((TargetObject:HKLM\\System\\CurrentControlSet\\Services\\* TargetObject:\\Start (Image:\\Users\\Public\\* OR Image:\\Perflogs\\* OR Image:\\ADMIN$\\* OR Image:\\Temp\\*) (Details:DWORD\ \(0x00000000\) OR Details:DWORD\ \(0x00000001\) OR Details:DWORD\ \(0x00000002\))) OR (TargetObject:HKLM\\System\\CurrentControlSet\\Services\\* TargetObject:\\ImagePath (Details:\\Users\\Public\\* OR Details:\\Perflogs\\* OR Details:\\ADMIN$\\* OR Details:\\Temp\\*))) (-((Image:\\Common\ Files\\* Image:\\Temp\\*) OR (TargetObject:\\CurrentControlSet\\Services\\MBAMInstallerService\\ImagePath Details:\\AppData\\Local\\Temp\\MBAMInstallerService.exe\" Image:C\:\\Windows\\system32\\services.exe)))