Vba32 AntiRootKit Log File

GEORGE-HP 18:46:14 15-07-2012
Home Edition SP1.0
AntiVirus checking is OFF
Sign checking is ON
AntiRootKit driver is working in ordinary mode

List of Kernel-Mode Hooks

Type	Number	Function Name	State	Base Address	Current Address	Driver
No hooks found

List of Kernel-Mode Notificators

Type	State	Current Address	Driver
No notificators installed

List of Driver Input/Output Handler's Hooks (IRP & FastIo)

Driver Object	Handler Name	State	Current Address	Driver
No hooks found

List of kernel modules

Module	Full Path	State	Description	Company Name	Base Address	Module Size	Information

List of processes

PID	Full Path	State	Description	Company Name	Information

List of autorun objects

Name	Image Path	State	Registry Path
Autostart Folders
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk	C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe	Signed
C:\Users\George\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk	C:\PROGRA~2\ERUNT\AUTOBACK.EXE, C:\Program Files (x86)\ERUNT\AUTOBACK.EXE, %SystemRoot%\ERDNT\AutoBackup\#Date# /noconfirmdelete /noprogresswindow
C:\Users\George\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KatMouse.lnk	C:\PROGRA~2\KatMouse\KatMouse.exe, C:\Program Files (x86)\KatMouse\KatMouse.exe
Autostart Keys
RemoveIT Pro v9Ent	C:\Program Files\RemoveIT Pro 2012 Enterprise\removeit.exe		HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Sysinternals Desktops	C:\Users\George\Documents\SysinternalsSuite\Desktops.exe	Signed	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Everything	"C:\Program Files (x86)\Everything\Everything.exe" -startup		HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Norton Online Backup	C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe	Signed	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
PDF Complete	C:\Program Files (x86)\PDF Complete\pdfsty.exe	Signed	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
StartCCC	"c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun	Signed	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
RemoveIT Pro v9Ent	C:\Program Files\RemoveIT Pro 2012 Enterprise\removeit.exe		HKEY_USERS\S-1-5-21-1768697462-2737597764-3804408366-1000\Software\Microsoft\Windows\CurrentVersion\Run
Sysinternals Desktops	C:\Users\George\Documents\SysinternalsSuite\Desktops.exe	Signed	HKEY_USERS\S-1-5-21-1768697462-2737597764-3804408366-1000\Software\Microsoft\Windows\CurrentVersion\Run
Windows WinLogon
Shell	Explorer.exe	Signed	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit	C:\Windows\system32\userinit.exe,	Signed	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
VmApplet	SystemPropertiesPerformance.exe /pagefile	Signed	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Browser Helper Objects
{9030D464-4C02-4ABF-8ECC-5164760863C6}	C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll	Signed	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
ActiveX
>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	%SystemRoot%\system32\unregmp2.exe /ShowWMP	Signed	HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components
>{26923b43-4d38-484f-9b9e-de460746276c}	C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig	Signed	HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components
>{60B49E34-C7CC-11D0-8953-00A0C90347FF}	"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP	Signed	HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components
{2C7339CF-2B09-4501-B3F3-F3508C9228ED}	%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll	Signed	HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components
{44BBA840-CC51-11CF-AAFA-00AA00B6015C}	"%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE	Signed	HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components
{6BF52A52-394A-11d3-B153-00C04F79FAA6}	%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI	Signed	HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components
{89820200-ECBD-11cf-8B85-00AA005B4340}	regsvr32.exe /s /n /i:U shell32.dll	Signed	HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components
{89820200-ECBD-11cf-8B85-00AA005B4383}	C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings	Signed	HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components
{89B4C1CD-B018-4511-B0A1-5476DBF70820}	C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install	Signed	HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components
WinLogon Notify
{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}	wlgpclnt.dll	Signed	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}
{25537BA6-77A8-11D2-9B6C-0000F8080861}	fdeploy.dll	Signed	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}
{3610eda5-77ef-11d2-8dc5-00c04fa31a66}	%SystemRoot%\System32\dskquota.dll	Signed	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}
{426031c0-0b47-4852-b0ca-ac3d37bfcb39}	gptext.dll	Signed	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}
{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}	C:\Windows\SysWOW64\iedkcs32.dll	Signed	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}
{7933F41E-56F8-41d6-A31C-4148A711EE93}	%SystemRoot%\System32\srchadmin.dll	Signed	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7933F41E-56F8-41d6-A31C-4148A711EE93}
{7B849a69-220F-451E-B3FE-2CB811AF94AE}	C:\Windows\SysWOW64\iedkcs32.dll	Signed	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7B849a69-220F-451E-B3FE-2CB811AF94AE}
{827D319E-6EAC-11D2-A4EA-00C04F79F83A}	scecli.dll	Signed	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}
{8A28E2C5-8D06-49A4-A08C-632DAA493E17}	%systemroot%\system32\gpprnext.dll	Signed	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{8A28E2C5-8D06-49A4-A08C-632DAA493E17}
{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}	C:\Windows\SysWOW64\iedkcs32.dll	Signed	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}
{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}	dot3gpclnt.dll	Signed	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{B587E2B1-4D59-4e7e-AED9-22B9DF11D053}
{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}	C:\Windows\SysWOW64\iedkcs32.dll	Signed	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
{FB2CA36D-0B40-4307-821B-A13B252DE56C}	gptext.dll	Signed	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{FB2CA36D-0B40-4307-821B-A13B252DE56C}
{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}	gptext.dll	Signed	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}
{e437bc1c-aa7d-11d2-a382-00c04f991e27}	%SystemRoot%\System32\polstore.dll	Signed	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}
{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}	gptext.dll	Signed	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}
Security Providers
SecurityProviders	credssp.dll		HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders
Value Run Keys
ProviderPath	%SystemRoot%\system32\ntmarta.dll	Signed	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\AccessProviders\Windows NT Access Provider
BootExecute	autocheck autochk *	Signed	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
StartupPrograms	rdpclip		HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd
Shell Service Object Delay Load
WebCheck	%Systemroot%\SysWow64\webcheck.dll	Signed	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
My Computer (Backup, Cleanup, Defrag utilities)
BackupPath	%SystemRoot%\system32\sdclt.exe		HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\BackupPath
CleanupPath	%SystemRoot%\System32\cleanmgr.exe /D %c	Signed	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\CleanupPath
DefragPath	%systemroot%\system32\dfrgui.exe	Signed	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\DefragPath
LSP Providers
MSAFD RfComm [Bluetooth]	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD Tcpip [RAW/IP]	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD Tcpip [RAW/IPv6]	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD Tcpip [TCP/IP]	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD Tcpip [TCP/IPv6]	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD Tcpip [UDP/IP]	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD Tcpip [UDP/IPv6]	%SystemRoot%\system32\mswsock.dll	Signed
RSVP TCP Service Provider	%SystemRoot%\system32\mswsock.dll	Signed
RSVP TCPv6 Service Provider	%SystemRoot%\system32\mswsock.dll	Signed
RSVP UDP Service Provider	%SystemRoot%\system32\mswsock.dll	Signed
RSVP UDPv6 Service Provider	%SystemRoot%\system32\mswsock.dll	Signed
Shell Spawning
Applications	"C:\Program Files (x86)\Internet Explorer\iexplore.exe" % 1	Signed	HKEY_CLASSES_ROOT\Applications\iexplore.exe\shell\open\command
CLSID	"C:\Program Files (x86)\Internet Explorer\iexplore.exe"	Signed	HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command
Drive	%SystemRoot%\Explorer.exe	Signed	HKEY_CLASSES_ROOT\Drive\shell\find\command
Folder	%SystemRoot%\Explorer.exe	Signed	HKEY_CLASSES_ROOT\Folder\shell\open\command
InternetShortcut	"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l	Signed	HKEY_CLASSES_ROOT\InternetShortcut\shell\open\command
Unknown	%SystemRoot%\SysWow64\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL % 1	Signed	HKEY_CLASSES_ROOT\Unknown\shell\openas\command
batfile	"% 1" %*	Signed	HKEY_CLASSES_ROOT\batfile\shell\open\command
comfile	"% 1" %*	Signed	HKEY_CLASSES_ROOT\comfile\shell\open\command
cplfile	%SystemRoot%\SysWow64\control.exe "% 1",%*	Signed	HKEY_CLASSES_ROOT\cplfile\shell\cplopen\command
exefile	"% 1" %*	Signed	HKEY_CLASSES_ROOT\exefile\shell\open\command
htafile	C:\Windows\SysWOW64\mshta.exe "% 1" %*	Signed	HKEY_CLASSES_ROOT\htafile\shell\open\command
inffile	%SystemRoot%\SysWow64\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 % 1	Signed	HKEY_CLASSES_ROOT\inffile\shell\install\command
jsefile	C:\Windows\System32\WScript.exe "% 1" %*	Signed	HKEY_CLASSES_ROOT\jsefile\shell\open\command
jsfile	%SystemRoot%\SysWow64\WScript.exe "% 1" %*	Signed	HKEY_CLASSES_ROOT\jsfile\shell\open\command
piffile	"% 1" %*	Signed	HKEY_CLASSES_ROOT\piffile\shell\open\command
regfile	regedit.exe "% 1"	Signed	HKEY_CLASSES_ROOT\regfile\shell\open\command
scrfile	"% 1"	Signed	HKEY_CLASSES_ROOT\scrfile\shell\config\command
scrfile	"% 1" /S	Signed	HKEY_CLASSES_ROOT\scrfile\shell\open\command
txtfile	%SystemRoot%\system32\NOTEPAD.EXE % 1	Signed	HKEY_CLASSES_ROOT\txtfile\shell\open\command
vbefile	%SystemRoot%\SysWow64\WScript.exe "% 1" %*	Signed	HKEY_CLASSES_ROOT\vbefile\shell\open\command
vbsfile	%SystemRoot%\SysWow64\WScript.exe "% 1" %*	Signed	HKEY_CLASSES_ROOT\vbsfile\shell\open\command
wsffile	"%SystemRoot%\System32\WScript.exe" "% 1" %*	Signed	HKEY_CLASSES_ROOT\wsffile\shell\open\command
wshfile	"%SystemRoot%\System32\WScript.exe" "% 1" %*	Signed	HKEY_CLASSES_ROOT\wshfile\shell\open\command

