<?xml version="1.0" encoding="windows-1251" ?>
<AVZ Version="4.46" LogDate="21.02.2017 21:34:35" WinDir="C:\Windows\" OS_MjVer="6" OS_MiVer="1" OS_Build="7601" OS_ProductName="Windows 7 Home Premium" BootMode="0" OS_CSDV="Service Pack 1" ProfileDir="C:\Users\Xyu" Session="" Domain="WORKGROUP" IsWow64="True" IsAdmin="True" Base64Mode="False" IsSRDisabled="False" MainDBDate="21.02.2017 16:00:07" CompHash="C10DB1C904CF6CB353CAB4642170AAA6" AVZMD5="DC6A72DB5A580DE52A06760341661C4E" OSInstallDate="30.01.2016 11:34:18"  >
 <PROCESS>
  <ITEM PID="1224" File="c:\program files (x86)\adguard\adguardsvc.exe" CheckResult="-1" Descr="Adguard for Windows" LegalCopyright="Copyright © Performix LLC 2008-2017" Hidden="0"  CmdLine="&quot;C:\Program Files (x86)\Adguard\AdguardSvc.exe&quot;" Size="151312" Attr="rsAh" CreateDate="07.02.2017 13:32:46" ChangeDate="07.02.2017 13:32:46" MD5="9D30D3DEAA89CD4DC7439132F4F7909B" Vendor="Performix LLC" Product="Adguard for Windows" OFN="AdguardSvc.exe" Ver="6.1.312.1629" IsPE="1" />
  <ITEM PID="3192" File="c:\users\xyu\desktop\customdesktopv21\customdesktoplogo.exe" CheckResult="-1" Descr="Custom Desktop Logo" LegalCopyright="Copyright ©  2008" Hidden="0"  CmdLine="&quot;C:\Users\Xyu\Desktop\CustomDesktopV21\CustomDesktopLogo.exe&quot; " Size="502272" Attr="rsAh" CreateDate="19.02.2017 22:49:53" ChangeDate="01.09.2016 13:36:44" MD5="FDD0416D33D216E0C41781DDCBF0391C" Vendor="Eric Wong" Product="Custom Desktop Logo" OFN="CustomDesktopLogo.exe" Ver="2.0.0.0" IsPE="1" />
 </PROCESS>
 <DLL>
  <ITEM File="C:\Program Files (x86)\Adguard\AdguardNetApi.DLL" CheckResult="-1"  Descr="Adguard network driver api x8"  LegalCopyright="Copyright (C) Performix LLC 201"  UsedBy="1224" Hidden="0" Size="1415952" Attr="rsAh" CreateDate="07.02.2017 13:25:42" ChangeDate="07.02.2017 13:25:42" MD5="A98E453D1A1CB0AB03313F15EEACB518" Product="Adguard for Window" OFN="AdguardNetApi.dl" Ver="6.1.3.0" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Program Files (x86)\Adguard\AdguardNetLib.DLL" CheckResult="-1"  Descr="Adguard network driver api x8"  LegalCopyright="Copyright (C) Performix LLC 201"  UsedBy="1224" Hidden="0" Size="142096" Attr="rsAh" CreateDate="07.02.2017 13:25:42" ChangeDate="07.02.2017 13:25:42" MD5="23A0AA96D5DB55A3E2B5793734CCE9A6" Product="Adguard for Window" OFN="AdguardNetLib.dl" Ver="6.1.3.0" IsPE="1" IsDLL="1" />
  <ITEM File="C:\Users\Xyu\Desktop\CustomDesktopV21\AMS.Profile.dll" CheckResult="-1"  Descr="AMS.Profile.dll"  LegalCopyright="Copyright (c) 2005 by Alvaro Mendez"  UsedBy="3192" Hidden="0" Size="45056" Attr="rsAh" CreateDate="19.02.2017 22:49:53" ChangeDate="01.09.2016 13:36:44" MD5="A1C74AB9FB955E2A9E37B3807B869A5D" Vendor="AMS" Product="AMS.Profile" OFN="AMS.Profile.dll" Ver="2.0.1874.1294" IsPE="1" IsDLL="1" />
 </DLL>
 <KERNELOBJ>
  <ITEM File="C:\Windows\system32\drivers\adgnetworktdidrv.sys" CheckResult="-1" Base="3F3A000" MemSize="013000" Descr="Adguard TDI network driver x6" LegalCopyright="Copyright (C) Performix LLC 201"  />
  <ITEM File="C:\Windows\System32\Drivers\dump_atapi.sys" CheckResult="-1" Base="51EB000" MemSize="009000" Descr="" LegalCopyright=""  />
  <ITEM File="C:\Windows\System32\Drivers\dump_dumpata.sys" CheckResult="-1" Base="51DF000" MemSize="00C000" Descr="" LegalCopyright=""  />
  <ITEM File="C:\Windows\System32\Drivers\dump_dumpfve.sys" CheckResult="-1" Base="4C00000" MemSize="013000" Descr="" LegalCopyright=""  />
 </KERNELOBJ>
 <Service>
  <ITEM File="C:\Program Files (x86)\Adguard\AdguardSvc.exe" Name="Adguard Service" CheckResult="-1" Type="16" State="4" Size="151312" Attr="rsAh" CreateDate="07.02.2017 13:32:46" ChangeDate="07.02.2017 13:32:46" MD5="9D30D3DEAA89CD4DC7439132F4F7909B" Vendor="Performix LLC" Product="Adguard for Windows" OFN="AdguardSvc.exe" Ver="6.1.312.1629" IsPE="1"  />
  <ITEM File="C:\Program Files (x86)\AVG\Av\avgamps.exe" Name="AvgAMPS" CheckResult="-1" Type="16" State="1" Size="971160" Attr="rsAh" CreateDate="09.01.2017 14:15:20" ChangeDate="09.01.2017 14:15:20" MD5="5AC8900F370E1392C095DF72AA0C7819" Vendor="AVG Technologies CZ, s.r.o." Product="AVG Internet Security" OFN="avgamps.exe" Ver="16.141.0.7998" IsPE="1"  />
  <ITEM File="C:\Program Files (x86)\AVG\Av\avgidsagenta.exe" Name="AVGIDSAgent" CheckResult="-1" Type="16" State="1" Size="5337600" Attr="rsAh" CreateDate="09.01.2017 14:28:22" ChangeDate="09.01.2017 14:28:22" MD5="37772DC2BE1F09486102BE34F930F5B6" Vendor="AVG Technologies CZ, s.r.o." Product="AVG Internet Security" OFN="avgidsagenta.exe" Ver="16.141.0.7998" IsPE="1" IsPE64="1"  />
  <ITEM File="C:\Windows\system32\EasyAntiCheat.exe" Name="EasyAntiCheat" CheckResult="-1" Type="16" State="1"   />
  <ITEM File="C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe" Name="OverwolfUpdater" CheckResult="-1" Type="16" State="1" Size="1325112" Attr="rsAh" CreateDate="20.02.2017 14:29:04" ChangeDate="20.02.2017 14:29:04" MD5="9C8FEF6D420B35FD7F276DB878DFF9CA" Vendor="Overwolf LTD" Product="Overwolf" OFN="OverwolfUpdater.exe" Ver="0.102.217.0" IsPE="1"  />
 </Service>
 <Drivers>
  <ITEM File="C:\Windows\system32\drivers\adgnetworktdidrv.sys" Name="adgnetworktdidrv" CheckResult="-1" Type="1" State="4" Size="63728" Attr="rsAh" CreateDate="20.02.2017 03:55:07" ChangeDate="01.02.2017 20:02:16" MD5="BF47214B37BF34EA5F1FD0D26B777E96" Product="Adguard for Window" OFN="adgnetworktdidrv.sy" Ver="6.1.3.0" IsPE="1" IsPE64="1"  />
 </Drivers>
 <AUTORUN>
  <ITEM File="C:\Program Files (x86)\Adguard\Adguard.exe" CheckResult="-1" Enabled="1" Type="REG" Size="5622032" Attr="rsAh" CreateDate="07.02.2017 13:32:22" ChangeDate="07.02.2017 13:32:22" MD5="1A83F3540BC3B60FC321848EA699148D" Vendor="Performix LLC" Product="Adguard for Windows" OFN="Adguard.exe" Ver="6.1.312.1629" IsPE="1" X1="HKEY_CURRENT_USER" X2="Software\Microsoft\Windows\CurrentVersion\Run" X3="Adguard" X4="C:\Program Files (x86)\Adguard\Adguard.exe /nosplash" Is64="0" />
  <ITEM File="C:\Windows\System32\win32k.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="System\CurrentControlSet\Control\Session Manager\SubSystems" X3="Kmode" X4="\SystemRoot\System32\win32k.sys" Is64="0" />
  <ITEM File="C:\WINDOWS\SYSTEM32\PSXSS.EXE" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="System\CurrentControlSet\Control\Session Manager\SubSystems" X3="Posix" X4="C:\WINDOWS\SYSTEM32\PSXSS.EXE " Is64="0" />
  <ITEM File="C:\Windows\system32\sdclt.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\BackupPath" X3="" X4="%SystemRoot%\system32\sdclt.exe" Is64="0" />
  <ITEM File="C:\Windows\System32\aelupsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\AeLookupSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\aelupsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\appidsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\AppIDSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\appidsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\appinfo.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Appinfo\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\appinfo.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\Audiosrv.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\AudioEndpointBuilder\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\Audiosrv.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\Audiosrv.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\AudioSrv\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\Audiosrv.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\AxInstSV.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\AxInstSV\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\AxInstSV.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\bdesvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\BDESVC\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\bdesvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\bfe.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\BFE\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\bfe.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\qmgr.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\BITS\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\qmgr.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\browser.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Browser\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\browser.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\bthserv.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\bthserv\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\bthserv.