Category: I got hacked

  • Strategies To Protect Yourself Against Identity Theft

    Identity theft is a serious crime that is growing each year. If you're a victim of identity theft you may spend months, even years, trying to repair a ruined credit history. A seriously damaged credit report can compromise your chances of getting a new job, a bank loan, insurance or even rental housing. It's even possible to be arrested for a crime you didn't commit if someone else has used your identity to break the law.

    Unfortunately, many of the methods that thieves use to steal identities are beyond your control to guard against. Although it's rare, even store clerks have been known to use their position to pass along information to identity thieves. There are some measures you can take, however, that will make it harder for a thief to steal your identity.

    Protect Your Credit Card Number When Making Purchases

    After you make a purchase and your credit or debit card has been swiped through a credit card terminal, check to make sure that the printed receipt hides all but the last 4 digits of your credit card account number (usually there will be Xs in place of the first 12 digits). Some terminals still print receipts that show all 16 digits of an account number, and may even include the expiration date as well. After your card is swiped, you're permitted by law to hide the first 12 digits of your account number on the copy of the receipt that the vendor keeps. Use any marking pen that will do the job.

    When you go to a restaurant, it's especially important to make sure that the first 12 digits of your credit card number are hidden on your receipt. You might be in the habit of signing it and then leaving the restaurant's copy on the table after your meal. An identity thief can easily steal the signed receipt before the waitperson comes back around to pick it up from the table. Don't take any chances.

    Do You Really Need To Give Your Social Security Number?

    Another important way that you can guard against identity theft is to avoid giving out your social security number unless it's absolutely required. Although you need to share your social security number when you apply for credit or for a bank account, sometimes a store or an organization will want to use it as an ID number, simply to identify you within their system. This is a common practice even though the law says that social security numbers aren't to be used as ID numbers. In these situations, use your judgment. There's usually an alternative if you ask.

    Destroy Documents That Contain Sensitive Personal Information

    Buy a paper shredder and use it to destroy documents you're throwing away which contain personal information such as credit card numbers, social security numbers, phone numbers and dates of birth. This is important to do both at home and at work. Identity thieves aren't above going through someone's trash to find valuable personal information that can help them obtain credit in your name.

    If The Worst Happens

    If you do become a victim of identity theft, take the following steps immediately:

    • Contact your credit card companies, close your accounts and ask to have new cards issued to you.
    • Place a fraud alert on your file with any one of the three major credit bureaus. The other two will be notified automatically.
    • File a police report. You may need it to show to creditors as proof of the crime.
    • File a complaint with the FTC, which maintains a database of identity theft cases used by law enforcement agencies for their investigations.
  • Comment Spammers Exploiting Open blogs

    I've recently experienced an increase in spam traffic on my blog.
    It started when I got about 20 comments in one day on one of my least
    popular articles.  I could see that the porn spammer had dug deep
    into my site and found a seemingly insignifigant article to place about
    100 links.  I deleted them imediately and blocked the IP from
    whince they came. 

    The very next day I had fifteen more.  I delete those and blocked
    that IP.  I've been forced to turn off my anonymous
    comments.  One of my favorite things about blogs is that anyone
    can say anything – they so refreshingly interactive that they create
    these close relationships with readers. 

    Unfortunately, casino, porn and pill spammers also see the power of
    blogs.  They target blogs with anonymous comments and
    trackbacks.  And they use thousands of hacked computers to act as
    proxies so that even if you block their IP they've got plenty more ways
    to get to you. 

    I've blocked them and I'm still seeing traffic coming from their sites
    which tells me that they have linked to my site and my visitors are
    clicking into their site then coming back to me. 

    Here is a list of Casino Spammers retreived from Netaloid.com

    “Finding our Poker Spammer’s identifying links is easy. Just
    visit one of his web pages by using one of the thousands of spam links
    he left on your site. Like poker.terashells.com, for instance. Then
    click on the links to the casino sites. You’ll see something like (or
    identical to) this:”

    http://www.pacificpoker.com/default.htm?sr=904970&flag=0002

    http://www.partypoker.com/index20100.htm?wm=2445773

    http://www.empirepoker.com/index.htm?wm=2170658

    http://banner.casinolasvegas.com/cgi-bin/redir.cgi?id=N&member=onlinecas&profile=lv2m

    http://www.888.com/default.htm?sr=611794&flag=0002

    http://www.starluckcasino.com/slcasino/links/56296.html

    http://www.aceclub.com/aceclub/links/1790.html

    http://www.reefclubcasino.com/default.htm?sr=806320&flag=0002

    For more on legally stopping Casino, Porn and other spammers visit:

    http://www.thepetitionsite.com/takeaction/353566831?ltl=1124161500

    http://www.theregister.co.uk/2005/01/31/link_spamer_interview/

  • 5 Simple ways to keep your computer secure and virus free

    These simple tips will help you stay virus and spyware free, even if you're connected to the internet 24 hours a day.

    1. Protect yourself

    Good protection on the Internet these days consists of 3 components: anti-virus software, anti-spyware software and a firewall.

    Good virus protection doesn't need to cost you a fortune. You can get excellent free anti-virus software at www.grisoft.com. Even the professional version of their software is very affordable.

    For spyware protection, go to www.lavasoft.de and download Ad-Aware SE Personal, also free. This will zap the most common spyware and adware found on the Internet.

    As for a firewall, Windows XP ships with a decent enough firewall. Just make sure it is always enabled. Alternatively you can visit a site like www.download.com and search for Zone Alarm, which has an excellent free version.

    The most important thing to keep in mind is that you need to keep your anti-virus software up to date. An anti-virus program that uses definitions that are months old is just about useless.

    Update your anti-virus and anti-spyware software at least once a week.

    2. Stop opening every attachment you receive.

    Most of the devastating worms and viruses of recent times were distributed via email. These viruses feed on the curiosity and also the ignorance of a huge number of email users. People will get an email from fakename@weirdsuspiciousdomain and they'll just open whatever file is attached to it.

    If you don't know the sender, don't open the attachment – just delete it. It doesn't matter if the subject promises you'll see Britney Spears dancing nude on the kitchen table, just delete it.

    If the email is from someone you know, always scan any attachments first before downloading or opening them.

    If every email user in the world followed these simple guidelines the distribution of viruses via email will grind to a halt.

    3. Stay clear of pornographic and illegal software sites

    *I know, I know… Why on earth go on the Internet if you can't have your porn and download it too?!  There are safe Porn sites but we will not address those in this blog… sorry.. Fark has some pretty good links to decent smutt.*

    If you want to pick up viruses and spyware quickly, visit some pornographic web sites. One wrong click on a subtle little pop-up or security warning window (which you'll run into often on these type of sites) and you'll have infested yourself with trojan horses, spyware, dialers and other unfavorable software that could leave your computer wide open to further attacks.

    The same goes for web sites distributing software, serial codes and cracks illegally (warez).

    Simply put – keep out of the dark side of the web and the odds of keeping your computer clean shifts decidedly in your favor.

    4. Watch out what you download

    Spyware is embedded in a lot of software on the Internet – especially those related to ripping, converting and playing music and videos. That free MP3 player or DVD Ripper you just downloaded may have installed a bunch of harmful spyware without you even knowing about it.

    5. Keep yourself informed

    Major anti-virus software developers like Symantec and Grisoft updates their sites regularly with the latest virus alerts. Visit these sites frequently to keep yourself aware of what threats are doing the rounds and how to avoid them.

    Using these simple and software I have kept my computer virus-free for the past 3 years. It's not rocket science. Just stay alert, use some common sense and you too can stay bug free while still enjoying your Internet experience.

     

    Tips on Broadband Security –>

    http://elamb.blogharbor.com/blog/BroadbandInternetSecurity

    Get rid of Trojans Smithfraud/HWclock.exe

  • Using VNC & SSH

    How to use VNC along with SSH to remotely and securely access your computer desktop by way of tunneling.

    VNC is a huge vulnerability on a network without encryption. Particularly on medium to large networks with lots of users. I use it at home but don't see the need for encryption there.

    read more | digg story

  • Use Google To Find Passwords

    Google hackers have been doing this for a while now. Here is a tutorial on finding passwords using google. This could be used to secure your own web server.

    Security Professionals charged with protecting IT infrastrutures would do well to become the most aggressive hacker of their own networks. This would help them to proactively seek out new exploits on their network, webserver, or IS they protect.

    read more | digg story

  • Whax How to (formerly known as whoppix)

    The WHAX Live CD OS (formerly known as WHOPPIX) has a useful knowledgebase of growing information on how to use its very modular features.