List of Drivers\Services (from Registry)

Name	Image Path	State	Description	Group
Services
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ALG	%SystemRoot%\System32\alg.exe		@%SystemRoot%\system32\Alg.exe,-112
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AMD External Events Utility	%SystemRoot%\system32\atiesrxx.exe			Event log
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AeLookupSvc	%systemroot%\system32\svchost.exe -k netsvcs	Signed	@%SystemRoot%\system32\aelupsvc.dll,-1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppIDSvc	%SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation	Signed	@%systemroot%\system32\appidsvc.dll,-100	ProfSvc_Group
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppMgmt	%SystemRoot%\system32\svchost.exe -k netsvcs	Signed
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Appinfo	%SystemRoot%\system32\svchost.exe -k netsvcs	Signed	@%systemroot%\system32\appinfo.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AudioEndpointBuilder	%SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted	Signed	@%SystemRoot%\system32\audiosrv.dll,-204	AudioGroup
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AudioSrv	%SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted	Signed	@%SystemRoot%\system32\audiosrv.dll,-200	AudioGroup
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AxInstSV	%SystemRoot%\system32\svchost.exe -k AxInstSVGroup	Signed	@%SystemRoot%\system32\AxInstSV.dll,-103
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BBSvc	"C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE"	Signed	Bing Bar Update Service
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BBUpdate	"C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE"	Signed	BBUpdate
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BDESVC	%SystemRoot%\System32\svchost.exe -k netsvcs	Signed	@%SystemRoot%\system32\bdesvc.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE	%systemroot%\system32\svchost.exe -k LocalServiceNoNetwork	Signed	@%SystemRoot%\system32\bfe.dll,-1001	NetworkProvider
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS	%SystemRoot%\system32\svchost.exe -k netsvcs	Signed	Background Intelligent Transfer Service
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser	%SystemRoot%\system32\svchost.exe -k netsvcs	Signed	@%systemroot%\system32\browser.dll,-100	NetworkProvider
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\COMSysApp	%SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}	Signed	@comres.dll,-947
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertPropSvc	%SystemRoot%\system32\svchost.exe -k netsvcs	Signed	@%SystemRoot%\System32\certprop.dll,-11
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc	%SystemRoot%\system32\svchost.exe -k NetworkService	Signed	@%SystemRoot%\system32\cryptsvc.dll,-1001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DPS	%SystemRoot%\System32\svchost.exe -k LocalServiceNoNetwork	Signed	@%systemroot%\system32\dps.dll,-500
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DcomLaunch	%SystemRoot%\system32\svchost.exe -k DcomLaunch	Signed	@oleres.dll,-5012	COM Infrastructure
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp	%SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted	Signed	@%SystemRoot%\system32\dhcpcore.dll,-100	TDI
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache	%SystemRoot%\system32\svchost.exe -k NetworkService	Signed	@%SystemRoot%\System32\dnsapi.dll,-101	TDI
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EFS	%SystemRoot%\System32\lsass.exe		@%SystemRoot%\system32\efssvc.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EapHost	%SystemRoot%\System32\svchost.exe -k netsvcs	Signed	@%systemroot%\system32\eapsvc.dll,-1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventSystem	%SystemRoot%\system32\svchost.exe -k LocalService	Signed	@comres.dll,-2450
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FDResPub	%SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation	Signed	@%systemroot%\system32\fdrespub.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FLEXnet Licensing Service	"C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe"	Signed	FLEXnet Licensing Service
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Fax	%systemroot%\system32\fxssvc.exe		@%systemroot%\system32\fxsresm.dll,-118
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FontCache	%SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation	Signed	@%systemroot%\system32\FntCache.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FontCache3.0.0.0	%systemroot%\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	Signed	@%SystemRoot%\system32\PresentationHost.exe,-3309
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HPAuto	"C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe"	Signed	HP Auto
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HPClientSvc	"C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe"	Signed	HP Client Services
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HomeGroupListener	%SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted	Signed	HomeGroup Listener
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HomeGroupProvider	%SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted	Signed	HomeGroup Provider
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IKEEXT	%systemroot%\system32\svchost.exe -k netsvcs	Signed	@%SystemRoot%\system32\ikeext.dll,-501
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPBusEnum	%SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted	Signed	@%systemroot%\system32\IPBusEnum.dll,-102
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KeyIso	%SystemRoot%\system32\lsass.exe		@keyiso.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KtmRm	%SystemRoot%\System32\svchost.exe -k NetworkServiceAndNoImpersonation	Signed	@comres.dll,-2946
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer	%SystemRoot%\system32\svchost.exe -k netsvcs	Signed	@%systemroot%\system32\srvsvc.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation	%SystemRoot%\System32\svchost.exe -k NetworkService	Signed	Workstation	NetworkProvider
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MMCSS	%SystemRoot%\system32\svchost.exe -k netsvcs	Signed	@%systemroot%\system32\mmcss.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSDTC	%SystemRoot%\System32\msdtc.exe		@comres.dll,-2797
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSiSCSI	%systemroot%\system32\svchost.exe -k netsvcs	Signed	@%SystemRoot%\system32\iscsidsc.dll,-5000	iSCSI
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mcx2Svc	%SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation	Signed	@%SystemRoot%\ehome\ehres.dll,-15501
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc	%SystemRoot%\system32\svchost.exe -k LocalServiceNoNetwork	Signed	@%SystemRoot%\system32\FirewallAPI.dll,-23090	NetworkProvider
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsMpSvc	"C:\Program Files\Microsoft Security Client\MsMpEng.exe"	Signed	Microsoft Antimalware Service	COM Infrastructure
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NOBU	"C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe" SERVICE	Signed	Norton Online Backup
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetMsmqActivator	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe" -NetMsmqActivator	Signed	@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetPipeActivator	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe	Signed	@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetTcpActivator	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe	Signed	@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetTcpPortSharing	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe	Signed	@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8201
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon	%SystemRoot%\system32\lsass.exe		@%SystemRoot%\System32\netlogon.dll,-102	MS_WindowsRemoteValidation
