home *** CD-ROM | disk | FTP | other *** search
/ Chip 2005 April / CHIP_CD_2005-04.iso / software / superutil_hit / files / su.exe / {app} / sugui32.dll < prev    next >
Encoding:
Extensible Markup Language  |  2005-01-03  |  620.8 KB  |  13,915 lines
  1. <?xml version="1.0" encoding="utf-8"?>
  2. <NA>
  3. <SW NAME="7FaSSt">
  4.     <DIRECTORIES>
  5.     </DIRECTORIES>
  6.     <FILES>
  7.         <FILE NAME="7search.dll" PATH="PFDir\\fs"></FILE>
  8.         <FILE NAME="FSInstall_1 Control.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
  9.     </FILES>
  10.     <COOKIES>
  11.         <COOKIE NAME="7search"></COOKIE>
  12.         <COOKIE NAME="fstrack"></COOKIE>
  13.         <COOKIE NAME="emergency24"></COOKIE>
  14.     </COOKIES>
  15.     <REGISTRY>
  16.         <KEYS>
  17.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{06dfedaa-6196-11d5-bfc8-00508b4a487d}"></REGKEY>
  18.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="7Search"></REGKEY>
  19.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{669695bc-a811-4a9d-8cdf-ba8c795f261e}"></REGKEY>
  20.         </KEYS>
  21.         <VALUES>
  22.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\1" VALUE="x"></REGVALUE>
  23.         </VALUES>
  24.     </REGISTRY>
  25. <DANGER_LEVEL>3</DANGER_LEVEL>
  26. <DESCRIPTION>7FaSSt is an IE toolbar which attaches to your browser.  It further tracks your behavior through the use of cookies, and a unique user ID is assigned to you specifically to track your browsing</DESCRIPTION>
  27. </SW>
  28. <SW NAME="PopMonster">
  29.      <DIRECTORIES>
  30.      </DIRECTORIES>
  31.      <FILES>
  32.          <FILE NAME="searchbar.dll" PATH="SysDir"></FILE>
  33.          <FILE NAME="searchbar.dll" PATH="Sys32Dir"></FILE>
  34.      </FILES>
  35.      <COOKIES>
  36.      </COOKIES>
  37.      <REGISTRY>
  38.          <KEYS>
  39.          </KEYS>
  40.          <VALUES>
  41.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{85c76fbd-6218-4379-95c1-b4f37bf6180}"></REGVALUE>
  42.          </VALUES>
  43.      </REGISTRY>
  44. <DANGER_LEVEL>1</DANGER_LEVEL>
  45. <DESCRIPTION>Homepage hijacker that changes your internet settings</DESCRIPTION>
  46. </SW>
  47. <SW NAME="Zzb">
  48.      <DIRECTORIES>
  49.      </DIRECTORIES>
  50.      <FILES>
  51.          <FILE NAME="zzb.exe" PATH="SysDir"></FILE>
  52.          <FILE NAME="zzb.exe" PATH="Sys32Dir"></FILE>
  53.      </FILES>
  54.      <COOKIES>
  55.      </COOKIES>
  56.      <REGISTRY>
  57.         <KEYS>
  58.         </KEYS>
  59.         <VALUES>
  60.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="zzb"></REGVALUE>
  61.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="zzb"></REGVALUE>
  62.         </VALUES>
  63.      </REGISTRY>
  64. <DANGER_LEVEL>1</DANGER_LEVEL>
  65. <DESCRIPTION>Stays resident in your system's memory which slows it down, known to be related to adware</DESCRIPTION>
  66. </SW>
  67. <SW NAME="DealHelper">
  68.      <DIRECTORIES>
  69.         <DIR NAME="DealHelper.com Inc" PATH="PFDir"></DIR>
  70.         <DIR NAME="TimeSync" PATH="PFDir"></DIR>
  71.      </DIRECTORIES>
  72.      <FILES>
  73.          <FILE NAME="dealhlpr.dll" PATH="SysDir"></FILE>
  74.          <FILE NAME="dealhlpr.dll" PATH="Sys32Dir"></FILE>
  75.          <FILE NAME="dealhlpr.dll" PATH="WinDir"></FILE>
  76.          <FILE NAME="dhbrwsr.exe" PATH="WinDir"></FILE>
  77.          <FILE NAME="DHUpdt.exe" PATH="WinDir"></FILE>
  78.          <FILE NAME="dhsvr.exe" PATH="WinDir"></FILE>
  79.          <FILE NAME="TimeSynchronize.exe" PATH="WinDir"></FILE>
  80.          <FILE NAME="AppsInstalled.htm" PATH="WinDir"></FILE>
  81.          <FILE NAME="msdhmd.dll" PATH="SysDir"></FILE>
  82.          <FILE NAME="msdhmd.dll" PATH="Sys32Dir"></FILE>
  83.          <FILE NAME="ZipArchive.dll" PATH="SysDir"></FILE>
  84.          <FILE NAME="ZipArchive.dll" PATH="Sys32Dir"></FILE>
  85.      </FILES>
  86.      <COOKIES>
  87.      </COOKIES>
  88.      <REGISTRY>
  89.          <KEYS>
  90.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{D848A3CA-0BFB-4DE0-BA9E-A57F0CCA1C13}"></REGKEY>
  91.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{D848A3CA-0BFB-4DE0-BA9E-A57F0CCA1C13}"></REGKEY>
  92.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\AppID" VALUE="dhbrwsr.EXE"></REGKEY>
  93.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\AppID" VALUE="{A1F53F1D-FB2D-4FE0-8EE8-7BBE69999D9F}"></REGKEY>
  94.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{5E3E1DC0-239A-4067-A4A0-88902C108E58}"></REGKEY>
  95.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{8B477303-698C-4EED-B9F6-C715842FBE33}"></REGKEY>
  96.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{D848A3CA-0BFB-4DE0-BA9E-A57F0CCA1C13}"></REGKEY>
  97.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{F00586DE-A432-4B9F-877D-E29CD87EFDD6}"></REGKEY>
  98.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes" VALUE="Dealhlpr.Band"></REGKEY>
  99.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes" VALUE="Dhbrwsr.BrowserWindows"></REGKEY>
  100.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes" VALUE="Dhbrwsr.BrowserWindows.1"></REGKEY>
  101.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes" VALUE="DHP.DHEvents"></REGKEY>
  102.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes" VALUE="DHP.DHEvents.1"></REGKEY>
  103.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes" VALUE="DHP.Popup"></REGKEY>
  104.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes" VALUE="DHP.Popup.1"></REGKEY>
  105.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\Interface" VALUE="{1DA40091-14B4-4C21-8170-A2CEEDE90B10}"></REGKEY>
  106.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\Interface" VALUE="{3AFAE37A-56A3-4850-B599-4DA9A9104B82}"></REGKEY>
  107.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\Interface" VALUE="{A2CDAFB4-EB9C-4EFC-BCFC-A7AA6745FF7E}"></REGKEY>
  108.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\Interface" VALUE="{DEBA1742-2BEC-4B78-A987-5837971193F7}"></REGKEY>
  109.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\Interface" VALUE="{F3816084-9608-485A-B63B-CAD8F931577E}"></REGKEY>
  110.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\TypeLib" VALUE="{5E19A321-635E-4BA5-8828-A5B6427CC61D}"></REGKEY>
  111.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\TypeLib" VALUE="{771262E0-8FEB-4E78-B292-B01C4071B9D1}"></REGKEY>
  112.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\TypeLib" VALUE="{B82B9ECF-40AE-46F2-B98E-B87CF17F70D0}"></REGKEY>
  113.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall" VALUE="DealHelper"></REGKEY>
  114.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall" VALUE="TimeSync"></REGKEY>
  115.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="DealHelper"></REGKEY>
  116.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="TimeSynchonization"></REGKEY>
  117.          </KEYS>
  118.          <VALUES>
  119.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{d848a3ca-0bfb-4de0-ba9e-a57f0cca1c13}"></REGVALUE>
  120.          </VALUES>
  121.      </REGISTRY>
  122.  <DANGER_LEVEL>1</DANGER_LEVEL>
  123.  <DESCRIPTION>Adware used to deliver advertisements to your PC</DESCRIPTION>
  124. </SW>
  125. <SW NAME="W32/Noala.b@MM">
  126.      <DIRECTORIES>
  127.      </DIRECTORIES>
  128.      <FILES>
  129.          <FILE NAME="wucrtupd.exe" PATH="WinDir"></FILE>
  130.          <FILE NAME="i-worm_info.txt" PATH="WinDir"></FILE>
  131.          <FILE NAME="lssice_info.txt" PATH="WinDir"></FILE>
  132.          <FILE NAME="no_a_la_LSSICE.txt" PATH="WinDir"></FILE>
  133.      </FILES>
  134.      <COOKIES>
  135.      </COOKIES>
  136.      <REGISTRY>
  137.         <KEYS>
  138.         </KEYS>
  139.         <VALUES>
  140.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="CriticalUpdate"></REGVALUE>
  141.         </VALUES>
  142.      </REGISTRY>
  143. <DANGER_LEVEL>2</DANGER_LEVEL>
  144. <DESCRIPTION>Worm that spreads via email and networks, reported to cause strange things to occur on your PC</DESCRIPTION>
  145. </SW>
  146. <SW NAME="TotalVelocity zSearch/Total Velocity">
  147.      <DIRECTORIES>
  148.      </DIRECTORIES>
  149.      <FILES>
  150.          <FILE NAME="zsearch.dll" PATH=""></FILE>
  151.         <FILE NAME="MSMGT.EXE" PATH="WinDir"></FILE>
  152.           <FILE NAME="TINYINSTALLER.EXE" PATH="WinDir"></FILE>
  153.      </FILES>
  154.      <COOKIES>
  155.      </COOKIES>
  156.      <REGISTRY>
  157.          <KEYS>
  158.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" VALUE="MSMGT"></REGKEY>
  159.          </KEYS>
  160.          <VALUES>
  161.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{5886a6dc-aaf4-45e9-979a-8e5e6dee30e7}"></REGVALUE>
  162.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="MSMGT"></REGVALUE>
  163.          </VALUES>
  164.      </REGISTRY>
  165.  <DANGER_LEVEL>1</DANGER_LEVEL>
  166.  <DESCRIPTION>Toolbar used to deliver search results to your PC and Hijacks your browser and home page settings</DESCRIPTION>
  167. </SW>
  168. <SW NAME="SearchAndBrowse">  
  169.      <DIRECTORIES>
  170.      </DIRECTORIES>
  171.      <FILES>
  172.          <FILE NAME="wst.dll" PATH="SysDir"></FILE>
  173.          <FILE NAME="wst.dll" PATH="Sys32Dir"></FILE>
  174.          <FILE NAME="wsr.dll" PATH="SysDir"></FILE>
  175.          <FILE NAME="wsr.dll" PATH="Sys32Dir"></FILE>
  176.      </FILES>
  177.      <COOKIES>
  178.      </COOKIES>
  179.      <REGISTRY>
  180.          <KEYS>
  181.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{EC788B03-A743-4274-AC9E-DB4F2A03F515}"></REGKEY>
  182.          </KEYS>
  183.          <VALUES>
  184.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{EC788B03-A743-4274-AC9E-DB4F2A03F515}"></REGVALUE>
  185.           </VALUES>
  186.      </REGISTRY>
  187. <DANGER_LEVEL>1</DANGER_LEVEL>
  188. <DESCRIPTION>Internet Explorer hijacker that provides a search box and adds favorites to IE</DESCRIPTION>
  189. </SW>
  190. <SW NAME="SCBar/ Search123">
  191.     <DIRECTORIES>
  192.         <DIR NAME="scbar" PATH="PFDir"></DIR>
  193.         <DIR NAME="winex" PATH="PFDir"></DIR>
  194.     </DIRECTORIES>
  195.     <FILES>
  196.         <FILE NAME="msietk1020.dll" PATH="WinDir"></FILE>
  197.         <FILE NAME="winex.exe" PATH="PFDir\\winex\\v2"></FILE>
  198.         <FILE NAME="scbar.exe" PATH="PFDir\\scbar\\v2"></FILE>
  199.         <FILE NAME="scbar.exe" PATH="PFDir\\scbar"></FILE>
  200.         <FILE NAME="scbar.dll" PATH="PFDir\\scbar\\v1"></FILE>
  201.         <FILE NAME="winex.dll" PATH="PFDir\\winex\\v2"></FILE>
  202.         <FILE NAME="winex.exe" PATH="PFDir\\winex"></FILE>
  203.     </FILES>
  204.     <COOKIES>
  205.     </COOKIES>
  206.     <REGISTRY>
  207.         <KEYS>
  208.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{00041A26-7033-432C-94C7-6371DE343822}"></REGKEY>
  209.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{22941A26-7033-432C-94C7-6371DE343822}"></REGKEY>
  210.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{00041A26-7033-432C-94C7-6371DE343822}"></REGKEY>
  211.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{22941A26-7033-432C-94C7-6371DE343822}"></REGKEY>
  212.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="sclib" VALUE="{00041a26-7033-432c-94c7-6371de343822}"></REGKEY>
  213.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{a096a159-4e58-45a9-8ee6-b11466851181}"></REGKEY>
  214.         </KEYS>
  215.         <VALUES>
  216.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="searchenhancement"></REGVALUE>
  217.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="windowenhancer"></REGVALUE>
  218.         </VALUES>
  219.     </REGISTRY>
  220. <DANGER_LEVEL>1</DANGER_LEVEL>
  221. <DESCRIPTION>Search and Error page hijacker that also spawns pop up advertisements</DESCRIPTION>
  222. </SW>
  223. <SW NAME="Regsvc32">  
  224.      <DIRECTORIES>
  225.      </DIRECTORIES>
  226.      <FILES>
  227.          <FILE NAME="regsvc32.exe" PATH="SysDir"></FILE>
  228.          <FILE NAME="regsvc32.exe" PATH="Sys32Dir"></FILE>
  229.      </FILES>
  230.      <COOKIES>
  231.      </COOKIES>
  232.      <REGISTRY>
  233.          <KEYS>
  234.          </KEYS>
  235.          <VALUES>
  236.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="MSRegSvc"></REGVALUE>
  237.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="regsvc32"></REGVALUE>
  238.           </VALUES>
  239.      </REGISTRY>
  240. <DANGER_LEVEL>2</DANGER_LEVEL>
  241. <DESCRIPTION>Changes your Internet Explorer settings and spawns adult advertisements</DESCRIPTION>
  242. </SW>
  243. <SW NAME="Search-Exe/ SearchExe">
  244.     <DIRECTORIES>
  245.         <DIR NAME="se" PATH="PFDir"></DIR>
  246.     </DIRECTORIES>
  247.     <FILES>
  248.         <FILE NAME="se.exe" PATH="PFDir\\se\\v2"></FILE>
  249.         <FILE NAME="se.dll" PATH="PFDir\\se\\v2"></FILE>
  250.     </FILES>
  251.     <COOKIES>
  252.     </COOKIES>
  253.     <REGISTRY>
  254.         <KEYS>
  255.         </KEYS>
  256.         <VALUES>
  257.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Search-Exe"></REGVALUE>
  258.         </VALUES>
  259.     </REGISTRY>
  260. <DANGER_LEVEL>1</DANGER_LEVEL>
  261. <DESCRIPTION>Search-Exe is a internet explorer settings hijacker</DESCRIPTION>
  262. </SW>
  263. <SW NAME="AccessPlugin">
  264.     <DIRECTORIES>
  265.         <DIR NAME="WebDialer" PATH="PFDir"></DIR>
  266.     </DIRECTORIES>
  267.     <FILES>
  268.         <FILE NAME="ngd.dll" PATH="SysDir"></FILE>
  269.         <FILE NAME="xxxvideo.exe" PATH=""></FILE>
  270.         <FILE NAME="hotporn.exe" PATH=""></FILE>
  271.         <FILE NAME="dp0.dll" PATH=""></FILE>
  272.         <FILE NAME="ngd.dll" PATH="Sys32Dir"></FILE>
  273.     </FILES>
  274.     <COOKIES>
  275.     </COOKIES>
  276.     <REGISTRY>
  277.         <KEYS>
  278.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE" VALUE="WebDialer"></REGKEY>
  279.         </KEYS>
  280.         <VALUES>
  281.         </VALUES>
  282.     </REGISTRY>
  283. <DANGER_LEVEL>2</DANGER_LEVEL>
  284. <DESCRIPTION>AccessPlugin is a dialer which can connect to phone numbers without your knowledge or permission - including 900 numbers</DESCRIPTION>
  285. </SW>
  286. <SW NAME="SearchCentrix"> 
  287.      <DIRECTORIES>
  288.      </DIRECTORIES>
  289.      <FILES>
  290.          <FILE NAME="wzhelper.dll" PATH="SysDir"></FILE>
  291.          <FILE NAME="wzhelper.dll" PATH="Sys32Dir"></FILE>
  292.         <FILE NAME="webalize.dll" PATH="SysDir"></FILE>
  293.         <FILE NAME="webalize.dll" PATH="Sys32Dir"></FILE>
  294.          <FILE NAME="somatic.dll" PATH="SysDir"></FILE>
  295.          <FILE NAME="somatic.dll" PATH="Sys32Dir"></FILE>
  296.          <FILE NAME="BarBHO.dll" PATH="SysDir"></FILE>
  297.          <FILE NAME="BarBHO.dll" PATH="Sys32Dir"></FILE>
  298.         <FILE NAME="mygeek.dll" PATH="SysDir"></FILE>
  299.         <FILE NAME="mygeek.dll" PATH="Sys32Dir"></FILE>
  300.      </FILES>
  301.      <COOKIES>
  302.      </COOKIES>
  303.      <REGISTRY>
  304.          <KEYS>
  305.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{4e7bd74f-2b8d-469e-c0fb-ef60b19da02a}"></REGKEY>
  306.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{CD2A865B-6C0F-44F9-BAA1-7CDB31E04BC8}"></REGKEY>
  307.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{CD2A865B-6C0F-44F9-BAA1-7CDB31E04BC8}"></REGKEY>
  308.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{4e7bd74f-2b8d-469e-c0fb-ef60b19da02a}"></REGKEY>
  309.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{C431BF1E-9E71-4BB6-9C4E-8496D158DB1F}"></REGKEY>
  310.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{C431BF1E-9E71-4BB6-9C4E-8496D158DB1F}"></REGKEY>
  311.         </KEYS>
  312.          <VALUES>
  313.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar\\WebBrowser" VALUE="{4E7BD74F-2B8D-469E-D9FB-FA6BAD98FA7D}"></REGVALUE>
  314.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar\\WebBrowser" VALUE="{C431BF1E-9E71-4BB6-9C4E-8496D158DB1F}"></REGVALUE>
  315.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{4E7BD74F-2B8D-469E-D7E4-F660B597BF2A}"></REGVALUE>
  316.          </VALUES>
  317.      </REGISTRY>
  318. <DANGER_LEVEL>1</DANGER_LEVEL>
  319. <DESCRIPTION>Internet Settings hijacker</DESCRIPTION>
  320. </SW>
  321. <SW NAME="ACXInstall">
  322.     <DIRECTORIES>
  323.     </DIRECTORIES>
  324.     <FILES>
  325.         <FILE NAME="acx_install.ocx" PATH="PFDir\\Downloaded Program Files"></FILE>
  326.     </FILES>
  327.     <COOKIES>
  328.         <COOKIE NAME="nocreditcard"></COOKIE>
  329.         <COOKIE NAME="ispdialer"></COOKIE>
  330.     </COOKIES>
  331.     <REGISTRY>
  332.         <KEYS>
  333.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{a4a435cf-3583-11d4-91bd-0048546a1450}"></REGKEY>
  334.         </KEYS>
  335.         <VALUES>
  336.         </VALUES>
  337.     </REGISTRY>
  338. <DANGER_LEVEL>2</DANGER_LEVEL>
  339. <DESCRIPTION>ACXInstall installs expensive dialers without user consent, almost exclusively used by porn sites to deliver these dialers</DESCRIPTION>
  340. </SW>
  341. <SW NAME="AdBreak">
  342.     <DIRECTORIES>
  343.     </DIRECTORIES>
  344.     <FILES>
  345.         <FILE NAME="SurfHelper.dll" PATH=""></FILE>
  346.         <FILE NAME="floid.dll" PATH=""></FILE>
  347.         <FILE NAME="floid.dr" PATH=""></FILE>
  348.         <FILE NAME="wbeInst$.exe" PATH=""></FILE>
  349.         <FILE NAME="cbinst$.exe" PATH=""></FILE>
  350.         <FILE NAME="kvnab$.exe" PATH=""></FILE>        
  351.         <FILE NAME="liqad$.exe" PATH=""></FILE>        
  352.         <FILE NAME="kkcomp$.exe" PATH=""></FILE>        
  353.         <FILE NAME="xadbrk_.exe" PATH=""></FILE>        
  354.         <FILE NAME="fhfmm-Uninstaller.exe" PATH=""></FILE>        
  355.         <FILE NAME="liqui-Uninstaller.exe" PATH=""></FILE>        
  356.         <FILE NAME="wbeCheck.exe" PATH="WinDir"></FILE>
  357.         <FILE NAME="exrem.ini" PATH="WinDir"></FILE>
  358.         <FILE NAME="wbeCheck.tmp" PATH="WinDir"></FILE>
  359.         <FILE NAME="wbeCheck.old" PATH="WinDir"></FILE>
  360.         <FILE NAME="hcwprn.exe" PATH="WinDir"></FILE>
  361.         <FILE NAME="settn.dll" PATH="WinDir"></FILE>
  362.         <FILE NAME="odidbu.ini" PATH="WinDir"></FILE>
  363.         <FILE NAME="plotpp.tmp" PATH="WinDir"></FILE>
  364.         <FILE NAME="ltosie.old" PATH="WinDir"></FILE>
  365.         <FILE NAME="kvnab.exe" PATH="WinDir"></FILE>
  366.         <FILE NAME="kvnab.dll" PATH="WinDir"></FILE>
  367.         <FILE NAME="kvnab.ini" PATH="WinDir"></FILE>
  368.         <FILE NAME="kvnab.tmp" PATH="WinDir"></FILE>
  369.         <FILE NAME="kvnab.old" PATH="WinDir"></FILE>
  370.         <FILE NAME="liqad.exe" PATH="WinDir"></FILE>
  371.         <FILE NAME="liqad.dll" PATH="WinDir"></FILE>
  372.         <FILE NAME="liqad.ini" PATH="WinDir"></FILE>
  373.         <FILE NAME="liqad.tmp" PATH="WinDir"></FILE>
  374.         <FILE NAME="liqad.old" PATH="WinDir"></FILE>
  375.         <FILE NAME="kkcomp.exe" PATH="WinDir"></FILE>
  376.         <FILE NAME="kkcomp.dll" PATH="WinDir"></FILE>
  377.         <FILE NAME="kkcomp.tmp" PATH="WinDir"></FILE>
  378.         <FILE NAME="kkcomp.old" PATH="WinDir"></FILE>
  379.         <FILE NAME="xadbrk.exe" PATH="WinDir"></FILE>
  380.         <FILE NAME="xadbrk.dll" PATH="WinDir"></FILE>
  381.         <FILE NAME="xabrk.dll" PATH="WinDir"></FILE>
  382.         <FILE NAME="xadbrk1.tmp" PATH="WinDir"></FILE>
  383.         <FILE NAME="xadbrk2.tmp" PATH="WinDir"></FILE>
  384.         <FILE NAME="xadbrk3.tmp" PATH="WinDir"></FILE>
  385.         <FILE NAME="fhfmm.exe" PATH="WinDir"></FILE>
  386.         <FILE NAME="fhfmm.dll" PATH="WinDir"></FILE>
  387.         <FILE NAME="fhfmm.txt" PATH="WinDir"></FILE>
  388.         <FILE NAME="fhfmm1.tmp" PATH="WinDir"></FILE>
  389.         <FILE NAME="fhfmm2.tmp" PATH="WinDir"></FILE>
  390.         <FILE NAME="fhfmm3.tmp" PATH="WinDir"></FILE>
  391.         <FILE NAME="liqui.exe" PATH="WinDir"></FILE>
  392.         <FILE NAME="liqui.dll" PATH="WinDir"></FILE>
  393.         <FILE NAME="liqui.txt" PATH="WinDir"></FILE>
  394.         <FILE NAME="liqui1.tmp" PATH="WinDir"></FILE>
  395.         <FILE NAME="liqui2.tmp" PATH="WinDir"></FILE>
  396.         <FILE NAME="liqui3.tmp" PATH="WinDir"></FILE>
  397.     </FILES>
  398.     <COOKIES>
  399.         <COOKIE NAME="larint"></COOKIE>
  400.         <COOKIE NAME="adbreak"></COOKIE>
  401.     </COOKIES>
  402.     <REGISTRY>
  403.         <KEYS>
  404.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="AdBreak"></REGKEY>
  405.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="OpenData"></REGKEY>
  406.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{00000000-D9E3-4BC6-A0BD-3D0CA4BE5271}"></REGKEY>
  407.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{00000000-D9E3-4BC6-A0BD-3D0CA4BE5271}"></REGKEY>
  408.         </KEYS>
  409.         <VALUES>
  410.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="CCB Enhancement"></REGVALUE>
  411.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce" VALUE="AdBreak"></REGVALUE>
  412.         </VALUES>
  413.     </REGISTRY>
  414. <DANGER_LEVEL>1</DANGER_LEVEL>
  415. <DESCRIPTION>AdBreak is a browser helper object that hijacks your home page, search page, and error pages</DESCRIPTION>
  416. </SW>
  417. <SW NAME="AdultChat dialer">
  418.     <DIRECTORIES>
  419.     </DIRECTORIES>
  420.     <FILES>
  421.         <FILE NAME="adult_chat.exe" PATH="WinDir"></FILE>
  422.         <FILE NAME="bzhdr[1].js" PATH=""></FILE>
  423.         <FILE NAME="myinitialsetup1.0.0.3.inf" PATH=""></FILE>
  424.         <FILE NAME="xxxdial.dun" PATH=""></FILE>
  425.         <FILE NAME="adult_chat.lnk" PATH=""></FILE>
  426.         <FILE NAME="dialer.inf" PATH=""></FILE>
  427.     </FILES>
  428.     <COOKIES>
  429.     </COOKIES>
  430.     <REGISTRY>
  431.         <KEYS>
  432.         </KEYS>
  433.         <VALUES>
  434.         </VALUES>
  435.     </REGISTRY>
  436. <DANGER_LEVEL>2</DANGER_LEVEL>
  437. <DESCRIPTION>AdultChat dialer is a dialer program that dials a very expensive number to access pornography, many times without user's knowledge</DESCRIPTION>
  438. </SW>
  439. <SW NAME="Adult-Links"> 
  440.     <DIRECTORIES>
  441.          <DIR NAME="adult links" PATH="favorites"></DIR>
  442.          <DIR NAME="adultsearch" PATH="favorites"></DIR>
  443.          <DIR NAME="adult links" PATH="favorites\\links"></DIR>
  444.          <DIR NAME="adultsearch" PATH="favorites\\links"></DIR>
  445.     </DIRECTORIES>
  446.     <FILES>
  447.         <FILE NAME="allch.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
  448.         <FILE NAME="NullCtrl Class.inf" PATH="PFDir\\Downloaded Program Files"></FILE>
  449.         <FILE NAME="Adult Links Daily.lnk" PATH=""></FILE>
  450.         <FILE NAME="qabar.dll" PATH="WinDir\\downloaded program files"></FILE>
  451.            <FILE NAME="qabar.inf" PATH="WinDir\\downloaded program files"></FILE>
  452.     </FILES>
  453.     <COOKIES>
  454.         <COOKIE NAME="mainentrypoint"></COOKIE>
  455.     </COOKIES>
  456.     <REGISTRY>
  457.         <KEYS>
  458.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Software" VALUE="QcBar"></REGKEY>
  459.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Software" VALUE="QcBar.1"></REGKEY>
  460.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Software" VALUE="Allch.IEObj"></REGKEY>
  461.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Software" VALUE="Allch.IEObj.1"></REGKEY>
  462.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="LinkZZ"></REGKEY>
  463.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Code Store Database\\Distribution Units" VALUE="{765E6B09-6832-4738-BDBE-25F226BA2AB0}"></REGKEY>
  464.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES" VALUE="QcBar"></REGKEY>
  465.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES" VALUE="QcBar.1"></REGKEY>
  466.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES" VALUE="Allch.IEObj"></REGKEY>
  467.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES" VALUE="Allch.IEObj.1"></REGKEY>
  468.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\CLSID" VALUE="{765E6B09-6832-4738-BDBE-25F226BA2AB0}"></REGKEY>
  469.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\CLSID" VALUE="{D6FC35D1-04AB-4D40-94CF-2E5AE4D0F8D2}"></REGKEY>
  470.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\Interface" VALUE="{ED7D1356-F7C2-4A27-A87C-C0DFEB3A628F}"></REGKEY>
  471.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\Interface" VALUE="{242CA913-1637-4F74-9729-EA349AF3ECAC}"></REGKEY>
  472.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\TypeLib" VALUE="{C02EE3A0-1881-419F-A5ED-737223463292}"></REGKEY>
  473.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\TypeLib" VALUE="{60381D4B-8129-449A-A5F2-5417AD0571CC}"></REGKEY> 
  474.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{765e6b09-6832-4738-bdbe-25f226ba2ab0}"></REGKEY>
  475.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="software" VALUE="qcbar"></REGKEY>
  476.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="software" VALUE="qcbar.1"></REGKEY>
  477.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{60381d4b-8129-449a-a5f2-5417ad0571cc}"></REGKEY>
  478.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{242ca913-1637-4f74-9729-ea349af3ecac}"></REGKEY>
  479.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{d6fc35d1-04ab-4d40-94cf-2e5ae4d0f8d2}"></REGKEY>
  480.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{ed7d1356-f7c2-4a27-a87c-c0dfeb3a628f}"></REGKEY>
  481.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{c02ee3a0-1881-419f-a5ed-737223463292}"></REGKEY>
  482.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="QcBar"></REGKEY>
  483.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="QcBar.1"></REGKEY>
  484.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="Allch.IEObj"></REGKEY>
  485.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="Allch.IEObj.1"></REGKEY>
  486.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{765E6B09-6832-4738-BDBE-25F226BA2AB0}"></REGKEY>
  487.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{ED7D1356-F7C2-4A27-A87C-C0DFEB3A628F}"></REGKEY>
  488.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="TypeLib" VALUE="{C02EE3A0-1881-419F-A5ED-737223463292}"></REGKEY>
  489.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{242CA913-1637-4F74-9729-EA349AF3ECAC}"></REGKEY>
  490.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="TypeLib" VALUE="{60381D4B-8129-449A-A5F2-5417AD0571CC}"></REGKEY>
  491.         </KEYS>
  492.         <VALUES>
  493.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{765E6B09-6832-4738-BDBE-25F226BA2AB0}"></REGVALUE>
  494.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="765E6B09-6832-4738-BDBE-25F226BA2AB0}"></REGVALUE>
  495.         </VALUES>
  496.     </REGISTRY>
  497. <DANGER_LEVEL>3</DANGER_LEVEL>
  498. <DESCRIPTION>Adult-Links is adware that modifies your search options, adds a browser toolbar, and monitors your browsing activity.  Almost exclusively delivers adult themed popups and annoyances</DESCRIPTION>
  499. </SW>
  500. <SW NAME="ASpam">
  501.     <DIRECTORIES>
  502.     </DIRECTORIES>
  503.     <FILES>
  504.         <FILE NAME="ASPAM.EXE" PATH=""></FILE>
  505.         <FILE NAME="drvman32.DLL" PATH="SysDir"></FILE>
  506.         <FILE NAME="AMCIS32.DLL" PATH="SysDir"></FILE>
  507.     </FILES>
  508.     <COOKIES>
  509.     </COOKIES>
  510.     <REGISTRY>
  511.         <KEYS>
  512.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes" VALUE="AMCIS32.IEClass"></REGKEY>
  513.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{657B9354-BB3B-4500-A9B0-109B4FA64815}"></REGKEY>
  514.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{657B9354-BB3B-4500-A9B0-109B4FA64815}"></REGKEY>
  515.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes" VALUE="DRVMAN32.IEClass"></REGKEY>
  516.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{499DB658-1909-420B-931A-4A8CAEFD232F}"></REGKEY>
  517.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{499DB658-1909-420B-931A-4A8CAEFD232F}"></REGKEY>
  518.         </KEYS>
  519.         <VALUES>
  520.         </VALUES>
  521.     </REGISTRY>
  522. <DANGER_LEVEL>2</DANGER_LEVEL>
  523. <DESCRIPTION>ASpam is a trojan that allows a remote attacker user level access on your machine, allowing them to delete/access anything they wish</DESCRIPTION>
  524. </SW>
  525. <SW NAME="Aureate">
  526.     <DIRECTORIES>
  527.     </DIRECTORIES>
  528.     <FILES>
  529.         <FILE NAME="advert.dll" PATH="SysDir"></FILE>
  530.         <FILE NAME="advert.dll" PATH="Sys32Dir"></FILE>
  531.         <FILE NAME="advert.dll" PATH="PFDir\\mediaring talk"></FILE>
  532.         <FILE NAME="tfde.dll" PATH="SysDir"></FILE>
  533.         <FILE NAME="tfde.dll" PATH="Sys32Dir"></FILE>
  534.         <FILE NAME="adimage.dll" PATH="Sys32Dir"></FILE>
  535.         <FILE NAME="adimage.dll" PATH="SysDir"></FILE>
  536.         <FILE NAME="amcis.dll" PATH="SysDir"></FILE>
  537.         <FILE NAME="amcis.dll" PATH="Sys32Dir"></FILE>
  538.         <FILE NAME="amcis2.dll" PATH="SysDir"></FILE>
  539.         <FILE NAME="amcis2.dll" PATH="Sys32Dir"></FILE>
  540.         <FILE NAME="amcis3.dll" PATH="SysDir"></FILE>
  541.         <FILE NAME="amcis3.dll" PATH="Sys32Dir"></FILE>
  542.         <FILE NAME="anadsc.ocx" PATH="SysDir"></FILE>
  543.         <FILE NAME="anadsc.ocx" PATH="Sys32Dir"></FILE>
  544.         <FILE NAME="anadscb.ocx" PATH="SysDir"></FILE>
  545.         <FILE NAME="anadscb.ocx" PATH="Sys32Dir"></FILE>
  546.         <FILE NAME="htmdeng.exe" PATH="SysDir"></FILE>
  547.         <FILE NAME="htmdeng.exe" PATH="Sys32Dir"></FILE>
  548.         <FILE NAME="ipcclient.dll" PATH="SysDir"></FILE>
  549.         <FILE NAME="ipcclient.dll" PATH="Sys32Dir"></FILE>
  550.         <FILE NAME="ipclient.dll" PATH="SysDir"></FILE>
  551.         <FILE NAME="ipclient.dll" PATH="Sys32Dir"></FILE>
  552.         <FILE NAME="msipcsv.exe" PATH="SysDir"></FILE>
  553.         <FILE NAME="msipcsv.exe" PATH="Sys32Dir"></FILE>
  554.          <FILE NAME="edit your profile.lnk" PATH="ProfilePath\\start menu\\programs\\radiate\\advertising"></FILE>
  555.          <FILE NAME="uninstall.lnk" PATH="ProfilePath\\start menu\\programs\\radiate\\advertising"></FILE>
  556.         <FILE NAME="free software.url" PATH="ProfilePath\\start menu\\programs\\radiate"></FILE>
  557.         <FILE NAME="privacy policy.url" PATH="ProfilePath\\start menu\\programs\\radiate"></FILE>
  558.         <FILE NAME="radiate web site.url" PATH="ProfilePath\\start menu\\programs\\radiate"></FILE>
  559.     </FILES>
  560.     <COOKIES>
  561.         <COOKIE NAME="devgames"></COOKIE>
  562.         <COOKIE NAME="aureate"></COOKIE>
  563.     </COOKIES>
  564.     <REGISTRY>
  565.         <KEYS>
  566.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{EBBFE27C-BDF0-11D2-BBE5-00609419F467}"></REGKEY>
  567.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{EBBFE27C-BDF0-11D2-BBE5-00609419F467}"></REGKEY>
  568.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{6d0bb051-a1a3-11d3-a67c-0050da2ce984}"></REGKEY>
  569.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{141c673d-4515-4482-905d-a2caa68538a1}"></REGKEY>
  570.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{6d0bb050-a1a3-11d3-a67c-0050da2ce984}"></REGKEY>
  571.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{6d0bb053-a1a3-11d3-a67c-0050da2ce984}"></REGKEY>
  572.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{8a2a68ae-9a25-444c-965b-b560105ed0a0}"></REGKEY>
  573.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{e670155f-7d8c-4bba-8cfe-24e5b5a31760}"></REGKEY>
  574.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{e976a28e-3b3d-4e18-a7d4-255a9f0e8ade}"></REGKEY>
  575.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\typelib" VALUE="{6d0bb056-a1a3-11d3-a67c-0050da2ce984}"></REGKEY>
  576.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall" VALUE="radiate advertising"></REGKEY>