    I notice a few people coming to my blog to find tutorials on WHAX/Whoppix, but where you really want to go is here:

    http://iwhax.net/modules/xoopsfaq/

    If there is something you want to know just ask the WHAX gurus on their interactive site.  The Whoppix webpage looked nice but the creators of this incredible tool made a briliant move in this new interactive, blog howto structure.

    If you Whax guys read this, I suggest getting some trackbacks.

    read more | digg story

  • Hacking and Enlightenment: Ed and Me on hacking

    This is my conversation with ED on my misuse of the word hacker on one of my website:

    Whoa, whoa, ED…

    I think my wording has completely miss led you.  Here is my feeling about hackers:

    About Defcon13 and Hackers vs. “Security Pros”:
    http://elamb.blogharbor.com/blog/_archives/2005/6/2/904009.html#302474

    My discussion with Martin about hackers:
    http://www.mckeay.net/secure/archives/000450.html

    My thoughts on hacking and the non believers (at the bottom by Sun Tzu):
    http://elamb.blogharbor.com/hacked/igothacked.htm

    Dude, I love hackers.  I'd like to consider myself a hacker.. but I
    don't feel worthy.  I've got the passion but I don't have the gift. 
    I've already been to the Oracle (bad matrix joke).

    Perhaps I should reword that article.  I believe in taking the
    concept of hacking back to its original roots before it was hijacked by
    the media.  I DO NOT want to contribute to that dogma.

    The Phisher
    used a combination of mail fraud and manipulated email and even set up
    a server.  He probably got tons of money and merchandise from ebay
    customers. 

    Like computer and/or telecommunication devices, I beleive ANY system
    can be hacked.. email systems, smoke alarms in Delta air planes, bar
    code readers, RFID's, FEDEX, all can be reprogrammed, streamlined,
    reverse engineered,  exploited and manipulated for good or for evil
    purposes. 

    For me, that is what makes hacking so cool.  A true “hack” is done upon
    gaining a new understanding of a given system.  Of course, some hacks
    are discovered completely by accident, but the hacks that are done out
    of understanding, is like a form of enlightenment. 

    Check it out… Buddha hacked the Universe… (o.k. too much weed).
     
     

    On 6/13/05, ed <XXX@XXX.com> wrote:

    hey rob,

    this incident has absolutely nothing to do with hackers.  it's called “mail
    fraud” and “wire fraud”.  what computer or telecommunications system was
    “hacked” here?

    please
    call a spade a spade: the vast majority of hackers are not
    thieves.  sure, a few are–but that's like calling all car
    drivers “bank getaway car drivers.”

    you're not helping to solve
    the problem by blaming the wrong group of people.  you should
    be blaming criminals, not hackers–who have nothing to do with your
    unfortunate experience.

    thanks,

    -ed

    From: ME
    Subject: Phisherprice: Phishing on Ebay During the Holidays
    Date: 8 May 2005 16:13:28 -0700

    A
    hacker tried to get a free phone using a phishing technique that I had
    never heard of.  The phisher used a Western Union Auction
    Money order form (a fake number) and actually sent me the fedex lable
    and had
    fedex come to my house to pick up the phone.  Even though I didn't have the cash for the phone yet.

    The Phishing exploit relies on the buyers greed and the feverish haste of holiday spending.

    Here is the phishing exploit in detail:
    http://elamb.blogharbor.com/hacked/phisherprice.htm

    rob
    http://elamb.org

  • What a Virus looks like on Hijackthis

    My buddy got some crazy virus that nuked his system.  Hijackthis
    could remove all this, but I've decided to wipe his system and start
    from scratch.

    Typically, you should not use Hijackthis unless you know what you are doing.  Here is a tutorial on Hijackthis.

    But if you have this kind of situation, you could easily see which items to delete.

    /Start of LOG/

    Logfile of HijackThis v1.97.7
    Scan saved at 9:24:24 PM, on 6/4/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Documents and Settingsxxxxxxx\Desktop\HijackThis.exe