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netman	%SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted	Signed	@%SystemRoot%\system32\netman.dll,-109
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NisSrv	"C:\Program Files\Microsoft Security Client\NisSrv.exe"	Signed	@C:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc	%SystemRoot%\System32\svchost.exe -k NetworkService	Signed	@%SystemRoot%\System32\nlasvc.dll,-1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PNRPAutoReg	%SystemRoot%\System32\svchost.exe -k LocalServicePeerNet	Signed	@%SystemRoot%\system32\pnrpauto.dll,-8002
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PNRPsvc	%SystemRoot%\System32\svchost.exe -k LocalServicePeerNet	Signed	@%SystemRoot%\system32\pnrpsvc.dll,-8000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PcaSvc	%systemroot%\system32\svchost.exe -k LocalSystemNetworkRestricted	Signed	@%SystemRoot%\system32\pcasvc.dll,-1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfHost	%SystemRoot%\SysWow64\perfhost.exe	Signed	@%systemroot%\sysWow64\perfhost.exe,-2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PlugPlay	%SystemRoot%\system32\svchost.exe -k DcomLaunch	Signed	@%SystemRoot%\system32\umpnpmgr.dll,-100	PlugPlay
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent	%SystemRoot%\system32\svchost.exe -k NetworkServiceNetworkRestricted	Signed	@%SystemRoot%\System32\polstore.dll,-5010
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Power	%SystemRoot%\system32\svchost.exe -k DcomLaunch	Signed	@%SystemRoot%\system32\umpo.dll,-100	Plugplay
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProfSvc	%systemroot%\system32\svchost.exe -k netsvcs	Signed	@%systemroot%\system32\profsvc.dll,-300	profsvc_group
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProtectedStorage	%SystemRoot%\system32\lsass.exe		@%systemroot%\system32\psbase.dll,-300
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\QWAVE	%windir%\system32\svchost.exe -k LocalServiceAndNoImpersonation	Signed	@%SystemRoot%\system32\qwave.dll,-1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAuto	%SystemRoot%\System32\svchost.exe -k netsvcs	Signed	@%Systemroot%\system32\rasauto.dll,-200
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan	%SystemRoot%\System32\svchost.exe -k netsvcs	Signed	@%Systemroot%\system32\rasmans.dll,-200
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess	%SystemRoot%\System32\svchost.exe -k netsvcs	Signed	@%Systemroot%\system32\mprdim.dll,-200
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry	%SystemRoot%\system32\svchost.exe -k regsvc	Signed	@regsvc.dll,-1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcEptMapper	%SystemRoot%\system32\svchost.exe -k RPCSS	Signed	@%windir%\system32\RpcEpMap.dll,-1001	COM Infrastructure
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcLocator	%SystemRoot%\system32\locator.exe		@%systemroot%\system32\Locator.exe,-2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs	%SystemRoot%\system32\svchost.exe -k rpcss	Signed	@oleres.dll,-5010	COM Infrastructure
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SCPolicySvc	%SystemRoot%\system32\svchost.exe -k netsvcs	Signed	@%SystemRoot%\System32\certprop.dll,-13
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SCardSvr	%SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation	Signed	@%SystemRoot%\System32\SCardSvr.dll,-1	SmartCardGroup
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SDRSVC	%SystemRoot%\system32\svchost.exe -k SDRSVC	Signed	@%SystemRoot%\system32\sdrsvc.dll,-107
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS	%SystemRoot%\system32\svchost.exe -k netsvcs	Signed	@%SystemRoot%\system32\Sens.dll,-200	ProfSvc_Group
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMPTRAP	%SystemRoot%\System32\snmptrap.exe		@%SystemRoot%\system32\snmptrap.exe,-3
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SSDPSRV	%SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation	Signed	@%systemroot%\system32\ssdpsrv.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SamSs	%SystemRoot%\system32\lsass.exe		@%SystemRoot%\system32\samsrv.dll,-1	MS_WindowsLocalValidation
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule	%SystemRoot%\System32\svchost.exe -k netsvcs	Signed	@%SystemRoot%\system32\schedsvc.dll,-100	SchedulerGroup
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SensrSvc	%SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation	Signed	@%SystemRoot%\System32\sensrsvc.dll,-1000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SessionEnv	%SystemRoot%\System32\svchost.exe -k netsvcs	Signed	@%SystemRoot%\System32\SessEnv.dll,-1026
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess	%SystemRoot%\System32\svchost.exe -k netsvcs	Signed	@%SystemRoot%\system32\ipnathlp.dll,-106
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ShellHWDetection	%SystemRoot%\System32\svchost.exe -k netsvcs	Signed	@%SystemRoot%\System32\shsvcs.dll,-12288	ShellSvcGroup
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SstpSvc	%SystemRoot%\system32\svchost.exe -k LocalService	Signed	@%SystemRoot%\system32\sstpsvc.dll,-200
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysMain	%systemroot%\system32\svchost.exe -k LocalSystemNetworkRestricted	Signed	@%SystemRoot%\system32\sysmain.dll,-1000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TBS	%SystemRoot%\System32\svchost.exe -k LocalServiceAndNoImpersonation	Signed	@%SystemRoot%\system32\tbssvc.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\THREADORDER	%SystemRoot%\system32\svchost.exe -k LocalService	Signed	@%systemroot%\system32\mmcss.dll,-102
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TabletInputService	%SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted	Signed	@%SystemRoot%\system32\TabSvc.dll,-100	PlugPlay
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TapiSrv	%SystemRoot%\System32\svchost.exe -k NetworkService	Signed	@%SystemRoot%\system32\tapisrv.dll,-10100
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService	%SystemRoot%\System32\svchost.exe -k NetworkService	Signed	@%SystemRoot%\System32\termsrv.dll,-268
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Themes	%SystemRoot%\System32\svchost.exe -k netsvcs	Signed	@%SystemRoot%\System32\themeservice.dll,-8192	ProfSvc_Group
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks	%SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted	Signed	@%SystemRoot%\system32\trkwks.dll,-1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrustedInstaller	%SystemRoot%\servicing\TrustedInstaller.exe	Signed	@%SystemRoot%\servicing\TrustedInstaller.exe,-100	ProfSvc_Group
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UxSms	%SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted	Signed	@%SystemRoot%\system32\dwm.exe,-2000	UIGroup
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS	%systemroot%\system32\vssvc.exe		@%systemroot%\system32\vssvc.exe,-102
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VaultSvc	%SystemRoot%\system32\lsass.exe		@%SystemRoot%\system32\vaultsvc.dll,-1003
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time	%SystemRoot%\system32\svchost.exe -k LocalService	Signed	@%SystemRoot%\system32\w32time.dll,-200
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMPNetworkSvc	"%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe"		@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WPCSvc	%SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted	Signed	@%SystemRoot%\system32\wpcsvc.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WPDBusEnum	%SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted	Signed	@%SystemRoot%\system32\wpdbusenum.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WSearch	%systemroot%\system32\SearchIndexer.exe /Embedding	Signed	@%systemroot%\system32\SearchIndexer.exe,-103
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WatAdminSvc	%SystemRoot%\system32\Wat\WatAdminSvc.exe		@%SystemRoot%\system32\Wat\WatUX.exe,-601
