معرفی بدافزارها با نام جعلی نرم افزارهای امنیتی و کاربردی

[Borna66]

AntiSpywareGuard

کد:
c:\Program Files\AntiSpywareGuard
c:\Program Files\AntiSpywareGuard\asg.exe
c:\Program Files\AntiSpywareGuard\asg.ini
c:\Program Files\AntiSpywareGuard\BL.dat
c:\Program Files\AntiSpywareGuard\PP.exe
c:\Program Files\AntiSpywareGuard\WL.dat
c:\Documents and Settings\All Users\Start Menu\Programs\AntiSpywareGuard
c:\Documents and Settings\All Users\Start Menu\Programs\AntiSpywareGuard\AntiSpywareGuard.ln k
c:\Documents and Settings\All Users\Start Menu\Programs\AntiSpywareGuard\Uninstall AntiSpywareGuard.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiSpywareGuard.lnk
%UserProfile%\Desktop\AntiSpywareGuard.lnk
کد:
HKEY_CURRENT_USER\Software\AntiSpywareGuard
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\AntiSpywareGuard
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\5.0\User Agent\Post Platform "3P_UASG 1.0.6.0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "AntiSpywareGuard"

__________________

[Borna66]

SpywareRemover 2009

کد:
c:\END
c:\Program Files\SpywareRemover2009
c:\Program Files\SpywareRemover2009\cn.exe
c:\Program Files\SpywareRemover2009\cn.xml
c:\Program Files\SpywareRemover2009\InstUp.exe
c:\Program Files\SpywareRemover2009\license.rtf
c:\Program Files\SpywareRemover2009\mfc80.dll
c:\Program Files\SpywareRemover2009\Microsoft.VC80.CRT.manife st
c:\Program Files\SpywareRemover2009\Microsoft.VC80.MFC.manife st
c:\Program Files\SpywareRemover2009\msvcm80.dll
c:\Program Files\SpywareRemover2009\msvcp80.dll
c:\Program Files\SpywareRemover2009\msvcr80.dll
c:\Program Files\SpywareRemover2009\PaymentPage.exe
c:\Program Files\SpywareRemover2009\pv.dat
c:\Program Files\SpywareRemover2009\readme.rtf
c:\Program Files\SpywareRemover2009\settings.ini
c:\Program Files\SpywareRemover2009\SR.exe
c:\Program Files\SpywareRemover2009\SR.xml
c:\Program Files\SpywareRemover2009\unins000.dat
c:\Program Files\SpywareRemover2009\unins000.exe
c:\Program Files\SpywareRemover2009\updateapp.dat
c:\Program Files\SpywareRemover2009\updatedb.dat
c:\Program Files\SpywareRemover2009\Updater.dll
c:\Program Files\SpywareRemover2009\UserAgent.dll
c:\Program Files\SpywareRemover2009\database
c:\Program Files\SpywareRemover2009\database\AutoProcess.dat
c:\Program Files\SpywareRemover2009\database\enemies.dat
c:\Program Files\SpywareRemover2009\database\Summary.dat
c:\Program Files\SpywareRemover2009\database\vbpv.dat
c:\Program Files\SpywareRemover2009\database\quarantine.dat
c:\Program Files\SpywareRemover2009\database\quarantine.dat\# post_quarantine
c:\Program Files\SpywareRemover2009\Quarantine
c:\Program Files\SpywareRemover2009\quaratine.dat
%UserProfile%\Desktop\SpywareRemover2009.lnk
%UserProfile%\Local Settings\Temp\USRM
c:\Documents and Settings\All Users\Application Data\SpywareRemover2009
c:\Documents and Settings\All Users\Application Data\SpywareRemover2009\Data
c:\Documents and Settings\All Users\Application Data\SpywareRemover2009\Data\Abbr
c:\Documents and Settings\All Users\Application Data\SpywareRemover2009\Data\ActivationCode
c:\Documents and Settings\All Users\Application Data\SpywareRemover2009\Data\ProductCode
c:\Documents and Settings\All Users\Start Menu\Programs\SpywareRemover2009
c:\Documents and Settings\All Users\Start Menu\Programs\SpywareRemover2009\Contact customer support.url
c:\Documents and Settings\All Users\Start Menu\Programs\SpywareRemover2009\SpywareRemover200 9 Online Manual.url
c:\Documents and Settings\All Users\Start Menu\Programs\SpywareRemover2009\SpywareRemover200 9.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\SpywareRemover2009\Uninstall SpywareRemover2009.lnk
کد:
HKEY_CURRENT_USER\Software\SpywareRemover2009
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\USRM_is1
HKEY_LOCAL_MACHINE\SOFTWARE\SpywareRemover2009
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Internet Settings\5.0\User Agent\Post Platform "USRM 1.0.165.0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "SpywareRemover2009"