    R1 – HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
    R1 – HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm
    R0 – HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/index.htm
    R1 – HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    R0 – HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
    R1 – HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    R0 – HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 – HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50141
    R1 – HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm
    R1 – HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.windowws.cc/hp.htm?id=632
    R1 – HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50141
    R3 – URLSearchHook: (no name) – {87766247-311C-43B4-8499-3D5FEC94A183} – C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
    O2 – BHO: (no name) – {01F44A8A-8C97-4325-A378-76E68DC4AB2E} – C:\WINDOWS\systb.dll
    O2 – BHO: (no name) – {02478D38-C3F9-4efb-9B51-7695ECA05670} – C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll
    O2 – BHO: (no name) – {12EE7A5E-0674-42f9-A76A-000000004D00} – C:\WINDOWS\System32\stlb2.dll
    O2 – BHO: (no name) – {7CD20E91-1F31-41da-8379-479EA31DF969} – c:\Program Files\XML\XML.dll
    O2 – BHO: (no name) – {87766247-311C-43B4-8499-3D5FEC94A183} – C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
    O2 – BHO: (no name) – {AA58ED58-01DD-4d91-8333-CF10577473F7} – c:\program files\google\googletoolbar2.dll
    O2 – BHO: (no name) – {CD231011-8FD9-8B23-D73B-F94DF3F378BF} – C:\WINDOWS\System32\bglncgy.dll
    O3 – Toolbar: McAfee VirusScan – {BA52B914-B692-46c4-B683-905236F6F655} – c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O3 – Toolbar: &Google – {2318C2B1-4965-11d4-9B18-009027A5CD4F} – c:\program files\google\googletoolbar2.dll
    O3 – Toolbar: &Yahoo! Companion –
    {EF99BD32-C1FB-11D2-892F-0090271D4F88} –
    C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll
    O3 – Toolbar: Search – {12EE7A5E-0674-42f9-A76B-000000004D00} – C:\WINDOWS\System32\stlb2.dll
    O3 – Toolbar: (no name) – {BDF6CE3D-F5C5-4462-9814-3C8EAC330CA8} – (no file)
    O3 – Toolbar: (no name) – {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} – (no file)
    O3 – Toolbar: AOL Toolbar – {4982D40A-C53B-4615-B15B-B5B5E98D167C} – C:\Program Files\AOL Toolbar\toolbar.dll
    O4 – HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 – HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
    O4 – HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 – HKLM\..\Run: [PCMService] “C:\Program Files\Dell\Media Experience\PCMService.exe”
    O4 – HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
    O4 – HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
    O4 – HKLM\..\Run: [Dell AIO Printer A940] “C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe”
    O4 – HKLM\..\Run: [eynvcahimk] C:\WINDOWS\System32\hvrpyxes.exe
    O4 – HKLM\..\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot
    O4 – HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain
    O4 – HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
    O4 – HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
    O4 – HKLM\..\Run: [Spyware remover] C:\WINDOWS\Remove_spyware.exe
    O4 – HKLM\..\Run: [Breg] “C:\Program Files\Common Files\Java\breg.exe”
    O4 – HKLM\..\Run: [Dvx] C:\WINDOWS\System32\wsxsvc\wsxsvc.exe
    O4 – HKLM\..\Run: [vmss] C:\WINDOWS\System32\vmss\vmss.exe
    O4 – HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
    O4 – HKLM\..\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime
    O4 – HKLM\..\Run: [AOL Spyware Protection] “C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe”
    O4 – HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    O4 – HKLM\..\Run: [Pure Networks Port Magic] “C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe” -Run
    O4 – HKLM\..\Run: [Agent Messenger] C:\WINDOWS\system32\netaimsg.exe
    O4 – HKLM\..\Run: [Windows Task Manager] c:\windows\system32\taskmg.exe
    O4 – HKLM\..\Run: [Player Explorer] C:\WINDOWS\system32\upnpfgnt.exe
    O4 – HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
    O4 – HKLM\..\Run: [BTV] C:\Program Files\BTV\btv.exe
    O4 – HKCU\..\Run: [jopa] C:\WINDOWS\System32\sysstartup.exe
    O4 – HKCU\..\Run: [uninstal] regsvr32 /u /s image.dll
    O4 – HKCU\..\Run: [PopUpStopperFreeEdition] “D:\Pop-Up Stopper Free Edition\PSFree.exe”
    O4 – HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
    O4 – HKCU\..\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background
    O4 – HKCU\..\Run: [Aida] C:\Documents and Settings\xxxxxxs\Application Data\eetu.exe
    O4 – HKCU\..\Run: [Codm] C:\WINDOWS\System32\w?auclt.exe
    O4 – HKCU\..\Run: [kvuiulm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [WindowsFY] c:\wp.exe
    O4 – HKCU\..\Run: [ihitlwq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ldbxlgl] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [udlehdl] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [uoedtft] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [evlalkp] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [sjjrwjx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [pdtvhkd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fwrgrct] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qsdyslc] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [aaybuvj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jgyjpix] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [hygmbrw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [wehewbp] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vnlvrxc] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [floooap] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mgkfpbv] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lvnkqvy] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dteaidf] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [drijnnm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [obpitds] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [degnopr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [etmmtmy] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [okjvkgo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jvnjngk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ltwqurd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [awbftdt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dbmfpju] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ktxcwmm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [owdsokp] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ijsxppm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [khgqnff] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rdeutao] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vwavbpq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bvcisnp] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [krfhhud] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fqhbquo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mpeaawe] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [cpjvnrk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nbdcjki] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [wbdpftr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [huyxlgq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xfvpwve] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xudynof] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [cookxmu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ktugikh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [kuujywh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nmulcxe] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [hdqobjn] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xmfhghh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [loynujq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ngqvcpm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [wcafafj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ngybekx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nflyebn] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [cexbnmt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tjqmdtc] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gclcxju] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qkdaadd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dtcplqx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [cenlmwq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [hctoghc] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tetmkwj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ukwngco] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xgnbnhs] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [iaubefo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tjelaxm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ntnfsua] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [yjryqrm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [roqprox] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tbjgxuv] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fgxmmlq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [duktyme] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [paqptny] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gaxmgil] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [llvnurx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ksnnbba] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [finrqqq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [iexwvbv] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [unesfss] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [kqucmfm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [aasuvbm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tyigbro] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ruvtfnj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dustsso] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [sfmxoan] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lxdkiod] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [axmhbny] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ntykqoy] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xhcgrls] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ewlfvcg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [wodegxo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jqmfgqb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [phaacfy] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [hruikce] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gsqfkdg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vtqvlxi] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [didjsoi] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lkjiwkq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qgaevdk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gwphpcm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qawkari] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [hwwlcdj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vdhsiex] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ptfpivo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xwnbqda] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [yefukgv] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [odvirvi] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [momgenh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [cyhbibe] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bxhylxw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dargpwa] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [piorfib] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [cbkwjxo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [cwiirbq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [efpidhi] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nicjvuh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qeqrjtc] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jgcnhnu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jcegqaa] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jpgxlll] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [sbdeysx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nfaxuxu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [yjfbhfb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [niasywm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lrsqmlt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ihkdpsy] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tstkruc] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fghdvqt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [onitrla] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [evqcwvu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [kcjlwvo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [iehhjej] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ebsujqx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bnkdecb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [leiopbx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [akkaqph] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [pgcfbuv] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [aotqbna] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vtrpkar] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mbqxedq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vxauuxk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [akliuxo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [pjpqyyu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nstdois] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lisptsp] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [kbxvgjo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [pmmvbys] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [hrkkfqj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [aijvxyc] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [umuxfju] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gcdrblp] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [blgxvya] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [cdyvsbk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tcuglpm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bcyosoo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rfjjmvx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qmwvxia] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ifaldfa] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [luhyvsu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qfgtacl] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xhvhbqp] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ulcxqgp] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jgfgabs] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jiakscc] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dwbigqf] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nemvfdd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dtgubqj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dhrvfkt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [yrqcykm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [kxpfqbo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vibqdhg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qiiwxaw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [kjokoqv] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rwwnbma] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [hbbscpw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xkejxxu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lmbxbho] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [phfyiow] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nnfneqt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qwwfoms] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [twnwtwc] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fxveelg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [sknjykp] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [futhexy] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gdcfadg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tkwhlaw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qsdxuam] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [eiwnqrg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [aujfvdh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tuexcyk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jkknokf] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xggojyu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qgbwsye] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jbrvsmq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [eqfvksf] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [pkcyoco] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jsumdct] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [efqhiqs] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [yjecjob] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [obwajwi] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [iwpqisa] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bdrowuf] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [esqqdsi] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fjtofia] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nkxjbka] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nreegbj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gkdfphb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mymgott] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lftuejl] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [sldtooi] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ogjqsjt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ucvevlg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qachhwo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [avswfhh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xkmydkr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qhowtxt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qsugrvk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nxhficq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jdhjsqb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [cuunhoj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jwbfsfa] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dkleokh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rxgvolb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [sxdleyf] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [aejosgr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tllbsnq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ieamjyh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [glskshq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qrvtlfc] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mxjaody] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bkfghjt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [deshmuk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bolycoi] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xwduhro] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [kwavoie] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ihggwiu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [chwfspm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ycuxlyu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qybugob] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ywopwoy] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [sfhhatj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rgtjmin] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [hoqjwey] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [agnpvrw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [owwnafc] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rqytlgb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xofifcs] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [allpyqt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nqoauax] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [alacrtm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tgbdsnm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rrktfrd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [owvhbvu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ufitpyu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [kvarokd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ttphutb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ireiyhg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [aklpggf] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mufkbvf] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mmhaawh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [wadpriq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [wogqbxb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lhoylnh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lfbpwul] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lklygro] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ycwcmqh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dswmqfb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gdbktdh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [wflkbms] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [olhiutm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mdxisbq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ateieau] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rdaipjh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lodxstd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [hlsywdq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [klgyklm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [irvekfd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rncixts] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [uhtdxxk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [audgduj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [hnsmgjv] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [etcbcaa] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mbemyqd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fyyqhgm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lapygid] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jqikhce] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qotugtf] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [timwoas] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ylwdkvu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bsrrvpy] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fknurjg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [oqyehci] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [wvmohsb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vnsuvob] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [hlkaqri] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [itnuwnt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vbdqsyr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fnambpa] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [yfwvpjh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dwkhsxg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [uhllmjh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ryfckun] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [wgwmtfq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jdbiusr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [prixxwg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [yegnuut] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [duesxgd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ftfoiwx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tpvpvdg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mvpguik] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [pajdamo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jxksocb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fcsqatf] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xsnferv] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [blfqrdg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [uttliji] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vjistyn] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [exartel] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mntxieb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ldnfvkr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gfwabuk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [uhejcoq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [canylqr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rwbhjbr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mjvdstt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vbkdbjf] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qjudnit] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jibtvsv] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qeuanft] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nynennj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lfpeqxc] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [hsrjowq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qsuumpq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ucathpb