  577.         </KEYS>
  578.         <VALUES>
  579.         </VALUES>
  580.     </REGISTRY>
  581. <DANGER_LEVEL>2</DANGER_LEVEL>
  582. <DESCRIPTION>Aureate is installed completely without user permission.  It causes your operating system to be unstable, delivers ads, and causes general system annoyances</DESCRIPTION>
  583. </SW>
  584. <SW NAME="BargainBuddy">
  585.     <DIRECTORIES>
  586.         <DIR NAME="Bargain Buddy" PATH="PFDir"></DIR>
  587.         <DIR NAME="adp" PATH="PFDir"></DIR>
  588.     </DIRECTORIES>
  589.     <FILES>
  590.         <FILE NAME="bargains.exe" PATH="PFDir\\bargain buddy\\bin2"></FILE>
  591.          <FILE NAME="adp.exe" PATH=""></FILE>
  592.         <FILE NAME="bargains.exe" PATH="PFDir\\bargain buddy\\bin"></FILE>
  593.         <FILE NAME="apuc.dll" PATH="PFDir\\bargain buddy\\bin"></FILE>
  594.         <FILE NAME="apuc.dll" PATH="PFDir\\bargain buddy\\bin2"></FILE>
  595.         <FILE NAME="CC_Versn.dll" PATH="PFDir\\Net2Phone CommCenter"></FILE>
  596.     </FILES>
  597.     <COOKIES>
  598.         <COOKIE NAME="Ikena"></COOKIE>
  599.         <COOKIE NAME="exactadvertising"></COOKIE>
  600.     </COOKIES>
  601.     <REGISTRY>
  602.         <KEYS>
  603.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{CE31A1F7-3D90-4874-8FBE-A5D97F8BC8F1}"></REGKEY>
  604.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="Bargains"></REGKEY>
  605.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft" VALUE="adp"></REGKEY>
  606.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{018b7ec3-eeca-11d3-8e71-0000e82c6c0d}"></REGKEY>
  607.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\code store database\\distribution units" VALUE="{018b7ec3-eeca-11d3-8e71-0000e82c6c0d}"></REGKEY>
  608.         </KEYS>
  609.         <VALUES>
  610.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="adp"></REGVALUE>
  611.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="BargainBuddy"></REGVALUE>
  612.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Bargain Buddy"></REGVALUE>
  613.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="bargains"></REGVALUE>
  614.         </VALUES>
  615.     </REGISTRY>
  616. <DANGER_LEVEL>2</DANGER_LEVEL>
  617. <DESCRIPTION>BargainBuddy delivers ads, as well as silently updates itself.  Causes general system instability as well as internet connectivity issues, as it is constantly connecting to its host PCs</DESCRIPTION>
  618. </SW>
  619. <SW NAME="Bulla">
  620.     <DIRECTORIES>
  621.     </DIRECTORIES>
  622.     <FILES>
  623.         <FILE NAME="IEPlugin.dll" PATH="SysDir"></FILE>
  624.     </FILES>
  625.     <COOKIES>
  626.     </COOKIES>
  627.     <REGISTRY>
  628.         <KEYS>
  629.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="IEPlugin"></REGKEY>
  630.         </KEYS>
  631.         <VALUES>
  632.         </VALUES>
  633.     </REGISTRY>
  634. <DANGER_LEVEL>1</DANGER_LEVEL>
  635. <DESCRIPTION>Bulla slows browsing, as it searches all pages you view and replaces advertisements with advertisements sponsored by Bulla</DESCRIPTION>
  636. </SW>
  637. <SW NAME="BuddyLinks/BuddyPicture/TalkStocks">
  638.      <DIRECTORIES>
  639.         <DIR NAME="Cache" PATH="PFDir\\Common Files\\PSD Tools"></DIR>
  640.       </DIRECTORIES>
  641.      <FILES>
  642.       <FILE NAME="atrwzpca.dll" PATH=""></FILE>
  643.       <FILE NAME="qpmytsxh.dll" PATH=""></FILE>
  644.          <FILE NAME="blengine.exe" PATH="PFDir\\Common Files\\PSD Tools"></FILE>
  645.          <FILE NAME="ShellInstaller.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
  646.          <FILE NAME="ShellInstallerRaptor.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
  647.          <FILE NAME="blengine.dll" PATH="PFDir\\Common Files\\PSD Tools"></FILE>
  648.          <FILE NAME="blaim.dll" PATH="PFDir\\Common Files\\PSD Tools"></FILE>
  649.          <FILE NAME="bldll.dll" PATH="PFDir\\Common Files\\PSD Tools"></FILE>
  650.          <FILE NAME="ChannelUp.exe" PATH="PFDir\\Common Files\\PSD Tools"></FILE>
  651.         <FILE NAME="blpref.exe" PATH="PFDir\\buddylinks.net"></FILE>
  652.         <FILE NAME="uninst.exe" PATH="PFDir\\buddylinks.net"></FILE>
  653.          <FILE NAME="av.exe" PATH="WinDir"></FILE>
  654.          <FILE NAME="b.exe" PATH="WinDir"></FILE>
  655.      </FILES>
  656.      <COOKIES>
  657.      </COOKIES>
  658.      <REGISTRY>
  659.          <KEYS>
  660.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall" VALUE="buddylinks.net"></REGKEY>
  661.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="buddylinks.net"></REGKEY>
  662.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="PSD Tools"></REGKEY>
  663.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{FDDCE9FE-1FC6-413C-80B1-37B101FDA1D4}"></REGKEY>
  664.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{FDDCE9FF-1FC6-413C-80B1-37B101FDA1D4}"></REGKEY>
  665.          </KEYS>
  666.          <VALUES>
  667.              <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="BLMessagingIntegration"></REGVALUE>
  668.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="antivirus"></REGVALUE>
  669.          </VALUES>
  670.      </REGISTRY>
  671.  <DANGER_LEVEL>1</DANGER_LEVEL>
  672.  <DESCRIPTION>BuddyLinks is an aol profile hijacker</DESCRIPTION>
  673. </SW>
  674. <SW NAME="CashToolbar/ App/Bpinst-A">
  675.     <DIRECTORIES>
  676.         <DIR NAME="CashToolbar" PATH="PFDir"></DIR>
  677.     </DIRECTORIES>
  678.     <FILES>
  679.         <FILE NAME="CashToolbarIE.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
  680.         <FILE NAME="CashToolbar.exe" PATH="WinDir\\Downloaded Program Files"></FILE>
  681.         <FILE NAME="CashToolbarConfig.ini" PATH="WinDir\\Downloaded Program Files"></FILE>
  682.     </FILES>
  683.     <COOKIES>
  684.     </COOKIES>
  685.     <REGISTRY>
  686.         <KEYS>
  687.         </KEYS>
  688.         <VALUES>
  689.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="CashToolbar"></REGVALUE>
  690.         </VALUES>
  691.     </REGISTRY>
  692. <DANGER_LEVEL>2</DANGER_LEVEL>
  693. <DESCRIPTION>CashToolbar delivers advertisements to the PC without permission, and adds a toolbar to your browser. It also silent updates itself with a running process in the background of the infected PC</DESCRIPTION>
  694. </SW>
  695. <SW NAME="ClickTheButton">
  696.     <DIRECTORIES>
  697.          <DIR NAME="CTB3_Shared" PATH="WinDir"></DIR>
  698.     </DIRECTORIES>
  699.     <FILES>
  700.         <FILE NAME="ctbclick.exe" PATH=""></FILE>
  701.         <FILE NAME="CTB.exe" PATH=""></FILE>
  702.         <FILE NAME="CTBHooks.dll" PATH="WinDir"></FILE>
  703.         <FILE NAME="CTBHooks.dll" PATH="SysDir"></FILE>
  704.         <FILE NAME="CTBHooks.dll" PATH="Sys32Dir"></FILE>
  705.     </FILES>
  706.     <COOKIES>
  707.     </COOKIES>
  708.     <REGISTRY>
  709.         <KEYS>
  710.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE" VALUE="CTB_BrandedClient"></REGKEY>
  711.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE" VALUE="CtbClient"></REGKEY>
  712.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE" VALUE="CtbSession"></REGKEY>
  713.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE" VALUE="CtbShopper"></REGKEY>
  714.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE" VALUE="CtbXML"></REGKEY>
  715.         </KEYS>
  716.         <VALUES>
  717.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="ClickTheButton"></REGVALUE>
  718.         </VALUES>
  719.     </REGISTRY>
  720.     <DANGER_LEVEL>1</DANGER_LEVEL>
  721.     <DESCRIPTION>ClickTheButton will detect if you visit a known shopping site, and instead provide links to other sites connected to Clickthebutton</DESCRIPTION>
  722. </SW>
  723. <SW NAME="CnsMin">
  724.     <DIRECTORIES>
  725.     </DIRECTORIES>
  726.     <FILES>
  727.         <FILE NAME="Bdhelper.dll" PATH="SysDir"></FILE>
  728.         <FILE NAME="Bdhelper.dll" PATH="Sys32Dir"></FILE>
  729.         <FILE NAME="CnsMin.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
  730.         <FILE NAME="CnsDel.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
  731.          <FILE NAME="Assist.dll" PATH="PFDir\\3721\\assist"></FILE>
  732.     </FILES>
  733.     <COOKIES>
  734.         <COOKIE NAME="3721"></COOKIE>
  735.     </COOKIES>
  736.     <REGISTRY>
  737.         <KEYS>
  738.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="3721"></REGKEY>
  739.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\CLSID" VALUE="{B83FC273-3522-4CC6-92EC-75CC86678DA4}"></REGKEY>
  740.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\CLSID" VALUE="{D157330A-9EF3-49F8-9A67-4141AC41ADD4}"></REGKEY>
  741.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES" VALUE="CnsHelper.CH"></REGKEY>
  742.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES" VALUE="CnsHelper.CH.1"></REGKEY>
  743.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES" VALUE="CnsMinHK.CnsHook"></REGKEY>
  744.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES" VALUE="CnsMinHK.CnsHook.1"></REGKEY>
  745.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="3721"></REGKEY>
  746.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="InterChina"></REGKEY>
  747.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Internet Explorer\\AdvancedOptions" VALUE="!CNS"></REGKEY>
  748.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Internet Explorer\\Extensions" VALUE="{5D73EE86-05F1-49ed-B850-E423120EC338}"></REGKEY>
  749.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Internet Explorer\\Extensions" VALUE="{ECF2E268-F28C-48d2-9AB7-8F69C11CCB71}"></REGKEY>
  750.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Internet Explorer\\Extensions" VALUE="{FD00D911-7529-4084-9946-A29F1BDF4FE5}"></REGKEY>
  751.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall" VALUE="CnsMin"></REGKEY>
  752.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{ca92b524-bc8a-4610-bd2c-6bd3e28155d0}"></REGKEY>
  753.               <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{B83FC273-3522-4CC6-92EC-75CC86678DA4}"></REGKEY>
  754.               <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{D157330A-9EF3-49F8-9A67-4141AC41ADD4}"></REGKEY>
  755.               <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="CnsHelper.CH"></REGKEY>
  756.               <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="CnsHelper.CH.1"></REGKEY>
  757.               <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="CnsMinHK.CnsHook"></REGKEY>
  758.               <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="CnsMinHK.CnsHook.1"></REGKEY>
  759.         </KEYS>
  760.         <VALUES>
  761.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall" VALUE="CnsMin"></REGVALUE>
  762.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="CnsMin"></REGVALUE>
  763.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{1b0e7716-898e-48cc-9690-4e338e8de1d3}"></REGVALUE>
  764.         </VALUES>
  765.     </REGISTRY>
  766. <DANGER_LEVEL>1</DANGER_LEVEL>
  767. <DESCRIPTION>CnsMin is aimed at stealing sponsored keyword listings, but is also focused on Chinese speakers using Chinese characters, which makes it that much more annoying to non Chinese speaking users</DESCRIPTION>
  768. </SW>
  769. <SW NAME="CometCursor">
  770.     <DIRECTORIES>
  771.         <DIR NAME="Comet" PATH="PFDir"></DIR>
  772.         <DIR NAME="Comet Systems" PATH="PFDir"></DIR>
  773.     </DIRECTORIES>
  774.     <FILES>
  775.         <FILE NAME="CometCursor.dll" PATH=""></FILE>
  776.         <FILE NAME="CommetCursor.exe" PATH=""></FILE>
  777.          <FILE NAME="Commet.dll" PATH="SysDir"></FILE>
  778.         <FILE NAME="Brbho.dll" PATH="PFDir\\comet\\install\\temp"></FILE>
  779.         <FILE NAME="Csbho.dll" PATH="SysDir\\comet\\bin"></FILE>
  780.          <FILE NAME="comet.dll" PATH="SysDir"></FILE>
  781.          <FILE NAME="comet.dll" PATH="Sys32Dir"></FILE>
  782.     </FILES>
  783.     <COOKIES>
  784.         <COOKIE NAME="cometcursor"></COOKIE>
  785.         <COOKIE NAME="cometsystems"></COOKIE>
  786.     </COOKIES>
  787.     <REGISTRY>
  788.         <KEYS>
  789.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{1678F7E1-C422-11D0-AD7D-00400515CAAA}"></REGKEY>        
  790.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{96DA5BEE-4ACC-476C-B3EC-54C6730C4293}"></REGKEY>
  791.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{D14D6793-9B65-11D3-80B6-00500487BDBA}"></REGKEY>
  792.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{FE6BC4EF-5676-484B-88AE-883323913256}"></REGKEY>            
  793.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{1678F7E1-C422-11D0-AD7D-00400515CAAA}"></REGKEY>
  794.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{96DA5BEE-4ACC-476C-B3EC-54C6730C4293}"></REGKEY>
  795.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{D14D6793-9B65-11D3-80B6-00500487BDBA}"></REGKEY>            
  796.         </KEYS>
  797.         <VALUES>
  798.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="CommetCursor"></REGVALUE>            
  799.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="DM_server"></REGVALUE>
  800.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="CC2KUI"></REGVALUE>
  801.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{FE6BC4EF-5676-484B-88AE-883323913256}"></REGVALUE>
  802.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar\\WebBrowser" VALUE="{FE6BC4EF-5676-484B-88AE-883323913256}"></REGVALUE>
  803.  
  804.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="CometCursor"></REGVALUE>
  805.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Comet Cursor"></REGVALUE>
  806.         </VALUES>
  807.     </REGISTRY>
  808.     <DANGER_LEVEL>1</DANGER_LEVEL>
  809.     <DESCRIPTION>CometCursor changes mouse pointers to different ones depending on the website.  It is known to track viewing habits as well</DESCRIPTION>
  810. </SW>
  811. <SW NAME="CommonName">
  812.     <DIRECTORIES>
  813.         <DIR NAME="CommonName" PATH="PFDir"></DIR>
  814.     </DIRECTORIES>
  815.     <FILES>
  816.         <FILE NAME="HTMLedit.dll" PATH="SysDir"></FILE>
  817.         <FILE NAME="HTMLedit.dll" PATH="Sys32Dir"></FILE>
  818.         <FILE NAME="CnbarIE.dll" PATH="SysDir"></FILE>
  819.         <FILE NAME="CnbarIE.dll" PATH="Sys32Dir"></FILE>
  820.         <FILE NAME="CnbarIE.dll" PATH="PFDir\\commonname\\toolbar"></FILE>
  821.         <FILE NAME="winnet.exe" PATH="PFDir\\commonname\\addressbar"></FILE>
  822.         <FILE NAME="winnet.exe" PATH="PFDir\\commonname\\toolbar"></FILE>
  823.         <FILE NAME="comwiz.exe" PATH="PFDir\\commonname\\addressbar"></FILE>
  824.         <FILE NAME="CNBabe.dll" PATH="PFDir\\CommonName\\Toolbar"></FILE>
  825.         <FILE NAME="CNMib.dll" PATH="PFDir\\CommonName\\Mib"></FILE>
  826.     </FILES>
  827.     <COOKIES>
  828.         <COOKIE NAME="commonname"></COOKIE>
  829.     </COOKIES>
  830.     <REGISTRY>
  831.         <KEYS>
  832.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{1e1b2879-88ff-11d2-8d96-d7acac95951f}"></REGKEY>
  833.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{00000000-0000-0000-0000-000000000000}"></REGKEY>
  834.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="CommonName"></REGKEY>
  835.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Internet Explorer\\MenuExt" VALUE="Add A Page Note"></REGKEY>
  836.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Internet Explorer\\MenuExt" VALUE="Bookmark This Page"></REGKEY>
  837.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Internet Explorer\\MenuExt" VALUE="Email This Link"></REGKEY>
  838.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Internet Explorer\\MenuExt" VALUE="Search using CommonName"></REGKEY>
  839.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES" VALUE="BabeIE.Helper"></REGKEY>
  840.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES" VALUE="BabeIE.Helper.1"></REGKEY>
  841.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES" VALUE="BabeIE.AgentIE"></REGKEY>
  842.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES" VALUE="BabeIE.AgentIE.1"></REGKEY>
  843.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES" VALUE="BabeIE.Handler"></REGKEY>
  844.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES" VALUE="BabeIE.Handler.1"></REGKEY>
  845.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\CLSID" VALUE="{00000000-0000-0000-0000-000000000000}"></REGKEY>
  846.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\CLSID" VALUE="{6656b666-992f-4d74-8588-8ca69e97d90c}"></REGKEY>
  847.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\CLSID" VALUE="{9346A6BB-1ED0-4174-AFB4-13CD4EC0AA40}"></REGKEY>
  848.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\TypeLib" VALUE="{D879D743-E2CC-4161-8034-2234203681C9}"></REGKEY>
  849.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{dd0032df-ceef-4e0a-8b75-e4d8861e11e5}"></REGKEY> 
  850.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Protocols\\Handler" VALUE="cn"></REGKEY>
  851.         </KEYS>
  852.         <VALUES>
  853.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="winnet"></REGVALUE>
  854.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Zenet"></REGVALUE>
  855.         </VALUES>
  856.     </REGISTRY>
  857. <DANGER_LEVEL>3</DANGER_LEVEL>
  858. <DESCRIPTION>CommonName displays sponsored results when the infected user attempts to search the web</DESCRIPTION>
  859. </SW>
  860. <SW NAME="Cydoor">
  861.     <DIRECTORIES>
  862.         <DIR NAME="Adcache" PATH="SysDir"></DIR>
  863.         <DIR NAME="Roodyc" PATH="SysDir"></DIR>
  864.         <DIR NAME="adcache" PATH="Sys32Dir"></DIR>
  865.         <DIR NAME="roodyc" PATH="Sys32Dir"></DIR>
  866.     </DIRECTORIES>
  867.     <FILES>
  868.         <FILE NAME="cd_clint.dll" PATH="ProfilePath\\local settings\\temp"></FILE>
  869.         <FILE NAME="cd_clint.dll" PATH="SysDir"></FILE>
  870.         <FILE NAME="cd_clint.dll" PATH="Sys32Dir\\adcache\\temp"></FILE>
  871.         <FILE NAME="cd_gif.dll" PATH="SysDir"></FILE>
  872.         <FILE NAME="cd_swf.dll" PATH="SysDir"></FILE>
  873.         <FILE NAME="cd_swf.dll" PATH="Sys32Dir"></FILE> 
  874.         <FILE NAME="cd_install_202.exe" PATH="PFDir\\imesh\\client"></FILE> 
  875.         <FILE NAME="cd_clint.dll" PATH="Sys32Dir"></FILE> 
  876.         <FILE NAME="cd_htm.dll" PATH="SysDir"></FILE> 
  877.         <FILE NAME="cd_htm.dll" PATH="Sys32Dir"></FILE> 
  878.         <FILE NAME="cd_load.exe" PATH="SysDir"></FILE> 
  879.         <FILE NAME="cd_load.exe" PATH="Sys32Dir"></FILE>
  880.         <FILE NAME="cd_html.dll" PATH="SysDir"></FILE>
  881.     </FILES>
  882.     <COOKIES>
  883.         <COOKIE NAME="cydoor"></COOKIE>
  884.     </COOKIES>
  885.     <REGISTRY>
  886.         <KEYS>
  887.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="Cydoor"></REGKEY>
  888.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="Cydoor"></REGKEY>
  889.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="Cydoor Services"></REGKEY>
  890.         </KEYS>
  891.         <VALUES>
  892.             <REGVALUE MAIN="Hkey_local_machine" SUB="Software\\Microsoft\\Windows\\Current Version\\Run" VALUE="Cydoor"></REGVALUE>
  893.             <REGVALUE MAIN="Hkey_local_machine" SUB="Software\\Microsoft\\Windows\\Current Version\\Shareddlls" VALUE="Cydoor"></REGVALUE>
  894.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\runonce" VALUE="cydoorupdate"></REGVALUE>
  895.         </VALUES>
  896.     </REGISTRY>
  897.     <DANGER_LEVEL>2</DANGER_LEVEL>
  898.     <DESCRIPTION>Cydoor hijacks search settings as well as keyword searches, They are also known to deliver popup advertising</DESCRIPTION>
  899. </SW>
  900. <SW NAME="Cytron/ Troj/Ortyc ">
  901.     <DIRECTORIES>
  902.     </DIRECTORIES>
  903.     <FILES>
  904.         <FILE NAME="potd.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
  905.         <FILE NAME="sec.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
  906.     </FILES>
  907.     <COOKIES>
  908.         <COOKIE NAME="surprisecards"></COOKIE>
  909.         <COOKIE NAME="cardwish"></COOKIE>
  910.         <COOKIE NAME="cytron"></COOKIE>
  911.     </COOKIES>
  912.     <REGISTRY>
  913.         <KEYS>
  914.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="POTD"></REGKEY>
  915.         </KEYS>
  916.         <VALUES>
  917.         </VALUES>
  918.     </REGISTRY>
  919.     <DANGER_LEVEL>1</DANGER_LEVEL>
  920.     <DESCRIPTION>Cytron displays popup advertisements when particular keywords are searched for</DESCRIPTION>
  921. </SW>
  922. <SW NAME="Download Accelerator Plus">
  923.     <DIRECTORIES>
  924.         <DIR NAME="download accelerator" PATH="PFDir"></DIR>
  925.         <DIR NAME="dap" PATH="PFDir"></DIR>
  926.         <DIR NAME="download accelerator" PATH="PFDir\\Common Files"></DIR>
  927.     </DIRECTORIES>
  928.     <FILES>
  929.         <FILE NAME="dap.exe" PATH="PFDir\\dap"></FILE>
  930.         <FILE NAME="dapupd.exe" PATH="PFDir\\dap"></FILE>
  931.         <FILE NAME="ezupdate.exe" PATH="PFDir\\dap"></FILE>
  932.         <FILE NAME="unwise.exe" PATH="PFDir\\dap"></FILE>
  933.         <FILE NAME="cabex.dll" PATH="PFDir\\dap"></FILE>
  934.         <FILE NAME="dapbho.dll" PATH="PFDir\\dap"></FILE>
  935.         <FILE NAME="dapie.dll" PATH="PFDir\\dap"></FILE>
  936.         <FILE NAME="dapiebar.dll" PATH="PFDir\\dap"></FILE>
  937.         <FILE NAME="mfc42.dll" PATH="PFDir\\dap"></FILE>
  938.         <FILE NAME="msvcrt.dll" PATH="PFDir\\dap"></FILE>    
  939.         <FILE NAME="redregistration.dll" PATH="PFDir\\dap"></FILE>    
  940.         <FILE NAME="zlib.dll" PATH="PFDir\\dap"></FILE>
  941.           <FILE NAME="dap.gif" PATH="PFDir\\dap"></FILE>    
  942.           <FILE NAME="dapextie.htm" PATH="PFDir\\dap"></FILE>    
  943.           <FILE NAME="dapextie2.htm" PATH="PFDir\\dap"></FILE>    
  944.           <FILE NAME="dapns.dll" PATH="PFDir\\dap"></FILE>    
  945.           <FILE NAME="dapop.dll" PATH="PFDir\\dap"></FILE>    
  946.           <FILE NAME="website.url" PATH="PFDir\\dap"></FILE>    
  947.           <FILE NAME="dap.uis" PATH="PFDir\\dap"></FILE>
  948.         <FILE NAME="dap update.lnk" PATH=""></FILE>
  949.         <FILE NAME="uninstall dap.lnk" PATH=""></FILE>
  950.         <FILE NAME="download accelerator.lnk" PATH=""></FILE>
  951.         <FILE NAME="download accelerator plus.lnk" PATH=""></FILE>
  952.         <FILE NAME="wbocx.ocx" PATH="WinDir\\system32"></FILE>
  953.     </FILES>
  954.     <COOKIES>
  955.         <COOKIE NAME="dap"></COOKIE>
  956.     </COOKIES>
  957.     <REGISTRY>
  958.         <KEYS>
  959.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\always" VALUE="search.yahoo.com"></REGKEY>
  960.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\clsid" VALUE="{f852086b-10e6-4743-9a3f-d8257a0a59e3}"></REGKEY>
  961.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\always" VALUE="windowsupdate.microsoft.com"></REGKEY>
  962.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\always" VALUE="winupdate.www.conxion.com"></REGKEY>
  963.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\interface" VALUE="{03d365cb-878a-4495-9350-7c67743335d9}"></REGKEY>
  964.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\always" VALUE="www.buydirect.com"></REGKEY>
  965.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\interface" VALUE="{5252ac41-94bb-11d1-b2e7-444553540000}"></REGKEY>
  966.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\always" VALUE="www.download.windowsupdate.com"></REGKEY>
  967.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\interface" VALUE="{5b985d95-d4ee-44e5-ae57-b88659b9dee4}"></REGKEY>
  968.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\always" VALUE="lycos.com"></REGKEY>
  969.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\interface" VALUE="{5bfa1dae-5edc-11d2-959e-00c00c02da5e}"></REGKEY>
  970.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\software\\speedbit\\download accelerator\\notrigger\\always" VALUE="www.shop.com"></REGKEY>
  971.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\interface" VALUE="{7892ba33-7984-43a5-a8f5-27ed0afe6143}"></REGKEY>
  972.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\interface" VALUE="{82351440-9094-11d1-a24b-00a0c932c7df}"></REGKEY>
  973.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes" VALUE="{0000cc75-acf3-4cac-a0a9-dd3868e06852}"></REGKEY>
  974.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\interface" VALUE="{68145e9-7785-4bb4-a20a-16e8a425972c}"></REGKEY>
  975.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{0096cc0a-623c-4829-ad9c-19af0dc9d8fe}"></REGKEY>
  976.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\protocols\\name-space handler\\ftp\\zda" VALUE="pattern1"></REGKEY>
  977.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\protocols\\name-space handler\\http\\zda" VALUE="pattern1"></REGKEY>
  978.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\protocols\\name-space handler\\https\\zda" VALUE="pattern1"></REGKEY>
  979.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\typelib" VALUE="{095006d5-6da6-4cdc-864e-7498015816bc}"></REGKEY>
  980.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{235d7a27-de65-49f0-bfcf-d5c3bc3b2e67}"></REGKEY>
  981.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{62999427-33fc-4baf-9c9c-bce6bd127f08}"></REGKEY>
  982.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="dapiebar.cbareventer"></REGKEY>
  983.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="dapiebar.cbareventer.1"></REGKEY>
  984.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="dapiebar.dapiebarband"></REGKEY>
  985.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="dapiebar.dapiebarband.1"></REGKEY>
  986.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{095006d5-6da6-4cdc-864e-7498015816bc}"></REGKEY>
  987.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{72920511-e300-44c1-8565-2fd66d7a7246}"></REGKEY>
  988.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{79516451-3e3e-453a-8968-37942f7979f3}"></REGKEY>
  989.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\typelib" VALUE="{5bfa1da1-5edc-11d2-959e-00c00c02da5e}"></REGKEY>
  990.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\typelib" VALUE="{5fe38345-35a8-11d3-bd27-000021c9a4d9}"></REGKEY>
  991.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\typelib" VALUE="{79516451-3e3e-453a-8968-37942f7979f3}"></REGKEY>
  992.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\typelib" VALUE="{82351433-9094-11d1-a24b-00a0c932c7df}"></REGKEY>
  993.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\anigifctrl.anigif" VALUE="insertable"></REGKEY>
  994.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\clsid" VALUE="{0000cc75-acf3-4cac-a0a9-dd3868e06852}"></REGKEY>
  995.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\clsid" VALUE="{235d7a27-de65-49f0-bfcf-d5c3bc3b2e67}"></REGKEY>
  996.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\clsid" VALUE="{5bfa1daf-5edc-11d2-959e-00c00c02da5e}"></REGKEY>
  997.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\clsid" VALUE="{61ab12e1-a5ff-11d1-b2e9-444553540000}"></REGKEY>
  998.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\clsid" VALUE="{62999427-33fc-4baf-9c9c-bce6bd127f08}"></REGKEY>
  999.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\clsid" VALUE="{6dc82d15-92f2-11d1-a255-00a0c932c7df}"></REGKEY>
  1000.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\clsid" VALUE="{8110aea1-ad5b-4b90-883f-04a9a33b106e}"></REGKEY>
  1001.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\clsid" VALUE="{82351441-9094-11d1-a24b-00a0c932c7df}"></REGKEY>
  1002.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\clsid" VALUE="{9738b9e6-8afa-11d2-959e-444553540002}"></REGKEY>
  1003.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\microsoft\\internet explorer\\extensions" VALUE="{669695bc-a811-4a9d-8cdf-ba8c795f261c}"></REGKEY>
  1004.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{0000cc75-acf3-4cac-a0a9-dd3868e06852}"></REGKEY>
  1005.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="speedbit"></REGKEY>
  1006.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit" VALUE="speedbit"></REGKEY>
  1007.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\always" VALUE="127.0.0.1"></REGKEY>
  1008.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\always" VALUE="data.alexa.com"></REGKEY>
  1009.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\leech\\custom" VALUE="extention list"></REGKEY>
  1010.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\download accelerator\\notrigger\\always" VALUE="download.macromedia.com"></REGKEY>
  1011.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\download accelerator\\notrigger\\always" VALUE="downloadfinder2.intel.com"></REGKEY>
  1012.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\download accelerator\\notrigger\\always" VALUE="guide.walla.co.il"></REGKEY>
  1013.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\download accelerator\\notrigger\\always" VALUE="rd.yahoo.com"></REGKEY>
  1014.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\download accelerator\\notrigger\\always" VALUE="search.lycos.com"></REGKEY>
  1015.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="allowupdate"></REGKEY>
  1016.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="barintegrated"></REGKEY>
  1017.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="browserintegration"></REGKEY>
  1018.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="details"></REGKEY>
  1019.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="download directory"></REGKEY>
  1020.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="dragurlwindow"></REGKEY>
  1021.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="dragurlwindowx"></REGKEY>
  1022.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="dragurlwindowy"></REGKEY>
  1023.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="exelocation"></REGKEY>
  1024.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="extensions"></REGKEY>
  1025.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="ftpsearchautofind"></REGKEY>
  1026.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="ftpsearchautoselect"></REGKEY>
  1027.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="helperintegrated"></REGKEY>
  1028.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="installage"></REGKEY>
  1029.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="installcompany"></REGKEY>
  1030.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="installemail"></REGKEY>
  1031.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="installgender"></REGKEY>
  1032.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="installinterests"></REGKEY>
  1033.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="installprof"></REGKEY>
  1034.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="installuser"></REGKEY>
  1035.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="lastnotifyversion"></REGKEY>
  1036.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="lastskin"></REGKEY>
  1037.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="lll"></REGKEY>
  1038.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="newversionchecking"></REGKEY>
  1039.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="lrv"></REGKEY>
  1040.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="noinfowindow"></REGKEY>
  1041.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="regularacceleratewindow"></REGKEY>
  1042.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="removefromlistwhenok"></REGKEY>
  1043.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="sessiontime"></REGKEY>
  1044.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="tempdirectory"></REGKEY>            
  1045.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator" VALUE="version"></REGKEY>
  1046.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\ads" VALUE="defaultcategory"></REGKEY>
  1047.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\ads" VALUE="nomaiod"></REGKEY>