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WbioSrvc	%SystemRoot%\system32\svchost.exe -k WbioSvcGroup	Signed	@%systemroot%\system32\wbiosrvc.dll,-100	SmartCardGroup
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WcsPlugInService	%SystemRoot%\system32\svchost.exe -k wcssvc	Signed	@%SystemRoot%\system32\WcsPlugInService.dll,-200
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdiServiceHost	%SystemRoot%\System32\svchost.exe -k LocalService	Signed	@%systemroot%\system32\wdi.dll,-502
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdiSystemHost	%SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted	Signed	@%systemroot%\system32\wdi.dll,-500
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient	%SystemRoot%\system32\svchost.exe -k LocalService	Signed	@%systemroot%\system32\webclnt.dll,-100	NetworkProvider
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wecsvc	%SystemRoot%\system32\svchost.exe -k NetworkService	Signed	@%SystemRoot%\system32\wecsvc.dll,-200
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WerSvc	%SystemRoot%\System32\svchost.exe -k WerSvcGroup	Signed	@%SystemRoot%\System32\wersvc.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc	%SystemRoot%\system32\svchost.exe -k LocalService	Signed	@%SystemRoot%\system32\winhttp.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinRM	%SystemRoot%\System32\svchost.exe -k NetworkService	Signed	@%Systemroot%\system32\wsmsvc.dll,-101
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winmgmt	%systemroot%\system32\svchost.exe -k netsvcs	Signed	@%Systemroot%\system32\wbem\wmisvc.dll,-205
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wlansvc	%SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted	Signed	@%SystemRoot%\System32\wlansvc.dll,-257	TDI
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WwanSvc	%SystemRoot%\system32\svchost.exe -k LocalServiceNoNetwork	Signed	@%SystemRoot%\System32\wwansvc.dll,-257	TDI
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aspnet_state	%SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	Signed	ASP.NET State Service
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bthserv	%SystemRoot%\system32\svchost.exe -k bthsvcs	Signed	@%SystemRoot%\System32\bthserv.dll,-101
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\btwdins	c:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe	Signed	Bluetooth Service
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\clr_optimization_v2.0.50727_32	%systemroot%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	Signed	Microsoft .NET Framework NGEN v2.0.50727_X86
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\clr_optimization_v2.0.50727_64	%systemroot%\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	Signed	Microsoft .NET Framework NGEN v2.0.50727_X64
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\clr_optimization_v4.0.30319_32	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	Signed	Microsoft .NET Framework NGEN v4.0.30319_X86
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\clr_optimization_v4.0.30319_64	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	Signed	Microsoft .NET Framework NGEN v4.0.30319_X64
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\defragsvc	%SystemRoot%\system32\svchost.exe -k defragsvc	Signed	@%SystemRoot%\system32\defragsvc.dll,-101
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dot3svc	%SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted	Signed	Wired AutoConfig	TDI
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ehRecvr	%systemroot%\ehome\ehRecvr.exe	Signed	@%SystemRoot%\ehome\ehrecvr.exe,-101
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ehSched	%systemroot%\ehome\ehsched.exe	Signed	@%SystemRoot%\ehome\ehsched.exe,-101
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog	%SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted	Signed	@%SystemRoot%\system32\wevtsvc.dll,-200	Event Log
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fdPHost	%SystemRoot%\system32\svchost.exe -k LocalService	Signed	@%systemroot%\system32\fdPHost.dll,-100
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gpsvc	%systemroot%\system32\svchost.exe -k netsvcs	Signed	@gpapi.dll,-112	ProfSvc_Group
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hidserv	%SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted	Signed	@%SystemRoot%\System32\hidserv.dll,-101
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hkmsvc	%SystemRoot%\System32\svchost.exe -k netsvcs	Signed	@%SystemRoot%\system32\kmsvc.dll,-6
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hpqwmiex	"C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe"		HP Software Framework Service
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\idsvc	"%systemroot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe"	Signed	@%systemroot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8193
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iphlpsvc	%SystemRoot%\System32\svchost.exe -k NetSvcs	Signed	@%SystemRoot%\system32\iphlpsvc.dll,-500
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lltdsvc	%SystemRoot%\System32\svchost.exe -k LocalService	Signed	@%SystemRoot%\system32\lltdres.dll,-1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lmhosts	%SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted	Signed	@%SystemRoot%\system32\lmhsvc.dll,-101	TDI
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msiserver	%systemroot%\system32\msiexec.exe /V	Signed	@%SystemRoot%\system32\msimsg.dll,-27
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\napagent	%SystemRoot%\System32\svchost.exe -k NetworkService	Signed	@%SystemRoot%\system32\qagentrt.dll,-6
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\netprofm	%SystemRoot%\System32\svchost.exe -k LocalService	Signed	@%SystemRoot%\system32\netprofm.dll,-202
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nsi	%systemroot%\system32\svchost.exe -k LocalService	Signed	@%SystemRoot%\system32\nsisvc.dll,-200
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p2pimsvc	%SystemRoot%\System32\svchost.exe -k LocalServicePeerNet	Signed	@%SystemRoot%\system32\pnrpsvc.dll,-8004
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p2psvc	%SystemRoot%\System32\svchost.exe -k LocalServicePeerNet	Signed	@%SystemRoot%\system32\p2psvc.dll,-8006
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pdfcDispatcher	C:\Program Files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService	Signed	PDF Document Manager
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pla	%SystemRoot%\System32\svchost.exe -k LocalServiceNoNetwork	Signed	@%systemroot%\system32\pla.dll,-500
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seclogon	%windir%\system32\svchost.exe -k netsvcs	Signed	@%SystemRoot%\system32\seclogon.dll,-7001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sppsvc	%SystemRoot%\system32\sppsvc.exe		@%SystemRoot%\system32\sppsvc.exe,-101
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sppuinotify	%SystemRoot%\system32\svchost.exe -k LocalService	Signed	@%SystemRoot%\system32\sppuinotify.dll,-103
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\stisvc	%SystemRoot%\system32\svchost.exe -k imgsvc	Signed	@%SystemRoot%\system32\wiaservc.dll,-9
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv	%SystemRoot%\System32\svchost.exe -k swprv	Signed	@%SystemRoot%\System32\swprv.dll,-103
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\upnphost	%SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation	Signed	@%systemroot%\system32\upnphost.dll,-213
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vds	%SystemRoot%\System32\vds.exe		@%SystemRoot%\system32\vds.exe,-100
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wbengine	"%systemroot%\system32\wbengine.exe"		Block Level Backup Engine Service
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wcncsvc	%SystemRoot%\System32\svchost.exe -k LocalServiceAndNoImpersonation	Signed	@%SystemRoot%\system32\wcncsvc.dll,-3
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wercplsupport	%SystemRoot%\System32\svchost.exe -k netsvcs	Signed	@%SystemRoot%\System32\wercplsupport.dll,-101
