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-1718339690-3013972182-446857107-1000\02lzqnfanptv]
"DeviceId"="<Data><User username="02LZQNFANPTV"><Pwd Det="false">AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA+YsHHWPl3EeBLwVEU/RAXgQAAAACAAAAAAAQZgAAAAEAACAAAADzyk8ckg+Z/fkcz6L5WEEUZzV/OEIT33FcbexAq4OUIgAAAAAOgAAAAAIAACAAAAByJLWSdSQwSESFJpT0iq5k/8/BNimZ2rza35zY9YkOzTAAAADSBfHgxuqO0zuY92uuZu2hr+kJBHlqmlUi+29UM9jom6+gkBCXl14CjYL5xwxotoRAAAAAoYnMi9ZzU/bzhoJLBvO7BkH2upHxjhA4/ZpzVcqWWjh93nPDkKZ7seGbDuj5TVgTo1/DxAu0jCUKHu9ERleixg==</Pwd><Certificate targetname="WindowsLive:(cert):name=02lzqnfanptv;serviceuri=msn-messenger-didc" keyword="Microsoft_WindowsLive:certificate:" type="1">PABDAGUAcgB0AEkAbgBmAG8APgA8AEsAZQB5AHAAYQBpAHIAPgBBAFEAQQBBAEEATgBDAE0AbgBkADgAQgBGAGQARQBSAGoASABvAEEAdwBFAC8AQwBsACsAcwBCAEEAQQBBAEEAdwBaAFoAbwBXAFQAZABYAGwARQBtAEUAdQBBADgAcQA4AEwATQB3AFMAdwBRAEEAQQBBAEEAQwBBAEEAQQBBAEEAQQBBAFEAWgBnAEEAQQBBAEEARQBBAEEAQwBBAEEAQQBBAEIASAB0ADQAcwBqAGUAUwBwADIARQA4AFkAZwB0AEsAO

Searching for "Guntony"
[HKEY_CURRENT_USER\Software\Guntony]
[HKEY_CURRENT_USER\Software\Classes\ChromeHTML\DefaultIcon]
@="C:\Program Files (x86)\Guntony\Guntony\chrome.exe,0"
[HKEY_CURRENT_USER\Software\Classes\ChromeHTML\shell\open\command]
@=""C:\Program Files (x86)\Guntony\Guntony\chrome.exe" "%1""
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities]
"ApplicationIcon"="C:\Program Files (x86)\Guntony\Guntony\chrome.exe,0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\DefaultIcon]
@="C:\Program Files (x86)\Guntony\Guntony\chrome.exe,0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\InstallInfo]
"ReinstallCommand"=""C:\Program Files (x86)\Guntony\Guntony\chrome.exe" "-ReinstallCommand""
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\InstallInfo]
"HideIconsCommand"=""C:\Program Files (x86)\Guntony\Guntony\chrome.exe" "-HideIconsCommand""
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\InstallInfo]
"ShowIconsCommand"=""C:\Program Files (x86)\Guntony\Guntony\chrome.exe" "-ShowIconsCommand""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Guntony]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Guntony]
"path"="C:\Program Files (x86)\Guntony\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Guntony]
"publicdirectroy"="C:\Users\Public\Documents\Guntony\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Guntony]
"publicdirectroy_log"="C:\Users\Public\Documents\Guntony\log\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Guntony]
"publicdirectroy_dump"="C:\Users\Public\Documents\Guntony\log\dump\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\Capabilities]
"ApplicationIcon"="C:\Program Files (x86)\Guntony\Guntony\chrome.exe,0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\DefaultIcon]
@="C:\Program Files (x86)\Guntony\Guntony\chrome.exe,0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\InstallInfo]
"ReinstallCommand"=""C:\Program Files (x86)\Guntony\Guntony\chrome.exe" "-ReinstallCommand""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\InstallInfo]
"HideIconsCommand"=""C:\Program Files (x86)\Guntony\Guntony\chrome.exe" "-HideIconsCommand""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\Google Chrome\InstallInfo]
"ShowIconsCommand"=""C:\Program Files (x86)\Guntony\Guntony\chrome.exe" "-ShowIconsCommand""
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{27C60F1F-7E7F-4B3C-B713-06D3263CB87D}"="v2.10|Action=Allow|Active=TRUE|Dir=In|App=C:\ProgramData\Guntony\protect\protect.exe|Name=Protect Service|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{EC1D2487-8B36-4655-97A5-1FD40416AA30}"="v2.10|Action=Allow|Active=TRUE|Dir=In|App=C:\Program Files (x86)\Guntony\Guntony\chrome.exe|Name=Chrome Browser|Desc=Chrome Browser|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{952C26F6-922A-405D-8899-D5E858F4EE28}"="v2.10|Action=Allow|Active=TRUE|Dir=In|App=C:\Program Files (x86)\Guntony\Guntony\bin\Guntony_server.exe|Name=Chrome Server|Desc=Chrome Server|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{27C60F1F-7E7F-4B3C-B713-06D3263CB87D}"="v2.10|Action=Allow|Active=TRUE|Dir=In|App=C:\ProgramData\Guntony\protect\protect.exe|Name=Protect Service|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{EC1D2487-8B36-4655-97A5-1FD40416AA30}"="v2.10|Action=Allow|Active=TRUE|Dir=In|App=C:\Program Files (x86)\Guntony\Guntony\chrome.exe|Name=Chrome Browser|Desc=Chrome Browser|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{952C26F6-922A-405D-8899-D5E858F4EE28}"="v2.10|Action=Allow|Active=TRUE|Dir=In|App=C:\Program Files (x86)\Guntony\Guntony\bin\Guntony_server.exe|Name=Chrome Server|Desc=Chrome Server|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{27C60F1F-7E7F-4B3C-B713-06D3263CB87D}"="v2.10|Action=Allow|Active=TRUE|Dir=In|App=C:\ProgramData\Guntony\protect\protect.exe|Name=Protect Service|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{EC1D2487-8B36-4655-97A5-1FD40416AA30}"="v2.10|Action=Allow|Active=TRUE|Dir=In|App=C:\Program Files (x86)\Guntony\Guntony\chrome.exe|Name=Chrome Browser|Desc=Chrome Browser|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{952C26F6-922A-405D-8899-D5E858F4EE28}"="v2.10|Action=Allow|Active=TRUE|Dir=In|App=C:\Program Files (x86)\Guntony\Guntony\bin\Guntony_server.exe|Name=Chrome Server|Desc=Chrome Server|"
[HKEY_USERS\S-1-5-21-1718339690-3013972182-446857107-1000\Software\Guntony]
[HKEY_USERS\S-1-5-21-1718339690-3013972182-446857107-1000\Software\Classes\ChromeHTML\DefaultIcon]
@="C:\Program Files (x86)\Guntony\Guntony\chrome.exe,0"
[HKEY_USERS\S-1-5-21-1718339690-3013972182-446857107-1000\Software\Classes\ChromeHTML\shell\open\command]
@=""C:\Program Files (x86)\Guntony\Guntony\chrome.exe" "%1""
[HKEY_USERS\S-1-5-21-1718339690-3013972182-446857107-1000_Classes\ChromeHTML\DefaultIcon]
@="C:\Program Files (x86)\Guntony\Guntony\chrome.exe,0"
[HKEY_USERS\S-1-5-21-1718339690-3013972182-446857107-1000_Classes\ChromeHTML\shell\open\command]
@=""C:\Program Files (x86)\Guntony\Guntony\chrome.exe" "%1""

-= EOF =-