  1048.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\ads\\default" VALUE="categoryid"></REGKEY>
  1049.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\ads\\default" VALUE="media"></REGKEY>
  1050.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger" VALUE="lasturl"></REGKEY>
  1051.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\whenfound" VALUE="151.99.197.24"></REGKEY>
  1052.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\whenfound" VALUE="32bit.bhs.com"></REGKEY>
  1053.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\whenfound" VALUE="3dfiles.com"></REGKEY>
  1054.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\whenfound" VALUE="chkpt.zdnet.com"></REGKEY>
  1055.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\whenfound" VALUE="download.lycos.com"></REGKEY>
  1056.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\whenfound" VALUE="ftpsearch.lycos.com"></REGKEY>
  1057.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\whenfound" VALUE="home.cnet.com"></REGKEY>
  1058.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\whenfound" VALUE="hotfiles.zdnet.com"></REGKEY>
  1059.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\whenfound" VALUE="music.lycos.com"></REGKEY>
  1060.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\whenfound" VALUE="public.wsj.com"></REGKEY>
  1061.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\whenfound" VALUE="volftp.tin.it"></REGKEY>
  1062.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\whenfound" VALUE="www.3dfiles.com"></REGKEY>
  1063.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\whenfound" VALUE="www.chip.de"></REGKEY>
  1064.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\whenfound" VALUE="www.download.com"></REGKEY>
  1065.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\whenfound" VALUE="www.fileplanet.com"></REGKEY>
  1066.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\whenfound" VALUE="www.google.com"></REGKEY>
  1067.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\whenfound" VALUE="www.rocketdownload.com"></REGKEY>
  1068.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\whenfound" VALUE="www.winzip.com"></REGKEY>
  1069.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\whenfound" VALUE="www.wsj.com"></REGKEY>
  1070.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\whennotfound" VALUE="volftp.tiscalinet.it"></REGKEY>
  1071.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\speedbit\\download accelerator\\notrigger\\whennotfound" VALUE="www.juston.com"></REGKEY>
  1072.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\.dal" VALUE="content type"></REGKEY>
  1073.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\.daf" VALUE="content type"></REGKEY>
  1074.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\daffile" VALUE="editflags"></REGKEY>
  1075.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\dalfile" VALUE="editflags"></REGKEY>
  1076.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\classes\\protocols\\name-space handler\\ftp\\zda" VALUE="clsid"></REGKEY>
  1077.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\protocols\\name-space handler\\http\\zda" VALUE="clsid"></REGKEY>
  1078.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\microsoft\\windows\\currentversion\\uninstall\\download accelerator plus beta" VALUE="displayname"></REGKEY>
  1079.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\microsoft\\windows\\currentversion\\uninstall\\download accelerator plus beta" VALUE="uninstallstring"></REGKEY>
  1080.         </KEYS>
  1081.         <VALUES>
  1082.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="DownloadAccelerator"></REGVALUE>
  1083.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="systimer"></REGVALUE>
  1084.         </VALUES>
  1085.     </REGISTRY>
  1086.     <DANGER_LEVEL>1</DANGER_LEVEL>
  1087.     <DESCRIPTION>Download Accelerator Plus is believed to track your downloads and report information collected to a central server</DESCRIPTION>
  1088. </SW>
  1089. <SW NAME="DownloadReceiver">
  1090.     <DIRECTORIES>
  1091.         <DIR NAME="eAcceleration" PATH="PFDir\\Common Files"></DIR>
  1092.     </DIRECTORIES>
  1093.     <FILES>
  1094.         <FILE NAME="systimer.exe" PATH="PFDir\\Common Files"></FILE>
  1095.         <FILE NAME="eac_drec.dll" PATH="PFDir\\Common Files"></FILE>
  1096.         <FILE NAME="download.exe" PATH="PFDir\\Common Files"></FILE>
  1097.         <FILE NAME="eac_drec.dll" PATH="PFDir\\Common Files\\eAcceleration"></FILE>
  1098.     </FILES>
  1099.     <COOKIES>
  1100.         <COOKIE NAME="buttonware"></COOKIE>
  1101.         <COOKIE NAME="eacceleration"></COOKIE>
  1102.     </COOKIES>
  1103.     <REGISTRY>
  1104.         <KEYS>
  1105.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{8869786c-8e72-45dc-911d-ab3416ac1df1}"></REGKEY>
  1106.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="Acceleration Software International Corporation"></REGKEY>
  1107.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="Acceleration Software International Corporation"></REGKEY>
  1108.         </KEYS>
  1109.         <VALUES>
  1110.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="systimer.exe"></REGVALUE>
  1111.         </VALUES>
  1112.     </REGISTRY>
  1113.     <DANGER_LEVEL>3</DANGER_LEVEL>
  1114.     <DESCRIPTION>DownloadReceiver will install components without user permission.  It also adds an advertising process at startup, which runs in the background of the PC</DESCRIPTION>
  1115. </SW>
  1116. <SW NAME="DownloadWare">
  1117.     <DIRECTORIES>
  1118.         <DIR NAME="PAgent" PATH="PFDir"></DIR>
  1119.         <DIR NAME="KFH" PATH="PFDir"></DIR>
  1120.         <DIR NAME="MediaLoads" PATH="PFDir"></DIR>
  1121.         <DIR NAME="MedCh" PATH="PFDir"></DIR>
  1122.         <DIR NAME="MovieNetworks" PATH="PFDir"></DIR>
  1123.         <DIR NAME="Popcorn.net" PATH="PFDir"></DIR>
  1124.         <DIR NAME="Real-Tens" PATH="PFDir"></DIR>
  1125.         <DIR NAME="DownloadWare" PATH="PFDir"></DIR>
  1126.     </DIRECTORIES>
  1127.     <FILES>
  1128.         <FILE NAME="PAgent.exe" PATH=""></FILE>
  1129.         <FILE NAME="bearshare.exe" PATH=""></FILE>
  1130.         <FILE NAME="grokster.exe" PATH=""></FILE>
  1131.         <FILE NAME="limewire.exe" PATH=""></FILE>
  1132.         <FILE NAME="morpheus.exe" PATH=""></FILE>
  1133.         <FILE NAME="MediaLoads.exe" PATH=""></FILE>
  1134.         <FILE NAME="ClipGenie.exe" PATH=""></FILE>
  1135.         <FILE NAME="ins.tmp" PATH=""></FILE>
  1136.         <FILE NAME="dw.exe" PATH="PFDir\\downloadware"></FILE>
  1137.     </FILES>
  1138.     <COOKIES>
  1139.         <COOKIE NAME="downloadware"></COOKIE>
  1140.         <COOKIE NAME="grokster"></COOKIE>
  1141.     </COOKIES>
  1142.     <REGISTRY>
  1143.         <KEYS>
  1144.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="PAgent"></REGKEY>
  1145.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="DownloadWare"></REGKEY>
  1146.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="MediaLoads"></REGKEY>
  1147.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="mlh"></REGKEY>
  1148.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="MicroGaming"></REGKEY>
  1149.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="KFH"></REGKEY>
  1150.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{0494d0da-f8e0-41ad-92a3-14154ece70ac}"></REGKEY>
  1151.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{0494d0dc-f8e0-41ad-92a3-14154ece70ac}"></REGKEY>
  1152.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="MediaLoads"></REGKEY>
  1153.         </KEYS>
  1154.         <VALUES>
  1155.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="PAgent"></REGVALUE> 
  1156.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="PAgent"></REGVALUE>
  1157.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="ins.tmp"></REGVALUE>
  1158.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="dw"></REGVALUE>
  1159.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="MediaLoads Installer"></REGVALUE>
  1160.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="DownloadWare"></REGVALUE>
  1161.         </VALUES>
  1162.     </REGISTRY>
  1163.     <DANGER_LEVEL>4</DANGER_LEVEL>
  1164.     <DESCRIPTION>DownloadWare will cause general system instability, and install software that allows Downloadware to excecute arbitrary code on the PC</DESCRIPTION>
  1165. </SW>
  1166. <SW NAME="FavoriteMan/Emesx.dll/SpyAssault">
  1167.     <DIRECTORIES>
  1168.     </DIRECTORIES>
  1169.     <FILES>
  1170.         <FILE NAME="favboot.dll" PATH="Sys32Dir"></FILE>
  1171.         <FILE NAME="favman.dll" PATH="Sys32Dir"></FILE>
  1172.         <FILE NAME="favorite.dll" PATH="Sys32Dir"></FILE>
  1173.         <FILE NAME="fone.dll" PATH="Sys32Dir"></FILE>
  1174.         <FILE NAME="im64.dll" PATH="Sys32Dir"></FILE>
  1175.         <FILE NAME="lwz.dll" PATH="Sys32Dir"></FILE>
  1176.         <FILE NAME="Aess.dll" PATH="SysDir"></FILE>
  1177.         <FILE NAME="Aess.dll" PATH="Sys32Dir"></FILE>
  1178.         <FILE NAME="ZZ.dll" PATH="SysDir"></FILE>
  1179.         <FILE NAME="ZZ.dll" PATH="Sys32Dir"></FILE>
  1180.         <FILE NAME="mpz300.dll" PATH="SysDir"></FILE>
  1181.         <FILE NAME="mpz300.dll" PATH="Sys32Dir"></FILE>
  1182.         <FILE NAME="trk.dll" PATH="SysDir"></FILE>
  1183.         <FILE NAME="trk.dll" PATH="Sys32Dir"></FILE>
  1184.         <FILE NAME="ofrg.dll" PATH="SysDir"></FILE>
  1185.         <FILE NAME="ofrg.dll" PATH="Sys32Dir"></FILE>
  1186.         <FILE NAME="favboot.dll" PATH="SysDir"></FILE>
  1187.         <FILE NAME="favorite.dll" PATH="SysDir"></FILE>
  1188.         <FILE NAME="FavMan.dll" PATH="SysDir"></FILE>
  1189.         <FILE NAME="lwz.dll" PATH="SysDir"></FILE>
  1190.         <FILE NAME="f1.dll" PATH="SysDir"></FILE>
  1191.         <FILE NAME="FOne.dll" PATH="SysDir"></FILE>
  1192.         <FILE NAME="gr02.dll" PATH="Sys32Dir"></FILE>
  1193.         <FILE NAME="emesx.dll" PATH="SysDir"></FILE>
  1194.         <FILE NAME="emesx.dll" PATH="Sys32Dir"></FILE>
  1195.         <FILE NAME="sysldr.dll" PATH="Sys32Dir"></FILE>
  1196.         <FILE NAME="mbr32.dll" PATH="Sys32Dir"></FILE>
  1197.         <FILE NAME="F1.dll" PATH="Sys32Dir"></FILE>
  1198.         <FILE NAME="im64.dll" PATH="SysDir"></FILE>
  1199.         <FILE NAME="dlh0st.dll" PATH="SysDir"></FILE>
  1200.         <FILE NAME="DDM3DIA.DLL" PATH="SysDir"></FILE>
  1201.         <FILE NAME="DDM3DIA.DLL" PATH="Sys32Dir"></FILE>
  1202.          <FILE NAME="td1.dll" PATH="SysDir"></FILE>
  1203.          <FILE NAME="td1.dll" PATH="Sys32Dir"></FILE>
  1204.         <FILE NAME="w3th3rb.dll" PATH=""></FILE>
  1205.         <FILE NAME="Ss32.dll" PATH="SysDir"></FILE>
  1206.         <FILE NAME="Ss32.dll" PATH="Sys32Dir"></FILE>
  1207.         <FILE NAME="gig.dll" PATH="Sys32Dir"></FILE>
  1208.     </FILES>
  1209.     <COOKIES>
  1210.     </COOKIES>
  1211.     <REGISTRY>
  1212.         <KEYS>
  1213.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows" VALUE="Counter"></REGKEY>
  1214.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows" VALUE="Server"></REGKEY>
  1215.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows" VALUE="Object"></REGKEY>
  1216.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{000000da-0786-4633-87c6-1aa7a4429ef1}"></REGKEY>
  1217.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{000000f1-34e3-4633-87c6-1aa7a44296da}"></REGKEY>
  1218.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{00000ef1-34e3-4633-87c6-1aa7a44296da}"></REGKEY>
  1219.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{139d88e5-c372-469d-b4c5-1fe00852ab9b}"></REGKEY>
  1220.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{ebbd88e5-c372-469d-b4c5-1fe00352ab9b}"></REGKEY>
  1221.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{00000ef1-0786-4633-87c6-1aa7a44296da}"></REGKEY>
  1222.         </KEYS>
  1223.         <VALUES>
  1224.             <REGVALUE MAIN="" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="msbb.exe"></REGVALUE>
  1225.         </VALUES>
  1226.     </REGISTRY>
  1227.     <DANGER_LEVEL>3</DANGER_LEVEL>
  1228.     <DESCRIPTION>FavoriteMan will install programs without user permission, as well as add entries to browser favorites menu and add desktop icons</DESCRIPTION>
  1229. </SW>
  1230. <SW NAME="FlashTrack">
  1231.     <DIRECTORIES>
  1232.         <DIR NAME="ftapp" PATH="PFDir"></DIR>
  1233.         <DIR NAME="flt" PATH="PFDir"></DIR>
  1234.     </DIRECTORIES>
  1235.     <FILES>
  1236.         <FILE NAME="ftapp.dll" PATH="PFDir\\ftapp"></FILE>
  1237.         <FILE NAME="flt.dll" PATH="PFDir\\flt"></FILE>
  1238.         <FILE NAME="flt.mon" PATH="PFDir\\flt"></FILE>
  1239.           <FILE NAME="ftapp.dll" PATH="SysDir"></FILE>
  1240.         <FILE NAME="ftapp.dll" PATH="Sys32Dir"></FILE>
  1241.         <FILE NAME="flt.dll" PATH="SysDir"></FILE>
  1242.         <FILE NAME="flt.dll" PATH="Sys32Dir"></FILE>    
  1243.     </FILES>
  1244.     <COOKIES>
  1245.     </COOKIES>
  1246.     <REGISTRY>
  1247.         <KEYS>
  1248.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="FTApp"></REGKEY>
  1249.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{665ACD90-4541-4836-9FE4-062386BB8F05}"></REGKEY>
  1250.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="flt"></REGKEY>
  1251.         </KEYS>
  1252.         <VALUES>
  1253.         </VALUES>
  1254.     </REGISTRY>
  1255.     <DANGER_LEVEL>2</DANGER_LEVEL>
  1256.     <DESCRIPTION>FlashTrack will monitor browsing activity as well as record kewyords that are searched for</DESCRIPTION>
  1257. </SW>
  1258. <SW NAME="Gator/Claria/IEGator/PDPPlugin">
  1259.     <DIRECTORIES>
  1260.             <DIR NAME="gator" PATH="PFDir"></DIR>
  1261.               <DIR NAME="date manager" PATH="PFDir"></DIR>
  1262.             <DIR NAME="fsg_tmp" PATH="ProfilePath\\local settings\\temp"></DIR>
  1263.             <DIR NAME="fsg_tmp" PATH="WinDir\\temp"></DIR>
  1264.             <DIR NAME="GMT" PATH="PFDir\\common files"></DIR>
  1265.             <DIR NAME="GMT" PATH="PFDir"></DIR>
  1266.             <DIR NAME="CMEII" PATH="PFDir\\common files"></DIR>
  1267.             <DIR NAME="gator.com" PATH="PFDir"></DIR>
  1268.             <DIR NAME="gui" PATH="PFDir"></DIR>
  1269.             <DIR NAME="store" PATH="PFDir"></DIR>
  1270.             <DIR NAME="WebPT" PATH="PFDir"></DIR>
  1271.               <DIR NAME="WebDM" PATH="PFDir"></DIR>
  1272.             <DIR NAME="PrecisionTime" PATH="PFDir"></DIR>
  1273.             <DIR NAME="GAIN" PATH="PFDir"></DIR>
  1274.             <DIR NAME="gator ewallet" PATH="PFDir"></DIR>
  1275.     </DIRECTORIES>
  1276.       <FILES>
  1277.         <FILE NAME="Fsg.exe" PATH="SysDir"></FILE>
  1278.         <FILE NAME="Fsg.exe" PATH="Sys32Dir"></FILE>
  1279.         <FILE NAME="Fsg_3202.exe" PATH="SysDir"></FILE>
  1280.         <FILE NAME="Fsg_3202.exe" PATH="Sys32Dir"></FILE>
  1281.         <FILE NAME="Trickler.exe" PATH="SysDir"></FILE>
  1282.         <FILE NAME="Trickler.exe" PATH="Sys32Dir"></FILE>
  1283.         <FILE NAME="PdpPlg Class" PATH="WinDir\\Downloaded Program Files"></FILE>
  1284.         <FILE NAME="PdpPi Class" PATH="WinDir\\Downloaded Program Files"></FILE>
  1285.         <FILE NAME="DFRun Class" PATH="WinDir\\Downloaded Program Files"></FILE>
  1286.         <FILE NAME="gmt.exe" PATH="PFDir\\common files\\GMT"></FILE>
  1287.          <FILE NAME="gator.exe" PATH="PFDir\\gator.com\\gator"></FILE>
  1288.          <FILE NAME="PrecisionTime.exe" PATH="PFDir\\PrecisionTime"></FILE>
  1289.          <FILE NAME="gmtproxy.dll" PATH="PFDir\\common files\\cmeii"></FILE>
  1290.          <FILE NAME="gatorstubsetup.exe" PATH="PFDir\\common files\\GMT"></FILE>
  1291.         <FILE NAME="cmeiiapi.dll" PATH=""></FILE>
  1292.         <FILE NAME="cmesys.exe" PATH=""></FILE>
  1293.         <FILE NAME="gappmgr.dll" PATH=""></FILE>
  1294.         <FILE NAME="gatorsupportinfo.txt" PATH=""></FILE>
  1295.         <FILE NAME="gcontroller.dll" PATH=""></FILE>
  1296.         <FILE NAME="gdwldeng.dll" PATH=""></FILE>
  1297.         <FILE NAME="giocl.dll" PATH=""></FILE>
  1298.         <FILE NAME="gioclclient.dll" PATH=""></FILE>
  1299.         <FILE NAME="gmtproxy.dll" PATH=""></FILE>
  1300.         <FILE NAME="gobjs.dll" PATH=""></FILE>
  1301.         <FILE NAME="gstore.dll" PATH=""></FILE>
  1302.         <FILE NAME="gstoreserver.dll" PATH=""></FILE>
  1303.         <FILE NAME="gtools.dll" PATH=""></FILE>
  1304.         <FILE NAME="PrecisionTime.exe" PATH=""></FILE>
  1305.         <FILE NAME="unwise.exe" PATH="PFDir\\PrecisionTime"></FILE>
  1306.         <FILE NAME="GStartup.lnk" PATH=""></FILE>
  1307.         <FILE NAME="PrecisionTime.lnk" PATH=""></FILE>
  1308.     </FILES>
  1309.     <COOKIES>
  1310.     </COOKIES>
  1311.     <REGISTRY>
  1312.         <KEYS>
  1313.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{21FFB6C0-0DA1-11D5-A9D5-00500413153C}"></REGKEY>
  1314.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="Gator.com"></REGKEY>
  1315.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="Gator"></REGKEY>
  1316.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="GatorTest"></REGKEY>
  1317.         </KEYS>
  1318.         <VALUES>
  1319.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="GMT"></REGVALUE>
  1320.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Trickler"></REGVALUE>
  1321.         </VALUES>
  1322.     </REGISTRY>
  1323.     <DANGER_LEVEL>2</DANGER_LEVEL>
  1324.     <DESCRIPTION>Gator is adware which will deliver popup ads to the PC and has been reported to slow down system performance</DESCRIPTION>
  1325. </SW>
  1326.  <SW NAME="SecondThought"> 
  1327.      <DIRECTORIES>
  1328.          <DIR NAME="stc" PATH="PFDir"></DIR>
  1329.      </DIRECTORIES>
  1330.      <FILES>
  1331.          <FILE NAME="stcloader.exe" PATH="SysDir"></FILE>
  1332.          <FILE NAME="2ndsrch.dll" PATH="SysDir"></FILE>
  1333.          <FILE NAME="2ndsrch.dll" PATH="Sys32Dir"></FILE>
  1334.          <FILE NAME="stc.exe" PATH="PFDir\\stc"></FILE>
  1335.          <FILE NAME="stcloader.exe" PATH="Sys32Dir"></FILE>
  1336.      </FILES>
  1337.      <COOKIES>
  1338.      </COOKIES>
  1339.      <REGISTRY>
  1340.          <KEYS>
  1341.               <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{13197ace-6851-45c3-a7ff-c281324d5489}"></REGKEY>
  1342.         </KEYS>
  1343.          <VALUES>
  1344.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="stcloader"></REGVALUE>
  1345.          </VALUES>
  1346.      </REGISTRY>
  1347.      <DANGER_LEVEL>1</DANGER_LEVEL>
  1348.     <DESCRIPTION>Adware used to deliver advertisements to your PC</DESCRIPTION>
  1349. </SW>
  1350. <SW NAME="IEfeatures">
  1351.     <DIRECTORIES>
  1352.     </DIRECTORIES>
  1353.     <FILES>
  1354.         <FILE NAME="internetfeatures.exe" PATH="Sys32Dir"></FILE>
  1355.         <FILE NAME="iefeatures.exe" PATH="Sys32Dir"></FILE>    
  1356.     </FILES>
  1357.     <COOKIES>
  1358.     </COOKIES>
  1359.     <REGISTRY>
  1360.         <KEYS>
  1361.         </KEYS>
  1362.         <VALUES>
  1363.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="msversion"></REGVALUE>
  1364.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="iefeatures"></REGVALUE>
  1365.         </VALUES>
  1366.     </REGISTRY>
  1367.     <DANGER_LEVEL>1</DANGER_LEVEL>
  1368.     <DESCRIPTION>Used to install other pieces of adware/spyware on your PC</DESCRIPTION>
  1369. </SW>
  1370. <SW NAME="Gratisware">
  1371.     <DIRECTORIES>
  1372.         <DIR NAME="Gratisware" PATH="PFDir"></DIR>
  1373.     </DIRECTORIES>
  1374.     <FILES>
  1375.         <FILE NAME="CRS32.dll" PATH="Sys32Dir"></FILE>
  1376.         <FILE NAME="CRS.EXE" PATH="Sys32Dir"></FILE>
  1377.         <FILE NAME="CRS32.REG" PATH="Sys32Dir"></FILE>
  1378.         <FILE NAME="CRS.OLD" PATH="Sys32Dir"></FILE>
  1379.         <FILE NAME="next.dl_" PATH="Sys32Dir"></FILE>
  1380.     </FILES>
  1381.     <COOKIES>
  1382.         <COOKIE NAME="targit"></COOKIE>
  1383.         <COOKIE NAME="gratisware"></COOKIE>
  1384.     </COOKIES>
  1385.     <REGISTRY>
  1386.         <KEYS>
  1387.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="Gratisware"></REGKEY>
  1388.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{5843A29E-1246-11D4-BA8C-0050DA707ACD}"></REGKEY>
  1389.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{5843A29E-1246-11D4-BA8C-0050DA707ACD}"></REGKEY>
  1390.         </KEYS>
  1391.         <VALUES>
  1392.         </VALUES>
  1393.     </REGISTRY>
  1394.     <DANGER_LEVEL>3</DANGER_LEVEL>
  1395.     <DESCRIPTION>Gratisware will deliver popup advertisements to the PC, as well as track certain browsing habits and report them back to a central server</DESCRIPTION>
  1396. </SW>
  1397. <SW NAME="HotBar">
  1398.     <DIRECTORIES>
  1399.         <DIR NAME="HotBar" PATH="PFDir"></DIR>
  1400.         <DIR NAME="bin" PATH="PFDir\\Hotbar"></DIR>
  1401.         <DIR NAME="4.1.8.0" PATH="PFDir\\Hotbar\\bin"></DIR>
  1402.         <DIR NAME="4.2.8.0" PATH="PFDir\\Hotbar\\bin"></DIR>
  1403.         <DIR NAME="4.3.1.0" PATH="PFDir\\Hotbar\\bin"></DIR>
  1404.         <DIR NAME="4.3.5.0" PATH="PFDir\\HotBar\\bin"></DIR>
  1405.         <DIR NAME="4.3.6.0" PATH="PFDir\\Hotbar\\bin"></DIR>
  1406.         <DIR NAME="4.3.8.0" PATH="PFDir\\Hotbar\\bin"></DIR>
  1407.         <DIR NAME="hotbar" PATH="WinDir\\application data"></DIR>
  1408.         <DIR NAME="hotbar" PATH="Sys32Dir\\config\\systemprofile\\application data"></DIR>
  1409.     </DIRECTORIES>
  1410.     <FILES>
  1411.         <FILE NAME="hotbar.exe" PATH=""></FILE>
  1412.         <FILE NAME="ctor.dll" PATH="Sys32Dir"></FILE>
  1413.         <FILE NAME="ctor.dll" PATH="SysDir"></FILE>
  1414.         <FILE NAME="hbinst.exe" PATH="PFDir\\hotbar\\bin"></FILE>
  1415.         <FILE NAME="hotbar.log" PATH="PFDir\\hotbar"></FILE>
  1416.         <FILE NAME="hbhostie.dll" PATH="SysDir"></FILE>
  1417.         <FILE NAME="hbinst.exe-033aa324.pf" PATH=""></FILE>
  1418.         <FILE NAME="hbinst.exe-0edab9c6.pf" PATH=""></FILE>
  1419.         <FILE NAME="hbinst.exe-1b8894d1.pf" PATH=""></FILE>
  1420.         <FILE NAME="hbsrv.exe-23ebbcc9.pf" PATH=""></FILE>
  1421.         <FILE NAME="hotbarplugin.class" PATH=""></FILE>
  1422.         <FILE NAME="hotbar_1066151651.log" PATH=""></FILE>
  1423.         <FILE NAME="hbhostie.dll" PATH="Sys32Dir"></FILE>
  1424.         <FILE NAME="hbinstie.dll" PATH="PFDir\\HotBar\\bin\\4.1.8.0"></FILE>
  1425.         <FILE NAME="hbtoolbar.dll" PATH="PFDir\\HotBar\\bin\\4.1.8.0"></FILE>
  1426.         <FILE NAME="hbinst.exe" PATH="PFDir\\HotBar\\bin\\4.1.8.0"></FILE>
  1427.         <FILE NAME="hbhostie.dll" PATH="PFDir\\HotBar\\bin\\4.1.8.0"></FILE>
  1428.         <FILE NAME="dbenderc.dll" PATH="PFDir\\HotBar\\bin\\4.1.8.0"></FILE>
  1429.         <FILE NAME="hbcoresrv.dll"  PATH="PFDir\\HotBar\\bin\\4.1.8.0"></FILE>
  1430.         <FILE NAME="hbhostoe.dll" PATH="PFDir\\HotBar\\bin\\4.1.8.0"></FILE>
  1431.         <FILE NAME="Install.scr" PATH="PFDir\\HotBar\\bin\\4.1.8.0"></FILE>
  1432.         <FILE NAME="hbhostol.dll" PATH="PFDir\\HotBar\\bin\\4.1.8.0"></FILE>
  1433.         <FILE NAME="hbsrv.exe" PATH="PFDir\\HotBar\\bin\\4.1.8.0"></FILE>
  1434.         <FILE NAME="hotbar.dll" PATH="PFDir\\HotBar\\bin\\4.1.8.0"></FILE>
  1435.         <FILE NAME="hbinstie.dll" PATH="PFDir\\HotBar\\bin\\4.2.8.0"></FILE>
  1436.         <FILE NAME="hbtoolbar.dll" PATH="PFDir\\HotBar\\bin\\4.2.8.0"></FILE>
  1437.         <FILE NAME="hbinst.exe" PATH="PFDir\\HotBar\\bin\\4.2.8.0"></FILE>
  1438.         <FILE NAME="dbenderc.dll" PATH="PFDir\\HotBar\\bin\\4.2.8.0"></FILE>
  1439.         <FILE NAME="hbcoresrv.dll"  PATH="PFDir\\HotBar\\bin\\4.2.8.0"></FILE>
  1440.         <FILE NAME="hbhostie.dll" PATH="PFDir\\HotBar\\bin\\4.2.8.0"></FILE>
  1441.         <FILE NAME="hbhostoe.dll" PATH="PFDir\\HotBar\\bin\\4.2.8.0"></FILE>
  1442.         <FILE NAME="install.scr" PATH="PFDir\\HotBar\\bin\\4.2.8.0"></FILE>
  1443.         <FILE NAME="hbhostol.dll" PATH="PFDir\\HotBar\\bin\\4.2.8.0"></FILE>
  1444.         <FILE NAME="hbsrv.exe" PATH="PFDir\\HotBar\\bin\\4.2.8.0"></FILE>
  1445.         <FILE NAME="hotbar.dll" PATH="PFDir\\HotBar\\bin\\4.2.8.0"></FILE>
  1446.         <FILE NAME="hbinstie.dll" PATH="PFDir\\HotBar\\bin\\4.3.1.0"></FILE>
  1447.         <FILE NAME="hbtoolbar.dll" PATH="PFDir\\HotBar\\bin\\4.3.1.0"></FILE>
  1448.         <FILE NAME="hbinst.exe" PATH="PFDir\\HotBar\\bin\\4.3.1.0"></FILE>
  1449.         <FILE NAME="hbhostie.dll" PATH="PFDir\\HotBar\\bin\\4.3.1.0"></FILE>
  1450.         <FILE NAME="dbenderc.dll" PATH="PFDir\\HotBar\\bin\\4.3.1.0"></FILE>
  1451.         <FILE NAME="hbcoresrv.dll"  PATH="PFDir\\HotBar\\bin\\4.3.1.0"></FILE>
  1452.         <FILE NAME="hbhostoe.dll" PATH="PFDir\\HotBar\\bin\\4.3.1.0"></FILE>
  1453.         <FILE NAME="install.scr" PATH="PFDir\\HotBar\\bin\\4.3.1.0"></FILE>
  1454.         <FILE NAME="hbhostol.dll" PATH="PFDir\\HotBar\\bin\\4.3.1.0"></FILE>
  1455.         <FILE NAME="hbsrv.exe" PATH="PFDir\\HotBar\\bin\\4.3.1.0"></FILE>
  1456.         <FILE NAME="hotbar.dll" PATH="PFDir\\HotBar\\bin\\4.3.1.0"></FILE>
  1457.         <FILE NAME="hbinstie.dll" PATH="PFDir\\HotBar\\bin\\4.3.5.0"></FILE>
  1458.         <FILE NAME="hbtoolbar.dll" PATH="PFDir\\HotBar\\bin\\4.3.5.0"></FILE>
  1459.         <FILE NAME="hbinst.exe" PATH="PFDir\\HotBar\\bin\\4.3.5.0"></FILE>
  1460.         <FILE NAME="dbenderc.dll" PATH="PFDir\\HotBar\\bin\\4.3.5.0"></FILE>
  1461.         <FILE NAME="hbcoresrv.dll"  PATH="PFDir\\HotBar\\bin\\4.3.5.0"></FILE>
  1462.         <FILE NAME="hbhostie.dll" PATH="PFDir\\HotBar\\bin\\4.3.5.0"></FILE>
  1463.         <FILE NAME="hbhostoe.dll" PATH="PFDir\\HotBar\\bin\\4.3.5.0"></FILE>
  1464.         <FILE NAME="install.scr" PATH="PFDir\\HotBar\\bin\\4.3.5.0"></FILE>
  1465.         <FILE NAME="hbhostol.dll" PATH="PFDir\\HotBar\\bin\\4.3.5.0"></FILE>
  1466.         <FILE NAME="hbsrv.exe" PATH="PFDir\\HotBar\\bin\\4.3.5.0"></FILE>
  1467.         <FILE NAME="hotbar.dll" PATH="PFDir\\HotBar\\bin\\4.3.5.0"></FILE>
  1468.         <FILE NAME="hbinstie.dll" PATH="PFDir\\HotBar\\bin\\4.3.6.0"></FILE>
  1469.         <FILE NAME="hbtoolbar.dll" PATH="PFDir\\HotBar\\bin\\4.3.6.0"></FILE>
  1470.         <FILE NAME="hbinst.exe" PATH="PFDir\\HotBar\\bin\\4.3.6.0"></FILE>
  1471.         <FILE NAME="dbenderc.dll" PATH="PFDir\\HotBar\\bin\\4.3.6.0"></FILE>
  1472.         <FILE NAME="hbcoresrv.dll"  PATH="PFDir\\HotBar\\bin\\4.3.6.0"></FILE>
  1473.         <FILE NAME="hbhostie.dll" PATH="PFDir\\HotBar\\bin\\4.3.6.0"></FILE>
  1474.         <FILE NAME="hbhostoe.dll" PATH="PFDir\\HotBar\\bin\\4.3.6.0"></FILE>
  1475.         <FILE NAME="install.scr" PATH="PFDir\\HotBar\\bin\\4.3.6.0"></FILE>
  1476.         <FILE NAME="hbhostol.dll" PATH="PFDir\\HotBar\\bin\\4.3.6.0"></FILE>
  1477.         <FILE NAME="hbsrv.exe" PATH="PFDir\\HotBar\\bin\\4.3.6.0"></FILE>
  1478.         <FILE NAME="hotbar.dll" PATH="PFDir\\HotBar\\bin\\4.3.6.0"></FILE>
  1479.         <FILE NAME="hbinstie.dll" PATH="PFDir\\HotBar\\bin\\4.3.8.0"></FILE>
  1480.         <FILE NAME="hbtoolbar.dll" PATH="PFDir\\HotBar\\bin\\4.3.8.0"></FILE>
  1481.         <FILE NAME="hbinst.exe" PATH="PFDir\\HotBar\\bin\\4.3.8.0"></FILE>
  1482.         <FILE NAME="dbenderc.dll" PATH="PFDir\\HotBar\\bin\\4.3.8.0"></FILE>
  1483.         <FILE NAME="hbcoresrv.dll"  PATH="PFDir\\HotBar\\bin\\4.3.8.0"></FILE>
  1484.         <FILE NAME="hbhostie.dll" PATH="PFDir\\HotBar\\bin\\4.3.8.0"></FILE>
  1485.         <FILE NAME="hbhostoe.dll" PATH="PFDir\\HotBar\\bin\\4.3.8.0"></FILE>
  1486.         <FILE NAME="install.scr" PATH="PFDir\\HotBar\\bin\\4.3.8.0"></FILE>
  1487.         <FILE NAME="hbhostol.dll" PATH="PFDir\\HotBar\\bin\\4.3.8.0"></FILE>
  1488.         <FILE NAME="hbsrv.exe" PATH="PFDir\\HotBar\\bin\\4.3.8.0"></FILE>
  1489.         <FILE NAME="hotbar.dll" PATH="PFDir\\HotBar\\bin\\4.3.8.0"></FILE>
  1490.         <FILE NAME="hbinstie.dll" PATH="PFDir\\HotBar\\bin"></FILE>
  1491.         <FILE NAME="hotbar.dll" PATH="PFDir\\HotBar"></FILE>
  1492.         <FILE NAME="hbinst.exe" PATH="SysDir"></FILE>
  1493.         <FILE NAME="HotBar.inf" PATH="WinDir\\Downloaded Program Files"></FILE>
  1494.         <FILE NAME="HotBar.log" PATH="WinDir\\Downloaded Program Files"></FILE>
  1495.         <FILE NAME="hbinst.exe" PATH="Sys32Dir"></FILE>
  1496.     </FILES>
  1497.     <COOKIES>
  1498.     </COOKIES>
  1499.     <REGISTRY>
  1500.         <KEYS>
  1501.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE" VALUE="Hotbar"></REGKEY>
  1502.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{204f937e-519e-4597-96fa-8f1f59f3cb6d}"></REGKEY>
  1503.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE" VALUE="Hotbar"></REGKEY> 
  1504.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\User Agent\\Post Platform" VALUE="Hotbar 3.0"></REGKEY>
  1505.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{da603411-0593-11d5-a46b-00508b5ba2df}"></REGKEY>
  1506.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{1038dd23-8ae8-451b-a134-4db8a49aa519}"></REGKEY>
  1507.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{17719b53-fad1-11d4-a466-00508b5ba2df}"></REGKEY>
  1508.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{17719b54-fad1-11d4-a466-00508b5ba2df}"></REGKEY>
  1509.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{1e24f8a0-5965-4902-90d4-08534e9adf3b}"></REGKEY>
  1510.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{3103e312-e1bb-49ab-80eb-0a92fca78746}"></REGKEY>
  1511.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{46417afd-7a15-4ed1-b764-cb72cd4d904f}"></REGKEY>
  1512.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{4bf4fafa-186e-4e36-8f74-525290438d7b}"></REGKEY>
  1513.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{4dbcfaf7-62e1-4811-8acc-6511e7192cb4}"></REGKEY>
  1514.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{60b25924-c865-11d2-b0c1-000000000000}"></REGKEY>
  1515.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{60f63095-41ec-11d5-b558-00d0b77f0a6d}"></REGKEY>
  1516.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{60f630a2-41ec-11d5-b558-00d0b77f0a6d}"></REGKEY>
  1517.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{69fd62b1-0216-4c31-8d55-840ed86b7c8f}"></REGKEY>
  1518.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{6a6ebae8-8c66-4675-b423-95b3ba530940}"></REGKEY>
  1519.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{6d6d1580-5b74-40ea-97f4-3c2b46c5abdd}"></REGKEY>
  1520.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{6f885f52-b45f-45bc-8642-fe3d56155a3a}"></REGKEY>
  1521.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{6fe00b71-7251-4e00-9186-ed89bbb946b8}"></REGKEY>
  1522.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{75d2080b-4857-4b96-9b7d-732634fbd01f}"></REGKEY>
  1523.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{7e33bc81-0818-11d5-b50d-00d0b77f0a6d}"></REGKEY>
  1524.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{8f59f897-6923-4b3b-8156-4e55d19de99a}"></REGKEY>
  1525.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{918e4b7a-4d80-43a4-83a7-39adcc11841f}"></REGKEY>
  1526.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{94beb7a2-36b7-46dc-8ad1-81a8332409c0}"></REGKEY>
  1527.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{9ee87a26-b2c8-4130-83f6-e8511d939976}"></REGKEY>
  1528.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{a80347d3-f757-11d4-a466-00508b5ba2df}"></REGKEY>
  1529.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{a80347df-f757-11d4-a466-00508b5ba2df}"></REGKEY>
  1530.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{a80347e0-f757-11d4-a466-00508b5ba2df}"></REGKEY>
  1531.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{ad9a7b03-be12-11d4-b493-00d0b77f0a6d}"></REGKEY>
  1532.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{b00609a6-82af-4c55-bbb8-adc8593ceb86}"></REGKEY>
  1533.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{b195b3a5-8a05-11d3-97a4-0004aca6948e}"></REGKEY>