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wlcrasvc	"C:\Program Files\Windows Live\Mesh\wlcrasvc.exe"	Signed	Windows Live Mesh remote connections service
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wlidsvc	"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"	Signed	Windows Live ID Sign-in Assistant
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wmiApSrv	%systemroot%\system32\wbem\WmiApSrv.exe		@%Systemroot%\system32\wbem\wmiapsrv.exe,-110
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc	%SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted	Signed	@%SystemRoot%\System32\wscsvc.dll,-200
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv	%systemroot%\system32\svchost.exe -k netsvcs	Signed	@%systemroot%\system32\wuaueng.dll,-105
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wudfsvc	%SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted	Signed	@%SystemRoot%\system32\wudfsvc.dll,-1000	PlugPlay
Drivers
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\1394ohci	\SystemRoot\system32\drivers\1394ohci.sys		1394 OHCI Compliant Host Controller
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\A2DDA	\??\C:\Users\George\Documents\EmsisoftEmergencyKit\Run\a2ddax64.sys	Signed	A2 Direct Disk Access Support Driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ACPI	system32\drivers\ACPI.sys		Microsoft ACPI Driver	Boot Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD	\SystemRoot\system32\drivers\afd.sys		@%systemroot%\system32\drivers\afd.sys,-1000	PNP_TDI
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AcpiPmi	\SystemRoot\system32\drivers\acpipmi.sys		ACPI Power Meter Driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AmdK8	\SystemRoot\system32\drivers\amdk8.sys		AMD K8 Processor Driver	Extended Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AmdPPM	\SystemRoot\system32\drivers\amdppm.sys		AMD Processor Driver	Extended Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppID	\SystemRoot\system32\drivers\appid.sys		@%systemroot%\system32\appidsvc.dll,-102
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AsyncMac	system32\DRIVERS\asyncmac.sys		@%systemroot%\system32\rascfg.dll,-32000
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BCM43XX	system32\DRIVERS\bcmwl664.sys		Broadcom 802.11 Network Adapter Driver	NDIS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHMODEM	\SystemRoot\system32\drivers\bthmodem.sys		Bluetooth Serial Communications Driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT	System32\Drivers\BTHport.sys		Bluetooth Port Driver	PNP Filter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHUSB	System32\Drivers\BTHUSB.sys		Bluetooth Radio USB Driver	PNP Filter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTWAMPFL	system32\DRIVERS\btwampfl.sys		btwampfl	PNP Filter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BrFiltLo	\SystemRoot\system32\drivers\BrFiltLo.sys		Brother USB Mass-Storage Lower Filter Driver	extended base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BrFiltUp	\SystemRoot\system32\drivers\BrFiltUp.sys		Brother USB Mass-Storage Upper Filter Driver	extended base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BrSerWdm	\SystemRoot\System32\Drivers\BrSerWdm.sys		Brother WDM Serial driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BrUsbMdm	\SystemRoot\System32\Drivers\BrUsbMdm.sys		Brother MFC USB Fax Only Modem
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BrUsbSer	\SystemRoot\System32\Drivers\BrUsbSer.sys		Brother MFC USB Serial WDM Driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BridgeMP	system32\DRIVERS\bridge.sys		@%SystemRoot%\system32\bridgeres.dll,-1	PNP_TDI
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Brserid	\SystemRoot\System32\Drivers\Brserid.sys		Brother MFC Serial Port Interface Driver (WDM)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BthEnum	system32\DRIVERS\BthEnum.sys		Bluetooth Request Block Driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BthPan	system32\DRIVERS\bthpan.sys		Bluetooth Device (Personal Area Network)	NDIS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS	System32\CLFS.sys		@%SystemRoot%\system32\clfs.sys,-100	Filter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CNG	System32\Drivers\cng.sys			Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CmBatt	\SystemRoot\system32\drivers\CmBatt.sys		Microsoft ACPI Control Method Battery Driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Compbatt	\SystemRoot\system32\drivers\compbatt.sys			System Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CompositeBus	\SystemRoot\system32\drivers\CompositeBus.sys		Composite Bus Enumerator Driver	Extended Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DXGKrnl	\SystemRoot\System32\drivers\dxgkrnl.sys		LDDM Graphics Subsystem	Video Init
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DfsC	System32\Drivers\dfsc.sys		@%systemroot%\system32\drivers\dfsc.sys,-101	Network
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Disk	system32\drivers\disk.sys		Disk Driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DrvAgent64	\??\C:\Windows\SysWOW64\Drivers\DrvAgent64.SYS	Signed	DrvAgent64
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EraserUtilRebootDrv	\??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys	Signed	EraserUtilRebootDrv
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ErrDev	\SystemRoot\system32\drivers\errdev.sys		Microsoft Hardware Error Device Driver	Extended Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FileInfo	system32\drivers\fileinfo.sys		@%SystemRoot%\system32\drivers\fileinfo.sys,-100	FSFilter Bottom
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Filetrace	system32\drivers\filetrace.sys		@%SystemRoot%\system32\drivers\filetrace.sys,-10001	FSFilter Activity Monitor
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FltMgr	system32\drivers\fltmgr.sys		@%SystemRoot%\system32\drivers\fltmgr.sys,-10001	FSFilter Infrastructure
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FsDepends	System32\drivers\FsDepends.sys		@%SystemRoot%\system32\drivers\fsdepends.sys,-10001	Filter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HDAudBus	\SystemRoot\system32\drivers\HDAudBus.sys		Microsoft UAA Bus Driver for High Definition Audio	Extended Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP	system32\drivers\HTTP.sys		@%SystemRoot%\system32\drivers\http.sys,-1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HdAudAddService	system32\drivers\HdAudio.sys		Microsoft 1.1 UAA Function Driver for High Definition Audio Service
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HidBatt	\SystemRoot\system32\drivers\HidBatt.sys		HID UPS Battery Driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HidBth	\SystemRoot\system32\drivers\hidbth.sys		Microsoft Bluetooth HID Miniport	extended base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HidIr	\SystemRoot\system32\drivers\hidir.sys		Microsoft Infrared HID Driver	extended base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HidUsb	\SystemRoot\system32\drivers\hidusb.sys		Microsoft HID Class Driver	extended base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HpSAMD	\SystemRoot\system32\drivers\HpSAMD.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPMIDRV	\SystemRoot\system32\drivers\IPMIDrv.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPNAT	System32\drivers\ipnat.sys		IP Network Address Translator
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IRENUM	system32\drivers\irenum.sys		@%SystemRoot%\system32\drivers\irenum.sys,-100
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IntcAzAudAddService	system32\drivers\RTKVHD64.sys		Service for Realtek HD Audio (WDM)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IpFilterDriver	system32\DRIVERS\ipfltdrv.sys		@%systemroot%\system32\rascfg.dll,-32013
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KSecDD	System32\Drivers\ksecdd.sys			Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KSecPkg	System32\Drivers\ksecpkg.sys			Cryptography
