Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Emsisoft Anti-Malware_is1]
"Inno Setup: Setup Version"="5.4.0 (u)"
"Inno Setup: App Path"="C:\\Program Files\\Emsisoft Anti-Malware"
"InstallLocation"="C:\\Program Files\\Emsisoft Anti-Malware\\"
"Inno Setup: Icon Group"="Emsisoft Anti-Malware"
"Inno Setup: No Icons"=dword:00000001
"Inno Setup: User"="أبو حمزة"
"Inno Setup: Selected Tasks"="desktop_icon,quicklaunch_icon,context_menu"
"Inno Setup: Deselected Tasks"=""
"Inno Setup: Language"="Arabic"
"DisplayName"="Emsisoft Anti-Malware 5.1"
"DisplayIcon"="C:\\Program Files\\Emsisoft Anti-Malware\\a2start.exe"
"UninstallString"="\"C:\\Program Files\\Emsisoft Anti-Malware\\unins000.exe\""
"QuietUninstallString"="\"C:\\Program Files\\Emsisoft Anti-Malware\\unins000.exe\" /SILENT"
"DisplayVersion"="5.1"
"Publisher"="Emsi Software GmbH"
"URLInfoAbout"="http://www.emsisoft.com"
"HelpLink"="http://support.emsisoft.com"
"URLUpdateInfo"="http://www.emsisoft.com"
"Comments"="Emsisoft"
"NoModify"=dword:00000001
"NoRepair"=dword:00000001
"InstallDate"="20110129"
"MajorVersion"=dword:00000005
"MinorVersion"=dword:00000001

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\YUCache\Emsisoft Anti-Malware_is1]
"SlowInfoCache"=hex:85,b3,8b,09,00,00,00,00,c0,4d,31,7e,84,d5,e3,40,78,6c,b6,\
  d5,d3,c3,e3,40,01,00,00,00,43,3a,5c,50,72,6f,67,72,61,6d,20,46,69,6c,65,73,\
  5c,45,6d,73,69,73,6f,66,74,20,41,6e,74,69,2d,4d,61,6c,77,61,72,65,5c,61,32,\
  73,74,61,72,74,2e,65,78,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,43,3a,5c,50,72,\
  6f,67,72,61,6d,20,46,69,6c,65,73,5c,45,6d,73,69,73,6f,66,74,20,41,6e,74,69,\
  2d,4d,61,6c,77,61,72,65,5c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Emsisoft Anti-Malware_is1]
"SlowInfoCache"=hex:28,02,00,00,01,00,00,00,00,f0,92,09,00,00,00,00,14,ce,a3,\
  f9,68,e5,cb,01,01,00,00,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,\
  61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,45,00,6d,00,73,00,69,\
  00,73,00,6f,00,66,00,74,00,20,00,41,00,6e,00,74,00,69,00,2d,00,4d,00,61,00,\
  6c,00,77,00,61,00,72,00,65,00,5c,00,61,00,32,00,67,00,75,00,61,00,72,00,64,\
  00,2e,00,65,00,78,00,65,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00,00,00
"Changed"=dword:00000000