[Borna66]

XP Protection Center

کد:
c:\Program Files\XPProtectionCenter
c:\Program Files\XPProtectionCenter\AVEngn.dll
c:\Program Files\XPProtectionCenter\htmlayout.dll
c:\Program Files\XPProtectionCenter\pthreadVC2.dll
c:\Program Files\XPProtectionCenter\Uninstall.exe
c:\Program Files\XPProtectionCenter\wscui.cpl
c:\Program Files\XPProtectionCenter\XPProtectionCenter.cfg
c:\Program Files\XPProtectionCenter\XPProtectionCenter.exe
c:\Program Files\XPProtectionCenter\data
c:\Program Files\XPProtectionCenter\data\daily.cvd
c:\Program Files\XPProtectionCenter\Microsoft.VC80.CRT
c:\Program Files\XPProtectionCenter\Microsoft.VC80.CRT\Micros oft.VC80.CRT.manifest
c:\Program Files\XPProtectionCenter\Microsoft.VC80.CRT\msvcm8 0.dll
c:\Program Files\XPProtectionCenter\Microsoft.VC80.CRT\msvcp8 0.dll
c:\Program Files\XPProtectionCenter\Microsoft.VC80.CRT\msvcr8 0.dll
c:\WINDOWS\agof.sys
c:\WINDOWS\fykutejudi.sys
c:\WINDOWS\nojeneqy.bin
c:\WINDOWS\olis._dl
c:\WINDOWS\totewake.db
c:\WINDOWS\uzoxapylu.reg
c:\WINDOWS\system32\_scui.cpl
c:\WINDOWS\system32\foxubory.dll
c:\WINDOWS\system32\gihakigobu.dat
c:\Documents and Settings\All Users\Application Data\aqugomafa.reg
c:\Documents and Settings\All Users\Application Data\kiwivaxav.inf
c:\Documents and Settings\All Users\Documents\ozipajy.reg
%UserProfile%\Application Data\hewifehaby._dl
%UserProfile%\Application Data\ojas.scr
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\XPProtectionCenter.lnk
%UserProfile%\Cookies\esed._dl
%UserProfile%\Cookies\ogituqiv.dll
%UserProfile%\Cookies\ojow.dll
%UserProfile%\Cookies\zygewusyfa.pif
%UserProfile%\Desktop\XPProtectionCenter.lnk
%UserProfile%\Local Settings\Application Data\aboh.com
%UserProfile%\Local Settings\Application Data\alarefuqe.exe
%UserProfile%\Local Settings\Application Data\mokofyf.exe
%UserProfile%\Local Settings\Application Data\pyxixu.exe
%UserProfile%\Local Settings\Application Data\sefyjemasy.vbs
%UserProfile%\Local Settings\Application Data\tuqijorujo.reg
%UserProfile%\Local Settings\Application Data\weci.bat
%UserProfile%\Local Settings\Temporary Internet Files\lavev.exe
%UserProfile%\Local Settings\Temporary Internet Files\ruhuf.sys
%UserProfile%\Start Menu\Programs\XPProtectionCenter
%UserProfile%\Start Menu\Programs\XPProtectionCenter\Uninstall.lnk
%UserProfile%\Start Menu\Programs\XPProtectionCenter\XPProtectionCente r.lnk
c:\Program Files\Common Files\liguzynaku.pif
c:\Program Files\Common Files\palozace.vbs
c:\Program Files\Common Files\usuk.scr
کد:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\XPProtectionCenter
HKEY_LOCAL_MACHINE\SOFTWARE\XPProtectionCenter
HKEY_CURRENT_USER\Control Panel\don't load "scui.cpl"
HKEY_CURRENT_USER\Control Panel\don't load "wscui.cpl"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "XP Protection