  1534.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{b195b3b2-8a05-11d3-97a4-0004aca6948e}"></REGKEY>
  1535.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{b195b3b3-8a05-11d3-97a4-0004aca6948e}"></REGKEY>
  1536.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{b701a704-f828-11d4-a466-00508b5ba2df}"></REGKEY>
  1537.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{b701a705-f828-11d4-a466-00508b5ba2df}"></REGKEY>
  1538.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{becafc17-baf9-11d4-b492-00d0b77f0a6d}"></REGKEY>
  1539.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{da603411-0593-11d5-a46b-10101b1b1111}"></REGKEY>
  1540.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{f4132b7b-1576-41b6-abd8-39c6c53047f7}"></REGKEY>
  1541.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{f64b26c1-07de-11d5-b50d-00d0b77f0a6d}"></REGKEY>
  1542.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{f7a1bf21-1d7d-4f5f-a201-0ca35a5cd68f}"></REGKEY>
  1543.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{1038dd23-8ae8-451b-a134-4db8a49aa519}"></REGKEY>
  1544.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{1e24f8a0-5965-4902-90d4-08534e9adf3b}"></REGKEY>
  1545.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{4dbcfaf7-62e1-4811-8acc-6511e7192cb4}"></REGKEY>
  1546.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{60f630a2-41ec-11d5-b558-00d0b77f0a6d}"></REGKEY>
  1547.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{69fd62b1-0216-4c31-8d55-840ed86b7c8f}"></REGKEY>
  1548.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{6fe00b71-7251-4e00-9186-ed89bbb946b8}"></REGKEY>
  1549.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{75d2080b-4857-4b96-9b7d-732634fbd01f}"></REGKEY>
  1550.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{a80347e0-f757-11d4-a466-00508b5ba2df}"></REGKEY>
  1551.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{b195b3b3-8a05-11d3-97a4-0004aca6948e}"></REGKEY>
  1552.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{becafc17-baf9-11d4-b492-00d0b77f0a6d}"></REGKEY>
  1553.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="hbhostie.hbbho.1"></REGKEY>
  1554.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="hotbar.hbmain.1"></REGKEY>
  1555.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{7e33bc81-0818-11d5-b50d-00d0b77f0a6d}"></REGKEY>
  1556.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="TypeLib" VALUE="{60f63095-41ec-11d5-b558-00d0b77f0a6d}"></REGKEY>
  1557.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="appid" VALUE="hbsrv.exe"></REGKEY>
  1558.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="appid" VALUE="{b701a705-f828-11d4-a466-00508b5ba2df}"></REGKEY>
  1559.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="hbcoresrv.hbcoreservices"></REGKEY>
  1560.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="hbcoresrv.hbcoreservices.1"></REGKEY>
  1561.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="hbhostol.hbmailanim"></REGKEY>
  1562.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="hbhostol.hbmailanim.1"></REGKEY>
  1563.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="hbinstie.hbinstobj"></REGKEY>
  1564.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="hbinstie.hbinstobj.1"></REGKEY>
  1565.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="hbsrv.hbcoreservices"></REGKEY>
  1566.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="hbsrv.hbcoreservices.1"></REGKEY>
  1567.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="hbtoolbar.hbtoolbarctl"></REGKEY>
  1568.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="hbtoolbar.hbtoolbarctl.1"></REGKEY>
  1569.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="hotbar.hbbho"></REGKEY>
  1570.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="hotbar.hbcommband"></REGKEY>
  1571.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="hotbar.hbcommband.1"></REGKEY>
  1572.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="hotbar.hbcommmband.1"></REGKEY>
  1573.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="hotbar.hbmain"></REGKEY>
  1574.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{17719b53-fad1-11d4-a466-00508b5ba2df}"></REGKEY>
  1575.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{17719b54-fad1-11d4-a466-00508b5ba2df}"></REGKEY>
  1576.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{3103e312-e1bb-49ab-80eb-0a92fca78746}"></REGKEY>
  1577.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{46417afd-7a15-4ed1-b764-cb72cd4d904f}"></REGKEY>
  1578.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{4bf4fafa-186e-4e36-8f74-525290438d7b}"></REGKEY>
  1579.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{6a6ebae8-8c66-4675-b423-95b3ba530940}"></REGKEY>
  1580.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{6f885f52-b45f-45bc-8642-fe3d56155a3a}"></REGKEY>
  1581.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{8f59f897-6923-4b3b-8156-4e55d19de99a}"></REGKEY>
  1582.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{918e4b7a-4d80-43a4-83a7-39adcc11841f}"></REGKEY>
  1583.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{9ee87a26-b2c8-4130-83f6-e8511d939976}"></REGKEY>
  1584.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{a80347df-f757-11d4-a466-00508b5ba2df}"></REGKEY>
  1585.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{ad9a7b03-be12-11d4-b493-00d0b77f0a6d}"></REGKEY>
  1586.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{b00609a6-82af-4c55-bbb8-adc8593ceb86}"></REGKEY>
  1587.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{b195b3b2-8a05-11d3-97a4-0004aca6948e}"></REGKEY>
  1588.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{da603411-0593-11d5-a46b-00508b5ba2df}"></REGKEY>
  1589.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{da603411-0593-11d5-a46b-10101b1b1111}"></REGKEY>
  1590.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{f4132b7b-1576-41b6-abd8-39c6c53047f7}"></REGKEY>
  1591.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{f64b26c1-07de-11d5-b50d-00d0b77f0a6d}"></REGKEY>
  1592.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{f7a1bf21-1d7d-4f5f-a201-0ca35a5cd68f}"></REGKEY>
  1593.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Software\\Microsoft\\windows\\CurrentVersion\\explorer\\browser helper objects" VALUE="{b195b3b3-8a05-11d3-97a4-0004aca6948e}"></REGKEY>
  1594.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="TypeLib" VALUE="{6d6d1580-5b74-40ea-97f4-3c2b46c5abdd}"></REGKEY>
  1595.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="TypeLib" VALUE="{94beb7a2-36b7-46dc-8ad1-81a8332409c0}"></REGKEY>
  1596.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="TypeLib" VALUE="{a80347d3-f757-11d4-a466-00508b5ba2df}"></REGKEY>
  1597.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="TypeLib" VALUE="{b195b3a5-8a05-11d3-97a4-0004aca6948e}"></REGKEY>
  1598.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="TypeLib" VALUE="{b701a704-f828-11d4-a466-00508b5ba2df}"></REGKEY>
  1599.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="{69fd62b1-0216-4c31-8d55-840ed86b7c8f}"></REGKEY>
  1600.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\internet explorer\\explorer bars" VALUE="{becafc17-baf9-11d4-b492-00d0b77f0a6d}"></REGKEY>
  1601.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\windows\\CurrentVersion\\internet settings\\user agent" VALUE="hotbar 3.0"></REGKEY>
  1602.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\appid" VALUE="{b701a705-f828-11d4-a466-00508b5ba2df}"></REGKEY>
  1603.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{17719b53-fad1-11d4-a466-00508b5ba2df}"></REGKEY>
  1604.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{17719b54-fad1-11d4-a466-00508b5ba2df}"></REGKEY>
  1605.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{3103e312-e1bb-49ab-80eb-0a92fca78746}"></REGKEY>
  1606.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{31321312-e1bb-49ab-80eb-13212ca78746}"></REGKEY>
  1607.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{46417afd-7a15-4ed1-b764-cb72cd4d904f}"></REGKEY>
  1608.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{4bf4fafa-186e-4e36-8f74-525290438d7b}"></REGKEY>
  1609.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{6a6ebae8-8c66-4675-b423-95b3ba530940}"></REGKEY>
  1610.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{6f885f52-b45f-45bc-8642-fe3d56155a3a}"></REGKEY>
  1611.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{7e33bc81-0818-11d5-b50d-00d0b77f0a6d}"></REGKEY>
  1612.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{8f59f897-6923-4b3b-8156-4e55d19de99a}"></REGKEY>
  1613.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{918e4b7a-4d80-43a4-83a7-39adcc11841f}"></REGKEY>
  1614.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{9ee87a26-b2c8-4130-83f6-e8511d939976}"></REGKEY>
  1615.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{a80347df-f757-11d4-a466-00508b5ba2df}"></REGKEY>
  1616.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{ad9a7b03-be12-11d4-b493-00d0b77f0a6d}"></REGKEY>
  1617.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{b00609a6-82af-4c55-bbb8-adc8593ceb86}"></REGKEY>
  1618.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{b195b3b2-8a05-11d3-97a4-0004aca6948e}"></REGKEY>
  1619.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{c8539bfe-8fd7-405c-8eef-d9af48dc6ba4}"></REGKEY>
  1620.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{da603411-0593-11d5-a46b-00508b5ba2df}"></REGKEY>
  1621.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{da603411-0593-11d5-a46b-10101b1b1111}"></REGKEY>
  1622.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{da603411-0593-11d5-a46b-10101ddd1111}"></REGKEY>
  1623.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{f4132b7b-1576-41b6-abd8-39c6c53047f7}"></REGKEY>
  1624.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{f64b26c1-07de-11d5-b50d-00d0b77f0a6d}"></REGKEY>
  1625.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\Interface" VALUE="{f7a1bf21-1d7d-4f5f-a201-0ca35a5cd68f}"></REGKEY>
  1626.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\TypeLib" VALUE="{60f63095-41ec-11d5-b558-00d0b77f0a6d}"></REGKEY>
  1627.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\TypeLib" VALUE="{6d6d1580-5b74-40ea-97f4-3c2b46c5abdd}"></REGKEY>
  1628.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\TypeLib" VALUE="{94beb7a2-36b7-46dc-8ad1-81a8332409c0}"></REGKEY>
  1629.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\TypeLib" VALUE="{a80347d3-f757-11d4-a466-00508b5ba2df}"></REGKEY>
  1630.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\TypeLib" VALUE="{b195b3a5-8a05-11d3-97a4-0004aca6948e}"></REGKEY>
  1631.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\TypeLib" VALUE="{b701a704-f828-11d4-a466-00508b5ba2df}"></REGKEY>
  1632.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Code Store Database\\Distribution Units" VALUE="{69fd62b1-0216-4c31-8d55-840ed86b7c8f}"></REGKEY>
  1633.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\office\\outlook\\addins" VALUE="hbhostol.hbmailanim"></REGKEY>
  1634.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\explorer\\browser helper objects" VALUE="{b195b3b3-8a05-11d3-97a4-0004aca6948e}"></REGKEY>
  1635.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\internet settings\\user agent\\post platform" VALUE="hotbar 4.2.13.0"></REGKEY>
  1636.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion" VALUE="runhotbar"></REGKEY>
  1637.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\uninstall" VALUE="hotbar uninstall"></REGKEY>
  1638.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="System\\currentcontrolset\\enum\\sw" VALUE="{03884cb6-e89a-4deb-b69e-8dc621686e6a}"></REGKEY>
  1639.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="System\\currentcontrolset\\enum\\sw" VALUE="{8e60217d-a2ee-47f8-b0c5-0f44c55f66dc}"></REGKEY>
  1640.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="System\\currentcontrolset\\enum\\sw" VALUE="{96e080c7-143c-11d1-b40f-00a0c9223196}"></REGKEY>
  1641.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="System\\currentcontrolset\\enum\\sw" VALUE="{b7eafdc0-a680-11d0-96d8-00aa0051e51d}"></REGKEY>
  1642.             <REGKEY MAIN="HKEY_USERS" SUB=".defaultSoftware" VALUE="hotbar"></REGKEY>
  1643.             <REGKEY MAIN="HKEY_USERS" SUB="s-1-5-21-329068152-1677128483-854245398-500\\software\\Microsoft\\internet explorer\\explorer bars" VALUE="{becafc17-baf9-11d4-b492-00d0b77f0a6d}"></REGKEY>
  1644.             <REGKEY MAIN="HKEY_USERS" SUB="s-1-5-21-725345543-1078145449-1343024091-500\\software\\Microsoft\\internet explorer\\explorer bars" VALUE="{becafc17-baf9-11d4-b492-00d0b77f0a6d}"></REGKEY>
  1645.         </KEYS>
  1646.         <VALUES>
  1647.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="B195B3B3-8A05-11D3-97A4-0004ACA6948E"></REGVALUE>
  1648.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\internet explorer\\toolbar" VALUE="webbrowser{b195b3b3-8a05-11d3-97a4-0004aca6948e}"></REGVALUE>
  1649.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\internet explorer\\toolbar" VALUE="{b195b3b3-8a05-11d3-97a4-0004aca6948e}"></REGVALUE>
  1650.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="HotBar"></REGVALUE>
  1651.         </VALUES>
  1652.     </REGISTRY>
  1653.     <DANGER_LEVEL>2</DANGER_LEVEL>
  1654.     <DESCRIPTION>HotBar is a toolbar that attaches to the browser.  Once installed, it delivers popup ads, and is known to significantly decrease both system and browser speed</DESCRIPTION>
  1655. </SW>
  1656. <SW NAME="HuntBar">
  1657.     <DIRECTORIES>
  1658.         <DIR NAME="MSIETS" PATH="PFDir\\Common Files"></DIR>
  1659.         <DIR NAME="Search Toolbar" PATH="PFDir"></DIR>
  1660.     </DIRECTORIES>
  1661.     <FILES>
  1662.         <FILE NAME="wintools.exe" PATH="PFDir\\common files\\wintools"></FILE>
  1663.         <FILE NAME="{26e8361f-bce7-4f75-a347-98c88b418322}" PATH="WinDir\\downloaded program files"></FILE>
  1664.         <FILE NAME="{8A05273A-2EA5-42DE-AA75-59EA7D9D50D7}" PATH="WinDir\\downloaded program files"></FILE>
  1665.         <FILE NAME="{59450DB0-341D-4436-B380-B8377D8B6796}" PATH="WinDir\\downloaded program files"></FILE>
  1666.         <FILE NAME="{D6E66235-7AA6-44ED-A06C-6F2033B1D993}" PATH="WinDir\\downloaded program files"></FILE>
  1667.         <FILE NAME="msiets.dll" PATH="PFDir\\Common Files\\MSIETS"></FILE>
  1668.         <FILE NAME="toolbar.dll" PATH="PFDir\\Toolbar"></FILE>
  1669.         <FILE NAME="msielink.dll" PATH="PFDir\\Common Files\\MSIETS"></FILE>
  1670.         <FILE NAME="{8A05273A-2EA5-42DE-AA75-59EA7D9D50D7}" PATH=""></FILE>
  1671.         <FILE NAME="{59450DB0-341D-4436-B380-B8377D8B6796}" PATH=""></FILE>
  1672.         <FILE NAME="btlink.dll" PATH="PFDir\\Common Files\\BTLINK"></FILE>
  1673.         <FILE NAME="msiein.dll" PATH="SysDir"></FILE>
  1674.         <FILE NAME="msiein.dll" PATH="Sys32Dir"></FILE>
  1675.         <FILE NAME="btiein.dll" PATH="SysDir"></FILE>
  1676.         <FILE NAME="btiein.dll" PATH="Sys32Dir"></FILE>
  1677.         <FILE NAME="stoolbar.dll" PATH="PFDir\\search toolbar"></FILE>
  1678.         <FILE NAME="btiein.dll" PATH="PFDir\\common files\\wintools"></FILE>
  1679.     </FILES>
  1680.     <COOKIES>
  1681.         <COOKIE NAME="trafficsyndicate"></COOKIE>
  1682.         <COOKIE NAME="bullseyesgames"></COOKIE>
  1683.         <COOKIE NAME="side-search"></COOKIE>
  1684.     </COOKIES>
  1685.     <REGISTRY>
  1686.         <KEYS>
  1687.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{8952A998-1E7E-4716-B23D-3DBE03910972}"></REGKEY>
  1688.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{8952A998-1E7E-4716-B23D-3DBE03910972}"></REGKEY>
  1689.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{0a5cf411-f0bf-4af8-a2a4-8233f3109bed}"></REGKEY>
  1690.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{d6dff6d8-b94b-4720-b730-1c38c7065c3b}"></REGKEY>
  1691.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{0a68c5a2-64ae-4415-88a2-6542304a4745}"></REGKEY>
  1692.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{8a05273a-2ea5-42de-aa75-59ea7d9d50d7}"></REGKEY>
  1693.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{a6250fb8-2206-499e-a7aa-e1ec437e71c0}"></REGKEY>
  1694.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{d6dff6d8-b94b-4720-b730-1c38c7065c3b}"></REGKEY>
  1695.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{d6e66235-7aa6-44ed-a06c-6f2033b1d993}"></REGKEY>
  1696.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{0a68c5a2-64ae-4415-88a2-6542304a4745}"></REGKEY>
  1697.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{a6250fb8-2206-499e-a7aa-e1ec437e71c0}"></REGKEY>
  1698.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{d6e66235-7aa6-44ed-a06c-6f2033b1d993}"></REGKEY>
  1699.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{d6dff6d8-b94b-4720-b730-1c38c7065c3b}"></REGKEY>
  1700.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="MSIETS"></REGKEY>
  1701.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="MSIETSLink"></REGKEY>
  1702.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="" VALUE="MSIETS"></REGKEY>
  1703.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="" VALUE="MSIEIN"></REGKEY>
  1704.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="" VALUE="BTIEIN"></REGKEY>
  1705.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="" VALUE="BTLINK"></REGKEY>
  1706.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="" VALUE="Search Toolbar"></REGKEY>
  1707.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{63b78bc1-a711-4d46-ad2f-c581ac420d41}"></REGKEY>
  1708.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{63b78bc1-a711-4d46-ad2f-c581ac420d41}"></REGKEY>
  1709.         </KEYS>
  1710.         <VALUES>
  1711.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{339bb23f-a864-48c0-a59f-29ea915965ec}"></REGVALUE>
  1712.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{8A05273A-2EA5-42DE-AA75-59EA7D9D50D7}"></REGVALUE>
  1713.         </VALUES>
  1714.     </REGISTRY>
  1715.     <DANGER_LEVEL>2</DANGER_LEVEL>
  1716.     <DESCRIPTION>HuntBar is known to attach a toolbar to the browser, as well as snoop on browsing activity, and silently update without user interaction</DESCRIPTION>
  1717. </SW>
  1718. <SW NAME="HungryHands">  
  1719.     <DIRECTORIES>
  1720.     </DIRECTORIES>
  1721.     <FILES>
  1722.         <FILE NAME="hhu.dll" PATH="WinDir"></FILE>
  1723.         <FILE NAME="hh.dll" PATH="WinDir"></FILE>
  1724.     </FILES>
  1725.     <COOKIES>
  1726.     </COOKIES>
  1727.     <REGISTRY>
  1728.         <KEYS>
  1729.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{bcf96fb4-5f1b-497b-aecc-910304a55011}"></REGKEY>
  1730.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{bcf96fb4-5f1b-497b-aecc-910304a55011}"></REGKEY>
  1731.         </KEYS>
  1732.         <VALUES>
  1733.         </VALUES>
  1734.     </REGISTRY>
  1735.     <DANGER_LEVEL>1</DANGER_LEVEL>
  1736.     <DESCRIPTION>Hijackers that changes internet settings to porn related sites</DESCRIPTION>
  1737. </SW>
  1738. <SW NAME="Bridge">  
  1739.     <DIRECTORIES>
  1740.     </DIRECTORIES>
  1741.     <FILES>
  1742.         <FILE NAME="bridge.dll" PATH="SysDir"></FILE>
  1743.         <FILE NAME="bridge.dll" PATH="Sys32Dir"></FILE>
  1744.     </FILES>
  1745.     <COOKIES>
  1746.     </COOKIES>
  1747.     <REGISTRY>
  1748.         <KEYS>
  1749.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{9c691a33-7dda-4c2f-be4c-c176083f35cf}"></REGKEY>
  1750.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{9c691a33-7dda-4c2f-be4c-c176083f35cf}"></REGKEY>
  1751.         </KEYS>
  1752.         <VALUES>
  1753.         </VALUES>
  1754.     </REGISTRY>
  1755.     <DANGER_LEVEL>1</DANGER_LEVEL>
  1756.     <DESCRIPTION>Flingstone Bridge spawns popup advertisement windows</DESCRIPTION>
  1757. </SW>
  1758. <SW NAME="Purityscan/Purityscan.c">
  1759.     <DIRECTORIES>
  1760.         <DIR NAME="purityscan" PATH="PFDir"></DIR>
  1761.     </DIRECTORIES>
  1762.     <FILES>
  1763.         <FILE NAME="winservn.exe" PATH="Sys32Dir"></FILE>
  1764.         <FILE NAME="purityscan.exe" PATH="PFDir\\purityscan"></FILE>
  1765.         <FILE NAME="wintsu.exe" PATH="Sys32Dir"></FILE>
  1766.     </FILES>
  1767.     <COOKIES>
  1768.     </COOKIES>
  1769.     <REGISTRY>
  1770.         <KEYS>
  1771.         </KEYS>
  1772.         <VALUES>
  1773.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="contentservice"></REGVALUE>
  1774.                <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="WCPS"></REGVALUE>
  1775.         </VALUES>
  1776.     </REGISTRY>
  1777.     <DANGER_LEVEL>1</DANGER_LEVEL>
  1778.     <DESCRIPTION>Purityscan will serve advertisements to your PC</DESCRIPTION>
  1779. </SW>
  1780. <SW NAME="IEPlugin">
  1781.     <DIRECTORIES>
  1782.     </DIRECTORIES>
  1783.     <FILES>
  1784.         <FILE NAME="winobject.dll" PATH="WinDir"></FILE>
  1785.         <FILE NAME="systb.dll" PATH="WinDir"></FILE>
  1786.         <FILE NAME="winserv.exe" PATH="WinDir"></FILE>
  1787.         <FILE NAME="wupdt.exe" PATH="WinDir"></FILE>
  1788.         <FILE NAME="kw.dat" PATH="WinDir"></FILE>
  1789.         <FILE NAME="toServer.pst" PATH="WinDir"></FILE>
  1790.         <FILE NAME="lu.dat" PATH="WinDir"></FILE>
  1791.         <FILE NAME="extract.exe" PATH="WinDir"></FILE>
  1792.         <FILE NAME="button0.ico" PATH="WinDir"></FILE>
  1793.         <FILE NAME="button1.ico" PATH="WinDir"></FILE>
  1794.         <FILE NAME="button2.ico" PATH="WinDir"></FILE>
  1795.         <FILE NAME="logo.ico" PATH="WinDir"></FILE>
  1796.     </FILES>
  1797.     <COOKIES>
  1798.         <COOKIE NAME="ieplugin"></COOKIE>
  1799.     </COOKIES>
  1800.     <REGISTRY>
  1801.         <KEYS>
  1802.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{69135BDE-5FDC-4B61-98AA-82AD2091BCCC}"></REGKEY>
  1803.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{914AFB33-550B-4BD0-B4EF-8DA185504836}"></REGKEY>
  1804.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{69135BDE-5FDC-4B61-98AA-82AD2091BCCC}"></REGKEY>
  1805.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{914AFB33-550B-4BD0-B4EF-8DA185504836}"></REGKEY>
  1806.         </KEYS>
  1807.         <VALUES>
  1808.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar\\WebBrowser" VALUE="{914AFB33-550B-4BD0-B4EF-8DA185504836}"></REGVALUE>
  1809.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar\\WebBrowser" VALUE="{69135BDE-5FDC-4B61-98AA-82AD2091BCCC}"></REGVALUE>
  1810.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{69135BDE-5FDC-4B61-98AA-82AD2091BCCC}"></REGVALUE>
  1811.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{914AFB33-550B-4BD0-B4EF-8DA185504836}"></REGVALUE>
  1812.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Win Server"></REGVALUE>
  1813.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Win Server Updt"></REGVALUE>
  1814.         </VALUES>
  1815.     </REGISTRY>
  1816.     <DANGER_LEVEL>2</DANGER_LEVEL>
  1817.     <DESCRIPTION>IEPlugin will silently update, hijack keyword searches as well as content entered into forms while surfing</DESCRIPTION>
  1818. </SW>
  1819. <SW NAME="IGetNet">
  1820.     <DIRECTORIES>
  1821.     </DIRECTORIES>
  1822.     <FILES>
  1823.         <FILE NAME="rsp001.dll" PATH="SysDir"></FILE> 
  1824.         <FILE NAME="rsp001.dll" PATH="Sys32Dir"></FILE>
  1825.         <FILE NAME="BHO.DLL" PATH="SysDir"></FILE>
  1826.         <FILE NAME="rsp.dll" PATH="SysDir"></FILE>
  1827.         <FILE NAME="WinStart.exe" PATH="SysDir"></FILE>
  1828.         <FILE NAME="install_all.dll" PATH="SysDir"></FILE>      
  1829.         <FILE NAME="update_com.dll" PATH="SysDir"></FILE>    
  1830.         <FILE NAME="update_removeold.dll" PATH="SysDir"></FILE> 
  1831.         <FILE NAME="winstart001.exe" PATH="Sys32Dir"></FILE>
  1832.         <FILE NAME="BHO001.dll" PATH="SysDir"></FILE>
  1833.          <FILE NAME="BHO001.dll" PATH="Sys32Dir"></FILE>
  1834.     </FILES>
  1835.     <COOKIES>
  1836.         <COOKIE NAME="ignkeywords"></COOKIE>
  1837.         <COOKIE NAME="rspsearch"></COOKIE>
  1838.         <COOKIE NAME="igetnet"></COOKIE>
  1839.     </COOKIES>
  1840.     <REGISTRY>
  1841.         <KEYS>
  1842.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software\\VB and VBA Program Settings" VALUE="Ie Rsp"></REGKEY>
  1843.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\Run " VALUE="WinStart001.exe"></REGKEY> 
  1844.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{60e78cac-e9a7-4302-b9ee-8582ede22fbf}"></REGKEY>
  1845.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{60e78cac-e9a7-4302-b9ee-8582ede22fbf}"></REGKEY>
  1846.         </KEYS>
  1847.         <VALUES>
  1848.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\Run" VALUE="WinStart"></REGVALUE>
  1849.         </VALUES>
  1850.     </REGISTRY>
  1851.     <DANGER_LEVEL>2</DANGER_LEVEL>
  1852.     <DESCRIPTION>IGetNet will hijack keyword searches as well as start a process at windows startup, which allows it to self update</DESCRIPTION>
  1853. </SW>
  1854. <SW NAME="SearchV/W32.Dumaru@mm">  
  1855.     <DIRECTORIES>
  1856.     </DIRECTORIES>
  1857.     <FILES>
  1858.         <FILE NAME="vxdmgr32.exe" PATH="Sys32Dir"></FILE>
  1859.         <FILE NAME="load32.exe" PATH="Sys32Dir"></FILE>
  1860.         <FILE NAME="dllreg.exe" PATH="WinDir"></FILE>
  1861.            <FILE NAME="MSupdater.exe-04f9ec8b.pf" PATH=""></FILE>
  1862.     </FILES>
  1863.     <COOKIES>
  1864.     </COOKIES>
  1865.     <REGISTRY>
  1866.         <KEYS>
  1867.         </KEYS>
  1868.         <VALUES>
  1869.         </VALUES>
  1870.     </REGISTRY>
  1871.     <DANGER_LEVEL>2</DANGER_LEVEL>
  1872.     <DESCRIPTION>Worm that trys to spread itself and allows unauthorized access to your PC</DESCRIPTION>
  1873. </SW>
  1874. <SW NAME="MPGCom">
  1875.     <DIRECTORIES>
  1876.     </DIRECTORIES>
  1877.     <FILES>
  1878.         <FILE NAME="iempg.dll" PATH="WinDir"></FILE>
  1879.     </FILES>
  1880.     <COOKIES>
  1881.     </COOKIES>
  1882.     <REGISTRY>
  1883.         <KEYS>
  1884.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{ffffffff-ffff-ffff-ffff-5f8507c5f4e9}"></REGKEY>
  1885.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{ffffffff-ffff-ffff-ffff-5f8507c5f4e9}"></REGKEY>
  1886.         </KEYS>
  1887.         <VALUES>
  1888.         </VALUES>
  1889.     </REGISTRY>
  1890.     <DANGER_LEVEL>1</DANGER_LEVEL>
  1891.     <DESCRIPTION>Browser helper object used to deliver ads to your PC</DESCRIPTION>
  1892. </SW>
  1893. <SW NAME="InetSpeak/INetSpeak.Iexplorr">
  1894.     <DIRECTORIES>
  1895.         <DIR NAME="mm050102" PATH="PFDir"></DIR>
  1896.     </DIRECTORIES>
  1897.     <FILES>
  1898.         <FILE NAME="iexplorr29.dll" PATH="WinDir"></FILE>
  1899.          <FILE NAME="iexplorr26.dll" PATH="WinDir"></FILE>
  1900.          <FILE NAME="iexplorr27.dll" PATH="WinDir"></FILE>
  1901.          <FILE NAME="iexplorr11.dll" PATH="WinDir"></FILE>
  1902.         <FILE NAME="winietoolbar.ini" PATH="WinDir"></FILE>
  1903.         <FILE NAME="WindowsIE.dll" PATH="WinDir"></FILE>
  1904.         <FILE NAME="boombar.dll" PATH="PFDir\\Internet Explorer"></FILE>
  1905.         <FILE NAME="BHO42602.dll" PATH="PFDir\\mm050102"></FILE>
  1906.         <FILE NAME="WindowsIE.dll" PATH="PFDir\\mm052202"></FILE>
  1907.         <FILE NAME="WindowsIE.dll" PATH="SysDir"></FILE>
  1908.         <FILE NAME="WindowsIE.dll" PATH="Sys32Dir"></FILE>
  1909.         <FILE NAME="iexplorr11.dll" PATH="PFDir\\internet explorer"></FILE>
  1910.         <FILE NAME="iexplorr11.dll" PATH="SysDir"></FILE>
  1911.         <FILE NAME="iexplorr11.dll" PATH="Sys32Dir"></FILE>
  1912.         <FILE NAME="iexplorr22.dll" PATH="PFDir\\internet explorer"></FILE>
  1913.         <FILE NAME="iexplorr22.dll" PATH="SysDir"></FILE>
  1914.         <FILE NAME="iexplorr22.dll" PATH="Sys32Dir"></FILE>
  1915.         <FILE NAME="iexplorr23.dll" PATH="PFDir\\internet explorer"></FILE>
  1916.         <FILE NAME="iexplorr23.dll" PATH="SysDir"></FILE>
  1917.         <FILE NAME="iexplorr23.dll" PATH="Sys32Dir"></FILE>
  1918.     </FILES>
  1919.     <COOKIES>
  1920.         <COOKIE NAME="musicmagnet"></COOKIE>
  1921.         <COOKIE NAME="eboom"></COOKIE>
  1922.     </COOKIES>
  1923.     <REGISTRY>
  1924.         <KEYS>
  1925.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{2E12B523-3D4C-4FAC-9B04-0376A8F5E879}"></REGKEY>
  1926.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{54ED9B49-81D1-4866-95A6-30F01DE0047E}"></REGKEY>
  1927.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{94326E3F-F51F-4863-A832-4ACD0D7D4BC3}"></REGKEY>
  1928.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{BC0D2038-2DE5-4A6F-92BC-B18A3E0DE32A}"></REGKEY>
  1929.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{2E12B523-3D4C-4FAC-9B04-0376A8F5E879}"></REGKEY>
  1930.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{a76066c9-941b-4209-9d96-0ac80501100d}"></REGKEY>
  1931.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{bc0d2038-2de5-4a6f-92bc-b18a3e0de32a}"></REGKEY>
  1932.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{a76066c9-941b-4209-9d96-0ac80501100d}"></REGKEY>
  1933.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{bc0d2038-2de5-4a6f-92bc-b18a3e0de32a}"></REGKEY>
  1934.         </KEYS>
  1935.         <VALUES>
  1936.         </VALUES>
  1937.     </REGISTRY>
  1938.     <DANGER_LEVEL>2</DANGER_LEVEL>
  1939.     <DESCRIPTION>InetSpeak will add a non-removable strip of advertising links below the standard browser buttons</DESCRIPTION>
  1940. </SW>
  1941. <SW NAME="MarketScore">
  1942.     <DIRECTORIES>
  1943.     </DIRECTORIES>
  1944.     <FILES>
  1945.         <FILE NAME="NSCheck.exe" PATH="Sys32Dir"></FILE>
  1946.         <FILE NAME="NSCheck.exe" PATH="SysDir"></FILE>
  1947.     </FILES>
  1948.     <COOKIES>
  1949.         <COOKIE NAME="marketscore"></COOKIE>
  1950.     </COOKIES>
  1951.     <REGISTRY>
  1952.         <KEYS>
  1953.         </KEYS>
  1954.         <VALUES>
  1955.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="MarketScore"></REGVALUE>
  1956.         </VALUES>
  1957.     </REGISTRY>
  1958.     <DANGER_LEVEL>1</DANGER_LEVEL>
  1959.     <DESCRIPTION>MarketScore runs at startup, ensuring all of your connections go through their servers, where the traffic can be analyzed</DESCRIPTION>
  1960. </SW>
  1961. <SW NAME="Mirar Toolbar"> 
  1962.     <DIRECTORIES>
  1963.     </DIRECTORIES>
  1964.     <FILES>
  1965.         <FILE NAME="NN_Bar.dll" PATH="SysDir"></FILE>
  1966.         <FILE NAME="NN_Bar21.dll" PATH="SysDir"></FILE>
  1967.         <FILE NAME="NN_Bar22.dll" PATH="SysDir"></FILE>
  1968.         <FILE NAME="NN_Bar23.dll" PATH="SysDir"></FILE>
  1969.         <FILE NAME="NN_Bar31.dll" PATH="SysDir"></FILE>
  1970.         <FILE NAME="WinNB40.dll" PATH="SysDir"></FILE>
  1971.         <FILE NAME="WinNB40.dll" PATH="Sys32Dir"></FILE>
  1972.         <FILE NAME="WinNB41.dll" PATH="Sys32Dir"></FILE>
  1973.         <FILE NAME="WinNB41.dll" PATH="SysDir"></FILE>
  1974.         <FILE NAME="WinNB42.dll" PATH="Sys32Dir"></FILE>
  1975.         <FILE NAME="WinNB42.dll" PATH="SysDir"></FILE>
  1976.         <FILE NAME="WinNB43.dll" PATH="Sys32Dir"></FILE>
  1977.         <FILE NAME="WinNB43.dll" PATH="SysDir"></FILE>
  1978.         <FILE NAME="WinNB51.dll" PATH="SysDir"></FILE>
  1979.         <FILE NAME="WinNB51.dll" PATH="Sys32Dir"></FILE>
  1980.         <FILE NAME="NN_Bar.dll" PATH="Sys32Dir"></FILE>
  1981.         <FILE NAME="NN_Bar21.dll" PATH="Sys32Dir"></FILE>
  1982.         <FILE NAME="NN_Bar22.dll" PATH="Sys32Dir"></FILE>
  1983.         <FILE NAME="NN_Bar31.dll" PATH="Sys32Dir"></FILE>
  1984.     </FILES>
  1985.     <COOKIES>
  1986.         <COOKIE NAME="mirar"></COOKIE>
  1987.     </COOKIES>
  1988.     <REGISTRY>
  1989.         <KEYS>
  1990.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{179E4B4A-76C3-4F65-BCED-C9FA1A28D2EF}"></REGKEY>
  1991.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}"></REGKEY>
  1992.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}"></REGKEY>