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\certprop.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\CertPropSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\certprop.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\rpcss.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\DcomLaunch\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\rpcss.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\defragsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\defragsvc\Parameters" X3="ServiceDll" X4="%Systemroot%\System32\defragsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\dnsrslvr.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\dnsrslvr.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\dot3svc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\dot3svc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\dot3svc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\dps.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\DPS\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\dps.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\eapsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\EapHost\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\eapsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\fdPHost.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\fdPHost\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\fdPHost.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\fdrespub.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\FDResPub\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\fdrespub.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\FntCache.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\FontCache\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\FntCache.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\gpsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\gpsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\gpsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\kmsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\hkmsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\kmsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\ListSvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\HomeGroupListener\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\ListSvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\ikeext.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\IKEEXT\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\ikeext.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\ipbusenum.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\IPBusEnum\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\ipbusenum.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\iphlpsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\iphlpsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\msdtckrm.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\KtmRm\Parameters" X3="ServiceDll" X4="%systemroot%\system32\msdtckrm.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\srvsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\srvsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\wkssvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\wkssvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\lltdsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\lltdsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\lltdsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\lmhsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\lmhosts\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\lmhsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\Mcx2Svc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Mcx2Svc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\Mcx2Svc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\mmcss.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\MMCSS\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\mmcss.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\mpssvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\mpssvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\iscsiexe.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\MSiSCSI\Parameters" X3="ServiceDll" X4="%systemroot%\system32\iscsiexe.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\qagentRT.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\napagent\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\qagentRT.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\netman.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Netman\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\netman.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\nlasvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\nlasvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\nsisvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\nsi\Parameters" X3="ServiceDll" X4="%systemroot%\system32\nsisvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\pnrpsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\p2pimsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\pnrpsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\p2psvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\p2psvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\p2psvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\pcasvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\PcaSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\pcasvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\umpnpmgr.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\PlugPlay\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\umpnpmgr.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\pnrpauto.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\PNRPAutoReg\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\pnrpauto.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\pnrpsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\PNRPsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\pnrpsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\ipsecsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\PolicyAgent\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\ipsecsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\umpo.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Power\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\umpo.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\profsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\ProfSvc\Parameters" X3="ServiceDll" X4="%systemroot%\system32\profsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\rasauto.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\RasAuto\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\rasauto.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\rasmans.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\RasMan\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\rasmans.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\regsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\RemoteRegistry\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\regsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\RpcEpMap.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\RpcEptMapper\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\RpcEpMap.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\rpcss.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\RpcSs\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\rpcss.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\SCardSvr.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\SCardSvr\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\SCardSvr.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\schedsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Schedule\Parameters" X3="ServiceDll" X4="%systemroot%\system32\schedsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\certprop.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\SCPolicySvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\certprop.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\SDRSVC.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\SDRSVC\Parameters" X3="ServiceDll" X4="%Systemroot%\System32\SDRSVC.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\seclogon.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\seclogon\Parameters" X3="ServiceDll" X4="%windir%\system32\seclogon.