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LSI_FC	\SystemRoot\system32\drivers\lsi_fc.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LSI_SAS	\SystemRoot\system32\drivers\lsi_sas.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LSI_SAS2	\SystemRoot\system32\drivers\lsi_sas2.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LSI_SCSI	\SystemRoot\system32\drivers\lsi_scsi.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxDAV	\SystemRoot\system32\drivers\mrxdav.sys		@%systemroot%\system32\webclnt.dll,-104
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSKSSRV	system32\drivers\MSKSSRV.sys		Microsoft Streaming Service Proxy	Extended Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSPCLOCK	system32\drivers\MSPCLOCK.sys		Microsoft Streaming Clock Proxy	Extended Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSPQM	system32\drivers\MSPQM.sys		Microsoft Streaming Quality Manager Proxy	Extended Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSTEE	system32\drivers\MSTEE.sys		Microsoft Streaming Tee/Sink-to-Sink Converter	Extended Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MTConfig	\SystemRoot\system32\drivers\MTConfig.sys		Microsoft Input Configuration Driver	Extended Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MegaSR	\SystemRoot\system32\drivers\MegaSR.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Modem	system32\drivers\modem.sys			Extended base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpFilter	system32\DRIVERS\MpFilter.sys		Microsoft Malware Protection Driver	FSFilter Anti-Virus
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mup	System32\Drivers\mup.sys		@%systemroot%\system32\drivers\mup.sys,-101	Network
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS	system32\drivers\ndis.sys		@%SystemRoot%\system32\drivers\ndis.sys,-200	NDIS Wrapper
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NativeWifiP	system32\DRIVERS\nwifi.sys		NativeWiFi Filter	NDIS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisCap	system32\DRIVERS\ndiscap.sys		NDIS Capture LightWeight Filter	NDIS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisTapi	system32\DRIVERS\ndistapi.sys		@%systemroot%\system32\rascfg.dll,-32001
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisWan	system32\DRIVERS\ndiswan.sys		@%systemroot%\system32\rascfg.dll,-32002
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ndisuio	system32\DRIVERS\ndisuio.sys		NDIS Usermode I/O Protocol	NDIS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBIOS	system32\DRIVERS\netbios.sys		NetBIOS Interface	NetBIOSGroup
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT	System32\DRIVERS\netbt.sys		@%SystemRoot%\system32\drivers\netbt.sys,-2	PNP_TDI
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NisDrv	system32\DRIVERS\NisDrvWFP.sys		Microsoft Network Inspection System
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PEAUTH	system32\drivers\peauth.sys		PEAUTH
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PORTMON	\??\C:\Users\George\Documents\SysinternalsSuite\PORTMSYS.SYS		PORTMON
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Parport	\SystemRoot\system32\drivers\parport.sys		Parallel port driver	Parallel arbitrator
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Partizan	system32\drivers\Partizan.sys	Signed	Partizan	Boot Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PptpMiniport	system32\DRIVERS\raspptp.sys		@%systemroot%\system32\rascfg.dll,-32006
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Processor	\SystemRoot\system32\drivers\processr.sys		Processor Driver	Extended Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Psched	system32\DRIVERS\pacer.sys		@%SystemRoot%\System32\drivers\pacer.sys,-101	NDIS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\QWAVEdrv	\SystemRoot\system32\drivers\qwavedrv.sys		@%SystemRoot%\system32\drivers\qwavedrv.sys,-1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPCDD	System32\DRIVERS\RDPCDD.sys		@%systemroot%\system32\DRIVERS\RDPCDD.sys,-100	Video Save
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPENCDD	system32\drivers\rdpencdd.sys		@%systemroot%\system32\drivers\RDPENCDD.sys,-101	Video Save
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPREFMP	system32\drivers\rdprefmp.sys		@%systemroot%\system32\drivers\RdpRefMp.sys,-101	Video Save
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RFCOMM	system32\DRIVERS\rfcomm.sys		Bluetooth Device (RFCOMM Protocol TDI)	PNP_TDI
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RTL8167	system32\DRIVERS\Rt64win7.sys		Realtek 8167 NT Driver	NDIS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAcd	System32\DRIVERS\rasacd.sys		Remote Access Auto Connection Driver	Streams Drivers
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAgileVpn	system32\DRIVERS\AgileVpn.sys		WAN Miniport (IKEv2)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasPppoe	system32\DRIVERS\raspppoe.sys		@%systemroot%\system32\rascfg.dll,-32007
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasSstp	system32\DRIVERS\rassstp.sys		@%systemroot%\system32\sstpsvc.dll,-202
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rasl2tp	system32\DRIVERS\rasl2tp.sys		@%systemroot%\system32\rascfg.dll,-32005
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SWDUMon	system32\DRIVERS\SWDUMon.sys		SWDUMon
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serenum	\SystemRoot\system32\drivers\serenum.sys		Serenum Filter Driver	PNP Filter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serial	\SystemRoot\system32\drivers\serial.sys			Extended base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SiSRaid2	\SystemRoot\system32\drivers\SiSRaid2.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SiSRaid4	\SystemRoot\system32\drivers\sisraid4.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Smb	system32\DRIVERS\smb.sys		@%SystemRoot%\system32\tcpipcfg.dll,-50005	PNP_TDI
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TCPIP6	system32\DRIVERS\tcpip.sys		Microsoft IPv6 Protocol Driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDPIPE	system32\drivers\tdpipe.sys		TDPIPE
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDTCP	system32\drivers\tdtcp.sys		TDTCP
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip	System32\drivers\tcpip.sys		@%SystemRoot%\system32\tcpipcfg.dll,-50003	PNP_TDI
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermDD	\SystemRoot\system32\drivers\termdd.sys		Terminal Device Driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TsUsbFlt	system32\drivers\tsusbflt.sys			base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TsUsbGD	\SystemRoot\system32\drivers\TsUsbGD.sys		Remote Desktop Generic USB Device	Extended Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR	system32\DRIVERS\USBSTOR.SYS		USB Mass Storage Driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UmPass	\SystemRoot\system32\drivers\umpass.sys		Microsoft UMPass Driver	Extended Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VgaSave	\SystemRoot\System32\drivers\vga.sys			Video Save
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WANARP	system32\DRIVERS\wanarp.sys		@%systemroot%\system32\rascfg.dll,-32011
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WIMMount	system32\drivers\wimmount.sys	Signed	WIMMount	FSFilter Infrastructure
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WUDFRd	system32\DRIVERS\WUDFRd.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WacomPen	\SystemRoot\system32\drivers\wacompen.sys		Wacom Serial Pen HID Driver	Extended Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wanarpv6	system32\DRIVERS\wanarp.sys		@%systemroot%\system32\rascfg.dll,-32012
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wd	\SystemRoot\system32\drivers\wd.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wdf01000	system32\drivers\Wdf01000.sys		Kernel Mode Driver Frameworks service	WdfLoadGroup
