Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FP-WIN.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPROT.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\F-STOPW.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FINDVIRU.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IAMSERV.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IBMASN.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FRW.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IAMAPP.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ECENGINE.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ESAFE.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DVP95.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DVP95_0.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\F-PROT.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\F-PROT95.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXPWATCH.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\F-AGNT95.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IBMAVSP.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LUALL.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MOOLIVE.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LOCKDOWN2000.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LOOKOUT.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVLU32.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVNT.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPFTRAY.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\N32SCANW.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICMON.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICSUPP95.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICLOAD95.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICLOADNT.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IOMON98.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\JEDI.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICSUPPNT.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IFACE.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLEANER3.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVE32.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGCTRL.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AUTODOWN.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCONSOL.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP32.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKSERV.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVNT.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_AVP32.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_AVPCC.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'TBMonEx' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANTI-TROJAN.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\APVXDWIN.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_AVPM.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ACKWIN32.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPCC.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFIAUDIT.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFINET.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BLACKICE.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFIADMIN.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLAW95CF.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLEANER.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFINET32.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLAW95.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPTC32.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPUPD.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPDOS32.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPM.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWUPD32.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BLACKD.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVSCHED32.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWIN95.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rising.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAVtimer.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\РЮёґ№¤ѕЯ.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAVmon.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAVmonD.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZONEALARM.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MAILMON.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WFINDV32.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\THGUARD.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanHunter.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EGHOST.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NMain.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSvcUI.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVFW.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logo1_.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logo_1.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVwsc.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchUI.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVsvc.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WEBSCANX.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PERSFW.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAV7.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCCWIN98.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCFWALLICON.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SAFEWEB.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCAN32.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAV7WIN.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FESCUE.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NORMIST.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NUPGRADE.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVWNT.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NISUM.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAVSCHED.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAVW.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NVC95.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAVCL.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCAN95.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VET95.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VETTRAY.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TDS2-98.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TDS2-NT.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSHWIN32.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSSTAT.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSCAN40.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSECOMR.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SERV95.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMC.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANPM.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCRSCAN.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TBSCAN.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TCA.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SPHINX.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SWEEP95.EXE] 'Debugger' = '%WINDIR%\Fonts\system\ati2evxx.exe'
- %WINDIR%\Fonts\system\ati2evxx.exe
- <SYSTEM32>\cmd.exe /c ""<Full path to virus>.bat""
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\1[1].txt
- %WINDIR%\Fonts\system\KBTMP.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\xin[1].jpg
- C:\ntldr.exe
- %WINDIR%\Fonts\system\ati2evxx.exe
- <Full path to virus>.bat
- C:\autorun.inf
- C:\ntldr.exe
- C:\autorun.inf
- %WINDIR%\Fonts\system\ati2evxx.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\1[1].txt
- %WINDIR%\Fonts\system\KBTMP.tmp
- 'm.##8.biz':80
- 'ht#1.ws':80
- m.##8.biz/xin.jpg
- ht#1.ws/ww/1.txt
- DNS ASK m.##8.biz
- DNS ASK ht#1.ws
- DNS ASK 10###.98725.com