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\sensrsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\SensrSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\sensrsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\ipnathlp.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\ipnathlp.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\sppuinotify.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\sppuinotify\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\sppuinotify.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\ssdpsrv.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\SSDPSRV\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\ssdpsrv.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\sstpsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\SstpSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\sstpsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\wiaservc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\stisvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\wiaservc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\swprv.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\swprv\Parameters" X3="ServiceDll" X4="%Systemroot%\System32\swprv.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\sysmain.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\SysMain\Parameters" X3="ServiceDll" X4="%systemroot%\system32\sysmain.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\TabSvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\TabletInputService\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\TabSvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\tbssvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\TBS\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\tbssvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\termsrv.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\TermService\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\termsrv.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\themeservice.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Themes\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\themeservice.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\mmcss.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\THREADORDER\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\mmcss.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\trkwks.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\TrkWks\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\trkwks.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\uxsms.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\UxSms\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\uxsms.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\w32time.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\W32Time\Parameters" X3="ServiceDll" X4="%systemroot%\system32\w32time.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\wbiosrvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\WbioSrvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\wbiosrvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\wecsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Wecsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\wecsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\wercplsupport.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\wercplsupport\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\wercplsupport.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\WerSvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\WerSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\WerSvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\wbem\WMIsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Winmgmt\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\wbem\WMIsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\wlansvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Wlansvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\wlansvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\wpdbusenum.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\WPDBusEnum\Parameters" X3="ServiceDll" X4="%SystemRoot%\system32\wpdbusenum.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\wscsvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\wscsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\wscsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\wuaueng.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\wuauserv\Parameters" X3="ServiceDll" X4="%systemroot%\system32\wuaueng.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\WUDFSvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\wudfsvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\WUDFSvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\wwansvc.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\WwanSvc\Parameters" X3="ServiceDll" X4="%SystemRoot%\System32\wwansvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\sysmain.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\rdyboost\Performance" X3="Library" X4="%systemroot%\system32\sysmain.dll" Is64="0" />
  <ITEM File="C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\DWA\resources\libraries\EventMessages.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Adobe Setup" X3="EventMessageFile" X4="C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\DWA\resources\libraries\EventMessages.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\wersvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Application Hang" X3="EventMessageFile" X4="%SystemRoot%\System32\wersvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\dwm.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Desktop Window Manager" X3="EventMessageFile" X4="%SystemRoot%\system32\dwm.exe" Is64="0" />
  <ITEM File="C:\Program Files (x86)\DVD" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Dvd Maker" X3="EventMessageFile" X4="%ProgramFiles%\DVD Maker\DVDMaker.exe" Is64="0" />
  <ITEM File="Maker\DVDMaker.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Dvd Maker" X3="EventMessageFile" X4="%ProgramFiles%\DVD Maker\DVDMaker.exe" Is64="0" />
  <ITEM File="C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\IPSEventLogMsg.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Handwriting Recognition" X3="EventMessageFile" X4="%CommonProgramFiles%\Microsoft Shared\Ink\IPSEventLogMsg.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\UI0Detect.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Interactive Services detection" X3="EventMessageFile" X4="%SystemRoot%\System32\UI0Detect.exe" Is64="0" />
  <ITEM File="C:\Windows\system32\fxsevent.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft Fax" X3="EventMessageFile" X4="%systemroot%\system32\fxsevent.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\AxInstSv.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-AxInstallService" X3="EventMessageFile" X4="%SystemRoot%\System32\AxInstSv.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\BlbEvents.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Backup" X3="EventMessageFile" X4="%windir%\system32\BlbEvents.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\defragsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Defrag" X3="EventMessageFile" X4="%systemroot%\system32\defragsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\eapsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-EapHost" X3="EventMessageFile" X4="%systemroot%\system32\eapsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\wecsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-EventCollector" X3="EventMessageFile" X4="%SystemRoot%\system32\wecsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\profsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-User Profiles Service" X3="EventMessageFile" X4="%SystemRoot%\System32\profsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\WINSAT.EXE" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-WindowsSystemAssessmentTool" X3="EventMessageFile" X4="%SystemRoot%\system32\WINSAT.EXE" Is64="0" />
  <ITEM File="C:\Windows\system32\winsrv.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Microsoft-Windows-Winsrv" X3="EventMessageFile" X4="%SystemRoot%\system32\winsrv.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\profsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Profsvc" X3="EventMessageFile" X4="%SystemRoot%\System32\profsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\wscsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\SecurityCenter" X3="EventMessageFile" X4="%SystemRoot%\System32\wscsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\sppsvc.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Software Protection Platform Service" X3="EventMessageFile" X4="%windir%\system32\sppsvc.exe" Is64="0" />