[Borna66]

VirusTrigger

کد:
c:\Program Files\VirusTriggerBin
c:\Program Files\VirusTriggerBin\uninst.exe
c:\Program Files\VirusTriggerBin\VirusTriggerBin.exe
c:\Program Files\VirusTriggerBin\VirusTriggerBinWarning.dll
c:\Program Files\WebMediaViewer
c:\Program Files\WebMediaViewer\browseu.exe
c:\Program Files\WebMediaViewer\browseul.dll
c:\Program Files\WebMediaViewer\hpmom.exe
c:\Program Files\WebMediaViewer\hpmon.exe
c:\Program Files\WebMediaViewer\hpmun.dll
c:\Program Files\WebMediaViewer\hpmun.exe
c:\Program Files\WebMediaViewer\myd.ico
c:\Program Files\WebMediaViewer\mym.ico
c:\Program Files\WebMediaViewer\myp.ico
c:\Program Files\WebMediaViewer\myv.ico
c:\Program Files\WebMediaViewer\ot.ico
c:\Program Files\WebMediaViewer\qttask.exe
c:\Program Files\WebMediaViewer\qttaskm.exe
c:\Program Files\WebMediaViewer\qttasku.exe
c:\Program Files\WebMediaViewer\ts.ico
c:\WINDOWS\system32\512686
c:\WINDOWS\system32\512686\512686.dll
c:\WINDOWS\system32\algg.exe
c:\WINDOWS\system32\gowqug.dll
c:\Documents and Settings\All Users\Desktop\Antivirus Scan.url
c:\Documents and Settings\All Users\Desktop\Online Antispyware Test.url
c:\Documents and Settings\All Users\Start Menu\Antivirus Scan.url
c:\Documents and Settings\All Users\Start Menu\Online Antispyware Test.url
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusTrigger 2.1.lnk
%UserProfile%\Desktop\VirusTrigger 2.1.lnk
%UserProfile%\Favorites\Antivirus Scan.url
%UserProfile%\My Documents\My Documents.url
%UserProfile%\My Documents\My Music\My Music.url
%UserProfile%\My Documents\My Pictures\My Pictures.url
%UserProfile%\My Documents\My Videos
%UserProfile%\My Documents\My Videos\My Video.url
%UserProfile%\Start Menu\VirusTrigger 2.1.lnk
%UserProfile%\Start Menu\Programs\VirusTrigger 2.1
%UserProfile%\Start Menu\Programs\VirusTrigger 2.1\VirusTrigger 2.1.lnk
c:\Program Files\Mozilla Firefox\searchplugins\search.xml
کد:
HKEY_CURRENT_USER\Software\VirusTriggerBin
HKEY_CURRENT_USER\Software\WebMediaViewer
HKEY_CLASSES_ROOT\CLSID\{096CBA44-4A4C-49f7-8903-1E75550ABCB7}
HKEY_CLASSES_ROOT\CLSID\{1f3dd9bf-1472-4a8b-b295-b596a597149b}
HKEY_CLASSES_ROOT\CLSID\{2EEF94DF-75F6-42E9-B7FB-AF5A170A6E2E}
HKEY_CLASSES_ROOT\CLSID\{51B15F5A-E98B-4658-B9CB-9307B74773A7}
HKEY_CLASSES_ROOT\CLSID\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}
HKEY_CLASSES_ROOT\CLSID\{EE8A3F7B-E4AB-5C41-4926-3FAED82759F5}
HKEY_CLASSES_ROOT\Interface\{967A494A-6AEC-4555-9CAF-FA6EB00ACF91}
HKEY_CLASSES_ROOT\Interface\{9692BE2F-EB8F-49D9-A11C-C24C1EF734D5}
HKEY_CLASSES_ROOT\Interface\{F7D09218-46D7-4D3D-9B7F-315204CD0836}
HKEY_CLASSES_ROOT\TypeLib\{A8954909-1F0F-41A5-A7FA-3B376D69E226}
HKEY_CLASSES_ROOT\TypeLib\{E63648F7-3933-440E-B4F6-A8584DD7B7EB}
HKEY_CLASSES_ROOT\VirusTriggerBinWarning.WarningBH O
HKEY_CLASSES_ROOT\VirusTriggerBinWarning.WarningBH O.1
HKEY_CLASSES_ROOT\webmedia.chl
HKEY_CLASSES_ROOT\z444.z444mgr
HKEY_CLASSES_ROOT\z444.z444mgr.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3B8FB116-D358-48A3-A5C7-DB84F15CBB04}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{096CBA44-4A4C-49f7-8903-1E75550ABCB7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{51B15F5A-E98B-4658-B9CB-9307B74773A7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\Browser Toolbar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\IExplorer add-on
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\Online Alert Manager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\System Alert Popup
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\VirusTriggerBin
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run "VirusTriggerBin"
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run "wblogon"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\App Paths\VirusTriggerBin "(Default)"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\SharedTaskScheduler "{1f3dd9bf-1472-4a8b-b295-b596a597149b}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\policies\explorer\run "QuickTime Task"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\policies\explorer\run "VMware hptray"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser "ITBar7Layout