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"LangID"=hex:01,04
"@C:\\WINDOWS\\system32\\SHELL32.dll,-9216"="جهاز الكمبيوتر"
"@C:\\WINDOWS\\system32\\SHELL32.dll,-9217"="مواضع شبكة الاتصال"
"@C:\\WINDOWS\\system32\\SHELL32.dll,-8964"="سلة المحذوفات"
"@xpsp1res.dll,-11004"="Outlook Express"
"@C:\\WINDOWS\\system32\\rcbdyctl.dll,-152"="المساعدة عن بُعد"
"@shell32.dll,-22051"="المفكرة"
"@C:\\WINDOWS\\system32\\tourstart.exe,-1"="جولة في Windows XP"
"@shell32.dll,-22017"="دفتر العناوين"
"@shell32.dll,-22022"="موجه الأوامر"
"@shell32.dll,-22065"="إدارة الأدوات المساعدة"
"@shell32.dll,-22052"="لوحة مفاتيح على الشاشة"
"@shell32.dll,-22041"="مكبر"
"@C:\\WINDOWS\\system32\\xpsp1res.dll,-10077"="تعيين افتراضيات البرامج والوصول إليها"
"@C:\\PROGRA~1\\MOVIEM~1\\wmm2res.dll,-61446"="Windows Movie Maker"
"@shell32.dll,-22023"="إدارة الكمبيوتر"
"@shell32.dll,-22055"="الأداء"
"@shell32.dll,-22059"="خدمات"
"@C:\\WINDOWS\\system32\\comres.dll,-661"="خدمات المكونات"
"@shell32.dll,-22029"="عارض الأحداث"
"@shell32.dll,-22025"="مصادر البيانات (ODBC)"
"@shell32.dll,-22040"="نهج الأمان المحلي"
"@shell32.dll,-22019"="الحاسبة"
"@shell32.dll,-22069"="الدفتر"
"@shell32.dll,-22054"="الرسام"
"@C:\\WINDOWS\\system32\\sti_ci.dll,-11"="معالج الماسح الضوئي والكاميرا"
"@shell32.dll,-22031"="HyperTerminal"
"@shell32.dll,-22027"="أداة إلغاء تجزئة القرص"
"@C:\\WINDOWS\\system32\\restore\\rstrui.exe,-2048"="استعادة النظام"
"@shell32.dll,-22018"="النسخ الاحتياطي"
"@shell32.dll,-22026"="تنظيف القرص"
"@shell32.dll,-22021"="مخطط توزيع الأحرف"
"@C:\\WINDOWS\\system32\\usmt\\migwiz.exe,-202"="معالج نقل الملفات والإعدادات"
"@shell32.dll,-22063"="معلومات النظام"
"@shell32.dll,-22016"="معالج الوصول"
"@shell32.dll,-22061"="مسجل الصوت"
"@shell32.dll,-22057"="Pinball"
"@shell32.dll,-22030"="الخلية الحرة"
"@C:\\PROGRA~1\\MSNGAM~1\\Windows\\chkrres.dll,-1212"="الداما عبر إنترنت"
"@C:\\PROGRA~1\\MSNGAM~1\\Windows\\bckgres.dll,-1212"="الطاولة عبر إنترنت"
"@C:\\WINDOWS\\system32\\mshearts.exe,-413"="الكوبة"
"@C:\\PROGRA~1\\MSNGAM~1\\Windows\\hrtzres.dll,-1212"="الكوبة عبر إنترنت"
"@C:\\PROGRA~1\\MSNGAM~1\\Windows\\shvlres.dll,-1212"="الورق البستوني عبر إنترنت"
"@C:\\PROGRA~1\\MSNGAM~1\\Windows\\rvseres.dll,-1212"="ريفرسي عبر إنترنت"
"@shell32.dll,-22060"="سوليتير"
"@C:\\WINDOWS\\system32\\spider.exe,-56"="سوليتير العنكبوت"
"@shell32.dll,-22045"="كانسة الألغام"
"@shell32.dll,-21782"="البرامج"
"@shell32.dll,-21787"="بدء التشغيل"
"@shell32.dll,-21761"="البرامج الملحقة"
"@shell32.dll,-21772"="ترفيه"
"@shell32.dll,-21760"="الوصول"
"@shell32.dll,-22067"="مستكشف Windows"
"@shell32.dll,-22062"="تزامن"
"@C:\\WINDOWS\\system32\\compatUI.dll,-115"="معالج توافق البرامج"
"@shell32.dll,-22075"="نشرة Windows"
"@shell32.dll,-21762"="أدوات إدارية"
"@shell32.dll,-21773"="تسالي"
"@shell32.dll,-21768"="اتصالات"
"@shell32.dll,-21788"="أدوات النظام"
"@C:\\WINDOWS\\system32\\netshell.dll,-1200"="اتصالات شبكة الاتصال"
"@C:\\WINDOWS\\system32\\netshell.dll,-1010"="معالج اتصال جديد"
"@C:\\WINDOWS\\system32\\hnetwiz.dll,-3085"="معالج \"إعداد شبكة الاتصال\""
"@C:\\WINDOWS\\System32\\xpsp2res.dll,-16201"="معالج إعداد الشبكة اللاسلكية"
"@shell32.dll,-22058"="مهام مجدولة"
"@C:\\WINDOWS\\System32\\xpsp2res.dll,-6103"="مركز الأمان"
"@shell32.dll,-22066"="التحكم بحجم الصوت"
"@explorer.exe,-7024"="إنترنت"
"@explorer.exe,-7025"="البريد الإلكتروني"
"@C:\\WINDOWS\\system32\\SHELL32.dll,-9227"="المستندات"
"@shell32.dll,-21779"="الصور"
"@shell32.dll,-21790"="الموسيقى"
"C:\\WINDOWS\\system32\\igfxpers.exe"="persistence Module"
"@xpsp1res.dll,-10077"="تعيين افتراضيات البرامج والوصول إليها"
"@C:\\WINDOWS\\system32\\SHELL32.dll,-9319"="الطابعات والفاكسات"
"@explorer.exe,-7021"="ت&عليمات ودعم"
"@explorer.exe,-7020"="&بحث"
"@explorer.exe,-7023"="تش&غيل..."
"C:\\WINDOWS\\system32\\igfxtray.exe"="igfxTray Module"
"C:\\WINDOWS\\system32\\hkcmd.exe"="hkcmd Module"
"C:\\WINDOWS\\system32\\WLTRAY.exe"="Dell Wireless WLAN Card Wireless Network Tray Applet"
"C:\\Program Files\\Common Files\\Acronis\\Schedule2\\schedhlp.exe"="Acronis Scheduler Helper"
"C:\\Program Files\\Unlocker\\UnlockerAssistant.exe"="UnlockerAssistant"
"C:\\Program Files\\KeyScrambler\\keyscrambler.exe"="KeyScrambler"
"C:\\WINDOWS\\system32\\dumprep.exe"="Windows Error Reporting Dump Reporting Tool"
"C:\\Program Files\\Malwarebytes' Anti-Malware\\mbamgui.exe"="Malwarebytes' Anti-Malware"
"C:\\Program Files\\Alwil Software\\Avast5\\avastUI.exe"="avast! Antivirus"
"C:\\PROGRAM FILES\\EMSISOFT ANTI-MALWARE\\a2guard.exe"="Background Guard"
"C:\\WINDOWS\\system32\\ctfmon.exe"="CTF Loader"
"C:\\Program Files\\SuperCopier2\\SuperCopier2.exe"="SuperCopier 2 (explorer file copy replacement)"
"C:\\Program Files\\AvaFind\\AvaFind.exe"="Ava Find Professional"
"C:\\Program Files\\WIDCOMM\\Bluetooth Software\\BTTray.exe"="Bluetooth Tray Application"
"@C:\\WINDOWS\\ime\\sptip.dll,-600"="التعرف على الكلام"
"C:\\Documents and Settings\\أبو حمزة\\Application Data\\Dropbox\\bin\\Dropbox.exe"="Dropbox"
"C:\\Program Files\\RocketDock\\RocketDock.exe"="RocketDock"
"C:\\WINDOWS\\system32\\OSK.exe"="‎‎On-Screen Keyboard"
"@shell32.dll,-12691"="المستندات الأخيرة"
"@shell32.dll,-21786"="قائمة ابدأ"
"C:\\PROGRAM FILES\\EMSISOFT ANTI-MALWARE\\a2start.exe"="Security Center"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="Firefox"
"C:\\Program Files\\Java\\jre6\\lib\\deploy\\jqs\\ff\\..\\..\\..\\..\\bin\\jqsnotify.exe"="Java(TM) Quick Starter binary"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="Windows Live Messenger"
"C:\\Program Files\\Internet Download Manager\\IDMan.exe"="Internet Download Manager (IDM)"
"C:\\WINDOWS\\explorer.exe"="Windows Explorer"
"@shell32.dll,-31233"="مهام الملفات والمجلدات"
"@shell32.dll,-31236"="إنشاء مجلد جديد"
"@shell32.dll,-31260"="نشر هذا المجلد إلى ويب"
"@shell32.dll,-31374"="‏‏مشاركة هذا المجلد"
"@shell32.dll,-31272"="مواضع أخرى"
"@shell32.dll,-21785"="مستندات مشتركة"
"@shell32.dll,-31274"="تفاصيل"
"@shell32.dll,-31242"="إعادة تسمية هذا الملف"
"@shell32.dll,-31244"="نقل هذا الملف"
"@shell32.dll,-31246"="نسخ هذا الملف"
"@shell32.dll,-31248"="نشر هذا الملف إلى ويب"
"@shell32.dll,-31370"="‏‏إرسال هذا الملف بالبريد الإلكتروني"
"@shell32.dll,-31252"="حذف هذا الملف"
"C:\\Program Files\\WinRAR\\WinRAR.exe"="WinRAR archiver"
"@shell32.dll,-12710"="تش&غيل"
"@shell32.dll,-31317"="مهام النظام"
"@shell32.dll,-31325"="إخفاء محتويات المجلد الحالي"