  <ITEM File="C:\Windows\system32\srcore.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\System Restore" X3="EventMessageFile" X4="%systemroot%\system32\srcore.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\VSSVC.EXE" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\VSS" X3="EventMessageFile" X4="%SystemRoot%\System32\VSSVC.EXE" Is64="0" />
  <ITEM File="f:\496bf1745e73b8cf8a2a\DW\DW20.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\VSSetup" X3="EventMessageFile" X4="f:\496bf1745e73b8cf8a2a\DW\DW20.exe" Is64="0" />
  <ITEM File="C:\Windows\System32\wersvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\WerSvc" X3="EventMessageFile" X4="%SystemRoot%\System32\wersvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\sdengin2.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Windows Backup" X3="EventMessageFile" X4="%systemroot%\system32\sdengin2.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\wsepno.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Windows Search Service Profile Notification" X3="EventMessageFile" X4="%SystemRoot%\system32\wsepno.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\winlogon.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Winlogon" X3="EventMessageFile" X4="%SystemRoot%\System32\winlogon.exe" Is64="0" />
  <ITEM File="C:\Windows\System32\winlogon.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wlclntfy" X3="EventMessageFile" X4="%SystemRoot%\System32\winlogon.exe" Is64="0" />
  <ITEM File="C:\Users\Xyu\AppData\Local\Temp\A717ACE5-A1B429CB-35A78D2F-13D277BC\zJItfXvcunkjjxt.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Doctor Web\Dr.Web Engine" X3="EventMessageFile" X4="C:\Users\Xyu\AppData\Local\Temp\A717ACE5-A1B429CB-35A78D2F-13D277BC\zJItfXvcunkjjxt.exe" Is64="0" />
  <ITEM File="C:\Windows\system32\wecsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\HardwareEvents" X3="DisplayNameFile" X4="%SystemRoot%\system32\wecsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\sppsvc.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Key Management Service\KmsRequests" X3="EventMessageFile" X4="%windir%\system32\sppsvc.exe" Is64="0" />
  <ITEM File="C:\Windows\System32\wevtsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Security\Microsoft-Windows-Eventlog" X3="EventMessageFile" X4="%SystemRoot%\System32\wevtsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\VSSVC.EXE" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\Security\VSSAudit" X3="EventMessageFile" X4="%SystemRoot%\System32\VSSVC.EXE" Is64="0" />
  <ITEM File="C:\Windows\System32\Drivers\acpi.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\ACPI" X3="EventMessageFile" X4="%SystemRoot%\System32\Drivers\acpi.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\aelupsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\AeLookupSvc" X3="EventMessageFile" X4="%SystemRoot%\System32\aelupsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\amdk8.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\AmdK8" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\amdk8.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\amdppm.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\AmdPPM" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\amdppm.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\bxvbda.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\b06bdrv" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\bxvbda.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\b57nd60a.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\b57nd60a" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\b57nd60a.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\DispCI.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Display" X3="EventMessageFile" X4="%SystemRoot%\System32\DispCI.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\evbda.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\ebdrv" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\evbda.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\fltmgr.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\FltMgr" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\fltmgr.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\Drivers\hidbth.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\HidBth" X3="EventMessageFile" X4="%SystemRoot%\System32\Drivers\hidbth.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\i8042prt.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\i8042prt" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\i8042prt.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\iaStorV.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\iaStorV" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\iaStorV.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\intelppm.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\intelppm" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\intelppm.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\ipmidrv.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\IPMIDRV" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\ipmidrv.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\isapnp.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\isapnp" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\isapnp.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\iscsilog.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\iScsiPrt" X3="EventMessageFile" X4="%SystemRoot%\System32\iscsilog.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\kbdclass.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\kbdclass" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\kbdclass.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\kbdhid.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\kbdhid" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\kbdhid.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\lsasrv.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\LsaSrv" X3="EventMessageFile" X4="%windir%\System32\lsasrv.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\lsm.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\LSM" X3="EventMessageFile" X4="%SystemRoot%\system32\lsm.exe" Is64="0" />
  <ITEM File="C:\Windows\system32\fveapi.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-BitLocker-API" X3="EventMessageFile" X4="%SystemRoot%\system32\fveapi.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\drivers\fvevol.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-BitLocker-Driver" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\fvevol.sys" Is64="0" />
  <ITEM File="C:\Windows\system32\qmgr.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Bits-Client" X3="EventMessageFile" X4="%systemroot%\system32\qmgr.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\cofiredm.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-CorruptedFileRecovery-Client" X3="EventMessageFile" X4="%SystemRoot%\system32\cofiredm.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\cofiredm.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-CorruptedFileRecovery-Server" X3="EventMessageFile" X4="%SystemRoot%\system32\cofiredm.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\samsrv.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Directory-Services-SAM" X3="EventMessageFile" X4="%SystemRoot%\System32\samsrv.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\dfdts.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-DiskDiagnostic" X3="EventMessageFile" X4="%windir%\system32\dfdts.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\WUDFPlatform.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-DriverFrameworks-UserMode" X3="EventMessageFile" X4="%SystemRoot%\system32\WUDFPlatform.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\wecsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-EventCollector" X3="EventMessageFile" X4="%SystemRoot%\system32\wecsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\wevtsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Eventlog" X3="EventMessageFile" X4="%SystemRoot%\System32\wevtsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\drivers\fltmgr.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-FilterManager" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\fltmgr.sys" Is64="0" />