[Borna66]

Ultra Antivirus 2009

کد:
c:\Program Files\UltraAV
c:\Program Files\UltraAV\UltraAV.cpl
c:\Program Files\UltraAV\UltraAV.exe
c:\Program Files\UltraAV\UltraAV.ooo
c:\Program Files\UltraAV\UltraAV0.dat
c:\Program Files\UltraAV\UltraAV1.dat
c:\Program Files\UltraAV\Uninstall.exe
c:\Documents and Settings\Bleeping\Desktop\Ultra Antivirus 2009.lnk
کد:
HKEY_CLASSES_ROOT\.key
HKEY_CURRENT_USER\Software\UltraAV
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\UltraAV
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run "ANTIVIRUS"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "ANTIVIRUS"

[Borna66]

Antivirus Pro 2009

کد:
c:\Program Files\AntivirusPro2009
c:\Program Files\AntivirusPro2009\AntivirusPro2009.cfg
c:\Program Files\AntivirusPro2009\AntivirusPro2009.exe
c:\Program Files\AntivirusPro2009\AVEngn.dll
c:\Program Files\AntivirusPro2009\htmlayout.dll
c:\Program Files\AntivirusPro2009\pthreadVC2.dll
c:\Program Files\AntivirusPro2009\Uninstall.exe
c:\Program Files\AntivirusPro2009\wscui.cpl
c:\Program Files\AntivirusPro2009\data
c:\Program Files\AntivirusPro2009\data\daily.cvd
c:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT
c:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\Microsof t.VC80.CRT.manifest
c:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\msvcm80. dll
c:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\msvcp80. dll
c:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\msvcr80. dll
c:\Documents and Settings\Bleeping\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusPro2009.lnk
c:\Documents and Settings\Bleeping\Desktop\AntivirusPro2009.lnk
c:\Documents and Settings\Bleeping\Start Menu\Programs\AntivirusPro2009
c:\Documents and Settings\Bleeping\Start Menu\Programs\AntivirusPro2009\AntivirusPro2009.ln k
c:\Documents and Settings\Bleeping\Start Menu\Programs\AntivirusPro2009\Uninstall.lnk
c:\WINDOWS\dyxad.bat
c:\WINDOWS\gutysolyk.dll
c:\WINDOWS\oheva._dl
c:\WINDOWS\uhuleko.bat
c:\WINDOWS\ulysi.bin
c:\WINDOWS\votadiboz.sys
c:\WINDOWS\xocorepen.lib
c:\WINDOWS\system32\_scui.cpl
c:\WINDOWS\system32\mehydohahe.scr
c:\WINDOWS\system32\owah.bat
c:\WINDOWS\system32\uquhoti.reg
c:\WINDOWS\system32\zuxeme._dl
c:\Program Files\Common Files\buryleto.dll
c:\Documents and Settings\All Users\Application Data\cyqi.sys
c:\Documents and Settings\All Users\Application Data\gemegiqyno.ban