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WfpLwf	system32\DRIVERS\wfplwf.sys		WFP Lightweight Filter	NDIS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmiAcpi	\SystemRoot\system32\drivers\wmiacpi.sys		Microsoft Windows Management Interface for ACPI	Extended Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WsAudioDevice_383S(1)	system32\drivers\WsAudioDevice_383S(1).sys		WsAudioDevice_383S(1)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WudfPf	system32\drivers\WudfPf.sys		User Mode Driver Frameworks Platform Driver	base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\adp94xx	\SystemRoot\system32\drivers\adp94xx.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\adpahci	\SystemRoot\system32\drivers\adpahci.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\adpu320	\SystemRoot\system32\drivers\adpu320.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\agp440	\SystemRoot\system32\drivers\agp440.sys		Intel AGP Bus Filter	PnP Filter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aliide	\SystemRoot\system32\drivers\aliide.sys			System Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amd_sata	system32\drivers\amd_sata.sys			SCSI miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amd_xata	system32\drivers\amd_xata.sys			SCSI miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amdide	\SystemRoot\system32\drivers\amdide.sys			System Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amdkmdag	system32\DRIVERS\atikmdag.sys			Video
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amdkmdap	system32\DRIVERS\atikmpag.sys			Video
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amdsata	\SystemRoot\system32\drivers\amdsata.sys			SCSI miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amdsbs	\SystemRoot\system32\drivers\amdsbs.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amdxata	system32\drivers\amdxata.sys			SCSI miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\arc	\SystemRoot\system32\drivers\arc.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\arcsas	\SystemRoot\system32\drivers\arcsas.sys			SCSI miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi	\SystemRoot\system32\drivers\atapi.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\b06bdrv	\SystemRoot\system32\drivers\bxvbda.sys		Broadcom NetXtreme II VBD	base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\b57nd60a	system32\DRIVERS\b57nd60a.sys		Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0	NDIS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\blbdrive	\SystemRoot\system32\drivers\blbdrive.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bowser	system32\DRIVERS\bowser.sys		@%systemroot%\system32\browser.dll,-102	Network
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\btwaudio	system32\drivers\btwaudio.sys		Bluetooth Audio Device Service
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\btwavdt	\SystemRoot\system32\drivers\btwavdt.sys		Bluetooth AVDT
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\btwl2cap	system32\DRIVERS\btwl2cap.sys		Bluetooth L2CAP Service	Extended Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\btwrchid	\SystemRoot\system32\drivers\btwrchid.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cdfs	system32\DRIVERS\cdfs.sys		CD/DVD File System Reader	Boot File System
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cdrom	\SystemRoot\system32\drivers\cdrom.sys		CD-ROM Driver	SCSI CDROM Class
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\circlass	\SystemRoot\system32\drivers\circlass.sys		Consumer IR Devices	Extended Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdide	\SystemRoot\system32\drivers\cmdide.sys			System Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\crcdisk	\SystemRoot\system32\drivers\crcdisk.sys		Crcdisk Filter Driver	Pnp Filter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\discache	System32\drivers\discache.sys		@%systemroot%\system32\drivers\discache.sys,-102
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\drmkaud	system32\drivers\drmkaud.sys		Microsoft Trusted Audio Drivers
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ebdrv	\SystemRoot\system32\drivers\evbda.sys		Broadcom NetXtreme II 10 GigE VBD	base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eeCtrl	\??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys	Signed	Symantec Eraser Control driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\elxstor	\SystemRoot\system32\drivers\elxstor.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fdc	\SystemRoot\system32\drivers\fdc.sys		Floppy Disk Controller Driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\flpydisk	\SystemRoot\system32\drivers\flpydisk.sys		Floppy Disk Driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fvevol	System32\DRIVERS\fvevol.sys		@%SystemRoot%\system32\drivers\fvevol.sys,-100	PnP Filter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gagp30kx	\SystemRoot\system32\drivers\gagp30kx.sys		Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms	PnP Filter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hcw85cir	\SystemRoot\system32\drivers\hcw85cir.sys		Hauppauge Consumer Infrared Receiver	Extended Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hwpolicy	System32\drivers\hwpolicy.sys		@%systemroot%\system32\drivers\hwpolicy.sys,-101
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt	\SystemRoot\system32\drivers\i8042prt.sys		i8042 Keyboard and PS/2 Mouse Port Driver	Keyboard Port
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iScsiPrt	system32\DRIVERS\msiscsi.sys		iScsiPort Driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iaStorV	\SystemRoot\system32\drivers\iaStorV.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\igfx	system32\DRIVERS\igdkmd64.sys			Video
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iirsp	\SystemRoot\system32\drivers\iirsp.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\intelide	\SystemRoot\system32\drivers\intelide.sys			System Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\intelppm	\SystemRoot\system32\drivers\intelppm.sys		Intel Processor Driver	Extended Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\isapnp	\SystemRoot\system32\drivers\isapnp.sys			Boot Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\k1mc580d	\??\C:\Windows\system32\drivers\k1mc580d.sys	Signed	Vba32 Armour Driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdclass	\SystemRoot\system32\drivers\kbdclass.sys		Keyboard Class Driver	Keyboard Class
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid	\SystemRoot\system32\drivers\kbdhid.sys		Keyboard HID Driver	Keyboard Port
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ksthunk	\SystemRoot\system32\drivers\ksthunk.sys		Kernel Streaming Thunks	PNP Filter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lltdio	system32\DRIVERS\lltdio.sys		Link-Layer Topology Discovery Mapper I/O Driver	NDIS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\luafv	\SystemRoot\system32\drivers\luafv.sys		@%systemroot%\system32\drivers\luafv.sys,-100	FSFilter Virtualization
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\megasas	\SystemRoot\system32\drivers\megasas.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\monitor	system32\DRIVERS\monitor.sys		Microsoft Monitor Class Function Driver Service
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mouclass	\SystemRoot\system32\drivers\mouclass.sys		Mouse Class Driver	Pointer Class
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mouhid	\SystemRoot\system32\drivers\mouhid.sys		Mouse HID Driver	Pointer Port
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mountmgr	System32\drivers\mountmgr.sys		@%SystemRoot%\system32\drivers\mountmgr.sys,-100	System Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mpio	\SystemRoot\system32\drivers\mpio.sys			Boot Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mpsdrv	System32\drivers\mpsdrv.sys		@%SystemRoot%\system32\FirewallAPI.dll,-23092	network
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mrxsmb	system32\DRIVERS\mrxsmb.sys		@%systemroot%\system32\wkssvc.dll,-1002	Network