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ywdacru] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [toykbla] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vnpcweg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gwchjjc] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [kprwgqp] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rgttnde] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [suujwjy] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nwbdchg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [medbdjx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ujbwpdc] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [raxlaay] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [idjrmtq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [civwcac] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tcbpfgn] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ofucdbo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tjvecsu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bdbuncl] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [munaypg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nopyvwc] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [hvxspau] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rlydpru] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bjvrcxh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mudtmsj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [iltgsvo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [okybvbh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jnhjbba] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dnwanet] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xglgogb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fsupywt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [upcxegk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gtkankk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [kahanmh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tjtqjyw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [wpslive] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [sjitmbj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fmtiakt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [srxpbjk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [axdytlc] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bmpaxdu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [iyypxdl] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mffqbch] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [brvqppy] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [axtyhwg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gspppec] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [frskkiw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fbdlrca] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nqamsxr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [niknick] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jvveode] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [pwggfiw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dgkxsyv] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lfyyawd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [prkniow] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [wbqtiya] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ugfyyxi] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tbisakj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [daanikr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [awclxer] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qrusuqt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jeuurur] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [uqbnujo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [apwkidi] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lmenbeb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ycnkhxi] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [kdyejqr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lucixop] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [pvuargo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [uufthvk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qcnfnlu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jwpnwyo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nuexmug] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gkugkgd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rmtqmfl] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tlouwgc] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nnpctey] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rkiceuv] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xjmmvea] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lqgjrbq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lytmbwl] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ycejosk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ocgsevy] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nwltygx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jxrxrus] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gfjeudh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [krojvje] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jbqwvhs] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fyygrqe] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [pdpfxlr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mpdhpxt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [axexsth] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nkxcfms] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [unqyobx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [uwacjit] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bujdvsk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ddywnec] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xogooji] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xrwgshx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [etuxeiq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [uqmukqw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [aqnttps] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tqcxwxb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [aemutwn] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bxjqypw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vmesock] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fnxvche] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [reyhust] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [pnvxktf] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [pwnfrqm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [wkuioor] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [pyqsaij] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [hgbnogk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nxshxcy] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [sglhatq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ykwkoau] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [phwyqft] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ppclpqw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [siayjcx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [sjelncj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ocicbel] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [iaehpls] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rrkbmeh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bgipumf] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [cjrcums] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fcxvrxk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vkjovwr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dgulqgm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bvrnkrb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [svyemgl] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ljqrfkl] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tyrckts] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rmtcpbj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [uuribqh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qjjyiwl] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [evaefjv] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lccrvxf] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nnoqncm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dswxpve] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [olvwrrm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [npxjejy] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [yaeduos] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qqigvoe] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xarwmdb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ursdrgb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rfnxloe] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [wuooumy] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qyjbiix] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [faiapay] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [offwbjp] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dolncum] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fdmsfnv] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rueyovr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [janqcuq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vobqpsa] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [wjjkncu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [sflslkt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nssprkt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ldrelco] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mymtnvm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [cuhyfam] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vegsexu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bqkgnoa] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xamrapg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [oaawhea] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dbtrtvu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xdwpdkf] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [axkycpl] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nkhnpbs] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [uumoirm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mmsqtnh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [buyovup] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rkflyvh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [spjydoe] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tcrkvfs] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [pxpfyoo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vmstygw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xdewgpg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [efthhnr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fdroovr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ltmcnyi] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [avsqqhc] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [einhfob] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [yivesub] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [khkjryk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ekevnyn] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [audssdr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fvadffo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [sqpafdw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [sgbheks] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [haselyr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ibrlirh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [cgprinw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tvoyqxp] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [uyipjjj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jlyphnp] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [twrfkxw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xhsxkex] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ewkbklq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [snbpftf] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dcuqrga] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bqmedhn] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lgqtgtg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vvddpuo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jpdevyf] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vlcvenm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [wpnbvpr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [wrqchvw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gvwyuol] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qdculqh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ruefelp] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [llovqhm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rfsdixx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xiqvbga] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [movnaly] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fbocwdu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [psyuvvc] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gnqnxjo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gswbmxe] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rhcsfmu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [kioxykd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tjxcruv] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vwbuyph] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vnqvvyu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vhoeglu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xemlaqx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [utonkih] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [uuxrnee] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qvcaxby] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ffpdrnh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ynmolec] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [oqeljaa] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ciooovn] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ujccyiv] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bltbtfw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [sbblkir] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xxbnsos] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [hjjvnji] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [pdmmyth] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ykcvgev] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vwdeqmi] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ikwgbcl] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mdycdum] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bmurxir] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [hclfars] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [hkaptfy] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qedkpml] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fiwwoqd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [cirunsi] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bqmhlkw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rukkrqd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [cfiavrx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [extlrbl] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [pakcupu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [uuiigbr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [hlqixwy] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gecykes] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tmnujla] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ekftlyn] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [yreuegj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nnsitjh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [wrmkbvm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vbuklor] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tiaumou] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [himsreu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ngtwxfm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jngebkw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ibnklcl] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rbimolv] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bdgcvcj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lqgxmtt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bcfwrsk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mvjwahy] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lhbxekx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qmhqwdc] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ruebspt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nabgnbu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [byvamdp] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fbxghtt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dfcxoov] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rfmufao] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [acetenq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [kmwmawk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ddmvkkj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ieopjvw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fwljfrh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rpfynjd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [uwyhmpp] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dabnhwf] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ubfquww] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [yklcdwx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [npjulkp] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tpwdxsw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ymhxfcg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mibupsv] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mswdjpk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nelrnmk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [podedkq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nwgwuvd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [liivese] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bplbikq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [aossrne] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [aakoopm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [iuiomqj] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [awmqihw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mdcixau] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [hkhpebe] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [cylsjvb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [urxhvte] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [eteerxp] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tfagfig] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fulosaw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gphiixk] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [pehodea] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nelcdft] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mrkdikn] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [esjiyqn] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nuddjyw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [chiyaow] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rxxbghr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gaiijas] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lfapkhu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gdlefqf] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gdjptjh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qucjjvt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jmduree] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [kivadrs] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ytbsuhu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [pdiwncv] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ospppjm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [oawasei] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [smgrvyi] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ghtfygd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [emvvpqm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xfrsllq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [cprgmds] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [gekwbvr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vfofkih] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mhctrbo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ankperx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lumhwtv] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ppagbnq] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [xnxrped] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qdgfxfd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [pqauivi] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ifihktd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bhfwtdy] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [wjtsvht] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [cgorkfi] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nqlkxlh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qskovth] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [cnsaddb] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [njvwcuw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [egnggcv] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dajujud] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tuycktt] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [otqdbpy] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ckydbyx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fyuffmr] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [kptyrtw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [kjbueip] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [wxuumle] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [pgieovg] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [wcbsulh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rusymth] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [nqpofkw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [sdrojgo] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lonilji] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [awadpeu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [buycqtl] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [iovvesa] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dyuonvw] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [sadgqsv] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [ihkicuh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [hyitrls] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [qgsexil] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [oolusav] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [oltpesd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [dhjqrgu] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [atlljtn] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [jkoprki] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fdkjlyd] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [vwaajyn] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [fvrnxhp] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tgmqxne] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [lmfgltf] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [rnhshvn] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [wfwatim] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [veyiwtm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [bbwaxme] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [mdpscfx] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [agiguhm] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [tamawmh] c:\windows\okmkbem.exe
    O4 – HKCU\..\Run: [guplslb] c:\windows\ipguxxe.exe
    O4 – HKCU\..\Run: [exfvvcu] c:\windows\ipguxxe.exe
    O4 – HKCU\..\Run: [gjsvicr] c:\windows\chpwubt.exe
    O4 – HKCU\..\Run: [xuattvf] c:\windows\chpwubt.exe
    O4 – HKCU\..\Run: [cbcbvbt] c:\windows\chpwubt.exe
    O4 – HKCU\..\Run: [medyuru] c:\windows\jtdbcma.exe
    O4 – HKCU\..\Run: [ywrropi] c:\windows\jtdbcma.exe
    O4 – HKCU\..\Run: [phwmjhj] c:\windows\jtdbcma.exe
    O4 – HKCU\..\Run: [tmmlkil] c:\windows\jtdbcma.exe
    O4 – HKCU\..\Run: [bvpuhqe] c:\windows\jtdbcma.exe
    O4 – HKCU\..\Run: [dhgehnm] c:\windows\jtdbcma.exe
    O4 – HKCU\..\Run: [giavqsy] c:\windows\jtdbcma.exe
    O4 – HKCU\..\Run: [cnesvmg] c:\windows\jtdbcma.exe
    O4 – HKCU\..\Run: [bnrwbsh] c:\windows\jtdbcma.exe
    O4 – HKCU\..\Run: [rhhcepp] c:\windows\jtdbcma.exe
    O4 – HKCU\..\Run: [tfltpbw] c:\windows\jtdbcma.exe
    O4 – HKCU\..\Run: [uttxdjo] c:\windows\jtdbcma.exe
    O4 – HKCU\..\Run: [qfiktri] c:\windows\jtdbcma.exe