c:\Documents and Settings\All Users\Application Data\pisijupag.dll
c:\Documents and Settings\All Users\Application Data\pymom.lib
c:\Documents and Settings\All Users\Application Data\wivodexy.reg
c:\Documents and Settings\All Users\Application Data\yzotuxeka.vbs
c:\Documents and Settings\Bleeping\Application Data\ydutufuj.inf
c:\Documents and Settings\Bleeping\Local Settings\Application Data\coziguduca._sy
c:\Documents and Settings\Bleeping\Local Settings\Application Data\fapeka._dl
c:\Documents and Settings\Bleeping\Local Settings\Application Data\gukusozy.sys
c:\Documents and Settings\Bleeping\Local Settings\Application Data\iluqopohaz.ban
کد:
HKEY_LOCAL_MACHINE\SOFTWARE\AntivirusPro2009
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\AntivirusPro2009
HKEY_CURRENT_USER\Control Panel\don't load "scui.cpl"
HKEY_CURRENT_USER\Control Panel\don't load "wscui.cpl"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "Antivirus Pro 2009

[Borna66]

Personal Defender 2009

کد:
c:\Program Files\Personal Defender 2009
c:\Program Files\Personal Defender 2009\dbbase.div
c:\Program Files\Personal Defender 2009\pdefendr.exe
%UserProfile%\Desktop\sccmsk.dll
%UserProfile%\Local Settings\Temp\ikbmqvex.exe
c:\Documents and Settings\Bleeping\Start Menu\Programs\Personal Defender 2009
c:\Documents and Settings\Bleeping\Start Menu\Personal Defender 2009.lnk
c:\Documents and Settings\Bleeping\Start Menu\Programs\Personal Defender 2009\Personal Defender 2009.lnk
کد:
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run "asus32"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PDefender
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "Personal Defender 2009"

[Borna66]

WinDefender 2009

کد:
c:\WINDOWS\k.txt
c:\Program Files\WinDefender
c:\Program Files\WinDefender\uninstall.exe
c:\Program Files\WinDefender\windef.exe
c:\Program Files\WinDefender\WinDefender.s1
c:\Program Files\WinDefender\WinDefender.s2
c:\Program Files\WinDefender\WinDefender.s3
c:\Program Files\WinDefender\WinDefender.s4
c:\Program Files\WinDefender\WinDefender.s5
c:\Program Files\WinDefender\WinDefender.s6
%UserProfile%\Desktop\WinDefender 2009.lnk
%UserProfile%\Start Menu\Programs\WinDefender 2009.lnk
کد:
HKEY_CURRENT_USER\Software\WinDefender2009
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\WinDefender 2009
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run "WinDefender2009"

[Borna66]

