Technical Information
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.exe
- svchost.exe
- [<HKCU>\Software\Microsoft\MSNMessenger]
- [<HKLM>\Software\Wow6432Node\Westwood\Nox]
- [<HKLM>\SOFTWARE\Wow6432Node\Nero\Installation\Families\Nero 8\Info]
- [<HKLM>\Software\Wow6432Node\Nero\Installation\Families\Nero 7\Info]
- [<HKLM>\SOFTWARE\Wow6432Node\Ahead\Nero - Burning Rom\Info]
- [<HKLM>\SOFTWARE\Wow6432Node\Electronic Arts\Medal of Honor Airborne]
- [<HKCU>\Software\JSG\Matrix Saver V2]
- [<HKLM>\SOFTWARE\Wow6432Node\Macromedia\Dreamweaver\7\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\Macromedia\Fireworks\7\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\Macromedia\Flash\7\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\NuMega\SmartCheck]
- [<HKCU>\Software\3d0\Status Legends of Might and Magic]
- [<HKCU>\Software\JoWooD\InstalledGames\IG2]
- [<HKLM>\SOFTWARE\Wow6432Node\Ahead\InCD]
- [<HKLM>\Software\Wow6432Node\IGI 2 Retail\CDKey]
- [<HKLM>\Software\Wow6432Node\Illusion Softworks\Hidden & Dangerous 2]
- [<HKCU>\Software\Valve\Half-Life\Settings]
- [<HKLM>\SOFTWARE\Wow6432Node\Headlight\GetRight]
- [<HKLM>\Software\Wow6432Node\THQ\Frontlines: Fuel of War]
- [<HKLM>\Software\Wow6432Node\THQ\Frontlines: Fuel of War Beta]
- [<HKLM>\SOFTWARE\Wow6432Node\Electronic Arts\EA Sports\FIFA 07\ergc]
- [<HKLM>\Software\Wow6432Node\AVConverter\iPod Converter]
- [<HKLM>\Software\Wow6432Node\OnlineTVPlayer\RegInfo]
- [<HKLM>\SOFTWARE\Wow6432Node\O&O\O&O Defrag\8.0\Pro\licenses]
- [<HKLM>\SOFTWARE\Wow6432Node\PowerQuest\PartitionMagic\8.0\UserInfo]
- [<HKLM>\SOFTWARE\Wow6432Node\TuneUp\Utilities\6.0]
- [<HKLM>\SOFTWARE\Wow6432Node\Pegasys Inc.\TMPGEnc DVD Author\1.0]
- [<HKLM>\SOFTWARE\Wow6432Node\Electronic Arts\Sims\The Sims 3\ergc]
- [<HKLM>\SOFTWARE\Wow6432Node\Electronic Arts\EA Games\The Sims 2 Glamour Life Stuff\ergc]
- [<HKLM>\SOFTWARE\Wow6432Node\Electronic Arts\EA Games\The Sims 2 Open For Business\ergc]
- [<HKLM>\SOFTWARE\Wow6432Node\Electronic Arts\EA Games\The Sims 2 Nightlife\ergc]
- [<HKLM>\SOFTWARE\Wow6432Node\Electronic Arts\EA Games\The Sims 2 University\ergc]
- [<HKLM>\SOFTWARE\Wow6432Node\TexasCalc\License]
- [<HKLM>\Software\Wow6432Node\TechSmith\SnagIt\8]
- [<HKLM>\SOFTWARE\Wow6432Node\THQ\Gas Powered Games\Supreme Commander]
- [<HKLM>\Software\Wow6432Node\Ubisoft\Splinter Cell Pandora Tomorrow]
- [<HKLM>\Software\Wow6432Node\Steganos\SIAVPN]
- [<HKLM>\SOFTWARE\Wow6432Node\LucasArts\Star Wars Battlefront II\1.1]
- [<HKLM>\SOFTWARE\Wow6432Node\LucasArts\Star Wars Battlefront II\1.0]
- [<HKLM>\SOFTWARE\Wow6432Node\GSC Game World\STALKER-SHOC]
- [<HKCU>\Software\Ubisoft\SILENT HUNTER III\Keys]
- [<HKLM>\SOFTWARE\Wow6432Node\Atari\Sid Meier's Pirates!]