"@shell32.dll,-31327"="إضافة أو إزالة البرامج"
"@shell32.dll,-31292"="البحث عن ملفات أو مجلدات"
"@shell32.dll,-31254"="إعادة تسمية هذا المجلد"
"@shell32.dll,-31256"="نقل هذا المجلد"
"@shell32.dll,-31258"="نسخ هذا المجلد"
"@shell32.dll,-31380"="إرسال ملفات هذا المجلد بالبريد الإلكتروني"
"@shell32.dll,-31262"="حذف هذا المجلد"
"@shell32.dll,-31234"="تنطبق هذه الملفات على الملفات والمجلدات التي تحددها."
"@shell32.dll,-31273"="تقوم هذه الارتباطات بفتح المجلدات الأخرى والانتقال بسرعة إلى المواقع المفيدة."
"@C:\\WINDOWS\\system32\\SHELL32.dll,-12695"="يحتوي على الملفات والمجلدات المشتركة بين مستخدمي هذا الكمبيوتر."
"@C:\\WINDOWS\\system32\\SHELL32.dll,-22912"="إظهار اختصارات إلى مواقع ويب وأجهزة الكمبيوتر على شبكة الاتصال ومواقع FTP."
"@shell32.dll,-31275"="يعرض هذا القسم معلومات حول حجم العنصر المحدد ونوع ملفه وأية معلومات أخرى حوله."
"C:\\Program Files\\Unlocker\\Unlocker.exe"="Unlocker"
"@shell32.dll,-12589"="الملفات موجودة حالياً على القرص المضغوط"
"@shell32.dll,-12590"="الملفات جاهزة للكتابة على القرص المضغوط"
"@C:\\WINDOWS\\system32\\SHELL32.dll,-22915"="يحتوي على الملفات والمجلدات التي قمت بحذفها."
"@C:\\WINDOWS\\system32\\SHELL32.dll,-8503"="بح&ث..."
"@C:\\WINDOWS\\system32\\mycomput.dll,-400"="إ&دارة"
"@C:\\WINDOWS\\system32\\notepad.exe,-469"="مستند نص"
"@C:\\WINDOWS\\system32\\shimgvw.dll,-302"="صورة GIF"
"@C:\\WINDOWS\\system32\\shimgvw.dll,-303"="صورة JPEG"
"@C:\\WINDOWS\\system32\\shimgvw.dll,-305"="صورة PNG"
"F:\\برامج تصوير\\snagit\\SnagIt 9.1.2 _Portable\\Snagit32.exe"="Snagit"
"F:\\برامج تصوير\\snagit\\SnagIt 9.1.2 _Portable\\TSCHelp.exe"="TechSmith HTML Help Helper"
"F:\\برامج تصوير\\snagit\\SnagIt 9.1.2 _Portable\\SnagPriv.exe"="Snagit RPC Helper"
"F:\\برامج تصوير\\snagit\\SnagIt 9.1.2 _Portable\\snagiteditor.exe"="Snagit Editor"
"@shell32.dll,-12693"="المفضلة"
"@shell32.dll,-21791"="الفيديو"
"C:\\Program Files\\Sun\\VirtualBox\\VirtualBox.exe"="VirtualBox GUI"
"@shell32.dll,-31232"="مهام النظام"
"@shell32.dll,-31294"="عرض معلومات النظام"
"@shell32.dll,-31312"="تغيير أحد الإعدادات"
"@C:\\WINDOWS\\system32\\SHELL32.dll,-22913"="إظهار محركات الأقراص والأجهزة المتصلة بهذا الكمبيوتر."
"F:\\برامج خاصه تبع حاتم اجهزة\\حمايه\\الاسطوانه بده شغل\\CD_Root\\autorun.exe"="AutoPlay Application"
"@C:\\WINDOWS\\system32\\shimgvw.dll,-304"="صورة نقطية"
"C:\\PROGRA~1\\Sun\\VIRTUA~1\\VirtualBox.exe"="VirtualBox GUI"
"@shell32.dll,-31291"="تنطبق هذه المهام على الكمبيوتر أو الأجهزة المحددة."
"@shell32.dll,-31295"="عرض معلومات عن الكمبيوتر كسرعة المعالج ومقدار الذاكرة المثبتة."
"C:\\Program Files\\Resource Hacker\\reshacker.exe"="Resource viewer, decompiler & recompiler."
"C:\\Program Files\\Universal Extractor\\uniextract.exe"="Universal Extractor"
"C:\\Program Files\\CCleaner\\ccleaner.exe"="CCleaner"
"C:\\WINDOWS\\system32\\RunDll32.exe"="Run a DLL as an App"
"F:\\برامج خاصه تبع حاتم اجهزة\\التعريب\\علي الغفراني.exe"="علي الغفراني"
"C:\\DOCUME~1\\8F8E~1\\LOCALS~1\\Temp\\RarSFX0\\autorun.exe"="AutoPlay Application"
"F:\\برامج خاصه تبع حاتم اجهزة\\حمايه\\الاسطوانه بده شغل\\CD_Root\\AutoPlay\\Docs\\virous x\\حمايتي ينزل في جهازي هاام\\برامج هامة\\مشغل فلاشات علي الجهاز\\flashplayer_10_sa_debug.exe"="Adobe Flash Player 10.0 r12"
"C:\\Documents and Settings\\أبو حمزة\\سطح المكتب\\aborsheed.exe"="RichView Package  for Delphi 5"
"F:\\اغلق الجهاز وقت ماتريد\\برنامج إغلاق الجهاز بالعربي.exe"="برنامج إغلاق الجهاز بالعربي"
"C:\\DOCUME~1\\8F8E~1\\LOCALS~1\\Temp\\RarSFX0\\diaasoft.com.exe"="diaasoft.com"
"E:\\الابدااااااااااااع\\ردودي\\ردودي.exe"="AutoPlay Application"
"C:\\DOCUME~1\\8F8E~1\\LOCALS~1\\Temp\\ir_ext_temp_0\\autorun.exe"="AutoPlay Application"
"C:\\Program Files\\Sony\\Vegas Pro 10.0\\vegas100.exe"="Vegas Pro"
"@shell32.dll,-31382"="إخراج هذا القرص"
"C:\\Program Files\\K-Lite Codec Pack\\Media Player Classic\\mplayerc.exe"="Media Player Classic - Homecinema"
"C:\\Program Files\\The KMPlayer\\KMPlayer.exe"="The KMPlayer"
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"="Windows Media Player"
"C:\\Program Files\\JetAudio\\jetAudio.exe"="jetAudio"
"@C:\\WINDOWS\\inf\\unregmp2.exe,-9925"="صوت تنسيق MP3"
"@shell32.dll,-31328"="توفير الخطوات اللازمة لإضافة برنامج جديد أو تغيير برنامج موجود أو إزالته."
"F:\\برامج خاصه تبع حاتم اجهزة\\حمايه\\الاسطوانه بده شغل\\CD_Root\\AutoPlay\\Docs\\virous x\\حمايتي ينزل في جهازي هاام\\البرونز\\كل البرامج الفحص\\runscanner.exe"="Runscanner freeware startup analyzer"
"F:\\برامج خاصه تبع حاتم اجهزة\\حمايه\\الاسطوانه بده شغل\\CD_Root\\AutoPlay\\Docs\\virous x\\حمايتي ينزل في جهازي هاام\\ملف التنظيف\\Starterلبدء التشغبل.exe"="Startup Manager for Windows 9x/Me/NT/2000/XP/2003"
"C:\\Program Files\\AutoIt3\\SciTE\\SciTE.exe"="SciTE - a Scintilla based Text Editor"
"C:\\Program Files\\AutoIt3\\AutoIt3.exe"="AutoIt v3 Script"
"C:\\WINDOWS\\system32\\NOTEPAD.EXE"="‎‎المفكرة"
"C:\\Program Files\\Windows NT\\Accessories\\WORDPAD.EXE"="‎‎الدفتر"
"@C:\\WINDOWS\\System32\\setupapi.dll,-2000"="معلومات الإعداد"
"@shell32.dll,-31250"="طباعة هذا الملف"
"C:\\WINDOWS\\system32\\mspaint.exe"="‎‎الرسام"
"F:\\برامج خاصه تبع حاتم اجهزة\\حمايه\\الاسطوانه بده شغل\\CD_Root\\AutoPlay\\Docs\\virous x\\حمايتي ينزل في جهازي هاام\\ملف التنظيف\\مراقبة العمليات\\procexp.exe"="Sysinternals Process Explorer"
"F:\\عالم البرمجة خطر\\E-Batch Maker 1.3 من اخوي الحبيب احمد شيخ علي\\Bat_To_Exe_Converter\\Bat_To_Exe_Converter.exe"="Bat To Exe Converter"
"C:\\WINDOWS\\system32\\shimgvw.dll"="Windows Picture and Fax Viewer"
"D:\\القعقاع 2011\\Qaqaa.2011.By.mwad3\\autorun.exe"="AutoPlay Application"
"@C:\\Program Files\\NetMeeting\\conf.exe,-12345"="هتفية إنترنت H.323"
"@C:\\WINDOWS\\system32\\accwiz.exe,-16"="إعدادات معالج الوصول"
"@C:\\WINDOWS\\inf\\unregmp2.exe,-9903"="تنسيق صوت AIFF"
"@C:\\WINDOWS\\inf\\unregmp2.exe,-9910"="قائمة تشغيل صوت/فيديو Windows Media"
"@C:\\WINDOWS\\inf\\unregmp2.exe,-9904"="تنسيق صوت AU"
"@C:\\WINDOWS\\system32\\SHELL32.dll,-22978"="حقيبة الملفات"
"@C:\\WINDOWS\\System32\\ntbackup.exe,-40"="ملف النسخ الاحتياطي في Windows"
"@C:\\WINDOWS\\System32\\pdh.dll,-10023"="ملف مراقب الأداء"
"@C:\\WINDOWS\\System32\\cryptext.dll,-6145"="ملف cat للأمان"
"@C:\\WINDOWS\\inf\\unregmp2.exe,-9918"="مسار قرص صوت مضغوط"
"@C:\\WINDOWS\\System32\\cdfview.dll,-4610"="ملف قناة"
"@C:\\WINDOWS\\System32\\cryptext.dll,-6108"="شهادة الأمان"
"@C:\\Program Files\\NetMeeting\\conf.exe,-12346"="الطلب السريع"