Real Antivirus

کد:
c:\Program Files\RealAV
c:\Program Files\RealAV\RealAV.exe
c:\Program Files\RealAV\vscan.tsi
c:\Program Files\RealAV\zlib.dll
c:\Program Files\RealAV\Infected
c:\Program Files\RealAV\Suspicious
%UserProfile%\Desktop\RealAV.lnk
%UserProfile%\Start Menu\Programs\RealAV
%UserProfile%\Start Menu\Programs\RealAV\RealAV.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\RealAV.lnk
کد:
HKEY_CURRENT_USER\Software\RealAV
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run "RealAV.exe"

_____________

_____

[Borna66]

AntiSpywareXP 2009



ک

د:
c:\Program Files\AntiSpywareXP2009
c:\Program Files\AntiSpywareXP2009\AntiSpywareXP2009.cfg
c:\Program Files\AntiSpywareXP2009\AntiSpywareXP2009.exe
c:\Program Files\AntiSpywareXP2009\AVEngn.dll
c:\Program Files\AntiSpywareXP2009\htmlayout.dll
c:\Program Files\AntiSpywareXP2009\pthreadVC2.dll
c:\Program Files\AntiSpywareXP2009\Uninstall.exe
c:\Program Files\AntiSpywareXP2009\wscui.cpl
c:\Program Files\AntiSpywareXP2009\data
c:\Program Files\AntiSpywareXP2009\data\daily.cvd
c:\Program Files\AntiSpywareXP2009\Microsoft.VC80.CRT
c:\Program Files\AntiSpywareXP2009\Microsoft.VC80.CRT\Microso ft.VC80.CRT.manifest
c:\Program Files\AntiSpywareXP2009\Microsoft.VC80.CRT\msvcm80 .dll
c:\Program Files\AntiSpywareXP2009\Microsoft.VC80.CRT\msvcp80 .dll
c:\Program Files\AntiSpywareXP2009\Microsoft.VC80.CRT\msvcr80 .dll
c:\Program Files\Common Files\esylol.pif
c:\Program Files\Common Files\xycyq.lib
c:\Program Files\Common Files\ymasum.vbs
c:\Program Files\Common Files\yxeg.dl
c:\WINDOWS\orezytoni.lib
c:\WINDOWS\orybug.sys
c:\WINDOWS\uxuwel.bat
c:\WINDOWS\system32\_scui.cpl
c:\WINDOWS\system32\eqakok.bat
c:\WINDOWS\system32\icumodypah._dl
c:\WINDOWS\system32\ygawufyx._sy
c:\Documents and Settings\All Users\Application Data\ixob.inf
c:\Documents and Settings\All Users\Application Data\ojubytu.pif
c:\Documents and Settings\All Users\Application Data\otycybyw._sy
c:\Documents and Settings\All Users\Documents\ogaqanyrim.ban
c:\Documents and Settings\All Users\Documents\pafyrunyt.scr
%UserProfile%\Application Data\afosaqim.ban
%UserProfile%\Application Data\cuzaryve.db
%UserProfile%\Application Data\emisom.dat
%UserProfile%\Application Data\ubir.bat
%UserProfile%\Application Data\ubofih.scr
%UserProfile%\Application Data\uhadi.bat
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiSpywareXP2009.lnk
%UserProfile%\Cookies\dutyfal._dl
%UserProfile%\Desktop\AntiSpywareXP2009.lnk
%UserProfile%\Local Settings\Application Data\otux.inf
%UserProfile%\Local Settings\Application Data\qefufa.bat
%UserProfile%\Start Menu\Programs\AntiSpywareXP2009
%UserProfile%\Start Menu\Programs\AntiSpywareXP2009\AntiSpywareXP2009. lnk
%UserProfile%\Start Menu\Programs\AntiSpywareXP2009\Uninstall.lnk
کد:
HKEY_LOCAL_MACHINE\SOFTWARE\AntiSpywareXP2009
HKEY_CURRENT_USER\Control Panel\don't load "scui.cpl"
HKEY_CURRENT_USER\Control Panel\don't load "wscui.cpl"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run "AntiSpywareXP 2009"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\AntiSpywareXP2009