  1993.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\Current Version\\Explorer\\Browser Helper Objects" VALUE="{8A0DCBDA-6E20-489C-9041-C1E8A0352E75}"></REGKEY>
  1994.         </KEYS>
  1995.         <VALUES>
  1996.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{179E4B4A-76C3-4F65-BCED-C9FA1A28D2EF}"></REGVALUE>
  1997.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Internet Explorer\\Toolbar\\WebBrowser" VALUE="{179E4B4A-76C3-4F65-BCED-C9FA1A28D2EF}"></REGVALUE>
  1998.         </VALUES>
  1999.     </REGISTRY>
  2000.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2001.     <DESCRIPTION>Mirar Toolbar is a toolbar addon for internet explorer.  It has the ability to hide, and then re-emerge, making removal difficult and very annoying</DESCRIPTION>
  2002. </SW>
  2003. <SW NAME="Surebar">
  2004.     <DIRECTORIES>
  2005.     </DIRECTORIES>
  2006.     <FILES>
  2007.         <FILE NAME="surebar.dll" PATH="SysDir"></FILE>
  2008.         <FILE NAME="surebar.dll" PATH="Sys32Dir"></FILE>
  2009.     </FILES>
  2010.     <COOKIES>
  2011.     </COOKIES>
  2012.     <REGISTRY>
  2013.         <KEYS>
  2014.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{D3F01312-8A3D-4D41-A4FA-FB61D295CB6B}"></REGKEY>
  2015.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\Current Version\\Explorer\\Browser Helper Objects" VALUE="{D3F01312-8A3D-4D41-A4FA-FB61D295CB6B}"></REGKEY>
  2016.         </KEYS>
  2017.         <VALUES>
  2018.         </VALUES>
  2019.     </REGISTRY>
  2020.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2021.     <DESCRIPTION>SureBar is a toolbar hijacker that will reset homepage settings, take over searches, and add a toolbar to internet explorer</DESCRIPTION>
  2022. </SW>
  2023. <SW NAME="NetPal">
  2024.     <DIRECTORIES>
  2025.     </DIRECTORIES>
  2026.     <FILES>
  2027.         <FILE NAME="n3tpa1.dll" PATH="SysDir"></FILE>
  2028.         <FILE NAME="n3tpa1.dll" PATH="Sys32Dir"></FILE>
  2029.         <FILE NAME="netpal.dll" PATH="Sys32Dir"></FILE>
  2030.         <FILE NAME="kernellos.dll" PATH="Sys32Dir"></FILE>
  2031.         <FILE NAME="n3tpa1i.dll" PATH="Sys32Dir"></FILE>   
  2032.         <FILE NAME="n3tpa1i.dll" PATH="SysDir"></FILE>
  2033.         <FILE NAME="n3tpa1p.dll" PATH="SysDir"></FILE>
  2034.         <FILE NAME="n3tpa1p.dll" PATH="Sys32Dir"></FILE>
  2035.     </FILES>
  2036.     <COOKIES>
  2037.         <COOKIE NAME="netpal"></COOKIE>
  2038.         <COOKIE NAME="mindset"></COOKIE>
  2039.         <COOKIE NAME="aadcom"></COOKIE>
  2040.         <COOKIE NAME="onadsolut"></COOKIE>
  2041.     </COOKIES>
  2042.     <REGISTRY>
  2043.         <KEYS>
  2044.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="Destiny"></REGKEY>
  2045.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="NetPalIExplore.NetPal"></REGKEY>
  2046.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="NetPalIExplore.NetPal.1"></REGKEY>
  2047.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{6085FB5B-C281-4b9c-8E5D-D2792EA30D2F}"></REGKEY>
  2048.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{6085FB5B-C281-4B9C-8E5D-D2792EA30D2F}"></REGKEY>
  2049.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{000e7270-cc7a-0786-8e7a-da09b51938a6}"></REGKEY> 
  2050.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{c7ade150-743d-11d4-8141-00e029626f6a}"></REGKEY> 
  2051.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{000e7270-cc7a-0786-8e7a-da09b51938a6}"></REGKEY>
  2052.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{6085FB5B-C281-4b9c-8E5D-D2792EA30D2F}"></REGKEY>
  2053.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{c7ade150-743d-11d4-8141-00e029626f6a}"></REGKEY>
  2054.         </KEYS>
  2055.         <VALUES>
  2056.         </VALUES>
  2057.     </REGISTRY>
  2058.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2059.     <DESCRIPTION>NetPal is adware which delivers ads to the pc, as well as adding additional shortcuts and desktop icons</DESCRIPTION>
  2060. </SW>
  2061. <SW NAME="Network Essentials/SmartPops">
  2062.     <DIRECTORIES>
  2063.        <DIR NAME="Network Essentials" PATH="PFDir"></DIR>
  2064.        <DIR NAME="medialoads enhanced" PATH="PFDir"></DIR>
  2065.     </DIRECTORIES>
  2066.     <FILES>
  2067.         <FILE NAME="Digital Signature.html" PATH="WinDir"></FILE>
  2068.         <FILE NAME="ne.dll" PATH="PFDir\\Network Essentials\\v8"></FILE>
  2069.         <FILE NAME="ne.dll" PATH="PFDir\\Network Essentials\\v9"></FILE>
  2070.         <FILE NAME="ne.dll" PATH="PFDir\\Network Essentials\\v10"></FILE>
  2071.         <FILE NAME="ne.dll" PATH="PFDir\\Network Essentials\\v11"></FILE>
  2072.         <FILE NAME="ne.exe" PATH="PFDir\\Network Essentials\\v11"></FILE>
  2073.         <FILE NAME="rh.dll" PATH=""></FILE>
  2074.     </FILES>
  2075.     <COOKIES>
  2076.     </COOKIES>
  2077.     <REGISTRY>
  2078.         <KEYS>
  2079.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{D5C778F1-CF13-4E70-ADF0-45A953E7CB8B}"></REGKEY>
  2080.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{0421701D-CF13-4E70-ADF0-45A953E7CB8B}"></REGKEY>
  2081.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{D5C778F1-CF13-4E70-ADF0-45A953E7CB8B}"></REGKEY>
  2082.         </KEYS>
  2083.         <VALUES>
  2084.         </VALUES>
  2085.     </REGISTRY>
  2086.     <DANGER_LEVEL>1</DANGER_LEVEL>
  2087.     <DESCRIPTION>Network Essentials hijacks keyword searches to display their sponsored results</DESCRIPTION>
  2088. </SW>
  2089. <SW NAME="W32.Mimail.E">  
  2090.     <DIRECTORIES>
  2091.     </DIRECTORIES>
  2092.     <FILES>
  2093.         <FILE NAME="sysload32.exe" PATH="WinDir"></FILE>
  2094.     </FILES> 
  2095.     <COOKIES>
  2096.     </COOKIES>
  2097.     <REGISTRY>
  2098.         <KEYS>
  2099.         </KEYS>
  2100.         <VALUES>
  2101.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="SystemLoad32"></REGVALUE>
  2102.         </VALUES>
  2103.     </REGISTRY>
  2104.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2105.     <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses</DESCRIPTION>
  2106. </SW>
  2107. <SW NAME="W32.Mimail.D">  
  2108.     <DIRECTORIES>
  2109.     </DIRECTORIES>
  2110.     <FILES>
  2111.         <FILE NAME="cnfrm.exe" PATH="WinDir"></FILE>
  2112.     </FILES> 
  2113.     <COOKIES>
  2114.     </COOKIES>
  2115.     <REGISTRY>
  2116.         <KEYS>
  2117.         </KEYS>
  2118.         <VALUES>
  2119.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Cnfrm32"></REGVALUE>
  2120.         </VALUES>
  2121.     </REGISTRY>
  2122.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2123.     <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses</DESCRIPTION>
  2124. </SW>
  2125. <SW NAME="W32.Mimail.C">  
  2126.     <DIRECTORIES>
  2127.     </DIRECTORIES>
  2128.     <FILES>
  2129.     </FILES> 
  2130.     <COOKIES>
  2131.     </COOKIES>
  2132.     <REGISTRY>
  2133.         <KEYS>
  2134.         </KEYS>
  2135.         <VALUES>
  2136.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="NetWatch32"></REGVALUE>
  2137.         </VALUES>
  2138.     </REGISTRY>
  2139.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2140.     <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses</DESCRIPTION>
  2141. </SW>
  2142. <SW NAME="W32.Mimail.A">  
  2143.     <DIRECTORIES>
  2144.     </DIRECTORIES>
  2145.     <FILES>
  2146.         <FILE NAME="videodrv.exe" PATH="WinDir"></FILE>
  2147.     </FILES> 
  2148.     <COOKIES>
  2149.     </COOKIES>
  2150.     <REGISTRY>
  2151.         <KEYS>
  2152.         </KEYS>
  2153.         <VALUES>
  2154.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="VideoDriver"></REGVALUE>
  2155.         </VALUES>
  2156.     </REGISTRY>
  2157.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2158.     <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses</DESCRIPTION>
  2159. </SW>
  2160. <SW NAME="W32.Mimail.G@mm">  
  2161.     <DIRECTORIES>
  2162.     </DIRECTORIES>
  2163.     <FILES>
  2164.         <FILE NAME="cnfrm33.exe" PATH="WinDir"></FILE>
  2165.     </FILES> 
  2166.     <COOKIES>
  2167.     </COOKIES>
  2168.     <REGISTRY>
  2169.         <KEYS>
  2170.         </KEYS>
  2171.         <VALUES>
  2172.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Cn323"></REGVALUE>
  2173.         </VALUES>
  2174.     </REGISTRY>
  2175.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2176.     <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses</DESCRIPTION>
  2177. </SW>
  2178. <SW NAME="W32.Sobig.A@mm">  
  2179.     <DIRECTORIES>
  2180.     </DIRECTORIES>
  2181.     <FILES>
  2182.         <FILE NAME="Winmgm32.exe" PATH="WinDir"></FILE>
  2183.     </FILES>
  2184.     <COOKIES>
  2185.     </COOKIES>
  2186.     <REGISTRY>
  2187.         <KEYS>
  2188.         </KEYS>
  2189.         <VALUES>
  2190.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="WindowsMGM"></REGVALUE>
  2191.         </VALUES>
  2192.     </REGISTRY>
  2193.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2194.     <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  2195. </SW>
  2196. <SW NAME="W32.Sobig.E">  
  2197.     <DIRECTORIES>
  2198.     </DIRECTORIES>
  2199.     <FILES>
  2200.         <FILE NAME="winssk32.exe" PATH="WinDir"></FILE>
  2201.     </FILES>
  2202.     <COOKIES>
  2203.     </COOKIES>
  2204.     <REGISTRY>
  2205.         <KEYS>
  2206.         </KEYS>
  2207.         <VALUES>
  2208.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="SSK Service"></REGVALUE>
  2209.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="SSK Service"></REGVALUE>
  2210.         </VALUES>
  2211.     </REGISTRY>
  2212.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2213.     <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  2214. </SW>
  2215. <SW NAME="W32.Sobig.B@mm">  
  2216.     <DIRECTORIES>
  2217.     </DIRECTORIES>
  2218.     <FILES>
  2219.         <FILE NAME="msccn32.exe" PATH="WinDir"></FILE>
  2220.     </FILES>
  2221.     <COOKIES>
  2222.     </COOKIES>
  2223.     <REGISTRY>
  2224.         <KEYS>
  2225.         </KEYS>
  2226.         <VALUES>
  2227.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="System Tray"></REGVALUE>
  2228.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="System Tray"></REGVALUE>
  2229.         </VALUES>
  2230.     </REGISTRY>
  2231.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2232.     <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  2233. </SW>
  2234. <SW NAME="W32.Sobig.C@mm">  
  2235.     <DIRECTORIES>
  2236.     </DIRECTORIES>
  2237.     <FILES>
  2238.         <FILE NAME="mscvb32.exe" PATH="WinDir"></FILE>
  2239.     </FILES>
  2240.     <COOKIES>
  2241.     </COOKIES>
  2242.     <REGISTRY>
  2243.         <KEYS>
  2244.         </KEYS>
  2245.         <VALUES>
  2246.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="System MScvb"></REGVALUE>
  2247.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="System MScvb"></REGVALUE>
  2248.         </VALUES>
  2249.     </REGISTRY>
  2250.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2251.     <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  2252. </SW>
  2253. <SW NAME="W32.Sobig.D@mm">  
  2254.     <DIRECTORIES>
  2255.     </DIRECTORIES>
  2256.     <FILES>
  2257.         <FILE NAME="cftrb32.exe" PATH="WinDir"></FILE>
  2258.     </FILES>
  2259.     <COOKIES>
  2260.     </COOKIES>
  2261.     <REGISTRY>
  2262.         <KEYS>
  2263.         </KEYS>
  2264.         <VALUES>
  2265.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="SFtrb Service"></REGVALUE>
  2266.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="SFtrb Service"></REGVALUE>
  2267.         </VALUES>
  2268.     </REGISTRY>
  2269.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2270.     <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  2271. </SW>
  2272. <SW NAME="W32.Logitall.A@mm">  
  2273.     <DIRECTORIES>
  2274.     </DIRECTORIES>
  2275.     <FILES>
  2276.         <FILE NAME="MyV.exe" PATH=""></FILE>
  2277.         <FILE NAME="SysInfoMyV.txt" PATH="SysDir"></FILE>
  2278.     </FILES> 
  2279.     <COOKIES>
  2280.     </COOKIES>
  2281.     <REGISTRY>
  2282.         <KEYS>
  2283.         </KEYS>
  2284.         <VALUES>
  2285.         </VALUES>
  2286.     </REGISTRY>
  2287.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2288.     <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses</DESCRIPTION>
  2289. </SW>
  2290. <SW NAME="W32.Hopalong@mm">  
  2291.     <DIRECTORIES>
  2292.     </DIRECTORIES>
  2293.     <FILES>
  2294.         <FILE NAME="Hop_along.exe" PATH="WinDir"></FILE>
  2295.     </FILES> 
  2296.     <COOKIES>
  2297.     </COOKIES>
  2298.     <REGISTRY>
  2299.         <KEYS>
  2300.         </KEYS>
  2301.         <VALUES>
  2302.         </VALUES>
  2303.     </REGISTRY>
  2304.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2305.     <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses</DESCRIPTION>
  2306. </SW>
  2307. <SW NAME="AccessMembre/Dialer.Montil">
  2308.     <DIRECTORIES>
  2309.     </DIRECTORIES>
  2310.     <FILES>
  2311.         <FILE NAME="accesmembre.dll" PATH=""></FILE>
  2312.     </FILES>
  2313.     <COOKIES>
  2314.     </COOKIES>
  2315.     <REGISTRY>
  2316.        <KEYS>
  2317.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{d1b80ebf-1a26-4fec-b0b9-dcb934c6507e}"></REGKEY>
  2318.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{a41c6220-6f42-4646-b119-fbe6f4d38e3c}"></REGKEY>
  2319.        </KEYS>
  2320.        <VALUES>
  2321.        </VALUES>
  2322.     </REGISTRY>
  2323.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2324.     <DESCRIPTION>Extremely dangerous dialer program that dials a very expensive number to access pornography</DESCRIPTION>
  2325. </SW>
  2326. <SW NAME="Win32.Holar.G">
  2327.     <DIRECTORIES>
  2328.     </DIRECTORIES>
  2329.     <FILES>
  2330.         <FILE NAME="explore.exe" PATH="Sys32Dir"></FILE>
  2331.         <FILE NAME="smtp.ocx" PATH="Sys32Dir"></FILE>
  2332.     </FILES>
  2333.     <COOKIES>
  2334.     </COOKIES>
  2335.     <REGISTRY>
  2336.         <KEYS>
  2337.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{3df2ae35-26a8-11d4-bdd2-00104bfec09f}"></REGKEY> 
  2338.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="smtpcontrol.smtp"></REGKEY> 
  2339.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{3df2ae33-26a8-11d4-bdd2-00104bfec09f}"></REGKEY> 
  2340.         </KEYS>
  2341.         <VALUES>
  2342.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="explore"></REGVALUE>
  2343.         </VALUES>
  2344.     </REGISTRY>
  2345.     <DANGER_LEVEL>1</DANGER_LEVEL>
  2346.     <DESCRIPTION>It is a mass-mailing worm that sends itself to the email addresses</DESCRIPTION>
  2347. </SW>
  2348. <SW NAME="W32/Holar-C"> 
  2349.     <DIRECTORIES>
  2350.     </DIRECTORIES>
  2351.     <FILES>
  2352.          <FILE NAME="CmdServ.exe" PATH="SysDir"></FILE>
  2353.         <FILE NAME="Mplayer.exe" PATH="SysDir"></FILE>
  2354.         <FILE NAME="Mplayer.exe" PATH="Sys32Dir"></FILE>
  2355.     </FILES> 
  2356.     <COOKIES>
  2357.     </COOKIES>
  2358.     <REGISTRY>
  2359.         <KEYS>
  2360.         </KEYS>
  2361.         <VALUES>
  2362.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="iLLeGal"></REGVALUE>
  2363.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="MyLife"></REGVALUE>
  2364.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="ZaCker"></REGVALUE>
  2365.         </VALUES>
  2366.     </REGISTRY>
  2367.     <DANGER_LEVEL>1</DANGER_LEVEL>
  2368.     <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses</DESCRIPTION>
  2369. </SW>
  2370. <SW NAME="W32.Gramos">  
  2371.     <DIRECTORIES>
  2372.     </DIRECTORIES>
  2373.     <FILES>
  2374.         <FILE NAME="Msgran.exe" PATH=""></FILE>
  2375.     </FILES> 
  2376.     <COOKIES>
  2377.     </COOKIES>
  2378.     <REGISTRY>
  2379.         <KEYS>
  2380.         </KEYS>
  2381.         <VALUES>
  2382.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Messenger start-up"></REGVALUE>
  2383.         </VALUES>
  2384.     </REGISTRY>
  2385.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2386.     <DESCRIPTION>Worm that allows unauthorized access to your PC</DESCRIPTION>
  2387. </SW>
  2388. <SW NAME="VirtuMonde/WindowsUpd">  
  2389.     <DIRECTORIES>
  2390.     </DIRECTORIES>
  2391.     <FILES>
  2392.         <FILE NAME="WindowsUpd1.exe" PATH="WinDir"></FILE>
  2393.         <FILE NAME="WindowsUpd2.exe" PATH="WinDir"></FILE>
  2394.         <FILE NAME="WindowsUpd4.exe" PATH="WinDir"></FILE>
  2395.     </FILES> 
  2396.     <COOKIES>
  2397.     </COOKIES>
  2398.     <REGISTRY>
  2399.         <KEYS>
  2400.         </KEYS>
  2401.         <VALUES>
  2402.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="WindowsUpd"></REGVALUE>
  2403.         </VALUES>
  2404.     </REGISTRY>
  2405.     <DANGER_LEVEL>1</DANGER_LEVEL>
  2406.     <DESCRIPTION>Adware that will spawn pop up advertisements</DESCRIPTION>
  2407. </SW>
  2408. <SW NAME="Veevo">  
  2409.     <DIRECTORIES>
  2410.     </DIRECTORIES>
  2411.     <FILES>
  2412.         <FILE NAME="VEEVO.DLL" PATH="SysDir"></FILE>
  2413.         <FILE NAME="VEEVO.DLL" PATH="Sys32Dir"></FILE>
  2414.     </FILES> 
  2415.     <COOKIES>
  2416.     </COOKIES>
  2417.     <REGISTRY>
  2418.         <KEYS>
  2419.         </KEYS>
  2420.         <VALUES>
  2421.         </VALUES>
  2422.     </REGISTRY>
  2423.     <DANGER_LEVEL>1</DANGER_LEVEL>
  2424.     <DESCRIPTION>Browser helper object used to control internet settings</DESCRIPTION>
  2425. </SW>
  2426. <SW NAME="Trojan.Myss.B">  
  2427.     <DIRECTORIES>
  2428.     </DIRECTORIES>
  2429.     <FILES>
  2430.         <FILE NAME="mssys.exe" PATH="WinDir"></FILE>
  2431.     </FILES> 
  2432.     <COOKIES>
  2433.     </COOKIES>
  2434.     <REGISTRY>
  2435.         <KEYS>
  2436.         </KEYS>
  2437.         <VALUES>
  2438.         </VALUES>
  2439.     </REGISTRY>
  2440.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2441.     <DESCRIPTION>Trojan that allows unauthorized parties access to your PC</DESCRIPTION>
  2442. </SW>
  2443. <SW NAME="Tatss">  
  2444.     <DIRECTORIES>
  2445.         <DIR NAME="pgtools" PATH="Sys32Dir"></DIR>
  2446.     </DIRECTORIES>
  2447.     <FILES>
  2448.         <FILE NAME="tatss.exe" PATH="Sys32Dir\\pgtools"></FILE>
  2449.     </FILES> 
  2450.     <COOKIES>
  2451.     </COOKIES>
  2452.     <REGISTRY>
  2453.         <KEYS>
  2454.         </KEYS>
  2455.         <VALUES>
  2456.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="tat"></REGVALUE>
  2457.         </VALUES>
  2458.     </REGISTRY>
  2459.     <DANGER_LEVEL>1</DANGER_LEVEL>
  2460.     <DESCRIPTION>Known to spawn pop up advertisements</DESCRIPTION>
  2461. </SW>
  2462. <SW NAME="Syscpy Spam Proxy/Atztecmarketing.syscpy">  
  2463.     <DIRECTORIES>
  2464.     </DIRECTORIES>
  2465.     <FILES>
  2466.         <FILE NAME="syscpy.exe" PATH="SysDir"></FILE>
  2467.         <FILE NAME="syscpy.exe" PATH="Sys32Dir"></FILE>
  2468.     </FILES> 
  2469.     <COOKIES>
  2470.     </COOKIES>
  2471.     <REGISTRY>
  2472.         <KEYS>
  2473.         </KEYS>
  2474.         <VALUES>
  2475.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="{e0e899ab-f487-11d5-8d29-0050ba6940e3}"></REGVALUE>
  2476.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Syscpy"></REGVALUE>
  2477.         </VALUES>
  2478.     </REGISTRY>
  2479.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2480.     <DESCRIPTION>Set up to allow your computer to be used as a relay for spammers</DESCRIPTION>
  2481. </SW>
  2482. <SW NAME="Syscm">  
  2483.     <DIRECTORIES>
  2484.     </DIRECTORIES>
  2485.     <FILES>
  2486.         <FILE NAME="Syscm.exe" PATH="Sys32Dir"></FILE>
  2487.     </FILES> 
  2488.     <COOKIES>
  2489.     </COOKIES>
  2490.     <REGISTRY>
  2491.         <KEYS>
  2492.         </KEYS>
  2493.         <VALUES>
  2494.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="syscm"></REGVALUE>
  2495.         </VALUES>
  2496.     </REGISTRY>
  2497.     <DANGER_LEVEL>1</DANGER_LEVEL>
  2498.     <DESCRIPTION>Attempts to download new files as well as change your internet settings</DESCRIPTION>
  2499. </SW>
  2500. <SW NAME="Spoolsvv"> 
  2501.      <DIRECTORIES>
  2502.     </DIRECTORIES>
  2503.      <FILES>
  2504.          <FILE NAME="spoolsvv.exe" PATH="Sys32Dir"></FILE>
  2505.      </FILES>
  2506.      <COOKIES>
  2507.      </COOKIES>
  2508.      <REGISTRY>
  2509.          <KEYS>
  2510.          </KEYS>
  2511.          <VALUES>
  2512.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Spoolsvv"></REGVALUE>
  2513.          </VALUES>
  2514.      </REGISTRY>
  2515.     <DANGER_LEVEL>1</DANGER_LEVEL>
  2516.     <DESCRIPTION>Runs at startup with no legitimate purpose</DESCRIPTION>
  2517. </SW>
  2518. <SW NAME="RapidBlaster">
  2519.     <DIRECTORIES>
  2520.         <DIR NAME="RapidBlaster" PATH="PFDir"></DIR>
  2521.     </DIRECTORIES>
  2522.     <FILES>
  2523.         <FILE NAME="rb32.exe" PATH="PFDir\\rapidblaster"></FILE>
  2524.     </FILES>
  2525.     <COOKIES>
  2526.         <COOKIE NAME="rapidblaster"></COOKIE>
  2527.     </COOKIES>
  2528.     <REGISTRY>
  2529.         <KEYS>
  2530.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="RapidBlaster"></REGKEY>
  2531.         </KEYS>
  2532.         <VALUES>
  2533.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="rb32 lptt01"></REGVALUE>
  2534.         </VALUES>
  2535.     </REGISTRY>
  2536.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2537.     <DESCRIPTION>RapidBlaster runs at windows startup, and records all information entered into forms when browsing</DESCRIPTION>
  2538. </SW>
  2539. <SW NAME="Search-Explorer">
  2540.     <DIRECTORIES>
  2541.         <DIR NAME="Search-Explorer" PATH="WinDir\\Downloaded Program Files"></DIR>
  2542.         <DIR NAME="search-explorer" PATH="PFDir"></DIR>
  2543.     </DIRECTORIES>
  2544.     <FILES>
  2545.         <FILE NAME="explbar.dll" PATH="PFDir\\search-explorer"></FILE>
  2546.         <FILE NAME="explbar.dll" PATH="WinDir\\downloaded program files"></FILE>
  2547.     </FILES>
  2548.     <COOKIES>
  2549.         <COOKIE NAME="adpowerzone"></COOKIE>
  2550.     </COOKIES>
  2551.     <REGISTRY>
  2552.         <KEYS>
  2553.         </KEYS>
  2554.         <VALUES>
  2555.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar\\WebBrowser" VALUE="{23DDAE8C-6A79-4d62-80AA-E95D89CB9811}"></REGVALUE>
  2556.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{23DDAE8C-6A79-4d62-80AA-E95D89CB9811}"></REGVALUE>
  2557.         </VALUES>
  2558.     </REGISTRY>
  2559.     <DANGER_LEVEL>1</DANGER_LEVEL>
  2560.     <DESCRIPTION>Internet explorer toolbar that slows down PC/Browsing</DESCRIPTION>
  2561. </SW>
  2562. <SW NAME="TinyBar">
  2563.     <DIRECTORIES>
  2564.     </DIRECTORIES>
  2565.     <FILES>
  2566.         <FILE NAME="tinybar.html" PATH="SysDir"></FILE>
  2567.         <FILE NAME="hb.html" PATH="SysDir"></FILE>
  2568.         <FILE NAME="br.reg" PATH="SysDir"></FILE>
  2569.         <FILE NAME="br.dll" PATH="SysDir"></FILE>
  2570.         <FILE NAME="hb.reg" PATH="SysDir"></FILE>
  2571.         <FILE NAME="sp.dll" PATH="SysDir"></FILE>
  2572.         <FILE NAME="atk.vbs" PATH="SysDir"></FILE>
  2573.         <FILE NAME="tinybar.exe" PATH="WinDir"></FILE>
  2574.     </FILES>
  2575.     <COOKIES>
  2576.         <COOKIE NAME="internet-eraser"></COOKIE>
  2577.         <COOKIE NAME="zeropopup"></COOKIE>
  2578.         <COOKIE NAME="tinybar"></COOKIE>
  2579.         <COOKIE NAME="allcybersearch"></COOKIE>
  2580.         <COOKIE NAME="gocybersearch"></COOKIE>
  2581.         <COOKIE NAME="topsearcher"></COOKIE>
  2582.         <COOKIE NAME="znext"></COOKIE>
  2583.         <COOKIE NAME="traffic4sure"></COOKIE>
  2584.         <COOKIE NAME="errorpage404"></COOKIE>
  2585.         <COOKIE NAME="searchaccurate"></COOKIE>
  2586.         <COOKIE NAME="ourlinklist"></COOKIE>
  2587.         <COOKIE NAME="topclicks"></COOKIE>
  2588.         <COOKIE NAME="iseekresults"></COOKIE>
  2589.         <COOKIE NAME="ysearchus"></COOKIE>
  2590.     </COOKIES>
  2591.     <REGISTRY>
  2592.         <KEYS>
  2593.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Internet Explorer\\Explorer Bars" VALUE="{69550BE2-9A78-11d2-BA91-00600827878D}"></REGKEY>
  2594.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Internet Explorer\\Explorer Bars" VALUE="{69555BE2-9A78-11d2-BA91-00600827878D}"></REGKEY>
  2595.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\CLSID" VALUE="{69550BE2-9A78-11d2-BA91-00600827878D}"></REGKEY>
  2596.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\CLSID" VALUE="{69555BE2-9A78-11d2-BA91-00600827878D}"></REGKEY>            
  2597.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{8fb0f3e2-5193-11d7-9f88-0050fc5441cb}"></REGKEY>
  2598.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Internet Explorer\\Explorer Bars" VALUE="{8FB0F3E2-5193-11D7-9F88-0050FC5441CB}"></REGKEY>
  2599.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Internet Explorer\\Explorer Bars" VALUE="{82599E0A-8C81-11D7-9F97-0050FC5441CB}"></REGKEY>
  2600.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{82599E0A-8C81-11D7-9F97-0050FC5441CB}"></REGKEY>
  2601.         </KEYS>
  2602.         <VALUES>
  2603.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{69550BE2-9A78-11d2-BA91-00600827878D}"></REGVALUE>
  2604.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{69555BE2-9A78-11d2-BA91-00600827878D}"></REGVALUE>
  2605.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{8FB0F3E2-5193-11D7-9F88-0050FC5441CB}"></REGVALUE>
  2606.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{82599E0A-8C81-11D7-9F97-0050FC5441CB}"></REGVALUE>
  2607.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Messenger"></REGVALUE>
  2608.         </VALUES>
  2609.     </REGISTRY>
  2610.     <DANGER_LEVEL>1</DANGER_LEVEL>
  2611.     <DESCRIPTION>TinyBar hijacks search options to default to their sites</DESCRIPTION>
  2612. </SW>
  2613. <SW NAME="Transponder">
  2614.     <DIRECTORIES>
  2615.     </DIRECTORIES>
  2616.     <FILES>
  2617.         <FILE NAME="IEHelper.DLL" PATH="WinDir"></FILE>
  2618.         <FILE NAME="VX2.dll" PATH="WinDir"></FILE>
  2619.         <FILE NAME="TPS108.dll" PATH="WinDir"></FILE>
  2620.         <FILE NAME="MSView.dll" PATH="WinDir"></FILE>
  2621.         <FILE NAME="MSView.dll" PATH="ProfilePath\\local settings"></FILE>
  2622.         <FILE NAME="msview.dll" PATH="SysDir"></FILE> 
  2623.         <FILE NAME="host.dll" PATH="WinDir"></FILE>
  2624.         <FILE NAME="sitehlpr.dll" PATH="WinDir"></FILE>
  2625.         <FILE NAME="MSView.ini" PATH="WinDir"></FILE>
  2626.          <FILE NAME="tps108.html" PATH=""></FILE>
  2627.         <FILE NAME="bc777.html" PATH=""></FILE>
  2628.         <FILE NAME="hostprep.exe" PATH="Sysdir"></FILE>
  2629.         <FILE NAME="hostprep.exe" PATH="Sys32dir"></FILE>
  2630.         <FILE NAME="ehelper.dll" PATH="SysDir"></FILE>
  2631.         <FILE NAME="msvprep.exe" PATH="WinDir"></FILE>
  2632.     </FILES>
  2633.     <COOKIES>
  2634.         <COOKIE NAME="mindset"></COOKIE>
  2635.         <COOKIE NAME="aadcom"></COOKIE>
  2636.         <COOKIE NAME="onadsolut"></COOKIE>
  2637.     </COOKIES>
  2638.     <REGISTRY>
  2639.         <KEYS>
  2640.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="Transponder"></REGKEY>
  2641.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="RespondMiter"></REGKEY>
  2642.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="TPS108"></REGKEY>
  2643.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="HostDll"></REGKEY>
  2644.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="SiteHlpr"></REGKEY>
  2645.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="MSView"></REGKEY>
  2646.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\code store database\\distribution units" VALUE="{30000273-8230-4dd4-be4f-6889d1e74167}"></REGKEY>
  2647.         </KEYS>
  2648.         <VALUES>
  2649.         </VALUES>
  2650.     </REGISTRY>
  2651.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2652.     <DESCRIPTION>Transponder is adware which delivers ads to the pc, as well as adding additional shortcuts and desktop icons</DESCRIPTION>
  2653. </SW>
  2654. <SW NAME="UCMore">
  2655.     <DIRECTORIES>
  2656.         <DIR NAME="UCMore" PATH="PFDir"></DIR>
  2657.     </DIRECTORIES>
  2658.     <FILES>
  2659.         <FILE NAME="UCMIE.dll" PATH="SysDir"></FILE>
  2660.         <FILE NAME="UCMIE.dll" PATH="Sys32Dir"></FILE>
  2661.         <FILE NAME="UCMIE.dll" PATH="PFDir\\UCMore"></FILE>
  2662.         <FILE NAME="iucmore.dll" PATH="PFDir\\UCMore"></FILE> 
  2663.     </FILES>
  2664.     <COOKIES>
  2665.     </COOKIES>
  2666.     <REGISTRY>
  2667.         <KEYS>
  2668.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES" VALUE="53CBEE82-D747-11D3-9ED0-005004189684"></REGKEY>
  2669.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="" VALUE="UCmore"></REGKEY>
  2670.         </KEYS>
  2671.         <VALUES>
  2672.         </VALUES>
  2673.     </REGISTRY>
  2674.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2675.     <DESCRIPTION>UCMore is a browser addon that also records all visited urls and reports them to a central server</DESCRIPTION>
  2676. </SW>
  2677. <SW NAME="Spytech SpyAgent">
  2678.     <DIRECTORIES>
  2679.     </DIRECTORIES>
  2680.     <FILES>
  2681.          <FILE NAME="spyagent.exe" PATH="PFDir\\spytech software\\spyagent professional"></FILE>
  2682.          <FILE NAME="spyrename.exe" PATH="PFDir\\spytech software\\spyagent professional"></FILE>
  2683.          <FILE NAME="systemsa32.dll" PATH=""></FILE>
  2684.     </FILES>
  2685.     <COOKIES>
  2686.     </COOKIES>
  2687.     <REGISTRY>
  2688.         <KEYS>
  2689.         </KEYS>
  2690.         <VALUES>
  2691.         </VALUES>
  2692.     </REGISTRY>
  2693.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2694.     <DESCRIPTION>Spytech Spyagent will record all activities on your PC</DESCRIPTION>
  2695. </SW>
  2696. <SW NAME="Wazam">
  2697.     <DIRECTORIES>
  2698.         <DIR NAME="Wazam.com" PATH="PFDir"></DIR>
  2699.         <DIR NAME="Wazam.com Toolbar" PATH="PFDir\\CursorArts\\IconForge"></DIR>
  2700.     </DIRECTORIES>
  2701.     <FILES>
  2702.         <FILE NAME="SBar.dll" PATH="PFDir\\CursorArts\\IconForge\\Wazam.com Toolbar"></FILE>
  2703.     </FILES>
  2704.     <COOKIES>
  2705.         <COOKIE NAME="favicon"></COOKIE>
  2706.         <COOKIE NAME="wazam"></COOKIE>
  2707.     </COOKIES>
  2708.     <REGISTRY>
  2709.         <KEYS>
  2710.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="SBB"></REGKEY>
  2711.         </KEYS>
  2712.         <VALUES>
  2713.         </VALUES>
  2714.     </REGISTRY>
  2715.     <DANGER_LEVEL>1</DANGER_LEVEL>
  2716.     <DESCRIPTION>Wazam is a browser addon that provides certain search features, but stays resident in the background and hides itself from the user</DESCRIPTION>
  2717. </SW>
  2718. <SW NAME="WurldMedia"> 
  2719.     <DIRECTORIES>
  2720.     </DIRECTORIES>
  2721.     <FILES>
  2722.        <FILE NAME="moz030715s.dll" PATH="SysDir"></FILE>
  2723.        <FILE NAME="moz030715s.dll" PATH="Sys32Dir"></FILE>
  2724.        <FILE NAME="moconfig.exe" PATH="SysDir"></FILE>
  2725.        <FILE NAME="moconfig.exe" PATH="Sys32Dir"></FILE>
  2726.        <FILE NAME="bpboh.dll" PATH="WinDir"></FILE>
  2727.        <FILE NAME="bpbho.dll" PATH="WinDir"></FILE>
  2728.        <FILE NAME="mbho.dll" PATH="SysDir"></FILE>
  2729.        <FILE NAME="mbho.dll" PATH="Sys32Dir"></FILE>
  2730.        <FILE NAME="mobho.dll" PATH=""></FILE>
  2731.        <FILE NAME="mostat.exe" PATH=""></FILE>
  2732.        <FILE NAME="MSCStat.exe" PATH="SysDir"></FILE>
  2733.        <FILE NAME="MSCStat2.exe" PATH="SysDir"></FILE>
  2734.        <FILE NAME="mdefshop.dll" PATH="SysDir"></FILE>
  2735.        <FILE NAME="mdefshop.dll" PATH="Sys32Dir"></FILE>
  2736.        <FILE NAME="bpboh.dll" PATH="Sys32Dir"></FILE>
  2737.        <FILE NAME="m030106shop.dll" PATH="Sys32Dir"></FILE>