  <ITEM File="C:\Windows\system32\mpssvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Firewall" X3="EventMessageFile" X4="%SystemRoot%\system32\mpssvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\fdphost.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-FunctionDiscoveryHost" X3="EventMessageFile" X4="%SystemRoot%\system32\fdphost.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\gpsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-GroupPolicy" X3="EventMessageFile" X4="%systemroot%\system32\gpsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\microsoft-windows-hal-events.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-HAL" X3="EventMessageFile" X4="%systemroot%\system32\microsoft-windows-hal-events.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\drivers\HTTP.SYS" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-HttpEvent" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\HTTP.SYS" Is64="0" />
  <ITEM File="C:\Windows\system32\ipbusenum.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-IPBusEnum" X3="EventMessageFile" X4="%systemroot%\system32\ipbusenum.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\iphlpsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Iphlpsvc" X3="EventMessageFile" X4="%windir%\system32\iphlpsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\microsoft-windows-kernel-power-events.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Kernel-Power" X3="EventMessageFile" X4="%systemroot%\system32\microsoft-windows-kernel-power-events.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\microsoft-windows-kernel-processor-power-events.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Kernel-Processor-Power" X3="EventMessageFile" X4="%systemroot%\system32\microsoft-windows-kernel-processor-power-events.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\lpksetup.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-LanguagePackSetup" X3="EventMessageFile" X4="%SystemRoot%\system32\lpksetup.exe" Is64="0" />
  <ITEM File="C:\Windows\System32\relpost.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-MemoryDiagnostics-Results" X3="EventMessageFile" X4="%SystemRoot%\System32\relpost.exe" Is64="0" />
  <ITEM File="C:\Windows\System32\mdsched.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-MemoryDiagnostics-Schedule" X3="EventMessageFile" X4="%SystemRoot%\System32\mdsched.exe" Is64="0" />
  <ITEM File="C:\Windows\System32\sstpsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-RasSstp" X3="EventMessageFile" X4="%SystemRoot%\System32\sstpsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\recovery.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Recovery" X3="EventMessageFile" X4="%SystemRoot%\system32\recovery.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\fdrespub.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-ResourcePublication" X3="EventMessageFile" X4="%SystemRoot%\system32\fdrespub.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\certprop.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-SCPNP" X3="EventMessageFile" X4="%SystemRoot%\system32\certprop.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\oobe\winsetup.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Setup" X3="EventMessageFile" X4="%SystemRoot%\system32\oobe\winsetup.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\csrsrv.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Subsys-SMSS" X3="EventMessageFile" X4="%windir%\system32\csrsrv.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\schedsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TaskScheduler" X3="EventMessageFile" X4="%SystemRoot%\system32\schedsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\tbssvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TBS" X3="EventMessageFile" X4="%SystemRoot%\system32\tbssvc.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\lsm.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TerminalServices-LocalSessionManager" X3="EventMessageFile" X4="%SystemRoot%\system32\lsm.exe" Is64="0" />
  <ITEM File="C:\Windows\system32\termsrv.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-TerminalServices-RemoteConnectionManager" X3="EventMessageFile" X4="%SystemRoot%\system32\termsrv.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\w32time.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Time-Service" X3="EventMessageFile" X4="%SystemRoot%\system32\w32time.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\umpnpmgr.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-UserPnp" X3="EventMessageFile" X4="%SystemRoot%\system32\umpnpmgr.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\wuaueng.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-WindowsUpdateClient" X3="EventMessageFile" X4="%systemroot%\system32\wuaueng.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\winlogon.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-Winlogon" X3="EventMessageFile" X4="%SystemRoot%\system32\winlogon.exe" Is64="0" />
  <ITEM File="C:\Windows\system32\wlansvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Microsoft-Windows-WLAN-AutoConfig" X3="EventMessageFile" X4="%windir%\system32\wlansvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\mouclass.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\mouclass" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\mouclass.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\mouhid.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\mouhid" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\mouhid.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\mpio.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\mpio" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\mpio.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\iscsiexe.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\MSiSCSI" X3="EventMessageFile" X4="%systemroot%\System32\iscsiexe.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\MTConfig.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\MTConfig" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\MTConfig.sys" Is64="0" />
  <ITEM File="C:\Windows\system32\drivers\ntfs.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Ntfs" X3="EventMessageFile" X4="%SystemRoot%\system32\drivers\ntfs.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\nvstor.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\nvstor" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\nvstor.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\parport.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Parport" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\parport.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\Drivers\Pcmcia.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\pcmcia" X3="EventMessageFile" X4="%SystemRoot%\System32\Drivers\Pcmcia.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\umpnpmgr.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\PlugPlayManager" X3="EventMessageFile" X4="%SystemRoot%\System32\umpnpmgr.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\umpo.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Power" X3="EventMessageFile" X4="%SystemRoot%\System32\umpo.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\processr.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Processor" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\processr.sys" Is64="0" />
  <ITEM File="C:\Windows\system32\sstpsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\RasSstp" X3="EventMessageFile" X4="%systemroot%\system32\sstpsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\samsrv.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\SAM" X3="EventMessageFile" X4="%SystemRoot%\System32\samsrv.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\sbp2port.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\sbp2port" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\sbp2port.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\lsasrv.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Schannel" X3="EventMessageFile" X4="%windir%\System32\lsasrv.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\serial.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Serial" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\serial.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\sermouse.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\sermouse" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\sermouse.sys" Is64="0" />