- [<HKLM>\Software\Wow6432Node\Red Storm Entertainment\RAVENSHIELD]
- [<HKLM>\Software\Wow6432Node\KONAMI\PES2008]
- [<HKLM>\Software\Wow6432Node\EnTech\PowerStrip]
- [<HKCU>\Software\Passware\Windows Key\7\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\Electronic Arts\EA Sports\FIFA 2005\ergc]
- [<HKLM>\SOFTWARE\Wow6432Node\TuneUp\Utilities\7.0]
- [<HKLM>\Software\Wow6432Node\Electronic Arts\EA Sports\FIFA 2004\ergc]
- [<HKLM>\Software\Wow6432Node\Electronic Arts\EA Sports\FIFA 2002\ergc]
- [<HKLM>\SOFTWARE\Wow6432Node\Elcom\Advanced ZIP Password Recovery\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\Elcom\Advanced PDF Password Recovery Pro\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\Elcom\Advanced PDF Password Recovery\Registration]
- [<HKLM>\SOFTWARE\Wow6432Node\Adobe\Photoshop\7.0\Registration]
- [<HKCU>\Software\Eugen Systems\ActOfWar]
- [<HKLM>\SOFTWARE\Wow6432Node\ACD Systems\PicaView]
- [<HKCU>\Software\Microsoft\Windows Live Mail]
- [<HKCU>\Identities\{91255D00-95D9-49F5-8E84-7C027F5283B7}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
- [<HKCU>\Identities\{91255D00-95D9-49F5-8E84-7C027F5283B7}\Software\Microsoft\Internet Account Manager\Accounts]
- [<HKLM>\Software\Wow6432Node\Sunflowers\Anno 1701]
- [<HKCU>\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
- [<HKCU>\Software\Paltalk]
- [<HKCU>\Software\Google\Google Talk\Accounts]
- [<HKCU>\Software\Mirabilis\ICQ\NewOwners]
- [<HKLM>\Software\Wow6432Node\Mirabilis\ICQ\NewOwners]
- [<HKCU>\Software\Yahoo\Pager]
- [<HKCU>\Software\AIM\AIMPRO]
- [<HKCU>\Software\America Online\AIM6\Passwords]
- [<HKCU>\Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users]
- [<HKCU>\Software\Microsoft\IdentityCRL]
- [<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
- [<HKLM>\Software\Wow6432Node\ashampoo\Ashampoo WinOptimizer Platinum 3]
- [<HKCU>\Software\@stake\LC5\Registration]
- [<HKLM>\Software\Wow6432Node\Activision\Call of Duty]
- [<HKLM>\SOFTWARE\Wow6432Node\CRYTEK\FARCRY2\UBI.COM]
- [<HKLM>\SOFTWARE\Wow6432Node\CRYTEK\FARCRY\UBI.COM]
- [<HKLM>\Software\Wow6432Node\F-Secure\BackWeb\iLauncher]
- [<HKCU>\Software\Sierra\CDKey]
- [<HKLM>\Software\Wow6432Node\Sierra\Empire Earth II]
- [<HKLM>\Software\Wow6432Node\DVD Audio Extractor\Settings]
- [<HKLM>\SOFTWARE\Wow6432Node\THQ\Dawn Of War]
- [<HKCU>\Software\Valve\Day of Defeat\Settings]
- [<HKLM>\SOFTWARE\Wow6432Node\CyberLink\PowerProducer\3.0\UserReg]
- [<HKLM>\SOFTWARE\Wow6432Node\Cyberlink\PowerBar]
- [<HKLM>\SOFTWARE\Wow6432Node\Cyberlink\PowerDVD]
- [<HKCU>\Software\Valve\Counter-Strike\Settings]
- [<HKLM>\SOFTWARE\Wow6432Node\THQ\Company of Heroes]
- [<HKLM>\Software\Wow6432Node\Westwood\Tiberian Sun]
- [<HKLM>\Software\Wow6432Node\Westwood\Red Alert]
- [<HKLM>\Software\Wow6432Node\Westwood\Red Alert 2]
- [<HKLM>\Software\Wow6432Node\Codec Tweak Tool]
- [<HKLM>\Software\Wow6432Node\Techland\Chrome]
- [<HKLM>\SOFTWARE\Wow6432Node\TechSmith\Camtasia Studio\4.0]
- [<HKLM>\Software\Wow6432Node\Activision\Call of Duty 4]
- [<HKLM>\Software\Wow6432Node\Activision\Call of Duty 2]
- [<HKLM>\Software\Wow6432Node\Electronic Arts\EA Sports\FIFA 2003\ergc]
- [<HKLM>\SOFTWARE\Wow6432Node\Nullsoft\Winamp]
- <LS_APPDATA>\google\chrome\user data\default\web data
- <LS_APPDATA>\google\chrome\user data\default\login data
- %APPDATA%\svchost.exe
- %TEMP%\cm5ori80.0.cs
- %TEMP%\cm5ori80.cmdline
- %TEMP%\cm5ori80.out
- %TEMP%\cscd1ce.tmp
- %TEMP%\resd1cf.tmp
- %TEMP%\cm5ori80.dll
- <Current directory>\dns.bat
- %APPDATA%\dial.dat
- %APPDATA%\chro.dat
- %APPDATA%\ffox.dat
- %APPDATA%\opra.dat
- %TEMP%\resd1cf.tmp
- %TEMP%\cscd1ce.tmp
- %TEMP%\cm5ori80.cmdline
- %TEMP%\cm5ori80.out
- %TEMP%\cm5ori80.0.cs
- %TEMP%\cm5ori80.dll
- <Current directory>\dns.bat
- %APPDATA%\dial.dat
- %APPDATA%\chro.dat
- %APPDATA%\ffox.dat
- %APPDATA%\opra.dat
- DNS ASK bl####hades.info
- '%APPDATA%\svchost.exe'
- '%APPDATA%\svchost.exe' /stext "%APPDATA%\mess.dat"
- '%APPDATA%\svchost.exe' /stext "%APPDATA%\mail.dat"
- '%APPDATA%\svchost.exe' /stext "%APPDATA%\dial.dat"
- '%APPDATA%\svchost.exe' /stext "%APPDATA%\chro.dat"
- '%APPDATA%\svchost.exe' /stext "%APPDATA%\iexp.dat"
- '%APPDATA%\svchost.exe' /stext "%APPDATA%\ptsg.dat"
- '%APPDATA%\svchost.exe' /stext "%APPDATA%\ffox.dat"
- '%APPDATA%\svchost.exe' /stext "%APPDATA%\opra.dat"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\cm5ori80.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD1CF.tmp" "%TEMP%\CSCD1CE.tmp"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\DNS.bat" "' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\cm5ori80.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD1CF.tmp" "%TEMP%\CSCD1CE.tmp"
- '%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\DNS.bat" "
- '%WINDIR%\syswow64\ipconfig.exe' /flushdnsipconfig/releaseipconfig/renew