  2738.        <FILE NAME="m030106shop.dll" PATH="SysDir"></FILE>
  2739.        <FILE NAME="m030206pohs.dll" PATH="SysDir"></FILE>
  2740.        <FILE NAME="m030206pohs.dll" PATH="Sys32Dir"></FILE>
  2741.        <FILE NAME="mo030414s.dll" PATH="Sys32Dir"></FILE>
  2742.        <FILE NAME="mo030414s.dll" PATH="SysDir"></FILE>
  2743.        <FILE NAME="moaa030425s.dll" PATH="SysDir"></FILE>
  2744.        <FILE NAME="moaa030425s.dll" PATH="Sys32Dir"></FILE>
  2745.     </FILES>
  2746.     <COOKIES>
  2747.     </COOKIES>
  2748.     <REGISTRY>
  2749.     <KEYS>
  2750.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software" VALUE="morp"></REGKEY>
  2751.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{3a279869-c6b6-4410-a041-0435de6ad916}"></REGKEY>  
  2752.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="rdxr"></REGKEY>
  2753.         <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="tchk.tchkbho"></REGKEY> 
  2754.         <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="tchk.tchkbho.1"></REGKEY>
  2755.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{2737a6c0-7e24-11d7-b299-00e0297e0844}"></REGKEY>
  2756.         <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{2737a6c0-7e24-11d7-b299-00e0297e0844}"></REGKEY>
  2757.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{525bbd23-1863-46c6-86d6-5f9a3715d44e}"></REGKEY>
  2758.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{5A3A5040-4210-11D7-BD2E-00080E34122F}"></REGKEY>
  2759.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{8E9C4F32-BD3F-4C49-9AF5-3F4C5D32EBD7}"></REGKEY>
  2760.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{98D7B53E-B1D2-4755-B0A4-703E18FF91E8}"></REGKEY>
  2761.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{CDBCFEAE-10BA-482C-9F6E-FC67207082D8}"></REGKEY>
  2762.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{D14641FA-445B-448E-9994-209f7AF15641}"></REGKEY>
  2763.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{F325E940-45EE-11D7-A420-444553540000}"></REGKEY>
  2764.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{2737a6c0-7e24-11d7-b299-00e0297e0844}"></REGKEY>
  2765.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{3a279869-c6b6-4410-a041-0435de6ad916}"></REGKEY>
  2766.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{40AC4D2D-491D-11D4-AAF2-0008C75DCD2B}"></REGKEY>
  2767.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{525BBD23-1863-46C6-86D6-5F9A3715D44E}"></REGKEY>
  2768.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{5A3A5040-4210-11D7-BD2E-00080E34122F}"></REGKEY>
  2769.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{8E9C4F32-BD3F-4C49-9AF5-3F4C5D32EBD7}"></REGKEY>
  2770.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{98D7B53E-B1D2-4755-B0A4-703E18FF91E8}"></REGKEY>
  2771.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{CDBCFEAE-10BA-482C-9F6E-FC67207082D8}"></REGKEY>
  2772.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{D14641FA-445B-448E-9994-209f7AF15641}"></REGKEY>
  2773.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{F325E940-45EE-11D7-A420-444553540000}"></REGKEY>
  2774.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Shopping Community" VALUE="DisplayName"></REGKEY>
  2775.     </KEYS>
  2776.     <VALUES>
  2777.     </VALUES>
  2778.     </REGISTRY>
  2779.     <DANGER_LEVEL>2</DANGER_LEVEL>
  2780.     <DESCRIPTION>WurldMedia steals affiliate commissions by redirecting visitors through their servers</DESCRIPTION>
  2781. </SW>
  2782. <SW NAME="SaveNow">
  2783.     <DIRECTORIES>
  2784.         <DIR NAME="WhenUDownload" PATH="WinDir\\Downloaded Program Files"></DIR>
  2785.         <DIR NAME="Db" PATH="WinDir\\Downloaded Program Files"></DIR>
  2786.         <DIR NAME="SavNow" PATH="PFDir"></DIR>
  2787.         <DIR NAME="SaveNow" PATH="PFDir"></DIR>
  2788.         <DIR NAME="Save" PATH="PFDir"></DIR>
  2789.     </DIRECTORIES>
  2790.     <FILES>
  2791.         <FILE NAME="savenow.db" PATH="PFDir\\SaveNow"></FILE>
  2792.         <FILE NAME="save.exe" PATH="PFDir\\Save"></FILE>
  2793.     </FILES>
  2794.     <COOKIES>
  2795.         <COOKIE NAME="whenu"></COOKIE>
  2796.     </COOKIES>
  2797.     <REGISTRY>
  2798.         <KEYS>
  2799.         </KEYS>
  2800.         <VALUES>
  2801.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{e2f2b9d0-96b9-4b25-b90c-636ecb207d18}"></REGKEY>
  2802.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{e2f2b9d0-96b9-4b25-b90c-636ecb207d18}"></REGKEY>
  2803.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="SaveNow"></REGVALUE>
  2804.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="WhenUSave"></REGVALUE>
  2805.         </VALUES>
  2806.     </REGISTRY>
  2807.     <DANGER_LEVEL>3</DANGER_LEVEL>
  2808.     <DESCRIPTION>SaveNow downloads and displays advertisements to the PC</DESCRIPTION>
  2809. </SW>
  2810. <SW NAME="lop">
  2811.     <DIRECTORIES>
  2812.         <DIR NAME="Window Active" PATH="PFDir"></DIR>
  2813.     </DIRECTORIES>
  2814.     <FILES>
  2815.         <FILE NAME="winactive.exe" PATH="PFDir\\Window Active"></FILE>
  2816.         <FILE NAME="chksbdrlya.dll" PATH=""></FILE>
  2817.         <FILE NAME="dmvcrthl.exe" PATH=""></FILE>
  2818.         <FILE NAME="eaeeishllblc.dll" PATH=""></FILE>
  2819.         <FILE NAME="eelykofrllfrj.dll" PATH=""></FILE>
  2820.         <FILE NAME="ealymfrprwch.dll" PATH=""></FILE>
  2821.         <FILE NAME="epllkeeoopr.dll" PATH=""></FILE>
  2822.         <FILE NAME="freabrlaouw.dll" PATH=""></FILE>
  2823.         <FILE NAME="gldqumssfrie.dll" PATH=""></FILE>
  2824.         <FILE NAME="hglllyxrxw.dll" PATH=""></FILE>
  2825.         <FILE NAME="icdrhwno.dll" PATH=""></FILE>
  2826.         <FILE NAME="heeachmstll.dll" PATH=""></FILE>
  2827.         <FILE NAME="meepajlr.dll" PATH=""></FILE>
  2828.         <FILE NAME="ousszidrta.dll" PATH=""></FILE>
  2829.         <FILE NAME="prnouestssstx.dll" PATH=""></FILE>
  2830.         <FILE NAME="quglwachfs.dll" PATH=""></FILE>
  2831.         <FILE NAME="sstroallhqch.dll" PATH=""></FILE>
  2832.         <FILE NAME="tblchepruprgr.dll" PATH=""></FILE>
  2833.         <FILE NAME="trdzhtxf.exe" PATH=""></FILE>
  2834.         <FILE NAME="trstshcrscksr.dll" PATH=""></FILE>
  2835.         <FILE NAME="ukfroigl.dll" PATH=""></FILE>
  2836.         <FILE NAME="upckeetoutw.dll" PATH=""></FILE>
  2837.         <FILE NAME="veaeyglckr.dll" PATH=""></FILE>
  2838.         <FILE NAME="woafrquzn.dll" PATH=""></FILE>
  2839.         <FILE NAME="eelykofrllfrpr.dll" PATH=""></FILE>
  2840.         <FILE NAME="yeecrsoustoull.dll" PATH=""></FILE>
  2841.         <FILE NAME="ziebaeeoaeepr.dll" PATH=""></FILE>
  2842.         <FILE NAME="prxzoustustgr.dll" PATH=""></FILE>
  2843.         <FILE NAME="plg_ie0.dll" PATH=""></FILE>
  2844.         <FILE NAME="plg_ie1.dll" PATH=""></FILE>
  2845.         <FILE NAME="plg_ie2.dll" PATH=""></FILE>
  2846.         <FILE NAME="plg_ie3.dll" PATH=""></FILE>
  2847.         <FILE NAME="plg_ie4.dll" PATH=""></FILE>
  2848.         <FILE NAME="plg_ie5.dll" PATH=""></FILE>
  2849.         <FILE NAME="plg_ie6.dll" PATH=""></FILE>
  2850.         <FILE NAME="plg_ie7.dll" PATH=""></FILE>
  2851.         <FILE NAME="plg_ie8.dll" PATH=""></FILE>
  2852.         <FILE NAME="plg_ie9.dll" PATH=""></FILE>
  2853.         <FILE NAME="quizbt0.dll" PATH=""></FILE>
  2854.         <FILE NAME="quizbt1.dll" PATH=""></FILE>
  2855.         <FILE NAME="quizbt2.dll" PATH=""></FILE>
  2856.         <FILE NAME="quizbt3.dll" PATH=""></FILE>
  2857.         <FILE NAME="quizbt4.dll" PATH=""></FILE>
  2858.         <FILE NAME="quizbt5.dll" PATH=""></FILE>
  2859.         <FILE NAME="quizbt6.dll" PATH=""></FILE>
  2860.         <FILE NAME="quizbt7.dll" PATH=""></FILE>
  2861.         <FILE NAME="quizbt8.dll" PATH=""></FILE>
  2862.         <FILE NAME="quizbt9.dll" PATH=""></FILE>
  2863.         <FILE NAME="blztstulla.dll" PATH=""></FILE>
  2864.         <FILE NAME="blztstullc.dll" PATH=""></FILE>
  2865.         <FILE NAME="blztstullj.dll" PATH=""></FILE>
  2866.         <FILE NAME="blztstullp.dll" PATH=""></FILE>
  2867.         <FILE NAME="blztstulls.dll" PATH=""></FILE>
  2868.         <FILE NAME="blztstullt.dll" PATH=""></FILE>
  2869.         <FILE NAME="blztstully.dll" PATH=""></FILE>
  2870.         <FILE NAME="blztstullpr.dll" PATH=""></FILE>
  2871.         <FILE NAME="blztstulltr.dll" PATH=""></FILE>
  2872.         <FILE NAME="blztstulloo.dll" PATH=""></FILE>
  2873.         <FILE NAME="meemnckyqbr.exe" PATH=""></FILE>
  2874.         <FILE NAME="ulyuiexeechp.exe" PATH=""></FILE>
  2875.         <FILE NAME="byb_save.exe" PATH=""></FILE>
  2876.         <FILE NAME="peebqusz.exe" PATH=""></FILE>
  2877.         <FILE NAME="tchejea.lib" PATH=""></FILE>
  2878.         <FILE NAME="iCndE.lib" PATH=""></FILE>
  2879.         <FILE NAME="desktop.htm" PATH="WinDir"></FILE>
  2880.         <FILE NAME="dnserror.htm" PATH="WinDir"></FILE>
  2881.         <FILE NAME="jexpoofro.htm" PATH="WinDir"></FILE>
  2882.         <FILE NAME="i_dnserr.gif" PATH="WinDir"></FILE>
  2883.         <FILE NAME="s_dnserr.gif" PATH="WinDir"></FILE>
  2884.         <FILE NAME="r_dnserr.gif" PATH="WinDir"></FILE>
  2885.         <FILE NAME="b_dnserr.gif" PATH="WinDir"></FILE>
  2886.         <FILE NAME="tiejexpoo.gif" PATH="WinDir"></FILE>
  2887.         <FILE NAME="xiejexpoo.gif" PATH="WinDir"></FILE>
  2888.         <FILE NAME="oiejexpoo.gif" PATH="WinDir"></FILE>
  2889.         <FILE NAME="uiejexpoo.gif" PATH="WinDir"></FILE>
  2890.         <FILE NAME="mp3.exe" PATH=""></FILE>
  2891.         <FILE NAME="mp3serch.exe" PATH=""></FILE>
  2892.         <FILE NAME="FreeMP3.exe" PATH=""></FILE>
  2893.         <FILE NAME="freemp3z.exe" PATH=""></FILE>
  2894.         <FILE NAME="FreeMP3Music.exe" PATH=""></FILE>
  2895.         <FILE NAME="free_sex_viewer.exe" PATH=""></FILE>
  2896.         <FILE NAME="free_deals.exe" PATH=""></FILE>
  2897.         <FILE NAME="Software_Plugin.exe" PATH=""></FILE>
  2898.         <FILE NAME="download_file.exe" PATH=""></FILE>
  2899.         <FILE NAME="The_Ultimate_Browser_Enhancer.exe" PATH=""></FILE>
  2900.         <FILE NAME="free_plugin.exe" PATH=""></FILE>
  2901.         <FILE NAME="download_plugin.exe" PATH=""></FILE>
  2902.         <FILE NAME="lopsearch.exe" PATH=""></FILE>
  2903.         <FILE NAME="asshuktr.exe" PATH=""></FILE>
  2904.         <FILE NAME="bilyooas.exe" PATH=""></FILE>
  2905.         <FILE NAME="crgbeaoa.exe" PATH=""></FILE>
  2906.         <FILE NAME="eaymulyl.exe" PATH=""></FILE>
  2907.         <FILE NAME="eeublidc.exe" PATH=""></FILE>
  2908.         <FILE NAME="glxshmcr.exe" PATH=""></FILE>
  2909.         <FILE NAME="ijlysseb.exe" PATH=""></FILE>
  2910.         <FILE NAME="jqumysto.exe" PATH=""></FILE>
  2911.         <FILE NAME="kfriegbs.exe" PATH=""></FILE>
  2912.         <FILE NAME="llfggrdr.exe" PATH=""></FILE>
  2913.         <FILE NAME="lltckiey.exe" PATH=""></FILE>
  2914.         <FILE NAME="lopsearc.exe" PATH=""></FILE>
  2915.         <FILE NAME="meepajlr.exe" PATH=""></FILE>
  2916.         <FILE NAME="mprcouie.exe" PATH=""></FILE>
  2917.         <FILE NAME="oofrkxpe.exe" PATH=""></FILE>
  2918.         <FILE NAME="quveioot.exe" PATH=""></FILE>
  2919.         <FILE NAME="shoucrck.exe" PATH=""></FILE>
  2920.         <FILE NAME="ssmeeibl.exe" PATH=""></FILE>
  2921.         <FILE NAME="tchpeatr.exe" PATH=""></FILE>
  2922.         <FILE NAME="tglblrll.exe" PATH=""></FILE>
  2923.         <FILE NAME="trstdris.exe" PATH=""></FILE>
  2924.         <FILE NAME="vestufck.exe" PATH=""></FILE>
  2925.         <FILE NAME="vfthrcbr.exe" PATH=""></FILE>
  2926.         <FILE NAME="xogyfhp.exe" PATH=""></FILE>
  2927.         <FILE NAME="ykphmbre.exe" PATH=""></FILE>
  2928.         <FILE NAME="ylynfste.exe" PATH=""></FILE>
  2929.         <FILE NAME="winactive.exe" PATH=""></FILE>
  2930.     </FILES>
  2931.     <COOKIES>
  2932.         <COOKIE NAME="lop"></COOKIE>
  2933.         <COOKIE NAME="aavc"></COOKIE>
  2934.         <COOKIE NAME="acjp"></COOKIE>
  2935.         <COOKIE NAME="ebav"></COOKIE>
  2936.         <COOKIE NAME="ebaw"></COOKIE>
  2937.         <COOKIE NAME="ebch"></COOKIE>
  2938.         <COOKIE NAME="ebch"></COOKIE>
  2939.         <COOKIE NAME="ebdv"></COOKIE>
  2940.         <COOKIE NAME="ebdw"></COOKIE>
  2941.         <COOKIE NAME="ebgo"></COOKIE>
  2942.         <COOKIE NAME="ebjp"></COOKIE>
  2943.         <COOKIE NAME="ebkb"></COOKIE>
  2944.         <COOKIE NAME="ebkn"></COOKIE>
  2945.         <COOKIE NAME="ebky"></COOKIE>
  2946.         <COOKIE NAME="eblv"></COOKIE>
  2947.         <COOKIE NAME="wbkb"></COOKIE>
  2948.         <COOKIE NAME="ebmu"></COOKIE>
  2949.         <COOKIE NAME="ebvr"></COOKIE>
  2950.         <COOKIE NAME="ecmh"></COOKIE>
  2951.         <COOKIE NAME="ecmp"></COOKIE>
  2952.         <COOKIE NAME="ecpm"></COOKIE>
  2953.         <COOKIE NAME="ecwz"></COOKIE>
  2954.         <COOKIE NAME="ecyb"></COOKIE>
  2955.         <COOKIE NAME="edhq"></COOKIE>
  2956.         <COOKIE NAME="edty"></COOKIE>
  2957.         <COOKIE NAME="eduy"></COOKIE>
  2958.         <COOKIE NAME="eeev"></COOKIE>
  2959.         <COOKIE NAME="farse"></COOKIE>
  2960.         <COOKIE NAME="ibmx"></COOKIE>
  2961.         <COOKIE NAME="icwb"></COOKIE>
  2962.         <COOKIE NAME="icwo"></COOKIE>
  2963.         <COOKIE NAME="icwp"></COOKIE>
  2964.         <COOKIE NAME="iddh"></COOKIE>
  2965.         <COOKIE NAME="idhh"></COOKIE>
  2966.         <COOKIE NAME="ifiz"></COOKIE>
  2967.         <COOKIE NAME="iguu"></COOKIE>
  2968.         <COOKIE NAME="samz"></COOKIE>
  2969.         <COOKIE NAME="saoe"></COOKIE>
  2970.         <COOKIE NAME="sbee"></COOKIE>
  2971.         <COOKIE NAME="sbjr"></COOKIE>
  2972.         <COOKIE NAME="sbnl"></COOKIE>
  2973.         <COOKIE NAME="sbnt"></COOKIE>
  2974.         <COOKIE NAME="sbvr"></COOKIE>
  2975.         <COOKIE NAME="scbm"></COOKIE>
  2976.         <COOKIE NAME="sckr"></COOKIE>
  2977.         <COOKIE NAME="scrk"></COOKIE>
  2978.         <COOKIE NAME="sdry"></COOKIE>
  2979.         <COOKIE NAME="seld"></COOKIE>
  2980.         <COOKIE NAME="sfux"></COOKIE>
  2981.         <COOKIE NAME="sheat"></COOKIE>
  2982.         <COOKIE NAME="sipo"></COOKIE>
  2983.         <COOKIE NAME="smds"></COOKIE>
  2984.         <COOKIE NAME="srib"></COOKIE>
  2985.         <COOKIE NAME="srox"></COOKIE>
  2986.         <COOKIE NAME="srsf"></COOKIE>
  2987.         <COOKIE NAME="ssaw"></COOKIE>
  2988.         <COOKIE NAME="ssby"></COOKIE>
  2989.         <COOKIE NAME="surj"></COOKIE>
  2990.         <COOKIE NAME="tbvg"></COOKIE>
  2991.         <COOKIE NAME="tdak"></COOKIE>
  2992.         <COOKIE NAME="tdmy"></COOKIE>
  2993.         <COOKIE NAME="tefs"></COOKIE>
  2994.         <COOKIE NAME="tfil"></COOKIE>
  2995.         <COOKIE NAME="tjar"></COOKIE>
  2996.         <COOKIE NAME="tjaw"></COOKIE>
  2997.         <COOKIE NAME="tjgo"></COOKIE>
  2998.         <COOKIE NAME="tjem"></COOKIE>
  2999.         <COOKIE NAME="torc"></COOKIE>
  3000.         <COOKIE NAME="wabu"></COOKIE>
  3001.         <COOKIE NAME="wabq"></COOKIE>
  3002.         <COOKIE NAME="wfix"></COOKIE>
  3003.         <COOKIE NAME="wflu"></COOKIE>
  3004.     </COOKIES>
  3005.     <REGISTRY>
  3006.         <KEYS>
  3007.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="ckotetlllyllshz"></REGKEY>
  3008.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="kseateasteestoe"></REGKEY>
  3009.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="ssaxstxoaieoagrh"></REGKEY>
  3010.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="TrinityAYB"></REGKEY>
  3011.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="rhvlveasteafpr"></REGKEY>
  3012.         </KEYS>
  3013.         <VALUES>
  3014.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="eeullz"></REGVALUE>
  3015.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="abtu"></REGVALUE>
  3016.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="zvoah"></REGVALUE>
  3017.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="lssxsh"></REGVALUE>
  3018.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="pprwly"></REGVALUE>
  3019.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="brchfgl"></REGVALUE>
  3020.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="brfrgroo"></REGVALUE>
  3021.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="chytrw"></REGVALUE>
  3022.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="eedrtss"></REGVALUE>
  3023.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="lldrlyk"></REGVALUE>
  3024.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="stoafv"></REGVALUE>
  3025.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="oooami"></REGVALUE>
  3026.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="oooik"></REGVALUE>
  3027.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="oucno"></REGVALUE>
  3028.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="phqtr"></REGVALUE>
  3029.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="qncu"></REGVALUE>
  3030.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="stjlee"></REGVALUE>
  3031.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="uaouea"></REGVALUE>
  3032.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="trglckea"></REGVALUE>
  3033.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="xckja"></REGVALUE>
  3034.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="ymste"></REGVALUE>
  3035.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="winactive"></REGVALUE>
  3036.         </VALUES>
  3037.     </REGISTRY>
  3038.     <DANGER_LEVEL>2</DANGER_LEVEL>
  3039.     <DESCRIPTION>Lop adds its own toolbar and search button to the browser, and is responsible for popup advertisements as well</DESCRIPTION>
  3040. </SW>
  3041. <SW NAME="Timesink/Conducent TimeSink">
  3042.     <DIRECTORIES>
  3043.         <DIR NAME="TimeSink" PATH="PFDir"></DIR>
  3044.     </DIRECTORIES>
  3045.     <FILES>
  3046.            <FILE NAME="vcpdll.dll" PATH="SysDir"></FILE>
  3047.         <FILE NAME="tsadbot.exe" PATH="PFDir\\TimeSink\\AdGateway"></FILE>
  3048.         <FILE NAME="tsad.dll" PATH="WinDir"></FILE>
  3049.         <FILE NAME="vcpdll.dll" PATH="WinDir"></FILE>
  3050.         <FILE NAME="FlexActv.dll" PATH="WinDir"></FILE>
  3051.         <FILE NAME="Addon2VB.dll" PATH="SysDir"></FILE>
  3052.     </FILES>
  3053.     <COOKIES>
  3054.     </COOKIES>
  3055.     <REGISTRY>
  3056.         <KEYS>
  3057.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE" VALUE="TimeSink"></REGKEY>
  3058.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE" VALUE="TimeSink.inc"></REGKEY>
  3059.              <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="TimeSink"></REGKEY>
  3060.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Software" VALUE="TimeSink.inc"></REGKEY>
  3061.             <REGKEY MAIN="Hkey_local_machine" SUB="Software\\Microsoft\\Windows\\Current Version\\Run" VALUE="Timesink"></REGKEY>
  3062.             <REGKEY MAIN="Hkey_local_machine" SUB="Software\\Microsoft\\Windows\\Current Version\\Shareddlls" VALUE="Timesink"></REGKEY>
  3063.         </KEYS>
  3064.         <VALUES>
  3065.             <REGVALUE MAIN="Hkey_local_machine" SUB="Software\\Microsoft\\Windows\\Current Version\\Run" VALUE="Timesink"></REGVALUE>
  3066.             <REGVALUE MAIN="Hkey_local_machine" SUB="Software\\Microsoft\\Windows\\Current Version\\Shareddlls" VALUE="Timesink"></REGVALUE>
  3067.         </VALUES>
  3068.     </REGISTRY>
  3069.     <DANGER_LEVEL>2</DANGER_LEVEL>
  3070.     <DESCRIPTION>Timesink will display pop up ads, including full screen flashing pop up ads.  It might also record your web browser history, and other personal information</DESCRIPTION>
  3071. </SW>
  3072. <SW NAME="eZula">
  3073.     <DIRECTORIES>
  3074.         <DIR NAME="ezula" PATH="PFDir"></DIR>
  3075.     </DIRECTORIES>
  3076.     <FILES>
  3077.         <FILE NAME="eZmmod.exe" PATH=""></FILE>
  3078.         <FILE NAME="eZuluMain.exe" PATH=""></FILE>
  3079.          <FILE NAME="basis.dst" PATH="PFDir\\ezula"></FILE>
  3080.          <FILE NAME="basis.kwd" PATH="PFDir\\ezula"></FILE>
  3081.         <FILE NAME="basis.pu" PATH="PFDir\\ezula"></FILE>
  3082.         <FILE NAME="basis.rst" PATH="PFDir\\ezula"></FILE>
  3083.         <FILE NAME="CHCON.dll" PATH="PFDir\\ezula"></FILE>
  3084.         <FILE NAME="eabh.dll" PATH="PFDir\\ezula"></FILE>
  3085.         <FILE NAME="genun.ez" PATH="PFDir\\ezula"></FILE>
  3086.         <FILE NAME="legend.lgn" PATH="PFDir\\ezula"></FILE>
  3087.         <FILE NAME="param.ez" PATH="PFDir\\ezula"></FILE>
  3088.         <FILE NAME="rwds.rst" PATH="PFDir\\ezula"></FILE>
  3089.         <FILE NAME="search.src" PATH="PFDir\\ezula"></FILE>
  3090.         <FILE NAME="seng.dll" PATH="PFDir\\ezula"></FILE>
  3091.         <FILE NAME="UNWISE.EXE" PATH="PFDir\\ezula"></FILE>
  3092.         <FILE NAME="upgrade.vrn" PATH="PFDir\\ezula"></FILE>
  3093.         <FILE NAME="version.vrn" PATH="PFDir\\ezula"></FILE>
  3094.         <FILE NAME="wndbannn.src" PATH="PFDir\\ezula"></FILE>
  3095.         <FILE NAME="arrow1.gif" PATH="PFDir\\ezula\\images"></FILE>
  3096.         <FILE NAME="arrow2.gif" PATH="PFDir\\ezula\\images"></FILE>
  3097.         <FILE NAME="button_small.gif" PATH="PFDir\\ezula\\images"></FILE>
  3098.         <FILE NAME="icon.gif" PATH="PFDir\\ezula\\images"></FILE>
  3099.         <FILE NAME="Layer_Bottom.gif" PATH="PFDir\\ezula\\images"></FILE>
  3100.         <FILE NAME="Layer_Center.gif" PATH="PFDir\\ezula\\images"></FILE>
  3101.         <FILE NAME="Layer_Top.gif" PATH="PFDir\\ezula\\images"></FILE>
  3102.         <FILE NAME="new.gif" PATH="PFDir\\ezula\\images"></FILE>
  3103.         <FILE NAME="PopUp_Follow_divider.gif" PATH="PFDir\\ezula\\images"></FILE>
  3104.         <FILE NAME="PopUp_Follow_Left.gif" PATH="PFDir\\ezula\\images"></FILE>
  3105.         <FILE NAME="PopUp_Follow_Off.gif" PATH="PFDir\\ezula\\images"></FILE>
  3106.         <FILE NAME="PopUp_Follow_On.gif" PATH="PFDir\\ezula\\images"></FILE>
  3107.         <FILE NAME="PopUp_Follow_Right.gif" PATH="PFDir\\ezula\\images"></FILE>
  3108.         <FILE NAME="PopUp_Top.gif" PATH="PFDir\\ezula\\images"></FILE>
  3109.         <FILE NAME="PopUp_Top_Bottom.gif" PATH="PFDir\\ezula\\images"></FILE>
  3110.         <FILE NAME="Side_B.gif" PATH="PFDir\\ezula\\images"></FILE>
  3111.         <FILE NAME="Side_L.gif" PATH="PFDir\\ezula\\images"></FILE>
  3112.         <FILE NAME="Side_R.gif" PATH="PFDir\\ezula\\images"></FILE>
  3113.         <FILE NAME="Side_Top.gif" PATH="PFDir\\ezula\\images"></FILE>
  3114.         <FILE NAME="spacer.gif" PATH="PFDir\\ezula\\images"></FILE>
  3115.         <FILE NAME="ezulaboot.dll" PATH=""></FILE>
  3116.         <FILE NAME="ezulaboot.inf" PATH=""></FILE>
  3117.         <FILE NAME="InstallCtrl.class" PATH="WinDir\\Downloaded Program Files"></FILE>
  3118.         <FILE NAME="eZulains.exe" PATH="WinDir"></FILE>
  3119.         <FILE NAME="ezulains.lgc" PATH="WinDir\\APPLOG"></FILE>
  3120.         <FILE NAME="mmod.exe" PATH="PFDir\\ezula"></FILE>  
  3121.         <FILE NAME="ezstub.exe" PATH="SysDir"></FILE> 
  3122.         <FILE NAME="stub.exe" PATH="Sys32Dir"></FILE>
  3123.     </FILES>
  3124.     <COOKIES>
  3125.     </COOKIES>
  3126.     <REGISTRY>
  3127.         <KEYS>
  3128.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="TYPELIB" VALUE="{07f0a536-47ba-11d4-8a6d-0050da2ee1be}"></REGKEY>
  3129.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="TYPELIB" VALUE="{58359011-bf36-11d3-99a2-0050da2ee1be}"></REGKEY>
  3130.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{07f0a543-47ba-11d4-8a6d-0050da2ee1be}"></REGKEY>
  3131.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{07f0a545-47ba-11d4-8a6d-0050da2ee1be}"></REGKEY>
  3132.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{19dfb2cb-9b27-11d4-b192-0050dab79376}"></REGKEY>
  3133.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{2079884b-6ef3-11d4-8a74-0050da2ee1be}"></REGKEY>
  3134.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{2306abe4-4d42-11d4-8a6d-0050da2ee1be}"></REGKEY>
  3135.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{3d7247e8-5db8-11d4-8a72-0050da2ee1be}"></REGKEY>
  3136.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{58359010-bf36-11d3-99a2-0050da2ee1be}"></REGKEY>
  3137.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{c4fee4a7-4b8b-11d4-8a6d-0050da2ee1be}"></REGKEY>
  3138.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{d290d6e7-bf9d-42f0-9c1b-3bc8ae769b57}"></REGKEY>
  3139.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\AppID" VALUE="eZulaMain.EXE"></REGKEY>
  3140.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\AppID" VALUE="{8A044397-5DA2-11D4-B185-0050DAB79376}"></REGKEY>
  3141.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{07F0A543-47BA-11D4-8A6D-0050DA2EE1BE}"></REGKEY>
  3142.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{07F0A545-47BA-11D4-8A6D-0050DA2EE1BE}"></REGKEY>
  3143.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{19DFB2CB-9B27-11D4-B192-0050DAB79376}"></REGKEY>
  3144.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{2079884B-6EF3-11D4-8A74-0050DA2EE1BE}"></REGKEY>
  3145.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{2306ABE4-4D42-11D4-8A6D-0050DA2EE1BE}"></REGKEY>
  3146.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{2BABD334-5C3F-11D4-B184-0050DAB79376}"></REGKEY>
  3147.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{3D7247E8-5DB8-11D4-8A72-0050DA2EE1BE}"></REGKEY>
  3148.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{58359010-BF36-11d3-99A2-0050DA2EE1BE}"></REGKEY>
  3149.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{B1DD8A69-1B96-11D4-B175-0050DAB79376}"></REGKEY>
  3150.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{C03351A4-6755-11D4-8A73-0050DA2EE1BE}"></REGKEY>
  3151.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{C4FEE4A7-4B8B-11D4-8A6D-0050DA2EE1BE}"></REGKEY>
  3152.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{D290D6E7-BF9D-42F0-9C1B-3BC8AE769B57}"></REGKEY>
  3153.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="EZulaAgent.eZulaCtrlHost"></REGKEY>
  3154.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="EZulaAgent.eZulaCtrlHost.1"></REGKEY>
  3155.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="eZulaAgent.IEObject"></REGKEY>
  3156.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="eZulaAgent.IEObject.1"></REGKEY>
  3157.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="EZulaAgent.PlugProt"></REGKEY>
  3158.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="EZulaAgent.PlugProt.1"></REGKEY>
  3159.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="EZulaFSearchEng.eZulaCode"></REGKEY>
  3160.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="EZulaFSearchEng.eZulaCode.1"></REGKEY>
  3161.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="EZulaFSearchEng.eZulaHash"></REGKEY>
  3162.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="EZulaFSearchEng.eZulaHash.1"></REGKEY>
  3163.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="EZulaFSearchEng.eZulaSearch"></REGKEY>
  3164.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="EZulaFSearchEng.eZulaSearch.1"></REGKEY>
  3165.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="EZulaFSearchEng.PopupDisplay"></REGKEY>
  3166.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="EZulaFSearchEng.PopupDisplay.1"></REGKEY>
  3167.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="EZulaFSearchEng.ResultHelper"></REGKEY>
  3168.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="EZulaFSearchEng.ResultHelper.1"></REGKEY>
  3169.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="EZulaFSearchEng.SearchHelper"></REGKEY>
  3170.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="EZulaFSearchEng.SearchHelper.1"></REGKEY>
  3171.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="EZulaMain.eZulaSearchPipe"></REGKEY>
  3172.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="EZulaMain.eZulaSearchPipe.1"></REGKEY>
  3173.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="EZulaMain.TrayIConM"></REGKEY>
  3174.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes" VALUE="EZulaMain.TrayIConM.1"></REGKEY>
  3175.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\Interface" VALUE="{07F0A542-47BA-11D4-8A6D-0050DA2EE1BE}"></REGKEY>
  3176.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\Interface" VALUE="{07F0A544-47BA-11D4-8A6D-0050DA2EE1BE}"></REGKEY>
  3177.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\Interface" VALUE="{1823BC4B-A253-4767-9CFC-9ACA62A6B136}"></REGKEY>
  3178.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\Interface" VALUE="{19DFB2CA-9B27-11D4-B192-0050DAB79376}"></REGKEY>
  3179.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\Interface" VALUE="{27BC6871-4D5A-11D4-8A6D-0050DA2EE1BE}"></REGKEY>
  3180.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\Interface" VALUE="{3D7247F1-5DB8-11D4-8A72-0050DA2EE1BE}"></REGKEY>
  3181.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\Interface" VALUE="{4FD8645F-9B3E-46C1-9727-9837842A84AB}"></REGKEY>
  3182.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\Interface" VALUE="{58359012-BF36-11D3-99A2-0050DA2EE1BE}"></REGKEY>
  3183.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\Interface" VALUE="{7EDC96E1-5DD3-11D4-B185-0050DAB79376}"></REGKEY>
  3184.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\Interface" VALUE="{8A0443A2-5DA2-11D4-B185-0050DAB79376}"></REGKEY>
  3185.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\Interface" VALUE="{8EBB1743-9A2F-11D4-8A7E-0050DA2EE1BE}"></REGKEY>
  3186.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\Interface" VALUE="{C03351A3-6755-11D4-8A73-0050DA2EE1BE}"></REGKEY>
  3187.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\Interface" VALUE="{C4FEE4A6-4B8B-11D4-8A6D-0050DA2EE1BE}"></REGKEY>
  3188.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\Interface" VALUE="{EF0372DC-F552-11D3-8528-0050DAB79376}"></REGKEY>
  3189.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\Interface" VALUE="{EF0372DE-F552-11D3-8528-0050DAB79376}"></REGKEY>
  3190.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\TypeLib" VALUE="{07F0A536-47BA-11D4-8A6D-0050DA2EE1BE}"></REGKEY>
  3191.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\TypeLib" VALUE="{083FA8F4-84F4-11D4-8A77-0050DA2EE1BE}"></REGKEY>
  3192.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\TypeLib" VALUE="{58359011-BF36-11D3-99A2-0050DA2EE1BE}"></REGKEY>
  3193.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\TypeLib" VALUE="{8A044396-5DA2-11D4-B185-0050DAB79376}"></REGKEY>
  3194.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES" VALUE="EZulaBoot.InstallCtrl"></REGKEY>
  3195.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES" VALUE="EZulaBoot.InstallCtrl.1"></REGKEY>
  3196.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES" VALUE="EZulaBootExe.InstallCtrl"></REGKEY>
  3197.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES" VALUE="EZulaBootExe.InstallCtrl.1"></REGKEY>
  3198.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\AppID" VALUE="{C0335198-6755-11D4-8A73-0050DA2EE1BE}"></REGKEY>
  3199.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\AppID" VALUE="eZulaBootExe.EXE"></REGKEY>
  3200.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\TypeLib" VALUE="{3D7247D1-5DB8-11D4-8A72-0050DA2EE1BE}"></REGKEY>
  3201.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES\\TypeLib" VALUE="{C0335197-6755-11D4-8A73-0050DA2EE1BE}"></REGKEY>
  3202.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Code Store Database\\Distribution Units" VALUE="{3D7247DE-5DB8-11D4-8A72-0050DA2EE1BE}"></REGKEY>
  3203.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\ModuleUsage" VALUE="C:/WINDOWS/Downloaded Program Files/eZulaBoot.dll"></REGKEY>
  3204.         </KEYS>
  3205.         <VALUES>
  3206.                <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="ezmmod"></REGVALUE>
  3207.             <REGVALUE MAIN="" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Doc Find Spec MRU" VALUE="EZulaboot"></REGVALUE>
  3208.         </VALUES>
  3209.     </REGISTRY>