  <ITEM File="C:\Windows\system32\services.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Service Control Manager" X3="EventMessageFile" X4="%SystemRoot%\system32\services.exe" Is64="0" />
  <ITEM File="C:\Windows\System32\snmptrap.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\SNMPTRAP" X3="EventMessageFile" X4="%SystemRoot%\System32\snmptrap.exe" Is64="0" />
  <ITEM File="C:\Windows\System32\wiaservc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\StillImage" X3="EventMessageFile" X4="%SystemRoot%\System32\wiaservc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\tcpmon.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\TCPMon" X3="EventMessageFile" X4="%SystemRoot%\System32\tcpmon.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\termsrv.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\TermService" X3="EventMessageFile" X4="%SystemRoot%\system32\termsrv.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\tsusbflt.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\TsUsbFlt" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\tsusbflt.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\vgapnp.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\vga" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\vgapnp.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\vds.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Virtual Disk Service" X3="EventMessageFile" X4="%SystemRoot%\System32\vds.exe" Is64="0" />
  <ITEM File="C:\Windows\System32\Drivers\VolSnap.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Volsnap" X3="EventMessageFile" X4="%SystemRoot%\System32\Drivers\VolSnap.sys" Is64="0" />
  <ITEM File="C:\Windows\system32\w32time.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\W32Time" X3="EventMessageFile" X4="%Systemroot%\system32\w32time.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\wacompen.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\WacomPen" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\wacompen.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\drivers\wd.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Wd" X3="EventMessageFile" X4="%SystemRoot%\System32\drivers\wd.sys" Is64="0" />
  <ITEM File="C:\Windows\system32\drivers\Wdf01000.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\wdf01000" X3="EventMessageFile" X4="\SystemRoot\system32\drivers\Wdf01000.sys" Is64="0" />
  <ITEM File="C:\Windows\System32\wecsvc.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\wecsvc" X3="EventMessageFile" X4="%SystemRoot%\System32\wecsvc.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\win32k.sys" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Win32k" X3="EventMessageFile" X4="%SystemRoot%\System32\win32k.sys" Is64="0" />
  <ITEM File="C:\Program Files (x86)\Windows Defender\MpEvMsg.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\WinDefend" X3="EventMessageFile" X4="%ProgramFiles%\Windows Defender\MpEvMsg.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\DFDTS.dll" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\Eventlog\System\Windows Disk Diagnostic" X3="EventMessageFile" X4="%SystemRoot%\System32\DFDTS.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\w32time.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient" X3="DllName" X4="%systemroot%\system32\w32time.dll" Is64="0" />
  <ITEM File="C:\Windows\system32\w32time.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer" X3="DllName" X4="%systemroot%\system32\w32time.dll" Is64="0" />
  <ITEM File="C:\Windows\System32\mctadmin.exe" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_USERS" X2="S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce" X3="mctadmin" X4="C:\Windows\System32\mctadmin.exe" Is64="0" />
  <ITEM File="C:\Windows\System32\mctadmin.exe" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_USERS" X2="S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce" X3="mctadmin" X4="C:\Windows\System32\mctadmin.exe" Is64="0" />
  <ITEM File="C:\Windows\system32\nvspcap64.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="Software\Microsoft\Windows\CurrentVersion\Run" X3="ShadowPlay" X4="&quot;C:\Windows\system32\rundll32.exe&quot; C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart" Is64="1" />
  <ITEM File="C:\Program Files (x86)\Zaxar\ZaxarLoader.exe" CheckResult="-1" Enabled="-1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Zaxar" X3="command" X4="&quot;C:\Program Files (x86)\Zaxar\ZaxarLoader.exe&quot; /verysilent" Is64="1" />
  <ITEM File="C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4bcd6cde-777b-48b6-9804-43568e23545d}" X3="DLLName" X4="C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll" Is64="1" />
  <ITEM File="auditcse.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{f3ccc681-b74c-4060-9f26-cd84525dca2a}" X3="DLLName" X4="auditcse.dll" Is64="1" />
  <ITEM File="nvoglv64.dll" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="Software\Microsoft\Windows NT\CurrentVersion\OpenGLDrivers\MSOGL" X3="DLL" X4="nvoglv64" Is64="1" />
  <ITEM File="C:\Windows\system32\WUDFHost.exe" CheckResult="-1" Enabled="1" Type="REG"  X1="HKEY_LOCAL_MACHINE" X2="Software\Microsoft\Windows NT\CurrentVersion\WUDF\Services\{193a1820-d9ac-4997-8c55-be817523f6aa}" X3="HostProcessImagePath" X4="C:\Windows\system32\WUDFHost.exe" Is64="1" />
  <ITEM File="C:\Windows\System32\rundll32.exe url,FileProtocolHandler &quot;http://www.mail.ru/cnt/20775012?gp=811035&quot;" CheckResult="3" Enabled="1" Type="LNK"  X1="C:\Users\Xyu\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\" X2="C:\Users\Xyu\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mail.Ru.lnk" X3="" X4="" Is64="0" />
 </AUTORUN>
 <BHO>
 </BHO>
 <ExplorerExt>
  <ITEM File="" CheckResult="-1" Enabled="1" ExtType="1" ExtName="AVG Find Extension" RegKey="SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved" CLSID="{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" Descr="" LegalCopyright=""   />
 </ExplorerExt>
 <PrintEXT>
  <ITEM File="localspl.dll" CheckResult="-1" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors" Descr="" LegalCopyright=""   />
  <ITEM File="FXSMON.DLL" CheckResult="-1" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors" Descr="" LegalCopyright=""   />
  <ITEM File="tcpmon.dll" CheckResult="-1" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors" Descr="" LegalCopyright=""   />
  <ITEM File="usbmon.dll" CheckResult="-1" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors" Descr="" LegalCopyright=""   />
  <ITEM File="WSDMon.dll" CheckResult="-1" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Monitors" Descr="" LegalCopyright=""   />
  <ITEM File="inetpp.dll" CheckResult="-1" Enabled="1" RegKey="SYSTEM\CurrentControlSet\Control\Print\Providers" Descr="" LegalCopyright=""   />
 </PrintEXT>
 <TaskScheduler>
  <ITEM File="avgsetupx.exe" JobName="AVG EUpdate Task" Status="1776727042" CheckResult="-1" Enabled="356599664" Descr="" LegalCopyright="" SHPath="C:\Windows\system32\Tasks\" FullCmd=" avgsetupx.exe  /eu" is64="1" TaskMode="2"   />
  <ITEM File=" aitagent " JobName="AitAgent" Status="1776429057" CheckResult="-1" Enabled="356599664" Descr="" LegalCopyright="" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Application Experience\" FullCmd=" aitagent " is64="1" TaskMode="2"   />
  <ITEM File="C:\Windows\ehome\mcupdate" JobName="mcupdate" Status="1776429058" CheckResult="-1" Enabled="356599664" Descr="" LegalCopyright="" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Media Center\" FullCmd=" %SystemRoot%\ehome\mcupdate  $(Arg0)" is64="1" TaskMode="2"   />
  <ITEM File="C:\Windows\ehome\ehrec" JobName="RecordingRestart" Status="1776429058" CheckResult="-1" Enabled="356599664" Descr="" LegalCopyright="" SHPath="C:\Windows\system32\Tasks\Microsoft\Windows\Media Center\" FullCmd=" %SystemRoot%\ehome\ehrec  /RestartRecording" is64="1" TaskMode="2"   />
  <ITEM File="C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe" JobName="Overwolf Updater Task" Status="1776727042" CheckResult="-1" Enabled="356599664" Descr="OverwolfUpdater" LegalCopyright="Copyright Overwolf © 2017" SHPath="C:\Windows\system32\Tasks\" FullCmd=" C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe  /RunningFrom Schedule" is64="1" TaskMode="2" Size="1325112" Attr="rsAh" CreateDate="20.02.2017 14:29:04" ChangeDate="20.02.2017 14:29:04" MD5="9C8FEF6D420B35FD7F276DB878DFF9CA" Vendor="Overwolf LTD" Product="Overwolf" OFN="OverwolfUpdater.exe" Ver="0.102.217.0" IsPE="1"  />