    O4 – HKCU\..\Run: [lcxdata] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [nwtyjkl] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [bjaqhdl] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ovbqyrt] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ikgluiu] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [cksccpd] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [jesopvx] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ogdeiuj] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [wahujun] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [iwtdynl] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [bdtumco] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [vuyktxe] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [qccmkxd] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [giyxhoy] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [pkeecxg] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [jevxkrf] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [sjmedaj] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [remjeun] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [wqpdaku] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [dxfyxhs] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [hdnootd] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [pbdsvvt] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [hwvjvku] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [jlpysml] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [lanqljk] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [fyddyww] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [uptfyva] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [mviwdor] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [raljsiv] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [cesanmh] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [kpqwbgj] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [qwbsles] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [vjrtnim] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [nawohpj] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [xvfeack] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [oynykip] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [nrvpkkk] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [owcdwob] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [qqcuiie] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [xbgxajv] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [cojxpqk] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [jhvrwwp] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ejptiss] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [mphhctd] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [xwccegt] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [dqpfgif] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [qjkvblx] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [jmsnfhx] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [qjeqcmx] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ohdfguv] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [fehdufd] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [baogxqf] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [fwonqny] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [vjncugr] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [udqfbeu] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [tqkuctd] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [hexmklr] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [yusqspb] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [qojyuvg] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [phxmwlv] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [esaqoex] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [whekrua] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [inkpsci] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [pvtgdka] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [fxrxclk] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [pcogoqy] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [xwomhye] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [clewifl] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [uxhhtqm] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ncqorsn] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ifchcrq] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [tgqqbhd] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ukqnrvq] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [nsrbuky] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [grkmvpj] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ykroxrm] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [mtmhcrl] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [dvfsmuf] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [qctxsfe] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [uykayfj] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [xwhvwja] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [uswvgoe] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [rqaeovw] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [jwiargq] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ydwjnnr] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [byxvqas] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [bcfvwxx] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [wyvrhru] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [phgllex] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [qmbepwi] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [cmhhfod] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [xqhvwwv] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [fnakcrv] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [viwomln] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [bivtfwh] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [qdfgsss] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [jgixfsw] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [kuxkjhy] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [efudypa] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [wficghg] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [odmhxeq] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [aecjejs] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [bcybcee] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [kgdmjbp] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [yapxbaj] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [juhpwvh] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [nwwnuqu] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [bbpwrrd] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [uthvfit] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [gblmsdc] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ftklkpu] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [axuopbb] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [mkiaygr] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ycvqitf] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [mtltdgk] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [vnsvoba] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [vvmxfvs] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [haywyid] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [qxshpab] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [wtvuery] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ixywbed] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [tpgerki] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [gegsxwa] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [gvupmxq] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [cljmhye] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [wlnjooc] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [effkubb] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [bdgwdql] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [hvddkvb] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [irbnuga] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [upqqvxh] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [tdigloy] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [filkwdn] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [aewkarv] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [lmxeqgo] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [dknruft] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [lvslhsp] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [jduvhxf] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [cssmbql] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [nliastb] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [evlomgg] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [niwioqc] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [brnlhbq] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ftsiygk] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [fktnxsb] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [oycdqfr] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [shiogfb] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [hremxbh] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [iagasru] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ongelmc] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [gxkpnvy] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [djdiqia] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ipnctbl] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [utibeyv] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ghxuupe] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [irulcof] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ilapfcm] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [espsomv] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ilrouvm] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [derjfro] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [vdnugjx] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ylyyaiv] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [astpqti] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [lbnbjbn] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [dmbkroq] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ngrqtae] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [eqesafr] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ecsjiec] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [fkkkwrm] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [chifdkm] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [dvrwgon] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [elenlxg] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [cawiapo] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [avcfrnl] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [sbkarwo] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [rvyoagw] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [bkarhle] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [dasrioi] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [pajcrqd] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [liypggk] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [upfkcck] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [wrgostt] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ninwxun] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ufqmqbl] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [nsljdlx] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ipmffho] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [iqceoqa] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [xbpcbsm] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [gnaqvfk] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [pgupekc] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ehmhlti] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [cqlvwin] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [xragfwp] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [vqufffe] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [wkwoebn] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [tvgeksy] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [soidjrq] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [qmcafmv] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [xvxsllj] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [uqmstna] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [bfdcjkc] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [aywbpau] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [tcmhgfk] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [sxnfhdp] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [wgpvtng] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [rspcrbi] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [xeeevlj] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [sojkpqy] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [wvosnye] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ftusnqu] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [gphvfky] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [dhlwwqj] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [prhxhef] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [horclim] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [dkgdbfn] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [gpdkbjt] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [tveaqyq] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [vtscxde] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [oxkgavu] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [wuofvml] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [grfkfln] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [gfpyapy] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [kxvqycn] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [hwgodcv] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [lyasvce] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [mxqrmqs] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ojsbend] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [mkvhaoe] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [kpgkxod] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [jcrkwlc] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [hikghjm] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [jmrycra] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [xtkuhpm] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ssovvmw] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [detgulm] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ysrqpkd] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [yonaudw] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [obcwgly] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [hfdycdx] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [pguaqvd] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [oiwbfad] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [gylslev] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [uutlpjx] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [bkyagfc] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ffmjlcs] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ujbqglj] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ritkdlw] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [symhtti] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [akcjvfs] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [vueelfk] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [dxpswcy] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [wwakutb] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [twpqkwj] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [drqrthr] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [prxrsgw] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [xiaqsjy] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [hlyqrot] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [jxpuakf] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [hhaqken] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [iopcmod] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [npryjip] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [rbatmbe] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [xhuisht] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [cxehefn] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [tmqvevt] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [rfnbapm] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [kthirdb] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ssyovst] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [sxrndmc] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [rxcmbyp] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [mkkmqia] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [pgcpbju] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [bgkwucc] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [vdsbdve] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [lknkrkj] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [aovrsxo] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [aesnmyo] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [lcycujq] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [vkivnwj] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [mpnhqsr] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [dysrhuf] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [xkwuyga] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [djkbyft] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [tbhljpg] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [eeffjro] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [htnrarn] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [lsylxnf] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [hhohpti] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [jrkggxk] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [beryxei] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [calwsub] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [dfxghtu] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [nnsrtbr] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [qpqcrpf] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [naibdpe] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [fjsuvnc] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [kyinmsa] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [mbtbfbf] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [sstcrel] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ruuqjcn] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [qjyhtsl] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [dngwrvk] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ecguvin] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [yycirsl] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ecpnxvf] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [nxrfulm] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [gdgiejo] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [upknsvs] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [inagmwh] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [gxaltin] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [hvdklxv] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [uxcpqtg] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ayohkkg] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [odymqbp] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [tamvbdo] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [igraxya] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [wmxveyr] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [squxlcp] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [piebwji] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [rdrqsrk] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [octuaug] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [cjcqktt] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [fesiuhb] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [peclvdf] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ujfjdxy] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [htgfbhm] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ssflrql] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [bfgsddb] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [tqweuxh] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [pulgppw] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [gswbnly] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [rvkoolh] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [avjbsam] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [vxbyvip] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ylvxwog] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ytojlko] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [wkxjaym] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [txmoprn] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [lsssucw] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [fmagqwn] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [qigilyn] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [fauptog] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [pwjefwe] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [aialqjn] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [oxanuov] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [hpmpoiy] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [foopwrr] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ghpswwh] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [hvtkuui] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ljbjrrf] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ssslvdd] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [jfgxwsq] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [telsouh] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [xduhnwh] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [spnnmnu] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ojmjmpf] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [tcetlab] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [qtjdike] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [drqprvm] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [wsnguoy] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [syubqat] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [oepeiad] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [cmjtbta] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [mqfavvc] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [hivqbkw] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [vgerdql] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [nrlxckb] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [walxhvo] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [crwqpac] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [dueoqjy] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [dxpdlnr] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [xyaovby] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [inknkiw] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [kkwmljy] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [nthfbdd] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [hcdxnbx] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [shnqyye] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [pmoqxuu] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ntkygsm] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [jcjhqhb] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [tgqsiic] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ncxvltn] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [kexuddk] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [pxdicgn] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [xmafjnr] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [daxhnho] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [vaqcnir] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [tqjspgu] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ttoruln] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [qposcen] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [kcvolnc] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [yjlnwig] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [gnomnpl] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [wrjdpas] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [luyvyax] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [wdnpqhv] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [vwjvtce] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [gqdygbb] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ndgvsft] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [abnfbpy] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [qjwqgob] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [cduqdem] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [llpevlg] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [uarcuky] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [tdmqjcv] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ugvbmxy] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ptcogbo] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [yqhhfgx] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ippylef] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [cigywgv] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [xjqkxeh] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [kmhjofh] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [srnntqn] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [yxxjiot] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ivwcxua] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [rqcyevn] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [wlupapm] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [grpbnsi] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [sdsmrpb] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [awedray] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ghiaeix] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [lmlybvr] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [fgaifbc] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [oltsevi] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [etptyik] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [cbtqnii] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [lkhuccy] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [oeqdhsn] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [clvmxdw] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [yeosttr] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [oxmtbig] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [phphree] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [maktmhm] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [fomgdww] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [pclisuy] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [pjknvvn] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [jdkokkc] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [lqifmmk] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [odyhdaj] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ijhrola] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ijsusve] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [euqbnjs] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [odamrvl] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [fjsrbqw] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [pdjrcwg] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [tyrvyhd] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [edwjplu] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [wsacbyc] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [opkfxqu] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ttwcqwh] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [lrnhtff] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [bwehbxq] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [oskloux] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ylptupx] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [fikbftj] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [yjkcpqt] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ldkgmuu] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [tuxdfrr] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [fbeffun] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [kpxegdc] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [kaijmqs] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [dabwkbo] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ikhsjdh] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [xbolbar] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [mbwfuum] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [arjtwfu] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [rovfwke] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [cbnoklp] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [nneamif] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [jtvwdhm] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [abdlwji] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [ppahnfp] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [oahljob] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [mmuhbxf] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [nugviph] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [npywoow] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [toeyjfu] c:\windows\gcqsicu.exe
    O4 – HKCU\..\Run: [cggfopx] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [hguudev] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [pglcuew] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [ulnfhtg] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [gnqhomg] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [nbgyjqt] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [senvqks] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [ipdloot] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [qndetsw] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [sohcrec] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [gigaysm] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [tdnafbu] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [qhmfpym] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [bihvyoj] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [mwmgcmq] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [tludahs] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [oijsxnp] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [byerlqg] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [qgbhmbm] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [vkmnsxg] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [wdqbfge] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [rafcipw] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [bqexnqf] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [kceohaw] c:\windows\lrqtamy.exe
    O4 – HKCU\..\Run: [qvavelx] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [dbgcqre] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [dsqupin] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [xrilnyd] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [tyogiee] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [aixeftq] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [gvhxsdr] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [vdipwvs] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [pboqjtq] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [gnougho] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [sneybux] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [gckrdvy] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [rbhnakd] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [xhrewpj] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [bdvkjbv] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [whdormp] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [puqbgtq] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ssiakbt] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ivintks] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [gcxptem] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [yfbnpwy] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [gdqfpxj] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ksaxwjx] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [rqttqib] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [wtxtgal] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [aavdqlg] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [drdyfcq] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [uuwlrfi] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [yvondts] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [wxqersx] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [jgqgcns] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [mxmpqai] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [nntaixf] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [bncarqr] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [msuvafg] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [cyghvox] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [wnkgchy] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [jmdfvto] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [hywduie] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [pfjfjkk] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [lagndui] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [jkjpqlw] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [hiutumc] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [cmwxeui] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [vurxqkq] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [srutbla] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [vsylaxy] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [nwomjmb] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ieeptxv] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [dolivgy] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [okufjcr] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [dupwhtk] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [rpgimcf] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [rdaoqse] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [dblyuww] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [qvefxio] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [rcaybjd] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ayprdfe] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [uoovnlm] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [krgmtip] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [dtttxbo] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [lklmhhe] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [lcxpgfo] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [pgeuged] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ybwygcb] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ginonyx] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [uaegfox] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [jimvvod] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [sllbubb] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [uahuxkh] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [nrkfofs] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [btnliln] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [jmtjibw] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [thiakxy] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [pqwbjrj] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [jhcvusx] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [uuhloqk] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [fgdawad] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ihwqyqx] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [qkefbph] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [wwemrym] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ykpkncd] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [qyewcnd] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [xmqcodp] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [qfatgiy] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [pkbvuqi] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [gysuwqs] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [goyuyjp] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [kalelnb] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [vdlkxcm] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [seqjmdm] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [siuyygl] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [egakkmj] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ooohrov] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [xklpstp] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [tattqok] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ppptgig] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [atjxyej] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [xaegtaq] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [imcprtm] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [iljghht] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [etsrtpu] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [jbsaawb] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [cyijkch] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [brgegtf] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [qnhdkhf] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [pyvehyv] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [odbxejm] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [trvpoyu] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [exxnsgp] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [wumwgik] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ixlqjbp] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [aiwshfm] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [mopkgas] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [obwukie] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [fsdrsbu] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [yuajpnn] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [uvbrmqr] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [elwgfuc] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [nysmmrj] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [rtojswe] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [vugmwnt] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ubuwnsr] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [fgrgmtp] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [hybaixk] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [afkginw] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [eeebojk] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [xjvkoji] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ckcmnxr] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [qfmiasl] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [thgefdm] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [nyexlur] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [whvkgxm] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [epvmvjc] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [fxwhenp] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [vvlugpw] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [cuybfjb] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [inceoac] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ftcjcao] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [fowpklq] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ufbyjhd] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [inpbael] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [xiuxwdx] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [npatybe] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [gpmlvbp] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [akhmaoe] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ddlhvev] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [leccxer] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [udysjof] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [biivbrh] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [hnubtko] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [mdbebnc] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [eplqevf] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [gltbydk] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [wqnrfvf] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [keawmps] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ospcmgc] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [oggaofg] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [okartco] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [fjbrowc] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [btoeljf] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [jcrxlcq] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [hhwiboo] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [klvgjml] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [otrbmtn] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [plxwmra] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [lkuvcec] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [hpksmhm] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [dedalfh] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [bqoiuoc] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [hnebhjr] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [virgqse] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [cdqdtjs] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [mxlgcuo] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [utspxcd] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [inllowg] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ibepqwr] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [sjmvrey] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [gqhqyqh] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ejrshjy] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [iwpihgk] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [drhywuc] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [aelcnqr] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [efnujcx] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [lukcbsc] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [jjxichv] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [xmhbcce] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [wqvfbno] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [egjfpjs] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ammgvnx] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [obaiicr] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ofwnjjy] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [ewhwexp] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [lruvhuk] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [hmnauyx] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [podbmom] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [mnnttsf] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [fcjpeoq] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [mmmntaa] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [lhtbuik] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [vaxdgrt] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [dfotylp] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [sumklsf] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [axojcyt] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [vehpnfy] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [kbvtjda] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [adgsiko] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [tujqsuy] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [wwejxbp] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [atbrdjo] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [wevfgip] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [wyyaagk] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [rvptell] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [tvgrlya] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [sjvcpqb] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [oisicqe] c:\windows\hsdsuns.exe
    O4 – HKCU\..\Run: [iedebop] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ckjppwv] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [aiorfxn] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [whsinuy] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [gpwgapw] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [gxgwpwn] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [dlmgmpl] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [gyrqsyn] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [fplbufc] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [mjryppq] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [nljeghd] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [madpwbh] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [wxpwdwe] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [pssybof] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ujmbvio] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [onfalcw] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ffkfuln] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [laxdjfe] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ilfdrio] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ikpviht] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [lsmopbs] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [pqsdxib] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [gsckhcf] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [nwisrop] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [gvnajrr] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [sjvevyg] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [lxpyyyc] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ultvemq] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [fwvduxe] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [cyrhcco] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [nxkyaxb] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [lfgfoui] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [gspfmph] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [usaihen] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [nnvxoxk] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [mwpxudm] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [epkqtnx] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [pjaktxy] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [efjbmsk] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [pimibry] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [yqqvsde] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [vocvjbj] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [lsydgns] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [cfvdkba] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [jqbqedq] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [kqdnoti] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [avqxdvw] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [qugqcpq] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [btyijic] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [pmvaery] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [obukvwt] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [mnoycpg] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [odxwheu] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [gvmtlkl] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [icqrrnv] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [fvdfkku] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [drchhmx] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ljyibgg] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [oxvmitv] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [qskouon] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [promdfa] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [pdojvuv] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ucqexpa] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [bmhrtge] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [nnwtacl] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [kieextx] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [osmxupr] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [tjoqlem] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [bkpwhev] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [qyvonqw] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [lymctrq] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [gikiqyq] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [rwlequn] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [foefahk] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [auudoqp] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [bqslsdv] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [mtbvxcx] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [bxutrsr] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [stbahbp] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [tsrwoqm] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [tredcpb] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [dqtcwty] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [wmrgatk] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ypcvkou] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [htemaew] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [gwyjvsb] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [mnrhtrd] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [yuuvvxe] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [xjpsrnv] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [eerlqdo] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [jatjqmk] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [awigxdr] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [uulgaxi] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [hwwwbip] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [xgucnhc] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [dhaetwl] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [dxrgpww] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [wcsepgy] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [eokiefl] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [yvrssud] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [fuqvbyx] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [udbxnct] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [quinbgu] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [vqaijbi] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [hpojnfa] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [nksdoyr] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ihuukvw] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [powufdb] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [pcvjyei] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [cbcfcpr] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [qecjbqe] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [sbbntlc] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [fiqcvfe] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [amlgtbb] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [iivjjdo] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [yugsocp] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ykihfoh] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ehmjuig] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [jcqigho] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [olxmvli] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ogrsoti] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [vtsqsgc] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ythhclw] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [dcmdvbf] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [fbqhvmk] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [orxjhuf] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [nkixpsu] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [jiwkkyu] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [wepyhbk] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [eymilfp] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [montvws] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [joxldwp] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [brsloim] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [oiyaijy] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ivfmeck] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [eatfdjq] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [qfpujik] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [vamofqf] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [nsuvbin] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [bdjnfxs] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [dlodsue] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [bkfiilt] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [jdfedif] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [fmwipke] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [gaensdh] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [gxrqvcf] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [beeiefg] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [tjdvyxv] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [bypekuh] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [lljjxio] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [nwwawbr] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [umauiiy] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [vqcswfc] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [mcywldt] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [muivxth] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [foamadj] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [eglmejo] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [aaahfhd] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [gsqtwpu] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [niofpwy] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [qqjlcmv] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [iyfrogt] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [qjtxdxp] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [dtlcwfd] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [wvyohtu] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [mbvhpoy] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [eerdtxy] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ydirtfh] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [pygxecn] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ciipbwu] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [rsvwrhr] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [opfvdhd] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [kskbtns] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ioorbjj] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ltvoivg] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ytsbwvi] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [rcjvqif] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [uyifhmj] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [eppusfn] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [pmtoyxq] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ugeacig] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [pvvvttj] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [qywkkrc] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [kqqpcxt] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [rwlcqua] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [dddfxjn] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [bruslrq] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [moxpsfh] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [chwulbd] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [bilfkwu] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [qfftdqn] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ianhfyo] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [hrqaxey] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ibsgcwj] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [sodlgmc] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ppfxmpv] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [eeqcttf] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [asbiytf] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [svcqqnc] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [atfodww] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [bhgdxle] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ihbgfhm] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [xwunpai] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ldmbgcj] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [troymti] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [mwkuwkx] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [peltivv] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [tnfmndh] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [mxwmqts] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [soebeuk] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [tfbmfjm] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [sjfdyyh] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [qbfsspk] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [dxhiasd] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [imbtpwi] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [bpksank] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ximgvlv] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [sucpgpi] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [uaspulc] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ggiskee] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [hxhcgyi] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [fcnqnrp] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [kaldcop] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [obimcmh] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [rpcbvco] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [deubdui] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [wslxkug] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [xiigfax] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [elvalsy] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [qvuqabb] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [qxwdoni] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [aoyoctf] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [vlfupkd] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [nxlmtmd] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ktpmapo] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [waflber] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [qffulag] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [axbflrw] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [jjkuwdo] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [inujjnr] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [lumusjr] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [yracqrh] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [anmywwd] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [jgmthww] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [xgwgudd] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [meaigjf] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [elvedjx] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [oeuvano] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [mhuomek] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [gdpeojc] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [uixbigq] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [rvfejuf] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ebsfyon] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ysodesb] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [cetxmco] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [wfpncvv] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [rulauem] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [tgidunp] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [gkrcwbe] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [kevhmdo] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ioucvdl] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [wvnsjna] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [onnsfrf] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [rgenoew] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [vtvjfwg] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [qehjvar] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [fyfjejk] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ejmguif] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [jdmmcqv] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [jcukjip] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [jnfxtix] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [kncnglh] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [mdtfvdu] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [mgqkuqx] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [aftyyyo] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [tistilp] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [brkkwhr] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [fbhkdrd] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [tyrtuvl] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [pxluwfx] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [dcelowm] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [rbmwahr] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [fhjtfhi] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [dnqeaan] c:\windows\msjbcol.exe
    O4 – HKCU\..\Run: [ehewijp] c:\windows\uccvyei.exe
    O4 – HKCU\..\Run: [dlnlyjc] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [puwppwt] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [feiveyw] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [tqwtyma] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [bhxvswd] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [apstbai] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [iutjckf] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [brcxhqi] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [yrpniak] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [lgsdxqw] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [oelkuhu] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [oarownw] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [lejggea] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [woilpxj] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [viajivo] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [qsacjaw] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [jwglcik] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [tarnxqk] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [awfndjx] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [eajtlrd] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [dtlntex] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [hjgrpif] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [ccrjwhm] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [wwuegsw] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [vdrmrtl] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [kwmifec] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [iqofayx] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [khnokag] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [ouegxti] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [idkdjxh] c:\windows\qwnwyge.exe
    O4 – HKCU\..\Run: [fqpetnt] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [biybvkx] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [cdcnsvj] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [trdtohp] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [delpdsc] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [wwgpvpm] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [rwntuhw] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [mjdmvli] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [mgiduky] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [mpnxveh] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [blsbjfy] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [aeadfck] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [fwlklsl] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [wfpqxcm] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [ndxapbn] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [egocret] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [yprftnh] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [xlbelrx] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [odyxksm] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [qtglwnt] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [cgihich] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [hyerysm] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [vhnusnx] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [tlthinl] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [mmewmus] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [fuwlfqp] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [arspeqt] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [ojmwauf] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [ntgtjva] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [sguwdrq] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [rjomcxd] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [ppsrryb] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [escmwwt] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [ikxxpei] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [mbfunmp] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [dajtmeb] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [rbflksp] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [awvbpoh] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [xtpodnc] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [ssivcxx] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [qbmebbj] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [hpmlavk] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [fpumcxu] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [lyrmnsh] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [altnicp] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [bjglllf] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [jkldaxa] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [svnkftg] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [vcewgib] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [lnojosj] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [dhfcavf] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [gtcmuot] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [llmfeda] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [xwjaoug] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [tpfjmuv] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [xiideta] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [dnskumv] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [dbnplgc] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [dkkheip] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [vyiiisa] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [hknldrj] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [vjeftqq] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [peexadu] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [gqsvkgx] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [gynlgxh] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [wohsqkp] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [arpcbrw] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [inennfl] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [gqvangr] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [ekbetjx] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [ljbrobx] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [hprkujk] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [iyqjgul] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [kjiudoh] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [ljjvtkx] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [gniwfxd] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [jkhnvbo] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [iiamevs] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [qwpawwj] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [fchvpit] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [waanpyv] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [lioopot] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [ydjgcfp] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [xepcpvx] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [dyhmrbc] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [aelkljd] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [kvbkigh] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [wgmfngx] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [wngyfxq] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [ydngutx] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [bcqhkyu] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [hbuahsm] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [kmecvxu] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [xqkrauj] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [wwuuvwu] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [vjkpngt] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [oytrexj] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [cberivx] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [avnhuum] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [wssohlf] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [lcxmfyw] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [bektcha] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [ebmnbre] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [ebcgcit] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [qqtkqyf] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [adahoce] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [cloyxco] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [wfftwth] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [wvkpshx] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [kwkowot] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [evcbfxm] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [qypkalf] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [gxetcqt] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [dbbcydi] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [lkogdga] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [fnbryjq] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [tvffrob] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [foxqltu] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [rhuifwa] c:\windows\atstuup.exe
    O4 – HKCU\..\Run: [proypwb] c:\windows\ekcypuo.exe
    O4 – HKCU\..\Run: [qkqcqmn] c:\windows\ekcypuo.exe
    O4 – HKCU\..\Run: [ttrtmjt] c:\windows\ekcypuo.exe
    O4 – HKCU\..\Run: [ehxnujd] c:\windows\ekcypuo.exe
    O4 – HKCU\..\Run: [ixdnmam] c:\windows\ekcypuo.exe
    O4 – HKCU\..\Run: [epyedal] c:\windows\ekcypuo.exe
    O4 – HKCU\..\Run: [vbnrvts] c:\windows\ekcypuo.exe
    O4 – HKCU\..\Run: [pkokard] c:\windows\ekcypuo.exe
    O4 – HKCU\..\Run: [owmtysw] c:\windows\ekcypuo.exe
    O4 – HKCU\..\Run: [eincsrx] c:\windows\ekcypuo.exe
    O4 – HKCU\..\Run: [tckfqcw] c:\windows\ekcypuo.exe
    O4 – HKCU\..\Run: [rbkevwl] c:\windows\ekcypuo.exe
    O4 – HKCU\..\Run: [ksmcltt] c:\windows\ekcypuo.exe
    O4 – HKCU\..\Run: [vcoyyik] c:\windows\ekcypuo.exe
    O4 – HKCU\..\Run: [eieiwqy] c:\windows\ekcypuo.exe
    O4 – HKCU\..\Run: [kkntnye] c:\windows\ekcypuo.exe
    O4 – HKCU\..\Run: [jydncgn] c:\windows\ekcypuo.exe
    O4 – HKCU\..\Run: [cpncmbh] c:\windows\upecvdm.exe
    O4 – HKCU\..\Run: [gdhqcic] c:\windows\lkwsmpu.exe
    O4 – HKCU\..\Run: [oqxkget] c:\windows\lkwsmpu.exe
    O4 – HKCU\..\Run: [xyamgit] c:\windows\lkwsmpu.exe
    O4 – HKCU\..\Run: [qutcrmm] c:\windows\lkwsmpu.exe
    O4 – HKCU\..\Run: [rbodsti] c:\windows\lkwsmpu.exe
    O4 – HKCU\..\Run: [xgncogi] c:\windows\lkwsmpu.exe
    O4 – HKCU\..\Run: [sqvhaij] c:\windows\lkwsmpu.exe
    O4 – HKCU\..\Run: [bcrqotx] c:\windows\lkwsmpu.exe
    O4 – HKCU\..\Run: [fankfht] c:\windows\lkwsmpu.exe
    O4 – HKCU\..\Run: [boihysk] c:\windows\lkwsmpu.exe
    O4 – HKCU\..\Run: [dmacmhr] c:\windows\lkwsmpu.exe
    O4 – HKCU\..\Run: [egojeqb] c:\windows\lkwsmpu.exe
    O4 – HKCU\..\Run: [ovitiha] c:\windows\utjmblv.exe
    O4 – HKCU\..\Run: [rejuyxp] c:\windows\utjmblv.exe
    O4 – HKCU\..\Run: [ysxcqee] c:\windows\utjmblv.exe
    O4 – HKCU\..\Run: [exeestx] c:\windows\lqkfxiy.exe
    O4 – HKCU\..\Run: [jodrwlm] c:\windows\lqkfxiy.exe
    O4 – HKCU\..\Run: [awdgxyp] c:\windows\poaytgh.exe
    O4 – HKCU\..\Run: [bhvkope] c:\windows\fdrruwd.exe
    O4 – HKCU\..\Run: [tpiryic] c:\windows\ulxpfpd.exe
    O4 – HKCU\..\Run: [hjihjoc] c:\windows\fdrruwd.exe
    O4 – HKCU\..\Run: [udxjapq] c:\windows\fdrruwd.exe
    O4 – HKCU\..\Run: [eoyulvu] c:\windows\fdrruwd.exe
    O4 – HKCU\..\Run: [awaewme] c:\windows\fdrruwd.exe
    O4 – HKCU\..\Run: [ncwlfcf] c:\windows\fdrruwd.exe
    O4 – HKCU\..\Run: [ipkavnn] c:\windows\fdrruwd.exe
    O4 – HKCU\..\Run: [aigidvv] c:\windows\fdrruwd.exe
    O4 – HKCU\..\Run: [bbjruue] c:\windows\fdrruwd.exe
    O4 – HKCU\..\Run: [mlmlpqw] c:\windows\fdrruwd.exe
    O4 – HKCU\..\Run: [aidmpda] c:\windows\fdrruwd.exe
    O4 – HKCU\..\Run: [cufmhtu] c:\windows\fdrruwd.exe
    O4 – HKCU\..\Run: [htlsumk] c:\windows\fdrruwd.exe
    O4 – HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
    O4 – Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
    O4 – Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 – Global Startup: winlogin.exe
    O8 – Extra context menu item: &AOL Toolbar search – res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    O8 – Extra context menu item: &Google Search – res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.html
    O8 – Extra context menu item: Backward &Links – res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.html
    O8 – Extra context menu item: Cac&hed Snapshot of Page – res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.html
    O8 – Extra context menu item: Si&milar Pages – res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.html
    O8 – Extra context menu item: Translate into English – res://C:\Program Files\Google\GoogleToolbar2.dll/cmtrans.html
    O9 – Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 – Extra button: Messenger (HKLM)
    O9 – Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
    O9 – Extra button: AOL Toolbar (HKLM)
    O9 – Extra 'Tools' menuitem: AOL Toolbar (HKLM)
    O9 – Extra button: Microsoft AntiSpyware helper (HKLM)
    O9 – Extra 'Tools' menuitem: Microsoft AntiSpyware helper (HKLM)
    O9 – Extra button: Real.com (HKLM)
    O9 – Extra button: Messenger (HKLM)
    O9 – Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O9 – Extra button: Microsoft AntiSpyware helper (HKCU)
    O9 – Extra 'Tools' menuitem: Microsoft AntiSpyware helper (HKCU)
    O10 – Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
    O10 – Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
    O10 – Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
    O16 – DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) –
    O16 – DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) – http://aolcc.aol.com/computercheckup/qdiagcc.cab