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mrxsmb10	system32\DRIVERS\mrxsmb10.sys		@%systemroot%\system32\wkssvc.dll,-1004	Network
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mrxsmb20	system32\DRIVERS\mrxsmb20.sys		@%systemroot%\system32\wkssvc.dll,-1006	Network
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msahci	\SystemRoot\system32\drivers\msahci.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msdsm	\SystemRoot\system32\drivers\msdsm.sys			System Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mshidkmdf	\SystemRoot\System32\drivers\mshidkmdf.sys		@%SystemRoot%\system32\drivers\mshidkmdf.sys,-100	Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msisadrv	system32\drivers\msisadrv.sys			Boot Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mssmbios	\SystemRoot\system32\drivers\mssmbios.sys		Microsoft System Management BIOS Driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nfrd960	\SystemRoot\system32\drivers\nfrd960.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nsiproxy	system32\drivers\nsiproxy.sys		@%SystemRoot%\system32\drivers\nsiproxy.sys,-2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nv_agp	\SystemRoot\system32\drivers\nv_agp.sys		NVIDIA nForce AGP Bus Filter	PnP Filter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvraid	\SystemRoot\system32\drivers\nvraid.sys			System Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvstor	\SystemRoot\system32\drivers\nvstor.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ohci1394	\SystemRoot\system32\drivers\ohci1394.sys		1394 OHCI Compliant Host Controller (Legacy)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\partmgr	System32\drivers\partmgr.sys		@%SystemRoot%\system32\drivers\partmgr.sys,-100	Boot Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pci	system32\drivers\pci.sys		PCI Bus Driver	Boot Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pciide	\SystemRoot\system32\drivers\pciide.sys			System Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pcmcia	\SystemRoot\system32\drivers\pcmcia.sys			System Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pcw	System32\drivers\pcw.sys		Performance Counters for Windows Driver	Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql2300	\SystemRoot\system32\drivers\ql2300.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql40xx	\SystemRoot\system32\drivers\ql40xx.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdbss	system32\DRIVERS\rdbss.sys		@%systemroot%\system32\wkssvc.dll,-1000	Network
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdpbus	\SystemRoot\system32\drivers\rdpbus.sys		Remote Desktop Device Redirector Bus Driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdyboost	System32\drivers\rdyboost.sys		ReadyBoost	PnP Filter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rspndr	system32\DRIVERS\rspndr.sys		Link-Layer Topology Discovery Responder	NDIS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sbp2port	\SystemRoot\system32\drivers\sbp2port.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\scfilter	System32\DRIVERS\scfilter.sys		@%SystemRoot%\System32\drivers\scfilter.sys,-11	PnP Filter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sdbus	system32\DRIVERS\sdbus.sys			System Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sermouse	\SystemRoot\system32\drivers\sermouse.sys		Serial Mouse Driver	Pointer Port
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sffdisk	\SystemRoot\system32\drivers\sffdisk.sys		SFF Storage Class Driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sffp_mmc	\SystemRoot\system32\drivers\sffp_mmc.sys		SFF Storage Protocol Driver for MMC
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sffp_sd	\SystemRoot\system32\drivers\sffp_sd.sys		SFF Storage Protocol Driver for SDBus
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sfloppy	\SystemRoot\system32\drivers\sfloppy.sys		High-Capacity Floppy Disk Drive
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srv	System32\DRIVERS\srv.sys		@%systemroot%\system32\srvsvc.dll,-102	Network
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srv2	System32\DRIVERS\srv2.sys		@%systemroot%\system32\srvsvc.dll,-104	Network
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvnet	System32\DRIVERS\srvnet.sys			Network
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\stexstor	\SystemRoot\system32\drivers\stexstor.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swenum	\SystemRoot\system32\drivers\swenum.sys		Software Bus Driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tcpipreg	System32\drivers\tcpipreg.sys		TCP/IP Registry Compatibility
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdx	system32\DRIVERS\tdx.sys		@%SystemRoot%\system32\tcpipcfg.dll,-50004	PNP_TDI
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tssecsrv	System32\DRIVERS\tssecsrv.sys		@%SystemRoot%\System32\DRIVERS\tssecsrv.sys,-101
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tunnel	system32\DRIVERS\tunnel.sys		Microsoft Tunnel Miniport Adapter Driver	NDIS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\uagp35	\SystemRoot\system32\drivers\uagp35.sys		Microsoft AGPv3.5 Filter	PnP Filter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\udfs	system32\DRIVERS\udfs.sys		udfs	Boot File System
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\uliagpkx	\SystemRoot\system32\drivers\uliagpkx.sys		Uli AGP Bus Filter	PnP Filter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\umbus	system32\DRIVERS\umbus.sys		UMBus Enumerator Driver	Extended Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbccgp	\SystemRoot\system32\drivers\usbccgp.sys		Microsoft USB Generic Parent Driver	Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbcir	\SystemRoot\system32\drivers\usbcir.sys		eHome Infrared Receiver (USBCIR)	Extended Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbehci	\SystemRoot\system32\drivers\usbehci.sys		Microsoft USB 2.0 Enhanced Host Controller Miniport Driver	Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbfilter	\SystemRoot\system32\drivers\usbfilter.sys		AMD USB Filter Driver	PNP Filter
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbhub	\SystemRoot\system32\drivers\usbhub.sys		Microsoft USB Standard Hub Driver	Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbohci	\SystemRoot\system32\drivers\usbohci.sys		Microsoft USB Open Host Controller Miniport Driver	Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbprint	\SystemRoot\system32\drivers\usbprint.sys		Microsoft USB PRINTER Class	extended base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbuhci	\SystemRoot\system32\drivers\usbuhci.sys		Microsoft USB Universal Host Controller Miniport Driver	Base
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vdrvroot	system32\drivers\vdrvroot.sys		Microsoft Virtual Drive Enumerator Driver	Boot Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vga	system32\DRIVERS\vgapnp.sys			Video
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vhdmp	\SystemRoot\system32\drivers\vhdmp.sys			SCSI miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\viaide	\SystemRoot\system32\drivers\viaide.sys			System Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\volmgr	system32\drivers\volmgr.sys		Volume Manager Driver	System Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\volmgrx	System32\drivers\volmgrx.sys		@%SystemRoot%\system32\drivers\volmgrx.sys,-100	System Bus Extender
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\volsnap	system32\drivers\volsnap.sys		Storage volumes
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vsmraid	\SystemRoot\system32\drivers\vsmraid.sys			SCSI Miniport
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vwifibus	system32\DRIVERS\vwifibus.sys		Virtual WiFi Bus Driver
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vwififlt	system32\DRIVERS\vwififlt.sys		Virtual WiFi Filter Driver	NDIS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ws2ifsl	\SystemRoot\system32\drivers\ws2ifsl.sys		@%systemroot%\System32\drivers\ws2ifsl.sys,-1000	PNP_TDI