  <ITEM File="C:\Users\Xyu\Desktop\sven\setup.exe" JobName="{F68075C3-C928-4351-8FD2-24D3B62E65D0}" Status="1776727042" CheckResult="-1" Enabled="356599664" Descr="" LegalCopyright="" SHPath="C:\Windows\system32\Tasks\" FullCmd=" C:\Windows\system32\pcalua.exe  -a C:\Users\Xyu\Desktop\sven\setup.exe -d C:\Users\Xyu\Desktop\sven" is64="1" TaskMode="2"   />
  <ITEM File="C:\Users\Xyu\Desktop\sven" JobName="{F68075C3-C928-4351-8FD2-24D3B62E65D0}" Status="1776727042" CheckResult="-1" Enabled="356599664" Descr="" LegalCopyright="" SHPath="C:\Windows\system32\Tasks\" FullCmd=" C:\Windows\system32\pcalua.exe  -a C:\Users\Xyu\Desktop\sven\setup.exe -d C:\Users\Xyu\Desktop\sven" is64="1" TaskMode="2"   />
 </TaskScheduler>
 <SPI>
 </SPI>
 <PORTS>
  <ITEM File="C:\Windows\system32\svchost.exe" CheckResult="0" PortType="1" LocalPort="135" RemotePort="0" RemoteHost="0.0.0.0" Size="20992" Attr="rsAh" CreateDate="14.07.2009 02:19:28" ChangeDate="14.07.2009 04:14:41" MD5="54A47F6B5E09A77E61649109C6A08866" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.1.7600.16385" IsPE="1"  />
  <ITEM File="System.exe" CheckResult="-1" PortType="1" LocalPort="445" RemotePort="0" RemoteHost="0.0.0.0"   />
  <ITEM File="mDNSResponder.exe" CheckResult="-1" PortType="1" LocalPort="5354" RemotePort="0" RemoteHost="0.0.0.0"   />
  <ITEM File="mDNSResponder.exe" CheckResult="-1" PortType="1" LocalPort="5354" RemotePort="49155" RemoteHost="127.0.0.1"   />
  <ITEM File="mDNSResponder.exe" CheckResult="-1" PortType="1" LocalPort="5354" RemotePort="49156" RemoteHost="127.0.0.1"   />
  <ITEM File="System.exe" CheckResult="-1" PortType="1" LocalPort="5357" RemotePort="0" RemoteHost="0.0.0.0"   />
  <ITEM File="c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe" CheckResult="0" PortType="1" LocalPort="9990" RemotePort="0" RemoteHost="0.0.0.0" Size="1881144" Attr="rsAh" CreateDate="26.05.2016 22:10:42" ChangeDate="02.05.2016 08:59:20" MD5="FA9BC0048ED46C5FB5C93EAFFC97F63D" Vendor="NVIDIA Corporation" Product="NVIDIA Network Service" OFN="NVNetworkService.exe" Ver="2.4.13.69" IsPE="1"  />
  <ITEM File="AppleMobileDeviceService.exe" CheckResult="-1" PortType="1" LocalPort="27015" RemotePort="0" RemoteHost="0.0.0.0"   />
  <ITEM File="AppleMobileDeviceService.exe" CheckResult="-1" PortType="1" LocalPort="27015" RemotePort="49159" RemoteHost="127.0.0.1"   />
  <ITEM File="c:\program files (x86)\steam\steam.exe" CheckResult="0" PortType="1" LocalPort="27036" RemotePort="0" RemoteHost="0.0.0.0" Size="2881824" Attr="rsAh" CreateDate="05.06.2015 00:11:32" ChangeDate="19.01.2017 04:30:28" MD5="5710E80EAB62305C4FD4D968567448D2" Vendor="Valve Corporation" Product="Steam Client Bootstrapper" OFN="steam.exe" Ver="3.78.49.52" IsPE="1"  />
  <ITEM File="NvStreamNetworkService.exe" CheckResult="-1" PortType="1" LocalPort="47984" RemotePort="0" RemoteHost="0.0.0.0"   />
  <ITEM File="NvStreamNetworkService.exe" CheckResult="-1" PortType="1" LocalPort="47989" RemotePort="0" RemoteHost="0.0.0.0"   />
  <ITEM File="NvStreamNetworkService.exe" CheckResult="-1" PortType="1" LocalPort="48010" RemotePort="0" RemoteHost="0.0.0.0"   />
  <ITEM File="C:\Windows\system32\wininit.exe" CheckResult="0" PortType="1" LocalPort="49152" RemotePort="0" RemoteHost="0.0.0.0" Size="96256" Attr="rsAh" CreateDate="14.07.2009 02:36:49" ChangeDate="14.07.2009 04:14:45" MD5="B5C5DCAD3899512020D135600129D665" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="WinInit.exe.mui" Ver="6.1.7600.16385" IsPE="1"  />
  <ITEM File="C:\Windows\system32\svchost.exe" CheckResult="0" PortType="1" LocalPort="49153" RemotePort="0" RemoteHost="0.0.0.0" Size="20992" Attr="rsAh" CreateDate="14.07.2009 02:19:28" ChangeDate="14.07.2009 04:14:41" MD5="54A47F6B5E09A77E61649109C6A08866" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.1.7600.16385" IsPE="1"  />
  <ITEM File="C:\Windows\system32\svchost.exe" CheckResult="0" PortType="1" LocalPort="49154" RemotePort="0" RemoteHost="0.0.0.0" Size="20992" Attr="rsAh" CreateDate="14.07.2009 02:19:28" ChangeDate="14.07.2009 04:14:41" MD5="54A47F6B5E09A77E61649109C6A08866" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.1.7600.16385" IsPE="1"  />
  <ITEM File="AppleMobileDeviceService.exe" CheckResult="-1" PortType="1" LocalPort="49155" RemotePort="5354" RemoteHost="127.0.0.1"   />
  <ITEM File="AppleMobileDeviceService.exe" CheckResult="-1" PortType="1" LocalPort="49156" RemotePort="5354" RemoteHost="127.0.0.1"   />
  <ITEM File="iTunesHelper.exe" CheckResult="-1" PortType="1" LocalPort="49159" RemotePort="27015" RemoteHost="127.0.0.1"   />
  <ITEM File="services.exe" CheckResult="-1" PortType="1" LocalPort="49163" RemotePort="0" RemoteHost="0.0.0.0"   />
  <ITEM File="C:\Windows\system32\svchost.exe" CheckResult="0" PortType="1" LocalPort="49164" RemotePort="0" RemoteHost="0.0.0.0" Size="20992" Attr="rsAh" CreateDate="14.07.2009 02:19:28" ChangeDate="14.07.2009 04:14:41" MD5="54A47F6B5E09A77E61649109C6A08866" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.1.7600.16385" IsPE="1"  />
  <ITEM File="c:\program files (x86)\adguard\adguardsvc.exe" CheckResult="-1" PortType="1" LocalPort="49167" RemotePort="0" RemoteHost="0.0.0.0" Size="151312" Attr="rsAh" CreateDate="07.02.2017 13:32:46" ChangeDate="07.02.2017 13:32:46" MD5="9D30D3DEAA89CD4DC7439132F4F7909B" Vendor="Performix LLC" Product="Adguard for Windows" OFN="AdguardSvc.exe" Ver="6.1.312.1629" IsPE="1"  />
  <ITEM File="lsass.exe" CheckResult="-1" PortType="1" LocalPort="49169" RemotePort="0" RemoteHost="0.0.0.0"   />
  <ITEM File="NvStreamNetworkService.exe" CheckResult="-1" PortType="1" LocalPort="49192" RemotePort="65001" RemoteHost="127.0.0.1"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="59184" RemotePort="59185" RemoteHost="127.0.0.1"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="59186" RemotePort="59187" RemoteHost="127.0.0.1"   />
  <ITEM File="" CheckResult="-1" PortType="1" LocalPort="59189" RemotePort="59190" RemoteHost="127.0.0.1"   />
  <ITEM File="NvStreamService.exe" CheckResult="-1" PortType="1" LocalPort="65000" RemotePort="0" RemoteHost="0.0.0.0"   />
  <ITEM File="NvStreamNetworkService.exe" CheckResult="-1" PortType="1" LocalPort="65001" RemotePort="0" RemoteHost="0.0.0.0"   />
  <ITEM File="NvStreamNetworkService.exe" CheckResult="-1" PortType="1" LocalPort="65001" RemotePort="49192" RemoteHost="127.0.0.1"   />
  <ITEM File="C:\Windows\system32\svchost.exe" CheckResult="0" PortType="2" LocalPort="500" RemotePort="0" RemoteHost="" Size="20992" Attr="rsAh" CreateDate="14.07.2009 02:19:28" ChangeDate="14.07.2009 04:14:41" MD5="54A47F6B5E09A77E61649109C6A08866" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.1.7600.16385" IsPE="1"  />
  <ITEM File="C:\Windows\system32\svchost.exe" CheckResult="0" PortType="2" LocalPort="1900" RemotePort="0" RemoteHost="" Size="20992" Attr="rsAh" CreateDate="14.07.2009 02:19:28" ChangeDate="14.07.2009 04:14:41" MD5="54A47F6B5E09A77E61649109C6A08866" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.1.7600.16385" IsPE="1"  />
  <ITEM File="C:\Windows\system32\svchost.exe" CheckResult="0" PortType="2" LocalPort="3702" RemotePort="0" RemoteHost="" Size="20992" Attr="rsAh" CreateDate="14.07.2009 02:19:28" ChangeDate="14.07.2009 04:14:41" MD5="54A47F6B5E09A77E61649109C6A08866" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.1.7600.16385" IsPE="1"  />
  <ITEM File="C:\Windows\system32\svchost.exe" CheckResult="0" PortType="2" LocalPort="3702" RemotePort="0" RemoteHost="" Size="20992" Attr="rsAh" CreateDate="14.07.2009 02:19:28" ChangeDate="14.07.2009 04:14:41" MD5="54A47F6B5E09A77E61649109C6A08866" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.1.7600.16385" IsPE="1"  />
  <ITEM File="C:\Windows\system32\svchost.exe" CheckResult="0" PortType="2" LocalPort="4500" RemotePort="0" RemoteHost="" Size="20992" Attr="rsAh" CreateDate="14.07.2009 02:19:28" ChangeDate="14.07.2009 04:14:41" MD5="54A47F6B5E09A77E61649109C6A08866" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.1.7600.16385" IsPE="1"  />
  <ITEM File="mDNSResponder.exe" CheckResult="-1" PortType="2" LocalPort="5353" RemotePort="0" RemoteHost=""   />
  <ITEM File="NvStreamNetworkService.exe" CheckResult="-1" PortType="2" LocalPort="5353" RemotePort="0" RemoteHost=""   />