    /End of Log/

  • Hacker Vs. Security Professional

    Defcon.org, 29 – 31 July, Las Vegas, NV.  $80.00 admission @ Alexis Park 

    Convention of hackers, crackers, programmers, security pros, black hats, white hat, gray hats the entire spectrum of security technology freaks converging on one location to discuss their favorite subject. 

    Once a year I am encouraged to go to numerous Security Conferences most of which turn out to be usless infomercials where vendors a trying to sell there plug in security solutions.

    There are very few that have really been of value.  Defcon is by FAR the best.  Since it is a hacker convetion I often have trouble convicing the Government of its worth.  It is good to know that FBI, CIA and possibly the NSA don't hold the same view as the Agencies I have worked for.

    I can not stress the value of Defcon to Security Professionals enough.

    Martin McKeay has a great site on Security issues.  We discussed what the word “hacker” conveys to most people. 

    The original meaning of hacker was that of a technical savvy person creative enough to come up with work arounds, fixes and find vulnerabilities.  This is what hacking still means to me.  It is my personal oppinion that this is where you seperate the men from the boys.  Hacking, in the traditional sense of the word, is the true gauge of technical skill and understanding. 

    These days the meaning of hacker, and hacking in general is used to address the activities of cybercriminals, or black hats.  Martin and I disagree with the direction that the concept is going. 

    Unfortunately, his view is what most “security professionals” and the general public currently think of the whole concept of hacking, that is is criminal behavior.  That is ignorant.

    But, no matter how you define hacking or hackers, it is the duty of ever one who calls themselves a security professional to know the practices and mind set of a hacker, criminal or otherwise.  It is like a detective or a profiler.  The best detectives, investigators and profilers have an understanding of why criminals do what they do.  In this same way, it is imperative that the Security Professional understand the techniques and mindset of every shade of hacker, black-white hat. 

    Which investigator will understand a thief better, the one with a PHD in criminology or the investigator who used to be a thief?

    If the security professional doesn't know how to exploit there own systems, how effect is that security professional… And if MOST security professionals can not exploit ANY system, what does it mean to be a system security professional? 

     

    Martins Comments:

    I love the 'Hacks' books from O'reilly. They've probably done more to regain the original meaning of hack and hacker than all of the protests by security professional combined. I have 4 or 5 of the 'Hacks' books sitting on my work and home bookshelves. Have you checked out Make magazine? (http://www.makezine.com/)

    I wish we could regain the original meaning of the word, but I fear it's a pointless battle. To the average Joe in America today, hackers will always and forever be the evil creators of viruses and trojans. Not that Joe could tell the difference between the two.

    I don't know if you remember it, but last year the guy who wrote the Sasser and Netsky viruses was hired by a German AV company (http://www.enn.ie/news.html?code=9554015). I know at least one German CISSP who was very upset at this idea, and let them know it. I also seem to remember that his employment didn't last long, but I couldn't find a link to that news. So at least one company was willing to hire a hacker knowingly and publicly.

    People don't want to have to worry about the complexity of the shade of a hacker. Black, gray or white hat, if you say you're a hacker, they assume you're after their bank account number. I'll stick with calling myself a Security Professional, rather than trying to borrow from the 'hacker mystique' for publicity.

    Posted by Martin at June 1, 2005 01:15 PM

    ME:

    McKeay.. great blog,

    I was at Barnes & Nobles the other day looking for Kyle Rankin's book, Knoppix Hacks and I noticed hacking is quite the buzz word. It seems every conceivable category of Information Technology now has a book followed by (or proceding) the words hack, hacking, hacker's guide ect. O'reily has a whole series on hacks (great books): http://www.oreilly.com/hacks/

    There is even a book called, “Understanding God's Will: how the HACK the equation” — (Not from O'reily)

    I believe the reason for this is because hacking is cool. Its like the new and very necessary quick fix tool among this era of information overload and technical bombardment.

    Many of the most famous and infamous player in this new Information Age have been Hackers. Just to name a few: William H. Gates III, KBE, Blake Ross (19 year old creator of FireFox), Linus Trivalds, Klaus Knopper (creator of Knoppix), the Woz, Paul Allen, Kevin Mitnic, Jeff Moss (creator of Defcon), all the creators of Unix, Bill Joy…

    The word hacker has been hi-jacked. Its real meaning has been… hacked. That is why I was over joyed when I was introduced to the Certified Ethical Hacker certification. I have yet to take the cert. I plan on using the CISSP to prepare me for it… it is difficult from what I've seen in the Sample tests. I hope this cert gains enough credibility to take the concept of the true hacker back in mind of the Business owners.

    I went to Defcon in 2003 (11 I think) and I learned a lot there. For one thing, not all hackers are evil Sasser Worm creators or apart of the “Hang Up Team” (a truly, TWISTED bunch of Russian hackers). Many of the Hackers speaking were hackers in the original since of the word. In fact, they were do-gooders! They would find exploits and try and report them imediately to the owner of the software or hardware. The biggest problem was that they companies like Microsoft and Oracle would not listen to them. They are often refered to as Gray Hats. Almost like vigilantes, where as White Hats can be considered people like you and me (mercenaries working for companies), and Black Hats just cyber criminals.

    I think the concept of what a hacker is is being transformed. Why a company would hire an Internationally know Black Hat and publicize it is, to me, not smart money. I bet it would even negatively effect the stock.

  • Importance of applying security to your system

    This is an update on my first post about the removing the trojan called smithfraud.  I help my friend get rid of the trojan and had the system purring, but shortly after he got back on the Internet with no protection and got hacked again.  This time worse then before.  Not only did he get smithfraud AGAIN but he got some crap I never even heard of.  I may have to wipe his entire hard drive.

    I constantly tell him how important it is to secure your system even if your on dial-up.  Just having Sp2 for XP is not enough.  I recommend at least a firewall. 

    If you have a broadband connection check out my walk through on securing broadband Internet connections.