"@C:\\WINDOWS\\system32\\icardres.dll.mui,-4162"="Managed Information Card file"
"@C:\\WINDOWS\\system32\\icardres.dll.mui,-4146"="Windows CardSpace backup file"
"@C:\\WINDOWS\\System32\\cryptext.dll,-6110"="قائمة إبطال الشهادات"
"@C:\\WINDOWS\\system32\\netshell.dll,-1300"="ملف شبكة الاتصال الهاتفي"
"@C:\\WINDOWS\\inf\\unregmp2.exe,-9927"="عرض تلفزيون مسجل لـ Microsoft"
"@C:\\WINDOWS\\system32\\shimgvw.dll,-301"="صورة EMF"
"@C:\\Program Files\\NetMeeting\\conf.exe,-12347"="Intel IPhone متوافق"
"@C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwres.dll,-20003"="إعدادات الاتصال بإنترنت"
"@C:\\WINDOWS\\System32\\wshext.dll,-4804"="JScript Script File"
"@C:\\WINDOWS\\System32\\wshext.dll,-4805"="JScript Encoded Script File"
"@C:\\WINDOWS\\inf\\unregmp2.exe,-9926"="ملف M3U"
"@C:\\WINDOWS\\inf\\unregmp2.exe,-9907"="تسلسل MIDI"
"@C:\\WINDOWS\\inf\\unregmp2.exe,-9902"="قصاصة فيلم"
"@C:\\WINDOWS\\system32\\mmcbase.dll,-130"="مستند Microsoft Common Console"
"@C:\\WINDOWS\\System32\\msi.dll,-34"="حزمة Windows Installer"
"@C:\\WINDOWS\\System32\\msi.dll,-35"="ملف تصحيح Windows Installer"
"@C:\\WINDOWS\\System32\\RCBdyctl.dll,-150"="Microsoft Remote Assistance Incident"
"@C:\\Program Files\\Movie Maker\\wmm2res.dll,-63097"="Windows Movie Maker Project"
"@C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\msinfo.dll,-391"="المستند MSInfo"
"@C:\\Program Files\\NetMeeting\\nmwb.dll,-1234"="Microsoft Netmeeting T126 متوافق مع مستند اللوح الأبيض"
"@C:\\WINDOWS\\System32\\cryptext.dll,-6111"="شهادات PKCS #7"
"@C:\\WINDOWS\\System32\\cryptext.dll,-6113"="توقيع PKCS #7"
"@C:\\WINDOWS\\System32\\scrobj.dll,-8192"="Windows Script Component"
"@C:\\WINDOWS\\system32\\shscrap.dll,-258"="كائن انتقالي"
"@C:\\WINDOWS\\System32\\cryptext.dll,-6112"="مخزن شهادات Microsoft المتسلسل"
"@C:\\WINDOWS\\System32\\cryptext.dll,-6109"="قائمة الشهادات الموثوق بها"
"@C:\\WINDOWS\\System32\\wshext.dll,-4803"="VBScript Encoded Script File"
"@C:\\WINDOWS\\System32\\wshext.dll,-4802"="VBScript Script File"
"@C:\\WINDOWS\\inf\\unregmp2.exe,-9908"="موجة صوتية"
"@C:\\WINDOWS\\inf\\unregmp2.exe,-9911"="اختصار Windows Media Audio"
"@C:\\WINDOWS\\inf\\unregmp2.exe,-9909"="ملف صوت/فيديو Windows Media"
"@C:\\WINDOWS\\inf\\unregmp2.exe,-9912"="Windows Media Audio file"
"@C:\\WINDOWS\\inf\\unregmp2.exe,-9920"="حزمة تنزيل Windows Media Player"
"@C:\\WINDOWS\\system32\\shimgvw.dll,-307"="صورة WMF"
"@C:\\WINDOWS\\inf\\unregmp2.exe,-9915"="ملف أسطح Windows Media Player"
"@C:\\WINDOWS\\inf\\unregmp2.exe,-9916"="حزمة أسطح Windows Media Player"
"@C:\\WINDOWS\\inf\\unregmp2.exe,-9923"="قائمة تشغيل Windows Media"
"@\"C:\\Program Files\\Windows NT\\Accessories\\WORDPAD.EXE\",-208"="مستند Write"
"@C:\\WINDOWS\\System32\\wshext.dll,-4801"="Windows Script File"
"@C:\\WINDOWS\\System32\\wshext.dll,-4800"="Windows Script Host Settings File"
"@C:\\WINDOWS\\inf\\unregmp2.exe,-9913"="قائمة تشغيل صوت/فيديو Windows Media"
"@C:\\WINDOWS\\system32\\msxml3r.dll,-1"="XML Document"
"@C:\\WINDOWS\\system32\\msxml3r.dll,-2"="XSL Stylesheet"
"C:\\Program Files\\Opera\\Opera.exe"="Opera Internet Browser"
"C:\\PROGRA~1\\MICROS~1\\OFFICE11\\OIS.EXE"="Microsoft Office Picture Manager"
"@shimgvw.dll,-550"="&معاينة"
"C:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"="Malwarebytes' Anti-Malware"
"C:\\WINDOWS\\system32\\SNDVOL32.EXE"="‎‎Volume Control"
"C:\\Program Files\\Acronis\\TrueImageHome\\TrueImageLauncher.exe"="Acronis True Image"
"C:\\Program Files\\Acronis\\TrueImageHome\\TrueImage.exe"="Acronis True Image"
"@C:\\WINDOWS\\system32\\SHELL32.dll,-22914"="يحتوي على خطابات وتقارير ومستندات وملفات أخرى."
"C:\\Program Files\\VS Revo Group\\Revo Uninstaller\\Revouninstaller.exe"="Revo Uninstaller"
"@shell32.dll,-31396"="مهام الفيديو"
"@shell32.dll,-31278"="قراءة الكل"
"@shell32.dll,-31379"="نسخ كافة العناصر إلى قرص مضغوط"
"@shell32.dll,-31285"="إحضار الصور من الكاميرا أو الماسح الضوئي"
"@shell32.dll,-31352"="النسخ إلى قرص مضغوط"
"@sendmail.dll,-21"="سطح المكتب (إنشاء اختصار)"
"@sendmail.dll,-4"="مستلم البريد"
"@shell32.dll,-31264"="نقل العناصر المحددة"
"@shell32.dll,-31266"="نسخ العناصر المحددة"
"@shell32.dll,-31362"="إرسال العناصر المحددة بالبريد الإلكتروني"
"@shell32.dll,-31270"="حذف العناصر المحددة"
"@shell32.dll,-31279"="قراءة المحدد"
"@shell32.dll,-31397"="تنطبق هذه المهام على ملفات ومجلدات الفيديو التي تحددها."
"@shell32.dll,-31276"="مهام الموسيقى"
"@xpsp3res.dll,-3000"="تسوّق لشراء الموسيقى من إنترنت"
"@shell32.dll,-31277"="تنطبق هذه المهام على ملفات ومجلدات الموسيقى التي تحددها."
"@shell32.dll,-31378"="نسخ كافة العناصر إلى قرص مضغوط صوتي"
"@shell32.dll,-31372"="النسخ إلى قرص صوتي مضغوط"
"C:\\Program Files\\AnvSoft\\Photo DVD Maker Professional\\DVDPhotoMaker.exe"="Photo DVD Maker Professional"
"C:\\Program Files\\WIDCOMM\\Bluetooth Software\\btsendto_explorer.exe"="SendTo from Explorer Application"
"@shell32.dll,-31268"="نشر العناصر المحددة إلى ويب"
"C:\\WINDOWS\\system32\\zipfldr.dll"="Compressed (zipped) Folders"
"C:\\WINDOWS\\system32\\cmd.exe"="Windows Command Processor"
"F:\\برامج خاصه تبع حاتم اجهزة\\حمايه\\الاسطوانه بده شغل\\CD_Root\\AutoPlay\\Docs\\جوست من سامح شرح\\هيثم مصلح Hiren's.BootCD\\Hiren's Bootاسطوانه الاصلاح الشهير الاقلاع عبر الفلاش\\حاتم\\HBCDCustomizer.exe"="Hiren's BootCD - Custom ISO Creator"
"C:\\MyBootCD\\7Z.ExE"="7Z"
"F:\\برامج خاصه تبع حاتم اجهزة\\حمايه\\الاسطوانه بده شغل\\CD_Root\\AutoPlay\\Docs\\جوست من سامح شرح\\هيثم مصلح Hiren's.BootCD\\Hiren's Bootاسطوانه الاصلاح الشهير الاقلاع عبر الفلاش\\حاتم\\BurnCDCC.exe"="BurnCDCC  - Burn a CD/DVD file image to a disc."
"F:\\برامج خاصه تبع حاتم اجهزة\\حمايه\\الاسطوانه بده شغل\\CD_Root\\AutoPlay\\Docs\\جوست من سامح شرح\\هيثم مصلح Hiren's.BootCD\\Hiren's Bootاسطوانه الاصلاح الشهير الاقلاع عبر الفلاش\\حاتم\\WinSetupFromUSB_0-2-1\\WinSetupFromUSB_0-2-1.exe"="WinSetupFromUSB_0-2-1"
"C:\\WinSetupFromUSB\\WinSetupFromUSB_0-2-1.exe"="WinSetupFromUSB_0-2-1"
"@C:\\WINDOWS\\system32\\SHELL32.dll,-31361"="توفير خيارات لتخصيص مظهر الكمبيوتر وكيفية عمله."
"C:\\WINDOWS\\regedit.exe"="‎‎Registry Editor"
"F:\\برامج خاصه تبع حاتم اجهزة\\حمايه\\الاسطوانه بده شغل\\CD_Root\\AutoPlay\\Docs\\الدروس خاصه في التثبيت صامت\\البحث عن الملفات الرجستري\\Registry Crawler 4.5.4 Arabic+Portable-By Shrief Shata.exe"="Registry Crawler 4.5.4 Arabic+Portable-By Shrief Shata"
"C:\\DOCUME~1\\8F8E~1\\LOCALS~1\\Temp\\RarSFX0\\rcrawler.exe"="Registry Crawler"