  3210.     <DANGER_LEVEL>1</DANGER_LEVEL>
  3211.     <DESCRIPTION>eZula modifies web sites displayed in your browser and adds their own sponsored links</DESCRIPTION>
  3212. </SW>
  3213. <SW NAME="GoHip">
  3214.     <DIRECTORIES>
  3215.          <DIR NAME="browserenh" PATH="PFDir"></DIR>
  3216.     </DIRECTORIES>
  3217.     <FILES>
  3218.         <FILE NAME="ie.dll" PATH="Sys32Dir"></FILE>
  3219.         <FILE NAME="winstartup.exe" PATH="WinDir"></FILE>
  3220.         <FILE NAME="winstartup.exe" PATH="PFDir\\browserenh"></FILE>
  3221.         <FILE NAME="winstartup.exe" PATH="Sys32Dir"></FILE>
  3222.         <FILE NAME="winstartup.exe" PATH="SysDir"></FILE>        
  3223.     </FILES>
  3224.     <COOKIES>
  3225.     </COOKIES>
  3226.     <REGISTRY>
  3227.         <KEYS>
  3228.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{ba3d9f56-5ec1-497d-881a-93a28f58d9ad}"></REGKEY>
  3229.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{f17edbc0-3eb2-11d3-ab74-00a0c9a522f2}"></REGKEY>
  3230.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="software" VALUE="browserenh"></REGKEY>
  3231.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="software" VALUE="gohip"></REGKEY>
  3232.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\code store database\\distribution units" VALUE="{f17edbc0-3eb2-11d3-ab74-00a0c9a522f2}"></REGKEY>
  3233.             <REGKEY MAIN="Hkey_local_machine" SUB="Software\\Microsoft\\Windows\\Current Version\\Run" VALUE="GoHip"></REGKEY>
  3234.         </KEYS>
  3235.         <VALUES>
  3236.                      <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="WINSTA~1.EXE"></REGVALUE>
  3237.         </VALUES>
  3238.     </REGISTRY>
  3239.     <DANGER_LEVEL>1</DANGER_LEVEL>
  3240.     <DESCRIPTION>GoHip will attach itself to your browser, as well as hijack your personalized browser settings and search options</DESCRIPTION>
  3241. </SW>
  3242. <SW NAME="Browser Toolbar">
  3243.     <DIRECTORIES>
  3244.         <DIR NAME="IO Class" PATH="WinDir\\Downloaded Program Files"></DIR>
  3245.     </DIRECTORIES>
  3246.     <FILES>
  3247.         <FILE NAME="ausvc.exe" PATH="WinDir"></FILE>
  3248.         <FILE NAME="mnsvc.exe" PATH="WinDir"></FILE>
  3249.         <FILE NAME="bvt.exe" PATH="WinDir"></FILE>
  3250.         <FILE NAME="absr.exe" PATH="WinDir"></FILE>
  3251.         <FILE NAME="auupg.exe" PATH=""></FILE>
  3252.         <FILE NAME="coolstuff.ocx" PATH=""></FILE>
  3253.         <FILE NAME="coolstuff.cab" PATH=""></FILE>
  3254.         <FILE NAME="coolstuff.inf" PATH=""></FILE>
  3255.         <FILE NAME="ea.bin" PATH=""></FILE>
  3256.         <FILE NAME="mbtcd.bak" PATH=""></FILE>
  3257.     </FILES>
  3258.     <COOKIES>
  3259.         <COOKIE NAME="browseevt"></COOKIE>
  3260.         <COOKIE NAME="browsertoolbar"></COOKIE>
  3261.     </COOKIES>
  3262.     <REGISTRY>
  3263.         <KEYS>
  3264.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\CLSID" VALUE="{6541B981-2E27-46B1-A2CC-8264A75B74FE}"></REGKEY>
  3265.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\CLSID" VALUE="{868B015F-3515-44DB-B0AD-182CD058985E}"></REGKEY>
  3266.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\CLSID" VALUE="{9A05FE9B-5B52-4D13-A77D-FA7C38557A8E}"></REGKEY>
  3267.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\CLSID" VALUE="{9E2099A5-9483-43fe-92D1-68DBFBE968A2}"></REGKEY>
  3268.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\CLSID" VALUE="{BAE85C97-2CD4-45C3-A1ED-E4CEF7C6AA52}"></REGKEY>
  3269.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\CLSID" VALUE="{C76BE992-2BC3-41A4-8B87-A8C01FE419A7}"></REGKEY>
  3270.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\CLSID" VALUE="{F53C844A-D9C8-4E92-B923-C05B46C4A7E3}"></REGKEY>
  3271.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\CLSID" VALUE="{FBE091E5-DF43-4FFB-AECC-7E3A3BC7B0D9}"></REGKEY>
  3272.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\AppID" VALUE="{8B034058-08B0-4CB3-B2E8-60238B4967F2}"></REGKEY>
  3273.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES" VALUE="ABsr.ABsr"></REGKEY>
  3274.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES" VALUE="ABsr.ABsr.1"></REGKEY>
  3275.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES" VALUE="ABsr.ADrv"></REGKEY>
  3276.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES" VALUE="ABsr.ADrv.1"></REGKEY>
  3277.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\AppID" VALUE="{9A05FE9B-5B52-4D13-A77D-FA7C38557A8E}"></REGKEY>
  3278.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\AppID" VALUE="ABsr.EXE"></REGKEY>
  3279.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\AppID" VALUE="bvt.EXE"></REGKEY>
  3280.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES" VALUE="BLSIM"></REGKEY>
  3281.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES" VALUE="BrowserEvt.BrowserEvent"></REGKEY>
  3282.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES" VALUE="BrowserEvt.BrowserEvent.1"></REGKEY>
  3283.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\Interface" VALUE="{5147EB69-9081-4F42-B02F-EA7CBAC9FCDE}"></REGKEY>
  3284.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\Interface" VALUE="{52FCFBDA-2C85-4933-A1A7-99D7AE569499}"></REGKEY>
  3285.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\Interface" VALUE="{5BD387E8-95DE-4FFF-9518-121299C4555F}"></REGKEY>
  3286.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\Typelib" VALUE="{6D8B1B74-4AB8-473B-B479-253FA1936802}"></REGKEY>
  3287.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\Typelib" VALUE="{C423B212-02B3-41CF-BE3A-532CE28180CD}"></REGKEY>
  3288.         </KEYS>
  3289.         <VALUES>
  3290.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="SysScan"></REGVALUE>
  3291.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="ausvc"></REGVALUE>
  3292.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="ABsr"></REGVALUE>
  3293.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="mnsvc"></REGVALUE>
  3294.         </VALUES>
  3295.     </REGISTRY>
  3296.     <DANGER_LEVEL>1</DANGER_LEVEL>
  3297.     <DESCRIPTION>Browser Toolbar hijacks browser search options as well as personalized settings</DESCRIPTION>
  3298. </SW>
  3299. <SW NAME="Trojan - Benjamin Kazaa">
  3300.     <DIRECTORIES>
  3301.         <DIR NAME="Sys32" PATH="WinDir\\Temp"></DIR>
  3302.     </DIRECTORIES>
  3303.     <FILES>
  3304.         <FILE NAME="EXPLORER.SCR" PATH="SysDir"></FILE>
  3305.     </FILES>
  3306.     <COOKIES>
  3307.     </COOKIES>
  3308.     <REGISTRY>
  3309.         <KEYS>
  3310.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft" VALUE="syscod"></REGKEY>
  3311.         </KEYS>
  3312.         <VALUES>
  3313.         </VALUES>
  3314.     </REGISTRY>
  3315.     <DANGER_LEVEL>2</DANGER_LEVEL>
  3316.     <DESCRIPTION>Benjamin Kazaa is a worm spread through the kazaa sharing service.  Once infected, the worm does several very harmful things to the PC, including replicating itself up to 2000 times</DESCRIPTION>
  3317. </SW>
  3318. <SW NAME="Kazaa">
  3319.     <DIRECTORIES>
  3320.         <DIR NAME="kazaa media desktop" PATH=""></DIR>
  3321.         <DIR NAME="kazaa" PATH="PFDir"></DIR>
  3322.     </DIRECTORIES>
  3323.     <FILES>
  3324.         <FILE NAME="kazaa media desktop.lnk" PATH=""></FILE>
  3325.         <FILE NAME="kazaa.exe" PATH="PFDir\\kazaa"></FILE>
  3326.         <FILE NAME="smdat32m.sys" PATH="WinDir"></FILE>
  3327.         <FILE NAME="smdat32a.sys" PATH="WinDir"></FILE>            
  3328.     </FILES>
  3329.     <COOKIES>
  3330.     </COOKIES>
  3331.     <REGISTRY>
  3332.         <KEYS>
  3333.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software" VALUE="kazaa"></REGKEY>
  3334.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall" VALUE="kazaa"></REGKEY>
  3335.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="software" VALUE="kazaa"></REGKEY>
  3336.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{66fc8717-efa7-4546-8c4a-e224f3a80c76}"></REGKEY>            
  3337.         </KEYS>
  3338.         <VALUES>
  3339.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="System-Service"></REGVALUE>
  3340.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="software" VALUE="kazaa"></REGVALUE>
  3341.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="kazaa"></REGVALUE>
  3342.         </VALUES>
  3343.     </REGISTRY>
  3344.     <DANGER_LEVEL>2</DANGER_LEVEL>
  3345.     <DESCRIPTION>Kazaa is popular peer to peer file sharing software that serves ads to your PC as well as installs other parasites</DESCRIPTION>
  3346. </SW>
  3347. <SW NAME="Trojan - Klez">
  3348.     <DIRECTORIES>
  3349.     </DIRECTORIES>
  3350.     <FILES>
  3351.         <FILE NAME="krn132.exe" PATH="SysDir"></FILE>
  3352.     </FILES>
  3353.     <COOKIES>
  3354.         <COOKIE NAME="xww"></COOKIE>
  3355.     </COOKIES>
  3356.     <REGISTRY>
  3357.         <KEYS>
  3358.         </KEYS>
  3359.         <VALUES>
  3360.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Krn132"></REGVALUE>
  3361.         </VALUES>
  3362.     </REGISTRY>
  3363.     <DANGER_LEVEL>2</DANGER_LEVEL>
  3364.     <DESCRIPTION>The Klez Trojan is a trojan spread by mostly email, that in some cases, has actually removed all files on the infected computer</DESCRIPTION>
  3365. </SW>
  3366. <SW NAME="Trojan - NetBUIE">
  3367.     <DIRECTORIES>
  3368.     </DIRECTORIES>
  3369.     <FILES>
  3370.         <FILE NAME="NBConfig.exe" PATH="SysDir"></FILE>
  3371.         <FILE NAME="NetBUIE.exe" PATH="SysDir"></FILE>
  3372.         <FILE NAME="DConfig.exe" PATH="SysDir"></FILE>
  3373.         <FILE NAME="StealthXP.exe" PATH="SysDir"></FILE>
  3374.     </FILES>
  3375.     <COOKIES>
  3376.     </COOKIES>
  3377.     <REGISTRY>
  3378.         <KEYS>
  3379.         </KEYS>
  3380.         <VALUES>
  3381.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="NetBUIE"></REGVALUE>
  3382.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="StealthXP"></REGVALUE>
  3383.         </VALUES>
  3384.     </REGISTRY>
  3385. <DANGER_LEVEL>1</DANGER_LEVEL>
  3386. <DESCRIPTION>The NetBUIE trojan is a virus that carries out periodic clicks on links for the creator of the virus</DESCRIPTION>
  3387. </SW>
  3388. <SW NAME="Trojan - WbeCheck">
  3389.     <DIRECTORIES>
  3390.     </DIRECTORIES>
  3391.     <FILES>
  3392.         <FILE NAME="pbsysie.dll" PATH="WinDir"></FILE>
  3393.     </FILES>
  3394.     <COOKIES>
  3395.     </COOKIES>
  3396.     <REGISTRY>
  3397.         <KEYS>
  3398.         </KEYS>
  3399.         <VALUES>
  3400.         </VALUES>
  3401.     </REGISTRY>
  3402. <DANGER_LEVEL>2</DANGER_LEVEL>
  3403. <DESCRIPTION>The WbeCheck trojan is a spying trojan that records all computer activity and reports it to a central server</DESCRIPTION>
  3404. </SW>
  3405. <SW NAME="NowBox">
  3406.     <DIRECTORIES>
  3407.         <DIR NAME="NowBox" PATH="PFDir"></DIR>
  3408.     </DIRECTORIES>
  3409.     <FILES>
  3410.         <FILE NAME="nowbox.lnk" PATH="PFDir\\nowbox"></FILE> 
  3411.     <FILE NAME="nowbox.lnk" PATH=""></FILE>
  3412.     </FILES>
  3413.     <COOKIES>
  3414.         <COOKIE NAME="nowbox"></COOKIE>
  3415.         <COOKIE NAME="vflash"></COOKIE>
  3416.     </COOKIES>
  3417.     <REGISTRY>
  3418.         <KEYS>
  3419.         </KEYS>
  3420.         <VALUES>
  3421.         </VALUES>
  3422.     </REGISTRY>
  3423. <DANGER_LEVEL>1</DANGER_LEVEL>
  3424. <DESCRIPTION>NowBox is a browser setting hijacker.  It also has a background process used for serving advertisements</DESCRIPTION>
  3425. </SW>
  3426. <SW NAME="webHancer2">
  3427.     <DIRECTORIES>
  3428.     </DIRECTORIES>
  3429.     <FILES>
  3430.         <FILE NAME="webHancer.exe" PATH=""></FILE>
  3431.     </FILES>
  3432.     <COOKIES>
  3433.     </COOKIES>
  3434.     <REGISTRY>
  3435.         <KEYS>
  3436.         </KEYS>
  3437.         <VALUES>
  3438.         </VALUES>
  3439.     </REGISTRY>
  3440. <DANGER_LEVEL>1</DANGER_LEVEL>
  3441. <DESCRIPTION>causes internet connection to be broken.</DESCRIPTION>
  3442. </SW>
  3443. <SW NAME="Onflow">
  3444.     <DIRECTORIES>
  3445.         <DIR NAME="Onflow" PATH="PFDir"></DIR>
  3446.     </DIRECTORIES>
  3447.     <FILES>
  3448.         <FILE NAME="onflow.exe" PATH=""></FILE>
  3449.     </FILES>
  3450.     <COOKIES>
  3451.     </COOKIES>
  3452.     <REGISTRY>
  3453.         <KEYS>
  3454.         </KEYS>
  3455.         <VALUES>
  3456.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Onflow"></REGVALUE>
  3457.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE " SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Onflow"></REGVALUE>
  3458.         </VALUES>
  3459.     </REGISTRY>
  3460. <DANGER_LEVEL>1</DANGER_LEVEL>
  3461. <DESCRIPTION>OnFlow is a rich media player with a silent update aspect</DESCRIPTION>
  3462. </SW>
  3463. <SW NAME="VLoading">
  3464.     <DIRECTORIES>
  3465.         <DIR NAME="Download class" PATH="WinDir\\Downloaded Program Files"></DIR>
  3466.     </DIRECTORIES>
  3467.     <FILES>
  3468.         <FILE NAME="VLoading.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
  3469.     </FILES>
  3470.     <COOKIES>
  3471.     </COOKIES>
  3472.     <REGISTRY>
  3473.         <KEYS>
  3474.         </KEYS>
  3475.         <VALUES>
  3476.         </VALUES>
  3477.     </REGISTRY>
  3478. <DANGER_LEVEL>2</DANGER_LEVEL>
  3479. <DESCRIPTION>VLoading allows unwanted software downloads, installation, and execution without any interaction from the user</DESCRIPTION>
  3480. </SW>
  3481. <SW NAME="Keylogger - Actions Monitor">
  3482.     <DIRECTORIES>
  3483.     </DIRECTORIES>
  3484.     <FILES>
  3485.         <FILE NAME="am.exe" PATH=""></FILE>
  3486.     </FILES>
  3487.     <COOKIES>
  3488.     </COOKIES>
  3489.     <REGISTRY>
  3490.         <KEYS>
  3491.         </KEYS>
  3492.         <VALUES>
  3493.         </VALUES>
  3494.     </REGISTRY>
  3495. <DANGER_LEVEL>1</DANGER_LEVEL>
  3496. <DESCRIPTION>Actions Monitor allows full recoding of any keystroke on the PC</DESCRIPTION>
  3497. </SW>
  3498. <SW NAME="Avenue A">
  3499.     <DIRECTORIES>
  3500.     </DIRECTORIES>
  3501.     <FILES>
  3502.     </FILES>
  3503.     <COOKIES>
  3504.         <COOKIE NAME="avenuea"></COOKIE>
  3505.         <COOKIE NAME="iballs"></COOKIE>
  3506.     </COOKIES>
  3507.     <REGISTRY>
  3508.         <KEYS>
  3509.         </KEYS>
  3510.         <VALUES>
  3511.         </VALUES>
  3512.     </REGISTRY>
  3513. <DANGER_LEVEL>0</DANGER_LEVEL>
  3514. <DESCRIPTION>Avenue A uses cookies to collect information about browsing habits, etc</DESCRIPTION>
  3515. </SW>
  3516. <SW NAME="BDE">
  3517.     <DIRECTORIES>
  3518.         <DIR NAME="BDE" PATH="WinDir"></DIR>
  3519.     </DIRECTORIES>
  3520.     <FILES>
  3521.         <FILE NAME="bdeclean.exe" PATH="WinDir\\bde"></FILE>
  3522.         <FILE NAME="bdesecureinstall.cab" PATH="Sys32Dir"></FILE>
  3523.         <FILE NAME="bdesecureinstall.exe" PATH="Sys32Dir"></FILE>
  3524.         <FILE NAME="bdeverify.dll" PATH="Sys32Dir"></FILE>
  3525.         <FILE NAME="bdedownloader.dll" PATH="Sys32Dir"></FILE>
  3526.         <FILE NAME="bdedata2.dll" PATH="Sys32Dir"></FILE>
  3527.         <FILE NAME="bdefdi.dll" PATH="Sys32Dir"></FILE>
  3528.         <FILE NAME="bdeinsta2.dll" PATH="Sys32Dir"></FILE>
  3529.         <FILE NAME="bdeinstall.exe" PATH="Sys32Dir"></FILE>
  3530.         <FILE NAME="bdeverify.exe" PATH="SysDir"></FILE>
  3531.         <FILE NAME="bdeengine2.dll" PATH="WinDir\\bde"></FILE>
  3532.         <FILE NAME="bde3d_ref2.dll" PATH="SysDir"></FILE>
  3533.         <FILE NAME="bde3d_ref2.dll" PATH="Sys32Dir"></FILE>
  3534.         <FILE NAME="bdeimage.dll" PATH="WinDir\\bde"></FILE>
  3535.         <FILE NAME="bdeload.dll" PATH="SysDir"></FILE>
  3536.         <FILE NAME="bdeload.dll" PATH="Sys32Dir"></FILE>
  3537.         <FILE NAME="bdeplayer2.dll" PATH="WinDir\\bde"></FILE>
  3538.         <FILE NAME="bderastdx6_30002.dll" PATH="SysDir"></FILE>
  3539.         <FILE NAME="bderastdx6_30002.dll" PATH="Sys32Dir"></FILE>
  3540.         <FILE NAME="bderastmmx_30001.dll" PATH="SysDir"></FILE>
  3541.         <FILE NAME="bderastmmx_30001.dll" PATH="Sys32Dir"></FILE>
  3542.         <FILE NAME="bdesac10.dll" PATH="SysDir"></FILE>
  3543.         <FILE NAME="bdesac10.dll" PATH="Sys32Dir"></FILE>
  3544.         <FILE NAME="bdeviewer.exe" PATH="WinDir\\bde"></FILE>
  3545.         <FILE NAME="npbdplay2.dll" PATH="WinDir\\bde"></FILE>
  3546.     </FILES>
  3547.     <COOKIES>
  3548.         <COOKIE NAME="BrilliantDigital"></COOKIE>
  3549.     </COOKIES>
  3550.     <REGISTRY>
  3551.         <KEYS>
  3552.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="ZUpdate"></REGKEY>
  3553.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES" VALUE="b3d"></REGKEY>
  3554.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES" VALUE="b3ds"></REGKEY>
  3555.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES" VALUE="s3d_auto_file"></REGKEY>
  3556.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES" VALUE="b3dini_auto_file"></REGKEY>
  3557.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES" VALUE="BDEPLAYER.BDEPlayerCtrl[.1]"></REGKEY>
  3558.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES" VALUE="BDESmartInstaller.BDESmartInstallerCtrl[.1]"></REGKEY>
  3559.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES" VALUE=".b3dini"></REGKEY>
  3560.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{67925165-C4B6-11D2-B9C6-0000E84F59A6}"></REGKEY>
  3561.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="TypeLib" VALUE="{82FC7881-AACC-11D2-B9C6-0000E842E40A}"></REGKEY>
  3562.         </KEYS>
  3563.         <VALUES>
  3564.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="b3dUpdate"></REGVALUE>
  3565.         </VALUES>
  3566.     </REGISTRY>
  3567. <DANGER_LEVEL>2</DANGER_LEVEL>
  3568. <DESCRIPTION>BDE can be remotely turned on, and allow access to any files on the PC</DESCRIPTION>
  3569. </SW>
  3570. <SW NAME="Comload/Coulomb Dialer">
  3571.     <DIRECTORIES>
  3572.     </DIRECTORIES>
  3573.     <FILES>
  3574.         <FILE NAME="comload.dll" PATH="WinDir"></FILE>
  3575.         <FILE NAME="comload.dll" PATH="SysDir"></FILE>   
  3576.         <FILE NAME="comload.dll" PATH="Sys32Dir"></FILE>
  3577.        <FILE NAME="dia1C.exe" PATH=""></FILE>
  3578.        <FILE NAME="dload.exe" PATH=""></FILE>
  3579.        <FILE NAME="Porn Turbo.exe" PATH=""></FILE>
  3580.     </FILES>
  3581.     <COOKIES>
  3582.         <COOKIE NAME="coulomb"></COOKIE>
  3583.     </COOKIES>
  3584.     <REGISTRY>
  3585.         <KEYS>
  3586.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID"  VALUE="{9E1089BC-1AE8-4685-8D77-6721E5C318A8}"></REGKEY>
  3587.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{19E91D82-7AD7-419F-866A-58C122DB1459}"></REGKEY>
  3588.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{F5F779A9-24E5-4BCD-9AE5-6313D4B5AC24}"></REGKEY>
  3589.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="TypeLib" VALUE="{266F948A-3DEE-4270-8F55-E79ACCD569FA}"></REGKEY>
  3590.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{9E1089BC-1AE8-4685-8D77-6721E5C318A8}"></REGKEY>
  3591.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{AD7FAFB0-16D6-40C3-AF27-585D6E6453FD}"></REGKEY>
  3592.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{9e1089bc-1ae8-4685-8d77-6721e5c318a8}"></REGKEY>
  3593.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{ad7fafb0-16d6-40c3-af27-585d6e6453fd}"></REGKEY>
  3594.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="comload.loader"></REGKEY>
  3595.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="comload.loader.1"></REGKEY>
  3596.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="comload.loader2"></REGKEY>
  3597.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="comload.loader2.1"></REGKEY>
  3598.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="dctl"></REGKEY>
  3599.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="software" VALUE="coulomb"></REGKEY>
  3600.             <REGKEY MAIN="HKEY_USERS" SUB=".default\\software" VALUE="coulomb"></REGKEY>
  3601.         </KEYS>
  3602.         <VALUES>
  3603.         </VALUES>
  3604.     </REGISTRY>
  3605. <DANGER_LEVEL>2</DANGER_LEVEL>
  3606. <DESCRIPTION>High cost dialer that uses your PC to dial pornographic related numbers</DESCRIPTION>
  3607. </SW>
  3608. <SW NAME="CrackedEarth">
  3609.     <DIRECTORIES>
  3610.         <DIR NAME="CrackedEarth" PATH="SysDir"></DIR>
  3611.     </DIRECTORIES>
  3612.     <FILES>
  3613.         <FILE NAME="searchhook.dll" PATH="SysDir\\CrackedEarth"></FILE>
  3614.     </FILES>
  3615.     <COOKIES>
  3616.         <COOKIE NAME="crackedearth"></COOKIE>
  3617.         <COOKIE NAME="genieknows"></COOKIE>
  3618.         <COOKIE NAME="cyberzine"></COOKIE>
  3619.     </COOKIES>
  3620.     <REGISTRY>
  3621.         <KEYS>
  3622.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="SearchHook"></REGKEY>
  3623.         </KEYS>
  3624.         <VALUES>
  3625.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="SearchHook"></REGVALUE>
  3626.         </VALUES>
  3627.     </REGISTRY>
  3628. <DANGER_LEVEL>1</DANGER_LEVEL>
  3629. <DESCRIPTION>CrackedEarth is a browser hijacker responsible for changing preferences as well as search options</DESCRIPTION>
  3630. </SW>
  3631. <SW NAME="DailyWinner">
  3632.     <DIRECTORIES>
  3633.     </DIRECTORIES>
  3634.     <FILES>
  3635.         <FILE NAME="veg32.dll" PATH="SysDir"></FILE>
  3636.         <FILE NAME="veg32.dll" PATH="Sys32Dir"></FILE>
  3637.         <FILE NAME="print32.dll" PATH="Sys32Dir"></FILE>
  3638.         <FILE NAME="print32.dll" PATH="SysDir"></FILE>
  3639.     </FILES>
  3640.     <COOKIES>
  3641.         <COOKIE NAME="DailyWinner"></COOKIE>
  3642.     </COOKIES>
  3643.     <REGISTRY>
  3644.         <KEYS>
  3645.         </KEYS>
  3646.         <VALUES>
  3647.         </VALUES>
  3648.     </REGISTRY>
  3649. <DANGER_LEVEL>1</DANGER_LEVEL>
  3650. <DESCRIPTION>DailyWinner opens up pop up advertisements when visiting certain sites</DESCRIPTION>
  3651. </SW>
  3652. <SW NAME="DialerOffline">
  3653.     <DIRECTORIES>
  3654.         <DIR NAME="blankdialer" PATH=""></DIR>
  3655.     </DIRECTORIES>
  3656.     <FILES>
  3657.         <FILE NAME="DialerOffline.dll" PATH="Sys32Dir"></FILE>
  3658.         <FILE NAME="DialerOffline.dll" PATH="SysDir"></FILE>
  3659.         <FILE NAME="LiveGirls.ico" PATH=""></FILE>
  3660.     </FILES>
  3661.     <COOKIES>
  3662.         <COOKIE NAME="stripplayer"></COOKIE>
  3663.     </COOKIES>
  3664.     <REGISTRY>
  3665.         <KEYS>
  3666.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{CEB29DA4-7AFA-4F24-B3CD-17351D590DF0}"></REGKEY>
  3667.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{1773B696-B019-4FC1-9EED-B1C7F925F56A}"></REGKEY>
  3668.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{20270406-63AD-4C7E-AE8D-BB632E508ACE}"></REGKEY>
  3669.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="TypeLib" VALUE="{A8882720-E26C-4073-8B8A-981D32882AF7}"></REGKEY>
  3670.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall" VALUE="Live Girls"></REGKEY>
  3671.         </KEYS>
  3672.         <VALUES>
  3673.         </VALUES>
  3674.     </REGISTRY>
  3675. <DANGER_LEVEL>2</DANGER_LEVEL>
  3676. <DESCRIPTION>DialerOffline is a dialer responsible for extremely high cost dialing from infected PCs</DESCRIPTION>
  3677. </SW>
  3678. <SW NAME="eXactSearch">
  3679.     <DIRECTORIES>
  3680.     </DIRECTORIES>
  3681.     <FILES>
  3682.         <FILE NAME="eXactToolbar.dll" PATH="SysDir"></FILE>
  3683.          <FILE NAME="eXactToolbar.dll" PATH="Sys32Dir"></FILE>
  3684.         <FILE NAME="exactupdate.exe" PATH=""></FILE>
  3685.     </FILES>
  3686.     <COOKIES>
  3687.         <COOKIE NAME="exactsearchbar"></COOKIE>
  3688.         <COOKIE NAME="exactadvertising"></COOKIE>
  3689.         <COOKIE NAME="mail.com"></COOKIE>
  3690.     </COOKIES>
  3691.     <REGISTRY>
  3692.         <KEYS>
  3693.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{f9765480-72d1-11d4-a75a-004f49045a87}"></REGKEY>
  3694.         </KEYS>
  3695.         <VALUES>
  3696.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{224530A0-C9CB-4AEE-9C0F-54AC1B533211}"></REGVALUE>
  3697.         </VALUES>
  3698.     </REGISTRY>
  3699. <DANGER_LEVEL>1</DANGER_LEVEL>
  3700. <DESCRIPTION>eXactSearch is a browser add on with certain additional search features</DESCRIPTION>
  3701. </SW>
  3702. <SW NAME="Mshp.dll hijacker">
  3703.     <DIRECTORIES>
  3704.     </DIRECTORIES>
  3705.     <FILES>
  3706.     </FILES>
  3707.     <COOKIES>
  3708.     </COOKIES>
  3709.     <REGISTRY>
  3710.         <KEYS>
  3711.         </KEYS>
  3712.         <VALUES>
  3713.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="image.dll"></REGVALUE>
  3714.         </VALUES>
  3715.     </REGISTRY>
  3716. <DANGER_LEVEL>1</DANGER_LEVEL>
  3717. <DESCRIPTION>Browser hijacker that changes your web settings</DESCRIPTION>
  3718. </SW>
  3719. <SW NAME="ezCyberSearch">
  3720.     <DIRECTORIES>
  3721.         <DIR NAME="ezSearchBar" PATH=""></DIR>
  3722.     </DIRECTORIES>
  3723.     <FILES>
  3724.         <FILE NAME="ezsearch.dll" PATH="SysDir"></FILE>
  3725.         <FILE NAME="ctadl1.dll" PATH="Sys32Dir"></FILE>
  3726.         <FILE NAME="ezsearch.dll" PATH="WinDir\\temp"></FILE>
  3727.         <FILE NAME="Inst Class.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
  3728.         <FILE NAME="ezsearch.dll" PATH="Sys32Dir"></FILE> 
  3729.     </FILES>
  3730.     <COOKIES>
  3731.         <COOKIE NAME="ezCyberSearch"></COOKIE>
  3732.     </COOKIES>
  3733.     <REGISTRY>
  3734.         <KEYS>
  3735.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{760a9dde-1433-4a7c-8189-d6735bb5d3dd}"></REGKEY>
  3736.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{aefcdec8-eb7d-429f-bc73-4f30d07bfe41}"></REGKEY>
  3737.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="ezSearchBar"></REGKEY>
  3738.         </KEYS>
  3739.         <VALUES>
  3740.         </VALUES>
  3741.     </REGISTRY>
  3742. <DANGER_LEVEL>2</DANGER_LEVEL>
  3743. <DESCRIPTION>ezCyberSearch includes a browser add on, as well as hijacking of settings associated with searching</DESCRIPTION>
  3744. </SW>
  3745. <SW NAME="W32.Opaserv.G.Worm">
  3746.       <DIRECTORIES>
  3747.       </DIRECTORIES>
  3748.       <FILES>
  3749.           <FILE NAME="marco!.scr" PATH="WinDir"></FILE>
  3750.        </FILES>
  3751.       <COOKIES>
  3752.       </COOKIES>
  3753.       <REGISTRY>
  3754.           <KEYS>
  3755.         </KEYS>
  3756.           <VALUES>
  3757.               <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="cronos"></REGVALUE>
  3758.           </VALUES>
  3759.       </REGISTRY>
  3760. <DANGER_LEVEL>1</DANGER_LEVEL>
  3761. <DESCRIPTION>Worm spread using networks</DESCRIPTION>
  3762. </SW>
  3763. <SW NAME="FreeScratchAndWin/XZoomy">
  3764.     <DIRECTORIES>
  3765.         <DIR NAME="FSW" PATH="PFDir"></DIR>
  3766.     </DIRECTORIES>
  3767.     <FILES>
  3768.         <FILE NAME="FSW.EXE" PATH=""></FILE>
  3769.         <FILE NAME="support.exe" PATH="SysDir"></FILE>
  3770.         <FILE NAME="support.exe" PATH="Sys32Dir"></FILE>
  3771.         <FILE NAME="IdleUI.dll" PATH="SysDir"></FILE>
  3772.         <FILE NAME="IdleUI.dll" PATH="Sys32Dir"></FILE>
  3773.         <FILE NAME="FSW.EXE" PATH="PFDir\\FSW"></FILE>
  3774.         <FILE NAME="fswinst.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
  3775.         <FILE NAME="IdleUI.dll" PATH=""></FILE>
  3776.     </FILES>
  3777.     <COOKIES>
  3778.         <COOKIE NAME="xzoomy"></COOKIE>
  3779.     </COOKIES>
  3780.     <REGISTRY>
  3781.         <KEYS>
  3782.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{47CC4DCD-BBC9-47A3-A677-44DB2559E0D8}"></REGKEY>
  3783.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{5DD7B3BE-FDEC-4563-B038-FF80F2345B89}"></REGKEY>
  3784.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{20A03A4C-9FAF-45D5-A5C2-B6C49774E03C}"></REGKEY>
  3785.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{99B0B113-6F25-49C9-8ECF-2FDDD3EDFF6A}"></REGKEY>
  3786.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes" VALUE="Fswinst.Application"></REGKEY>
  3787.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes" VALUE="FSW_beta1.Application"></REGKEY>
  3788.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes" VALUE="FSWINST.FswinstCtrl.1"></REGKEY>
  3789.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes" VALUE="FSW.Application"></REGKEY>
  3790.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="System\\CurrentControlSet\\Control\\Shutdown" VALUE="SetupProgramRan"></REGKEY>
  3791.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{20A03A4C-9FAF-45D5-A5C2-B6C49774E03C}"></REGKEY>
  3792.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{99B0B113-6F25-49C9-8ECF-2FDDD3EDFF6A}"></REGKEY>
  3793.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="FSW_beta1.Application"></REGKEY>
  3794.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="Fswinst.Application"></REGKEY>
  3795.         </KEYS>
  3796.         <VALUES>
  3797.             <REGVALUE MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="FSW_beta1.Application"></REGVALUE>
  3798.             <REGVALUE MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="Fswinst.Application"></REGVALUE>
  3799.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="FSW"></REGVALUE>
  3800.         </VALUES>
  3801.     </REGISTRY>
  3802. <DANGER_LEVEL>3</DANGER_LEVEL>
  3803. <DESCRIPTION>FreeScratchAndWin is responsible for online scratchcard games, and includes a browser helper object as well</DESCRIPTION>
  3804. </SW>
  3805. <SW NAME="IEAccess">
  3806.     <DIRECTORIES>
  3807.         <DIR NAME="eGroup" PATH="PFDir"></DIR>
  3808.         <DIR NAME="eGroup" PATH="WinDir"></DIR>
  3809.     </DIRECTORIES>
  3810.     <FILES>
  3811.         <FILE NAME="IEAccess2.dll" PATH="SysDir"></FILE>
  3812.         <FILE NAME="IEAccess2.dll" PATH="Sys32Dir"></FILE> 
  3813.         <FILE NAME="IEDial class.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
  3814.     </FILES>
  3815.     <COOKIES>
  3816.         <COOKIE NAME="eGroup"></COOKIE>
  3817.         <COOKIE NAME="nocreditcard"></COOKIE>
  3818.         <COOKIE NAME="sex-explorer"></COOKIE>
  3819.         <COOKIE NAME="electronic-group"></COOKIE>
  3820.     </COOKIES>
  3821.     <REGISTRY>
  3822.         <KEYS>
  3823.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="egroup"></REGKEY>
  3824.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="egroup"></REGKEY>
  3825.         </KEYS>
  3826.         <VALUES>
  3827.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\WinTrust\\Trust Providers\\Software Publishing\\Trust Database\\0" VALUE="ELECTRONIC GROUP"></REGVALUE>
  3828.         </VALUES>
  3829.     </REGISTRY>
  3830. <DANGER_LEVEL>4</DANGER_LEVEL>
  3831. <DESCRIPTION>IEAccess is used primarily by porn sites to install high cost dialers that connect the PC to expensive 900 numbers</DESCRIPTION>
  3832. </SW>
  3833. <SW NAME="ILookup/ILookup.windec32">
  3834.     <DIRECTORIES>
  3835.         <DIR NAME="i-lookup" PATH="PFDir"></DIR>
  3836.     </DIRECTORIES>
  3837.     <FILES>
  3838.         <FILE NAME="I-Lookup.com Toolbar.ocx" PATH=""></FILE>
  3839.         <FILE NAME="GlobalWebSearch.com.ocx" PATH=""></FILE>
  3840.         <FILE NAME="Ineb.dll" PATH="Sys32Dir"></FILE>
  3841.         <FILE NAME="Chgrgs.dll" PATH="Sys32Dir"></FILE>
  3842.         <FILE NAME="GWS.dll" PATH="Sys32Dir"></FILE>
  3843.         <FILE NAME="abeb.dll" PATH="Sys32Dir"></FILE>
  3844.         <FILE NAME="bmeb.dll" PATH="SysDir"></FILE>
  3845.         <FILE NAME="ttil.exe" PATH="WinDir\\ilookup"></FILE>
  3846.         <FILE NAME="drbr.dll" PATH="Sys32Dir"></FILE>
  3847.         <FILE NAME="sbus.dll" PATH="Sys32Dir"></FILE>
  3848.         <FILE NAME="sbus.dll" PATH="SysDir"></FILE>
  3849.         <FILE NAME="drbr.dll" PATH="SysDir"></FILE> 
  3850.         <FILE NAME="Ineb.dll" PATH="SysDir"></FILE>
