HKLM-x32\...\Run: [] [x]
HKLM-x32\...\Run: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe" [1391272 2012-01-03] (Ask)
C:\Program Files (x86)\Ask.com
HKU\Kopas\...\Run: [scOzbBdGTDLPgOK] C:\Users\Kopas\AppData\Roaming\RarArchiverWin.exe [230315 2012-05-09] (Nonprofit organization offering health, educational, and distance learning Internet broadcasting services)
C:\Users\Kopas\AppData\Roaming\RarArchiverWin.exe
HKU\Kopas\...\Policies\system: [DisableTaskMgr] 1
HKU\Kopas\...\Policies\system: [DisableRegistryTools] 1
HKU\Kopas\...\Policies\Explorer: [NoDesktop] 1
HKU\Kopas\...\Winlogon: [Userinit] C:\Users\Kopas\AppData\Roaming\RarArchiverWin.exe,C:\WINDOWS\System32\userinit.exe, [30208 2009-07-13] (Microsoft Corporation)
HKU\Kopas\...\Winlogon: [Shell] C:\Users\Kopas\AppData\Roaming\RarArchiverWin.exe [230315 2012-05-09] (Nonprofit organization offering health, educational, and distance learning Internet broadcasting services)