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a2util]
"Type"=dword:00000001
"Start"=dword:00000001
"ErrorControl"=dword:00000000
"ImagePath"=hex(2):5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,\
  67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,45,00,6d,\
  00,73,00,69,00,73,00,6f,00,66,00,74,00,20,00,41,00,6e,00,74,00,69,00,2d,00,\
  4d,00,61,00,6c,00,77,00,61,00,72,00,65,00,5c,00,61,00,32,00,75,00,74,00,69,\
  00,6c,00,33,00,32,00,2e,00,73,00,79,00,73,00,00,00
"DisplayName"="a-squared Malware-IDS utility driver"
"Description"="Provides several additional functionality used by the a-squared Malware-IDS."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a2util\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
  05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
  20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
  00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
  00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a2util\Enum]
"0"="Root\\LEGACY_A2UTIL\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a2injectiondriver]
"Description"="a-squared minifilter"
"Type"=dword:00000002
"Start"=dword:00000001
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,\
  67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,45,00,6d,\
  00,73,00,69,00,73,00,6f,00,66,00,74,00,20,00,41,00,6e,00,74,00,69,00,2d,00,\
  4d,00,61,00,6c,00,77,00,61,00,72,00,65,00,5c,00,61,00,32,00,64,00,69,00,78,\
  00,38,00,36,00,2e,00,73,00,79,00,73,00,00,00
"DisplayName"="a2injectiondriver"
"Group"="FSFilter Anti-Virus"
"DependOnService"=hex(7):46,00,6c,00,74,00,4d,00,67,00,72,00,00,00,00,00
"DependOnGroup"=hex(7):00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a2injectiondriver\Instances]
"DefaultInstance"="a2di Instance"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a2injectiondriver\Instances\a2di Instance]
"Altitude"="328910"
"Flags"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a2injectiondriver\Parameters]
"DebugFlags"=dword:00000003