  <ITEM File="c:\program files (x86)\steam\steam.exe" CheckResult="0" PortType="2" LocalPort="27036" RemotePort="0" RemoteHost="" Size="2881824" Attr="rsAh" CreateDate="05.06.2015 00:11:32" ChangeDate="19.01.2017 04:30:28" MD5="5710E80EAB62305C4FD4D968567448D2" Vendor="Valve Corporation" Product="Steam Client Bootstrapper" OFN="steam.exe" Ver="3.78.49.52" IsPE="1"  />
  <ITEM File="c:\program files (x86)\nvidia corporation\update core\nvbackend.exe" CheckResult="0" PortType="2" LocalPort="48200" RemotePort="0" RemoteHost="" Size="2398776" Attr="rsAh" CreateDate="26.05.2016 22:11:01" ChangeDate="02.05.2016 09:02:13" MD5="C8AC55CCB8AB33713522B4CAAFAC0F59" Vendor="NVIDIA Corporation" Product="NVIDIA Backend" OFN="NvBackend.exe" Ver="20.16.5.0" IsPE="1"  />
  <ITEM File="NvStreamUserAgent.exe" CheckResult="-1" PortType="2" LocalPort="48201" RemotePort="0" RemoteHost=""   />
  <ITEM File="nvtray.exe" CheckResult="-1" PortType="2" LocalPort="48202" RemotePort="0" RemoteHost=""   />
  <ITEM File="NvStreamUserAgent.exe" CheckResult="-1" PortType="2" LocalPort="49719" RemotePort="0" RemoteHost=""   />
  <ITEM File="NvStreamUserAgent.exe" CheckResult="-1" PortType="2" LocalPort="49720" RemotePort="0" RemoteHost=""   />
  <ITEM File="NvStreamUserAgent.exe" CheckResult="-1" PortType="2" LocalPort="53657" RemotePort="0" RemoteHost=""   />
  <ITEM File="AppleMobileDeviceService.exe" CheckResult="-1" PortType="2" LocalPort="54523" RemotePort="0" RemoteHost=""   />
  <ITEM File="AppleMobileDeviceService.exe" CheckResult="-1" PortType="2" LocalPort="54524" RemotePort="0" RemoteHost=""   />
  <ITEM File="mDNSResponder.exe" CheckResult="-1" PortType="2" LocalPort="54525" RemotePort="0" RemoteHost=""   />
  <ITEM File="c:\program files (x86)\steam\steam.exe" CheckResult="0" PortType="2" LocalPort="57049" RemotePort="0" RemoteHost="" Size="2881824" Attr="rsAh" CreateDate="05.06.2015 00:11:32" ChangeDate="19.01.2017 04:30:28" MD5="5710E80EAB62305C4FD4D968567448D2" Vendor="Valve Corporation" Product="Steam Client Bootstrapper" OFN="steam.exe" Ver="3.78.49.52" IsPE="1"  />
  <ITEM File="NvStreamUserAgent.exe" CheckResult="-1" PortType="2" LocalPort="57620" RemotePort="0" RemoteHost=""   />
  <ITEM File="NvStreamUserAgent.exe" CheckResult="-1" PortType="2" LocalPort="57621" RemotePort="0" RemoteHost=""   />
  <ITEM File="NvStreamUserAgent.exe" CheckResult="-1" PortType="2" LocalPort="57622" RemotePort="0" RemoteHost=""   />
  <ITEM File="NvStreamUserAgent.exe" CheckResult="-1" PortType="2" LocalPort="57623" RemotePort="0" RemoteHost=""   />
  <ITEM File="NvStreamUserAgent.exe" CheckResult="-1" PortType="2" LocalPort="57624" RemotePort="0" RemoteHost=""   />
  <ITEM File="NvStreamUserAgent.exe" CheckResult="-1" PortType="2" LocalPort="57625" RemotePort="0" RemoteHost=""   />
  <ITEM File="NvStreamUserAgent.exe" CheckResult="-1" PortType="2" LocalPort="57626" RemotePort="0" RemoteHost=""   />
  <ITEM File="NvStreamUserAgent.exe" CheckResult="-1" PortType="2" LocalPort="57627" RemotePort="0" RemoteHost=""   />
  <ITEM File="C:\Windows\system32\svchost.exe" CheckResult="0" PortType="2" LocalPort="57998" RemotePort="0" RemoteHost="" Size="20992" Attr="rsAh" CreateDate="14.07.2009 02:19:28" ChangeDate="14.07.2009 04:14:41" MD5="54A47F6B5E09A77E61649109C6A08866" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.1.7600.16385" IsPE="1"  />
  <ITEM File="NvStreamService.exe" CheckResult="-1" PortType="2" LocalPort="59785" RemotePort="0" RemoteHost=""   />
  <ITEM File="NvStreamNetworkService.exe" CheckResult="-1" PortType="2" LocalPort="62101" RemotePort="0" RemoteHost=""   />
  <ITEM File="NvStreamNetworkService.exe" CheckResult="-1" PortType="2" LocalPort="62102" RemotePort="0" RemoteHost=""   />
  <ITEM File="NvStreamNetworkService.exe" CheckResult="-1" PortType="2" LocalPort="62103" RemotePort="0" RemoteHost=""   />
  <ITEM File="NvStreamNetworkService.exe" CheckResult="-1" PortType="2" LocalPort="62104" RemotePort="0" RemoteHost=""   />
  <ITEM File="NvStreamNetworkService.exe" CheckResult="-1" PortType="2" LocalPort="62468" RemotePort="0" RemoteHost=""   />
  <ITEM File="C:\Windows\system32\svchost.exe" CheckResult="0" PortType="2" LocalPort="62691" RemotePort="0" RemoteHost="" Size="20992" Attr="rsAh" CreateDate="14.07.2009 02:19:28" ChangeDate="14.07.2009 04:14:41" MD5="54A47F6B5E09A77E61649109C6A08866" Vendor="Microsoft Corporation" Product="Îïåðàöèîííàÿ ñèñòåìà Microsoft® Windows®" OFN="svchost.exe.mui" Ver="6.1.7600.16385" IsPE="1"  />
  <ITEM File="iTunesHelper.exe" CheckResult="-1" PortType="2" LocalPort="62921" RemotePort="0" RemoteHost=""   />
  <ITEM File="iTunesHelper.exe" CheckResult="-1" PortType="2" LocalPort="62922" RemotePort="0" RemoteHost=""   />
  <ITEM File="NvStreamService.exe" CheckResult="-1" PortType="2" LocalPort="65000" RemotePort="0" RemoteHost=""   />
 </PORTS>
 <DPF>
 </DPF>
 <CPL>
 </CPL>
 <ActiveSetup>
 </ActiveSetup>
 <HOSTS>
 </HOSTS>
 <ProtocolExt>
 </ProtocolExt>
 <NET_SHARE>
  <ITEM Name="ADMIN$" Path="C:\Windows" Connections="0"  />
  <ITEM Name="C$" Path="C:\" Connections="0"  />
  <ITEM Name="E$" Path="E:\" Connections="0"  />
  <ITEM Name="F$" Path="F:\" Connections="0"  />
  <ITEM Name="IPC$" Path="" Connections="0"  />
 </NET_SHARE>
<WMI_INFO>
 <SecurityCenter>
  <AntiVirusProduct>
  </AntiVirusProduct>
  <FireWallProduct>
  </FireWallProduct>
 </SecurityCenter>
 <SecurityCenter2>
  <AntiVirusProduct>
    <Data Name="Malwarebytes" pathToSignedProductExe="C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" ProductState="393216" />
    <Data Name="AVG AntiVirus Free Edition" pathToSignedProductExe="C:\Program Files (x86)\AVG\Av\avgwsc.exe" ProductState="270336" />
  </AntiVirusProduct>
  <FireWallProduct>
  </FireWallProduct>
  <AntiSpywareProduct>
    <Data Name="Malwarebytes" pathToSignedProductExe="C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" ProductState="393216" />
    <Data Name="Windows Defender" pathToSignedProductExe="%ProgramFiles%\Windows Defender\MSASCui.exe" ProductState="393472" />
    <Data Name="AVG AntiVirus Free Edition" pathToSignedProductExe="C:\Program Files (x86)\AVG\Av\avgwsc.exe" ProductState="270336" />
  </AntiSpywareProduct>
 </SecurityCenter2>
</WMI_INFO>
<NET_DIAG>
 <DNS>
  <Host Name="yandex.ru" IP="" Ping="0" PingInfo="11010,0,0.0.0.0" />
  <Host Name="google.ru" IP="" Ping="0" PingInfo="11010,0,0.0.0.0" />
  <Host Name="google.com" IP="" Ping="0" PingInfo="11010,0,0.0.0.0" />
  <Host Name="www.kaspersky.com" IP="" Ping="0" PingInfo="11010,0,0.0.0.0" />
  <Host Name="www.kaspersky.ru" IP="" Ping="0" PingInfo="11010,0,0.0.0.0" />
  <Host Name="dnl-03.geo.kaspersky.com" IP="" Ping="0" PingInfo="11010,0,0.0.0.0" />
  <Host Name="dnl-11.geo.kaspersky.com" IP="" Ping="0" PingInfo="11010,0,0.0.0.0" />
  <Host Name="activation-v2.kaspersky.com" IP="" Ping="0" PingInfo="11010,0,0.0.0.0" />
  <Host Name="odnoklassniki.ru" IP="" Ping="0" PingInfo="11010,0,0.0.0.0" />
  <Host Name="vk.com" IP="" Ping="0" PingInfo="11010,0,0.0.0.0" />
  <Host Name="vkontakte.ru" IP="" Ping="0" PingInfo="11010,0,0.0.0.0" />
  <Host Name="twitter.com" IP="" Ping="0" PingInfo="11010,0,0.0.0.0" />
  <Host Name="facebook.com" IP="" Ping="0" PingInfo="11010,0,0.0.0.0" />
  <Host Name="ru-ru.facebook.com" IP="" Ping="0" PingInfo="11010,0,0.0.0.0" />
 </DNS>
 <IE_Setup>
  <Key RegKey="HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" Name="AutoConfigURL" VAL="" />
  <Key RegKey="HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" Name="AutoConfigProxy" VAL="wininet.dll" />
  <Key RegKey="HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" Name="ProxyOverride" VAL="*.local" />
  <Key RegKey="HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" Name="ProxyServer" VAL="" />
  <Key RegKey="HKLM\SYSTEM\CurrentControlSet\services\NlaSvc\Parameters\Internet\ManualProxies" Name="" VAL="" />
 </IE_Setup>
 <TCP_IP>
 </TCP_IP>
 <TCP_IP_PR>
 </TCP_IP_PR>
</NET_DIAG>
 <IPU>
  <ITEM Code="1" X1="TermService" X2="Ñëóæáû óäàëåííûõ ðàáî÷èõ ñòîëîâ" />
  <ITEM Code="1" X1="SSDPSRV" X2="Îáíàðóæåíèå SSDP" />
  <ITEM Code="1" X1="Schedule" X2="Ïëàíèðîâùèê çàäàíèé" />
  <ITEM Code="2" />
  <ITEM Code="3" />
  <ITEM Code="5" />
  <ITEM Code="8" X1="1" />
 </IPU>
 <WIZARD-TSW>
  <ITEM ID="58" Level="3" Fixed="0" />
  <ITEM ID="59" Level="3" Fixed="0" />
  <ITEM ID="61" Level="2" Fixed="0" />
  <ITEM ID="87" Level="3" Fixed="0" />
 </WIZARD-TSW>
</AVZ>
