HKU\Administrator\...\Run: [ctfmon.exe] - C:\Documents and Settings\Administrator\Application Data\Microsoft\Qgmkep\qgmkep.exe [ 2013-11-27] (Microsoft Corporation)
HKU\Administrator\...\Run: [otswgwz] - C:\Documents and Settings\Administrator\Application Data\Microsoft\Qgmkep\qgmkep.exe [ 2013-11-27] (Microsoft Corporation)
Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\qgmkep.lnk
ShortcutTarget: qgmkep.lnk -> C:\Documents and Settings\Administrator\Application Data\Microsoft\Qgmkep\qgmkep.exe (Microsoft Corporation)
S2 wiarbsxhw; C:\Documents and Settings\Admin.MAS_SERVER\Application Data\Microsoft\Aiyxqxqa\aiyxqxqa.exe [244732 2013-11-25] (Microsoft Corporation)
C:\Documents and Settings\Administrator\Application Data\Microsoft\Qgmkep
C:\Documents and Settings\Admin.MAS_SERVER\Application Data\Microsoft\Aiyxqxqa