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a2injectiondriver\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
  05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
  20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
  00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
  00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a2injectiondriver\Enum]
"0"="Root\\LEGACY_A2INJECTIONDRIVER\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a2AntiMalware]
"Type"=dword:00000010
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"="\"C:\\Program Files\\Emsisoft Anti-Malware\\a2service.exe\""
"DisplayName"="Emsisoft Anti-Malware 5.0 - Service"
"ObjectName"="LocalSystem"
"Description"="Scans the PC for unwanted software and provides protection from malicious code"
"Group"="FSFilter Anti-Virus"
"FailureActions"=hex:00,00,00,00,00,00,00,00,00,00,00,00,03,00,00,00,59,00,59,\
  00,01,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a2AntiMalware\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,60,00,04,00,00,00,00,00,14,00,9d,01,02,00,01,01,00,00,00,00,00,\
  05,0b,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,05,12,00,00,00,\
  00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,\
  00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
  00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a2AntiMalware\Enum]
"0"="Root\\LEGACY_A2ANTIMALWARE\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a2acc]
"Description"="a-squared minifilter"
"Type"=dword:00000002
"Start"=dword:00000003
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,52,00,4f,00,\
  47,00,52,00,41,00,4d,00,20,00,46,00,49,00,4c,00,45,00,53,00,5c,00,45,00,4d,\
  00,53,00,49,00,53,00,4f,00,46,00,54,00,20,00,41,00,4e,00,54,00,49,00,2d,00,\
  4d,00,41,00,4c,00,57,00,41,00,52,00,45,00,5c,00,61,00,32,00,61,00,63,00,63,\
  00,78,00,38,00,36,00,2e,00,73,00,79,00,73,00,00,00
"DisplayName"="a2acc"
"Group"="FSFilter Anti-Virus"
"DependOnService"=hex(7):46,00,6c,00,74,00,4d,00,67,00,72,00,00,00,00,00
"DependOnGroup"=hex(7):00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a2acc\Instances]
"defaultInstance"="a2acc Instance"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a2acc\Instances\a2acc Instance]
"Altitude"="328900"
"Flags"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a2acc\Parameters]
"DebugFlags"=dword:00000003

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a2acc\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
  05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
  20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
  00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
  00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a2acc\Enum]
"0"="Root\\LEGACY_A2ACC\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_A2ANTIMALWARE\0000]
"Service"="a2AntiMalware"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="Emsisoft Anti-Malware 5.0 - Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_A2ANTIMALWARE\0000\Control]
"ActiveService"="a2AntiMalware"

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\a2util]
"Type"=dword:00000001
"Start"=dword:00000001
"ErrorControl"=dword:00000000
"ImagePath"=hex(2):5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,\
  67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,45,00,6d,\
  00,73,00,69,00,73,00,6f,00,66,00,74,00,20,00,41,00,6e,00,74,00,69,00,2d,00,\
  4d,00,61,00,6c,00,77,00,61,00,72,00,65,00,5c,00,61,00,32,00,75,00,74,00,69,\
  00,6c,00,33,00,32,00,2e,00,73,00,79,00,73,00,00,00
"DisplayName"="a-squared Malware-IDS utility driver"
"Description"="Provides several additional functionality used by the a-squared Malware-IDS."

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\a2util\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
  05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
  20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
  00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
  00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\a2injectiondriver]
"Description"="a-squared minifilter"
"Type"=dword:00000002
"Start"=dword:00000001
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,\
  67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,45,00,6d,\
  00,73,00,69,00,73,00,6f,00,66,00,74,00,20,00,41,00,6e,00,74,00,69,00,2d,00,\
  4d,00,61,00,6c,00,77,00,61,00,72,00,65,00,5c,00,61,00,32,00,64,00,69,00,78,\
  00,38,00,36,00,2e,00,73,00,79,00,73,00,00,00
"DisplayName"="a2injectiondriver"
"Group"="FSFilter Anti-Virus"
"DependOnService"=hex(7):46,00,6c,00,74,00,4d,00,67,00,72,00,00,00,00,00
"DependOnGroup"=hex(7):00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\a2injectiondriver\Instances]
"DefaultInstance"="a2di Instance"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\a2injectiondriver\Instances\a2di Instance]
"Altitude"="328910"
"Flags"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\a2injectiondriver\Parameters]
"DebugFlags"=dword:00000003

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\a2injectiondriver\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
  05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
  20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
  00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
  00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\a2AntiMalware]
"Type"=dword:00000010
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"="\"C:\\Program Files\\Emsisoft Anti-Malware\\a2service.exe\""
"DisplayName"="Emsisoft Anti-Malware 5.0 - Service"
"ObjectName"="LocalSystem"
"Description"="Scans the PC for unwanted software and provides protection from malicious code"
"Group"="FSFilter Anti-Virus"
"FailureActions"=hex:00,00,00,00,00,00,00,00,00,00,00,00,03,00,00,00,59,00,59,\
  00,01,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\a2AntiMalware\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,60,00,04,00,00,00,00,00,14,00,9d,01,02,00,01,01,00,00,00,00,00,\
  05,0b,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,05,12,00,00,00,\
  00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,\
  00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
  00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\a2acc]
"Description"="a-squared minifilter"
"Type"=dword:00000002
"Start"=dword:00000003
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,52,00,4f,00,\
  47,00,52,00,41,00,4d,00,20,00,46,00,49,00,4c,00,45,00,53,00,5c,00,45,00,4d,\
  00,53,00,49,00,53,00,4f,00,46,00,54,00,20,00,41,00,4e,00,54,00,49,00,2d,00,\
  4d,00,41,00,4c,00,57,00,41,00,52,00,45,00,5c,00,61,00,32,00,61,00,63,00,63,\
  00,78,00,38,00,36,00,2e,00,73,00,79,00,73,00,00,00
"DisplayName"="a2acc"
"Group"="FSFilter Anti-Virus"
"DependOnService"=hex(7):46,00,6c,00,74,00,4d,00,67,00,72,00,00,00,00,00
"DependOnGroup"=hex(7):00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\a2acc\Instances]
"defaultInstance"="a2acc Instance"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\a2acc\Instances\a2acc Instance]
"Altitude"="328900"
"Flags"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\a2acc\Parameters]
"DebugFlags"=dword:00000003

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\a2acc\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
  05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
  20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
  00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
  00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_A2ANTIMALWARE\0000]
"Service"="a2AntiMalware"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="Emsisoft Anti-Malware 5.0 - Service"

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\a2util]
"Type"=dword:00000001
"Start"=dword:00000001
"ErrorControl"=dword:00000000
"ImagePath"=hex(2):5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,\
  67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,45,00,6d,\
  00,73,00,69,00,73,00,6f,00,66,00,74,00,20,00,41,00,6e,00,74,00,69,00,2d,00,\
  4d,00,61,00,6c,00,77,00,61,00,72,00,65,00,5c,00,61,00,32,00,75,00,74,00,69,\
  00,6c,00,33,00,32,00,2e,00,73,00,79,00,73,00,00,00
"DisplayName"="a-squared Malware-IDS utility driver"
"Description"="Provides several additional functionality used by the a-squared Malware-IDS."

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\a2util\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
  05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
  20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
  00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
  00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\a2util\Enum]
"0"="Root\\LEGACY_A2UTIL\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\a2injectiondriver]
"Description"="a-squared minifilter"
"Type"=dword:00000002
"Start"=dword:00000001
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,\
  67,00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,5c,00,45,00,6d,\
  00,73,00,69,00,73,00,6f,00,66,00,74,00,20,00,41,00,6e,00,74,00,69,00,2d,00,\
  4d,00,61,00,6c,00,77,00,61,00,72,00,65,00,5c,00,61,00,32,00,64,00,69,00,78,\
  00,38,00,36,00,2e,00,73,00,79,00,73,00,00,00
"DisplayName"="a2injectiondriver"
"Group"="FSFilter Anti-Virus"
"DependOnService"=hex(7):46,00,6c,00,74,00,4d,00,67,00,72,00,00,00,00,00
"DependOnGroup"=hex(7):00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\a2injectiondriver\Instances]
"DefaultInstance"="a2di Instance"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\a2injectiondriver\Instances\a2di Instance]
"Altitude"="328910"
"Flags"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\a2injectiondriver\Parameters]
"DebugFlags"=dword:00000003

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\a2injectiondriver\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
  05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
  20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
  00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
  00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\a2injectiondriver\Enum]
"0"="Root\\LEGACY_A2INJECTIONDRIVER\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\a2AntiMalware]
"Type"=dword:00000010
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"="\"C:\\Program Files\\Emsisoft Anti-Malware\\a2service.exe\""
"DisplayName"="Emsisoft Anti-Malware 5.0 - Service"
"ObjectName"="LocalSystem"
"Description"="Scans the PC for unwanted software and provides protection from malicious code"
"Group"="FSFilter Anti-Virus"
"FailureActions"=hex:00,00,00,00,00,00,00,00,00,00,00,00,03,00,00,00,59,00,59,\
  00,01,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\a2AntiMalware\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,60,00,04,00,00,00,00,00,14,00,9d,01,02,00,01,01,00,00,00,00,00,\
  05,0b,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,05,12,00,00,00,\
  00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,00,\
  00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
  00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\a2AntiMalware\Enum]
"0"="Root\\LEGACY_A2ANTIMALWARE\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\a2acc]
"Description"="a-squared minifilter"
"Type"=dword:00000002
"Start"=dword:00000003
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,50,00,52,00,4f,00,\
  47,00,52,00,41,00,4d,00,20,00,46,00,49,00,4c,00,45,00,53,00,5c,00,45,00,4d,\
  00,53,00,49,00,53,00,4f,00,46,00,54,00,20,00,41,00,4e,00,54,00,49,00,2d,00,\
  4d,00,41,00,4c,00,57,00,41,00,52,00,45,00,5c,00,61,00,32,00,61,00,63,00,63,\
  00,78,00,38,00,36,00,2e,00,73,00,79,00,73,00,00,00
"DisplayName"="a2acc"
"Group"="FSFilter Anti-Virus"
"DependOnService"=hex(7):46,00,6c,00,74,00,4d,00,67,00,72,00,00,00,00,00
"DependOnGroup"=hex(7):00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\a2acc\Instances]
"defaultInstance"="a2acc Instance"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\a2acc\Instances\a2acc Instance]
"Altitude"="328900"
"Flags"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\a2acc\Parameters]
"DebugFlags"=dword:00000003

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\a2acc\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
  05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
  20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
  00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
  00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\a2acc\Enum]
"0"="Root\\LEGACY_A2ACC\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_A2ANTIMALWARE\0000]
"Service"="a2AntiMalware"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="Emsisoft Anti-Malware 5.0 - Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_A2ANTIMALWARE\0000\Control]
"ActiveService"="a2AntiMalware"




[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB77609F-2178-4E6F-9C4B-44AC179D937A}\InProcServer32]
@="C:\\Program Files\\Emsisoft Anti-Malware\\a2contmenu.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\asquared.Scanner.Settings\shell\open\command]
@="C:\\PROGRAM FILES\\EMSISOFT ANTI-MALWARE\\A2START.EXE \"/c=%1\""

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\asquared.Scanner.Settings\DefaultIcon]
@="C:\\PROGRAM FILES\\EMSISOFT ANTI-MALWARE\\A2START.EXE,0"