  3851.         <FILE NAME="GWS.dll" PATH="SysDir"></FILE>
  3852.         <FILE NAME="Chgrgs.dll" PATH="SysDir"></FILE>
  3853.         <FILE NAME="abeb.dll" PATH="SysDir"></FILE>
  3854.         <FILE NAME="bmeb.dll" PATH="Sys32Dir"></FILE>
  3855.         <FILE NAME="WINDEC32.DLL" PATH="SysDir"></FILE>
  3856.         <FILE NAME="windec32.dll" PATH="Sys32Dir"></FILE>
  3857.     </FILES>
  3858.     <COOKIES>
  3859.         <COOKIE NAME="i-lookup"></COOKIE>
  3860.         <COOKIE NAME="globalwebsearch"></COOKIE>
  3861.         <COOKIE NAME="iclicks"></COOKIE>
  3862.         <COOKIE NAME="eaffiliate"></COOKIE>
  3863.     </COOKIES>
  3864.     <REGISTRY>
  3865.         <KEYS>
  3866.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{18B79968-1A76-4953-9EBB-B651407F8998}"></REGKEY>
  3867.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="ineb"></REGKEY>
  3868.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{0aaf602e-72a1-45fe-bab1-06971e07eaa2}"></REGKEY>
  3869.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{4c759ec6-96bd-4551-a320-e61a1d68437f}"></REGKEY>
  3870.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{54a85a38-a699-4aec-8f88-ab542210c93b}"></REGKEY>
  3871.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{8e4c16f3-45c8-4b24-99e6-f55082b7c4f1}"></REGKEY>
  3872.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{c82b55f0-60e0-478c-bc55-e4e22f11301d}"></REGKEY>
  3873.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{d35a69a7-7a34-4c67-814a-3f508c0bf371}"></REGKEY>
  3874.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{fbaa0b9e-a059-43e4-9699-76eb0aeb975b}"></REGKEY>
  3875.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{753aa023-02d1-447d-8b55-53a91a5abf18}"></REGKEY>
  3876.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{2038a287-4221-4f76-a7c0-addd77afabb3}"></REGKEY>
  3877.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{0c9cbfe1-91cd-40c2-bb64-1ec84c4c46af}"></REGKEY>
  3878.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{0aaf602e-72a1-45fe-bab1-06971e07eaa2}"></REGKEY>
  3879.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{2038a287-4221-4f76-a7c0-addd77afabb3}"></REGKEY>
  3880.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{0c9cbfe1-91cd-40c2-bb64-1ec84c4c46af}"></REGKEY>
  3881.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{61d029ac-972b-49fe-a155-962dfa0a37bb}"></REGKEY>
  3882.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{fbaa0b9e-a059-43e4-9699-76eb0aeb975b}"></REGKEY>
  3883.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{2038a287-4221-4f76-a7c0-addd77afabb3}"></REGKEY>
  3884.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{61d029ac-972b-49fe-a155-962dfa0a37bb}"></REGKEY>
  3885.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{35cc7369-c6eb-4a64-ab05-44cf0b5087a0}"></REGKEY>
  3886.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{8e4c16f3-45c8-4b24-99e6-f55082b7c4f1}"></REGKEY>
  3887.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{61d029ac-972b-49fe-a155-962dfa0a37bb}"></REGKEY>
  3888.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{8e4c16f3-45c8-4b24-99e6-f55082b7c4f1}"></REGKEY>
  3889.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{d35a69a7-7a34-4c67-814a-3f508c0bf371}"></REGKEY>
  3890.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{7e893886-5641-4867-a323-2d8abb7b4d6d}"></REGKEY>
  3891.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{b0632ec9-bd27-48c4-b16c-294f8823bff0}"></REGKEY>
  3892.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{e6ed4741-a9df-4bb1-a203-c7461fc00355}"></REGKEY>
  3893.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\typelib" VALUE="{edd73c85-28b8-4145-ab9c-673c74c667e6}"></REGKEY>
  3894.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\software\\microsoft\\internet explorer\\toolbar" VALUE="{8e4c16f3-45c8-4b24-99e6-f55082b7c4f1}"></REGKEY>
  3895.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{fe1a240f-b247-4e06-a600-30e28f5af3a0}"></REGKEY>
  3896.         </KEYS>
  3897.         <VALUES>
  3898.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{6ef3ae25-5a7d-40c2-9b44-9ed0068621c0}"></REGVALUE>
  3899.         </VALUES>
  3900.     </REGISTRY>
  3901. <DANGER_LEVEL>3</DANGER_LEVEL>
  3902. <DESCRIPTION>I-Lookup provides a search box as well as custom buttons added to the browser.  It also adds bookmarks and hijacks browser settings</DESCRIPTION>
  3903. </SW>
  3904. <SW NAME="IPInsight">
  3905.     <DIRECTORIES>
  3906.     </DIRECTORIES>
  3907.     <FILES>
  3908.         <FILE NAME="IPInsigt.dll" PATH="WinDir\\LastGood"></FILE>
  3909.         <FILE NAME="IPInsigt.pnf" PATH="WinDir\\LastGood\\INF"></FILE>
  3910.         <FILE NAME="IPInsigt.inf" PATH="WinDir\\LastGood\\INF"></FILE>
  3911.         <FILE NAME="Sentry.exe" PATH="WinDir"></FILE>
  3912.         <FILE NAME="Sentry.ini" PATH="WinDir"></FILE>
  3913.         <FILE NAME="IPInsigt.dll" PATH="WinDir"></FILE>
  3914.         <FILE NAME="alchem.exe" PATH="WinDir"></FILE>
  3915.     </FILES>
  3916.     <COOKIES>
  3917.     </COOKIES>
  3918.     <REGISTRY>
  3919.         <KEYS>
  3920.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="IPInsight"></REGKEY>
  3921.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{000004CC-E4FF-4F2C-BC30-DBEF0B983BC9}"></REGKEY>
  3922.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{000004CC-E4FF-4F2C-BC30-DBEF0B983BC9}"></REGKEY>
  3923.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\app management\\arpcache" VALUE="IPInsight"></REGKEY> 
  3924.         </KEYS>
  3925.         <VALUES>
  3926.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Sentry"></REGVALUE>
  3927.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run'" VALUE="ALCHEM"></REGVALUE>
  3928.         </VALUES>
  3929.     </REGISTRY>
  3930. <DANGER_LEVEL>2</DANGER_LEVEL>
  3931. <DESCRIPTION>IPInsight is a process that monitors data entered into forms and reports information to a central server</DESCRIPTION>
  3932. </SW>
  3933. <SW NAME="MasterDialer">
  3934.     <DIRECTORIES>
  3935.     </DIRECTORIES>
  3936.     <FILES>
  3937.         <FILE NAME="AXDownload.dll" PATH=""></FILE>
  3938.         <FILE NAME="Main class.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
  3939.         <FILE NAME="WebInstall.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
  3940.         <FILE NAME="WebUpdate.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
  3941.     </FILES>
  3942.     <COOKIES>
  3943.         <COOKIE NAME="firstway"></COOKIE>
  3944.         <COOKIE NAME="comfix"></COOKIE>
  3945.     </COOKIES>
  3946.     <REGISTRY>
  3947.         <KEYS>
  3948.         </KEYS>
  3949.         <VALUES>
  3950.         </VALUES>
  3951.     </REGISTRY>
  3952. <DANGER_LEVEL>2</DANGER_LEVEL>
  3953. <DESCRIPTION>MasterDialer is used as a high cost dialer that connects users by modem and is usually associated with porn sites</DESCRIPTION>
  3954. </SW>
  3955. <SW NAME="Meridian">
  3956.     <DIRECTORIES>
  3957.     </DIRECTORIES>
  3958.     <FILES>
  3959.         <FILE NAME="myaccess.dll" PATH="SysDir"></FILE>
  3960.         <FILE NAME="gdiplus64.dll" PATH="SysDir"></FILE>
  3961.         <FILE NAME="ie64.dll" PATH="SysDir"></FILE>
  3962.         <FILE NAME="myaccess.dll" PATH="Sys32Dir"></FILE>
  3963.         <FILE NAME="gdiplus64.dll" PATH="Sys32Dir"></FILE>
  3964.         <FILE NAME="ie64.dll" PATH="Sys32Dir"></FILE>
  3965.         <FILE NAME="ver64.dll" PATH="Sys32Dir"></FILE>
  3966.         <FILE NAME="bho.dll" PATH="Sys32Dir"></FILE>
  3967.         <FILE NAME="ver64.dll" PATH="SysDir"></FILE>
  3968.     </FILES>
  3969.     <COOKIES>
  3970.         <COOKIE NAME="tbi"></COOKIE>
  3971.         <COOKIE NAME="thumbsnatcher"></COOKIE>
  3972.     </COOKIES>
  3973.     <REGISTRY>
  3974.         <KEYS>
  3975.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{FA79FA22-8DB3-43D1-997B-6DBFD8845569}"></REGKEY>
  3976.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{FA79FA22-8DB3-43D1-997B-6DBFD8845569}"></REGKEY>
  3977.         </KEYS>
  3978.         <VALUES>
  3979.         </VALUES>
  3980.     </REGISTRY>
  3981. <DANGER_LEVEL>1</DANGER_LEVEL>
  3982. <DESCRIPTION>Meridian is a browser helper object that opens up various pop up advertising based on sites visited</DESCRIPTION>
  3983. </SW>
  3984. <SW NAME="MoneyTree">
  3985.     <DIRECTORIES>
  3986.     </DIRECTORIES>
  3987.     <FILES>
  3988.         <FILE NAME="iopti130.dll" PATH="WinDir"></FILE>
  3989.         <FILE NAME="nem207.dll" PATH="WinDir"></FILE>
  3990.         <FILE NAME="wsem210.dll" PATH="WinDir"></FILE>
  3991.         <FILE NAME="nem212.dll" PATH="WinDir"></FILE>
  3992.         <FILE NAME="NSUpdateLiteCtrl Class.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
  3993.         <FILE NAME="MoneyTree Dialer.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
  3994.         <FILE NAME="nsupdate.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
  3995.         <FILE NAME="NSupd9x.inf" PATH="WinDir\\Downloaded Program Files"></FILE>
  3996.         <FILE NAME="UniDist.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
  3997.         <FILE NAME="UniDst.inf" PATH="WinDir\\Downloaded Program Files"></FILE>
  3998.         <FILE NAME="multidist" PATH="WinDir\\Downloaded Program files"></FILE> 
  3999.         <FILE NAME="NSUpdateLiteCtrl Class" PATH="WinDir/DownloadProgramfile"></FILE>
  4000.         <FILE NAME="NSLiteUpdateCtrl Class" PATH="WinDir/DownloadProgramfile"></FILE>
  4001.         <FILE NAME="MoneyTree Dialer" PATH="WinDir/DownloadProgramfile"></FILE>
  4002.         <FILE NAME="MultiDist" PATH="WinDir/DownloadProgramfile"></FILE>
  4003.         <FILE NAME="Software Update Manager" PATH="WinDir/DownloadProgramfile"></FILE>
  4004.         <FILE NAME="ioptiXXX.dll" PATH=""></FILE>
  4005.         <FILE NAME="nemXXX.dll" PATH=""></FILE>
  4006.         <FILE NAME="wsemXXX.dll" PATH=""></FILE>
  4007.         <FILE NAME="iopti130.dll" PATH=""></FILE>
  4008.     </FILES>
  4009.     <COOKIES>
  4010.     </COOKIES>
  4011.     <REGISTRY>
  4012.        <KEYS>
  4013.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{a0f0d762-d1de-43af-b70e-d87864743eb3}"></REGKEY>
  4014.        </KEYS>
  4015.        <VALUES>
  4016.        </VALUES>
  4017.     </REGISTRY>
  4018. <DANGER_LEVEL>2</DANGER_LEVEL>
  4019. <DESCRIPTION>MoneyTree is an ActiveX control that is used to install high cost dialers, primarily for porn sites</DESCRIPTION>
  4020. </SW>
  4021. <SW NAME="PerMedia">
  4022.     <DIRECTORIES>
  4023.     </DIRECTORIES>
  4024.     <FILES>
  4025.         <FILE NAME="permedia.exe" PATH=""></FILE>
  4026.         <FILE NAME="winsrv.exe" PATH=""></FILE>
  4027.         <FILE NAME="winsrv_reg.exe" PATH=""></FILE>
  4028.     </FILES>
  4029.     <COOKIES>
  4030.         <COOKIE NAME="friendgreetings"></COOKIE>
  4031.         <COOKIE NAME="friend-greeting"></COOKIE>
  4032.         <COOKIE NAME="laugh-mail"></COOKIE>
  4033.         <COOKIE NAME="us-downloads"></COOKIE>
  4034.         <COOKIE NAME="pv1"></COOKIE>
  4035.     </COOKIES>
  4036.     <REGISTRY>
  4037.         <KEYS>
  4038.         </KEYS>
  4039.         <VALUES>
  4040.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="PerMedia"></REGVALUE>
  4041.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="winsrv"></REGVALUE>
  4042.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="winsrv reg"></REGVALUE>
  4043.         </VALUES>
  4044.     </REGISTRY>
  4045. <DANGER_LEVEL>2</DANGER_LEVEL>
  4046. <DESCRIPTION>PerMedia is started at windows startup, has an auto-update feature, and a browser helper object that tampers with browser settings</DESCRIPTION>
  4047. </SW>
  4048. <SW NAME="X-Diver/BillByCall">  
  4049.      <DIRECTORIES>
  4050.      </DIRECTORIES>
  4051.      <FILES>
  4052.          <FILE NAME="cax.dll" PATH=""></FILE>
  4053.          <FILE NAME="cuwin32.exe" PATH=""></FILE>
  4054.          <FILE NAME="x-diver.dun" PATH=""></FILE>
  4055.       </FILES>
  4056.      <COOKIES>
  4057.         <COOKIE NAME="EOPS"></COOKIE>
  4058.      </COOKIES>
  4059.      <REGISTRY>
  4060.          <KEYS>
  4061.          </KEYS>
  4062.          <VALUES>
  4063.          </VALUES>
  4064.      </REGISTRY>
  4065. <DANGER_LEVEL>2</DANGER_LEVEL>
  4066. <DESCRIPTION>X-Diver is a premium rate dialer, based out of Germany.  It allows the PC to be connected to a high rate phone number without user interaction</DESCRIPTION>
  4067. </SW>
  4068. <SW NAME="Xupiter">
  4069.     <DIRECTORIES>
  4070.         <DIR NAME="Xupiter" PATH="PFDir"></DIR>
  4071.         <DIR NAME="Browser" PATH="PFDir"></DIR>
  4072.         <DIR NAME="Sqwire" PATH="PFDir"></DIR>
  4073.         <DIR NAME="oe" PATH="PFDir"></DIR>
  4074.         <DIR NAME="orbit" PATH="PFDir"></DIR> 
  4075.     </DIRECTORIES>
  4076.     <FILES>
  4077.         <FILE NAME="XupiterStartup.exe" PATH=""></FILE>
  4078.         <FILE NAME="XupiterToolbarLoader.exe" PATH=""></FILE>
  4079.            <FILE NAME="xupiterstartup2003.exe" PATH=""></FILE>
  4080.         <FILE NAME="BWCfgLoader.exe" PATH=""></FILE>
  4081.         <FILE NAME="XTCfgLoader.exe" PATH=""></FILE>
  4082.         <FILE NAME="oeloader.exe" PATH="WinDir\\downloaded program files"></FILE>
  4083.         <FILE NAME="uc.exe" PATH="PFDir\\sqwire"></FILE>
  4084.         <FILE NAME="cc.exe" PATH="PFDir\\sqwire"></FILE>
  4085.         <FILE NAME="XupiterToolbar.dll" PATH="PFDir\\Xupiter\\Updates"></FILE>
  4086.         <FILE NAME="XTUpdate.dll" PATH="PFDir\\Xupiter\\Updates"></FILE>
  4087.         <FILE NAME="XTSearch.dll" PATH="PFDir\\Xupiter\\Updates"></FILE>
  4088.         <FILE NAME="XupiterToolbar.dll" PATH="PFDir\\Xupiter"></FILE>
  4089.         <FILE NAME="XTUpdate.dll" PATH="PFDir\\Xupiter"></FILE>
  4090.         <FILE NAME="XTSearch.dll" PATH="PFDir\\Xupiter"></FILE>
  4091.         <FILE NAME="BrowserToolbar.dll" PATH="PFDir\\Browser\\Updates"></FILE>
  4092.         <FILE NAME="BWUpdate.dll" PATH="PFDir\\Browser\\Updates"></FILE>
  4093.         <FILE NAME="BWSearch.dll" PATH="PFDir\\Browser\\Updates"></FILE>
  4094.         <FILE NAME="t.dll" PATH="PFDir\\Sqwire"></FILE>
  4095.         <FILE NAME="u.dll" PATH="PFDir\\Sqwire"></FILE>
  4096.         <FILE NAME="s.dll" PATH="PFDir\\Sqwire"></FILE>
  4097.         <FILE NAME="SQLoader.exe" PATH="WinDir\\Downloaded Program Files"></FILE>
  4098.         <FILE NAME="SQLoader.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
  4099.         <FILE NAME="SQLoader.inf" PATH="WinDir\\Downloaded Program Files"></FILE>
  4100.         <FILE NAME="SQInstaller.exe" PATH="WinDir\\Downloaded Program Files"></FILE>
  4101.         <FILE NAME="toolbar.dll" PATH="PFDir\\Common Files\\OE"></FILE>
  4102.            <FILE NAME="redirector.dll" PATH="PFDir\\Common Files\\OE"></FILE>
  4103.            <FILE NAME="search.dll" PATH="PFDir\\Common Files\\OE"></FILE>
  4104.         <FILE NAME="XupiterStartup.exe" PATH="PFDir\\Xupiter"></FILE>
  4105.            <FILE NAME="BWCfgLoader.exe" PATH="PFDir\\Xupiter"></FILE>
  4106.            <FILE NAME="XTCfgLoader.exe" PATH="PFDir\\Xupiter"></FILE>
  4107.            <FILE NAME="XupiterToolbarLoader.exe" PATH="PFDir\\Xupiter"></FILE>
  4108.            <FILE NAME="xupiterstartup2003.exe" PATH="PFDir\\Xupiter"></FILE>
  4109.            <FILE NAME="RunDownload.exe" PATH=""></FILE>
  4110.            <FILE NAME="XupiterToolbar.exe" PATH=""></FILE>
  4111.         <FILE NAME="view.exe" PATH="PFDir\\orbit"></FILE>
  4112.     </FILES>
  4113.     <COOKIES>
  4114.         <COOKIE NAME="Sqwire"></COOKIE>
  4115.         <COOKIE NAME="BrowserWise"></COOKIE>
  4116.         <COOKIE NAME="freewebupgrades"></COOKIE>
  4117.         <COOKIE NAME="FortuneCity"></COOKIE>
  4118.     </COOKIES>
  4119.     <REGISTRY>
  4120.         <KEYS>
  4121.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{0FDA4D2B-7975-405d-8D7C-F5E2247EAE80}"></REGKEY>
  4122.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Software" VALUE="Xupiter"></REGKEY>
  4123.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Software" VALUE="SQ"></REGKEY>
  4124.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="SQ"></REGKEY>
  4125.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="Xupiter"></REGKEY>
  4126.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Code Store Database\\Distribution Units" VALUE="{A27CFCAE-9351-4D74-BFFC-21EB19693D8C}"></REGKEY>
  4127.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{2662bdd7-05d6-408f-b241-ff98face6054}"></REGKEY>
  4128.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{26fd5192-a97c-4b48-a5d7-2420cfdcfdf2}"></REGKEY>
  4129.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{3c5ba506-6c30-4738-9ced-797acadea8dc}"></REGKEY>
  4130.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{57e69d5a-6539-4d7d-9637-775de8a385b4}"></REGKEY>
  4131.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{6e6dd93e-1fc3-4f43-8afb-1b7b90c9d3eb}"></REGKEY>
  4132.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{702ad576-fddb-4d0f-9811-a43252064684}"></REGKEY>
  4133.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{a27cfcae-9351-4d74-bffc-21eb19693d8c}"></REGKEY>
  4134.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{d48f2e28-68e2-4920-9848-d6e6c7ab3eb7}"></REGKEY>
  4135.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{d7b3e460-9968-4191-bd6f-beed1bc18482}"></REGKEY>
  4136.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{1a8b567b-bd3f-44a1-8b94-f50d37a1914e}"></REGKEY>
  4137.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{3a021d2f-5f75-47f5-9bab-a137e1fb015f}"></REGKEY>
  4138.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{d686db39-659a-491a-a35c-60b99495c16e}"></REGKEY>
  4139.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{2662bdd7-05d6-408f-b241-ff98face6054}"></REGKEY>
  4140.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="TypeLib" VALUE="{43732063-1bda-45a0-bbee-13e014cb4041}"></REGKEY>
  4141.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="TypeLib" VALUE="{909e0059-f545-42de-9d2c-cc4a3e336ec3}"></REGKEY>
  4142.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="TypeLib" VALUE="{c6c2871f-7467-4a35-90fa-9e9894bc1916}"></REGKEY>
  4143.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="xtsearch.xtsearchhook"></REGKEY>
  4144.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="xtsearch.xtsearchhook.1"></REGKEY>
  4145.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="xtupdate."></REGKEY>
  4146.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="xtupdate.xt"></REGKEY>
  4147.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="xtupdate.xt.1"></REGKEY>
  4148.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="xupitertoolbar"></REGKEY>
  4149.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="xupitertoolbar.band"></REGKEY>
  4150.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="xupitertoolbar.band.1"></REGKEY>                        
  4151.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Code Store Database\\Distribution Units" VALUE="{280168bc-76bf-4cd0-b835-3d686efa8ddc}"></REGKEY>
  4152.         </KEYS>
  4153.         <VALUES>
  4154.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="XupiterStartup"></REGVALUE>
  4155.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="XupiterCfgLoader"></REGVALUE>
  4156.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="SQUpdatesChecker"></REGVALUE>
  4157.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="SQConfigChecker"></REGVALUE>
  4158.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="OrbitUpdate"></REGVALUE>
  4159.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="OrbitView"></REGVALUE> 
  4160.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Xupiter Startup"></REGVALUE>
  4161.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="xupiterstartup2003"></REGVALUE>
  4162.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="XupiterToolbarLoader"></REGVALUE> 
  4163.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{702AD576-FDDB-4d0f-9811-A43252064684}"></REGVALUE>
  4164.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{57E69D5A-6539-4d7d-9637-775DE8A385B4}"></REGVALUE>
  4165.         </VALUES>
  4166.     </REGISTRY>
  4167. <DANGER_LEVEL>4</DANGER_LEVEL>
  4168. <DESCRIPTION>Xupiter modifies your browser settings to contain their buttons, as well as automatically updating itself, it hijacks browser settings</DESCRIPTION>
  4169. </SW>
  4170. <SW NAME="OnlineDialer">
  4171.     <DIRECTORIES>
  4172.         <DIR NAME="OnlineDialer" PATH="PFDir"></DIR>
  4173.     </DIRECTORIES>
  4174.     <FILES>
  4175.         <FILE NAME="MaConnect.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
  4176.         <FILE NAME="eConnect.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
  4177.         <FILE NAME="IEDialer.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
  4178.         <FILE NAME="SunInfoConnect.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
  4179.         <FILE NAME="BelCallConnect.dll" PATH=""></FILE>
  4180.         <FILE NAME="Loader class.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
  4181.         <FILE NAME="eConn class.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
  4182.         <FILE NAME="IELoaderCtl class.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
  4183.         <FILE NAME="Download class.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
  4184.         <FILE NAME="snConnect class.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
  4185.     </FILES>
  4186.     <COOKIES>
  4187.         <COOKIE NAME="online-dialer"></COOKIE>
  4188.         <COOKIE NAME="libereco"></COOKIE>
  4189.         <COOKIE NAME="0190"></COOKIE>
  4190.         <COOKIE NAME="4netmedia"></COOKIE>
  4191.     </COOKIES>
  4192.     <REGISTRY>
  4193.         <KEYS>
  4194.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{02c20140-76f8-4763-83d5-b660107b7a90}"></REGKEY>
  4195.         </KEYS>
  4196.         <VALUES>
  4197.         </VALUES>
  4198.     </REGISTRY>
  4199. <DANGER_LEVEL>2</DANGER_LEVEL>
  4200. <DESCRIPTION>OnlineDialer is an ActiveX control that is used to install high cost dialers, primarily for porn sites</DESCRIPTION>
  4201. </SW>
  4202. <SW NAME="Searchex">
  4203.     <DIRECTORIES>
  4204.     </DIRECTORIES>
  4205.     <FILES>
  4206.         <FILE NAME="hmepge.dll" PATH="Sys32Dir"></FILE>
  4207.         <FILE NAME="hmepge.dll" PATH="SysDir"></FILE>
  4208.         <FILE NAME="IEBrw.dll" PATH="SysDir"></FILE>
  4209.         <FILE NAME="HomePage.dll" PATH="SysDir"></FILE>
  4210.         <FILE NAME="IEBrw.dll" PATH="Sys32Dir"></FILE>
  4211.         <FILE NAME="HomePage.dll" PATH="Sys32Dir"></FILE>
  4212.         <FILE NAME="hotlink.dll" PATH="SysDir"></FILE>
  4213.         <FILE NAME="hotlink.dll" PATH="Sys32Dir"></FILE>
  4214.         </FILES>
  4215.     <COOKIES>
  4216.         <COOKIE NAME="cantfind"></COOKIE>
  4217.         <COOKIE NAME="winstream"></COOKIE>
  4218.     </COOKIES>
  4219.     <REGISTRY>
  4220.         <KEYS>
  4221.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{b405ee45-1aa2-410d-a6cf-1a74371dcd62}"></REGKEY>
  4222.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{a116a5c1-ad77-446c-992a-f56200b112db}"></REGKEY>
  4223.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{1a98bca2-0bd1-47de-9710-c7665f7f1fcb}"></REGKEY>
  4224.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{1a98bca2-0bd1-47de-9710-c7665f7f1fcb}"></REGKEY>
  4225.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{a116a5c1-ad77-446c-992a-f56200b112db}"></REGKEY>
  4226.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{b405ee45-1aa2-410d-a6cf-1a74371dcd62}"></REGKEY>
  4227.         </KEYS>
  4228.         <VALUES>
  4229.         </VALUES>
  4230.     </REGISTRY>
  4231. <DANGER_LEVEL>3</DANGER_LEVEL>
  4232. <DESCRIPTION>Searchex is a homepage and search setting hijacker</DESCRIPTION>
  4233. </SW>
  4234. <SW NAME="XDialer">
  4235.     <DIRECTORIES>
  4236.     </DIRECTORIES>
  4237.     <FILES>
  4238.         <FILE NAME="DialX.ocx" PATH="SysDir"></FILE>
  4239.         <FILE NAME="AButton.ocx" PATH="SysDir"></FILE> 
  4240.         <FILE NAME="AButton.ocx" PATH="Sys32Dir"></FILE>
  4241.         <FILE NAME="DialX.ocx" PATH="Sys32Dir"></FILE>
  4242.         <FILE NAME="XDial.ocx" PATH="Sys32Dir"></FILE>
  4243.         <FILE NAME="XDial.ocx" PATH="SysDir"></FILE>
  4244.     </FILES>
  4245.     <COOKIES>
  4246.         <COOKIE NAME="pctlca"></COOKIE>
  4247.     </COOKIES>
  4248.     <REGISTRY>
  4249.         <KEYS>
  4250.         </KEYS>
  4251.         <VALUES>
  4252.         </VALUES>
  4253.     </REGISTRY>
  4254. <DANGER_LEVEL>2</DANGER_LEVEL>
  4255. <DESCRIPTION>XDialer is a Japanese high cost dialer, primarily used for porn sites</DESCRIPTION>
  4256. </SW>
  4257. <SW NAME="Searchit/SearchitBar">
  4258.     <DIRECTORIES>
  4259.     </DIRECTORIES>
  4260.     <FILES>
  4261.         <FILE NAME="srchitbar.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
  4262.         <FILE NAME="Searchit Toolbar.inf" PATH="WinDir\\Downloaded Program Files"></FILE>
  4263.     </FILES>
  4264.     <COOKIES>
  4265.         <COOKIE NAME="inet-traffic"></COOKIE>
  4266.     </COOKIES>
  4267.     <REGISTRY>
  4268.         <KEYS>
  4269.         </KEYS>
  4270.         <VALUES>
  4271.         </VALUES>
  4272.     </REGISTRY>
  4273. <DANGER_LEVEL>1</DANGER_LEVEL>
  4274. <DESCRIPTION>Searchit is a basic toolbar offering various search features</DESCRIPTION>
  4275. </SW>
  4276. <SW NAME="SearchSquire">
  4277.     <DIRECTORIES>
  4278.     </DIRECTORIES>
  4279.     <FILES>
  4280.         <FILE NAME="SearchSquire.dll" PATH="SysDir"></FILE>
  4281.         <FILE NAME="SearchSquire2.dll" PATH="SysDir"></FILE>
  4282.         <FILE NAME="engines.txt" PATH="SysDir"></FILE>
  4283.         <FILE NAME="partner.txt" PATH="SysDir"></FILE>
  4284.         <FILE NAME="SearchSquire.exe" PATH="SysDir"></FILE>
  4285.         <FILE NAME="SquireUninst.exe" PATH="SysDir"></FILE>
  4286.         <FILE NAME="SearchSquire2.inf" PATH="SysDir"></FILE>
  4287.         <FILE NAME="SearchUpdate.exe" PATH="SysDir"></FILE>
  4288.         <FILE NAME="unsearch.exe" PATH="SysDir"></FILE>
  4289.         <FILE NAME="SearchSquire.inf" PATH="WinDir\\Downloaded Program Files"></FILE>
  4290.     </FILES>
  4291.     <COOKIES>
  4292.     </COOKIES>
  4293.     <REGISTRY>
  4294.         <KEYS>
  4295.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{907CA0E5-CE84-11D6-9508-02608CDD2846}"></REGKEY>
  4296.         </KEYS>
  4297.         <VALUES>
  4298.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="SearchSquire"></REGVALUE>
  4299.         </VALUES>
  4300.     </REGISTRY>
  4301. <DANGER_LEVEL>2</DANGER_LEVEL>
  4302. <DESCRIPTION>SearchSquire is a browser sidebar add on that contains paid links to offers from SearchSquire sponsors</DESCRIPTION>
  4303. </SW>
  4304. <SW NAME="Mainpean Stardialer"> 
  4305.     <DIRECTORIES>
  4306.     </DIRECTORIES>
  4307.     <FILES>
  4308.         <FILE NAME="stardialer.exe" PATH=""></FILE>
  4309.         <FILE NAME="opr0009i.exe" PATH=""></FILE>
  4310.         <FILE NAME="StarInstall control.inf" PATH="WinDir\\Downloaded Program Files"></FILE>
  4311.         <FILE NAME="StarInstall.ocx" PATH=""></FILE>
  4312.         <FILE NAME="P2P p2p-10110.lnk" PATH=""></FILE>
  4313.         <FILE NAME="p2p-10110.exe" PATH=""></FILE>
  4314.     </FILES>
  4315.     <COOKIES>
  4316.         <COOKIE NAME="MainPean"></COOKIE>
  4317.     </COOKIES>
  4318.     <REGISTRY>
  4319.       <KEYS>
  4320.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="CLSID" VALUE="{E0B795B4-FD95-4ABD-A375-27962EFCE8CF}"></REGKEY>
  4321.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE" VALUE="MainPean Highspeed"></REGKEY>
  4322.       </KEYS>
  4323.       <VALUES>
  4324.       </VALUES>
  4325.     </REGISTRY>
  4326. <DANGER_LEVEL>3</DANGER_LEVEL>
  4327. <DESCRIPTION>Dialer used to dial high cost numbers from your PC without your knowledge</DESCRIPTION>
  4328. </SW>
  4329. <SW NAME="ISearch">
  4330.     <DIRECTORIES>
  4331.     </DIRECTORIES>
  4332.     <FILES>
  4333.         <FILE NAME="toolbar.dll" PATH="SysDir"></FILE>
  4334.         <FILE NAME="toolbar.dll" PATH="Sys32Dir"></FILE>
  4335.     </FILES>
  4336.     <COOKIES>
  4337.     </COOKIES>
  4338.     <REGISTRY>
  4339.         <KEYS>
  4340.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{1C78AB3F-A857-482e-80C03A1E5238A565}"></REGKEY>
  4341.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{1c78ab3f-a857-482e-80c0-3a1e5238a565}"></REGKEY>
  4342.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{1C78AB3F-A857-482e-80C0-3A1E5238A565}"></REGKEY>
  4343.         </KEYS>
  4344.         <VALUES>
  4345.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Internet Explorer\\Toolbar\\WebBrowser" VALUE="{1C78AB3F-A857-482E-80C0-3A1E5238A565}"></REGVALUE>
  4346.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{1C78AB3F-A857-482e-80C0-3A1E5238A565}"></REGVALUE>
  4347.         </VALUES>
  4348.     </REGISTRY>
  4349. <DANGER_LEVEL>1</DANGER_LEVEL>
  4350. <DESCRIPTION>ISearch is a toolbar also known to change your searches to use ISearch sponsored results</DESCRIPTION>
  4351. </SW>
  4352. <SW NAME="StripPlayer">
  4353.     <DIRECTORIES>
  4354.         <DIR NAME="strip-player" PATH="PFDir"></DIR>
  4355.     </DIRECTORIES>
  4356.     <FILES>
  4357.         <FILE NAME="ActiveStripSetup.dll" PATH="SysDir"></FILE>
  4358.     </FILES>
  4359.     <COOKIES>
  4360.     </COOKIES>
  4361.     <REGISTRY>
  4362.         <KEYS>
  4363.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes" VALUE="ActiveStripSetup.EGStripDownload"></REGKEY>
  4364.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes" VALUE="ActiveStripSetup.EGStripDownload.1"></REGKEY>
  4365.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\CLSID" VALUE="{E3F7205F-2AE0-4BF0-816B-2D24A5F20EC7}"></REGKEY>
  4366.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\TypeLib" VALUE="{357AA41A-B7A8-4632-A27D-5B980B25CF43}"></REGKEY>
  4367.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\Interface" VALUE="{BC23F736-C5BE-47FB-B459-1757933E5DF3}"></REGKEY>
  4368.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\SystemCertificates\\TrustedPublisher\\Certificates" VALUE="Electronic Group"></REGKEY>
  4369.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{D037F883-92C3-4F89-A302-C01127CF3C72}"></REGKEY>
  4370.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{E0B795B4-FD95-4ABD-A375-27962EFCE8CF}"></REGKEY>
  4371.         </KEYS>
  4372.         <VALUES>
  4373.         </VALUES>
  4374.     </REGISTRY>
  4375. <DANGER_LEVEL>3</DANGER_LEVEL>
  4376. <DESCRIPTION>StripPlayer is a high cost dialer providing access to strip-player.com</DESCRIPTION>
  4377. </SW>
  4378. <SW NAME="SubSearch">
  4379.     <DIRECTORIES>
  4380.     </DIRECTORIES>
  4381.     <FILES>
  4382.         <FILE NAME="BHO2.dll" PATH="SysDir"></FILE>
  4383.         <FILE NAME="MSNIE.dll" PATH="SysDir"></FILE>
  4384.         <FILE NAME="sbsrch_v2.dll" PATH="SysDir"></FILE>
  4385.         <FILE NAME="SbSrch_V21.dll" PATH="SysDir"></FILE>
  4386.         <FILE NAME="winfgnet_1.dat" PATH=""></FILE>
  4387.         <FILE NAME="rmvold.exe" PATH=""></FILE>
  4388.         <FILE NAME="BHO2.dll" PATH="Sys32Dir"></FILE>
  4389.         <FILE NAME="MSNIE.dll" PATH="Sys32Dir"></FILE>
  4390.         <FILE NAME="sbsrch_v2.dll" PATH="Sys32Dir"></FILE>
  4391.         <FILE NAME="SbSrch_V21.dll" PATH="Sys32Dir"></FILE>
  4392.         <FILE NAME="msvcn.dll" PATH="Sys32Dir"></FILE>
  4393.         <FILE NAME="msvcn.dll" PATH="SysDir"></FILE>
  4394.         <FILE NAME="SbSrch_V22.dll" PATH="SysDir"></FILE>
  4395.         <FILE NAME="SbSrch_V22.dll" PATH="Sys32Dir"></FILE>
  4396.         <FILE NAME="01A00.DLL" PATH="SysDir"></FILE>
  4397.          <FILE NAME="01A00.DLL" PATH="Sys32Dir"></FILE>
  4398.     </FILES>
  4399.     <COOKIES>
  4400.         <COOKIE NAME="adscholar"></COOKIE>
  4401.         <COOKIE NAME="hightrafficads"></COOKIE>
  4402.         <COOKIE NAME="popunder"></COOKIE>
  4403.         <COOKIE NAME="cpcads"></COOKIE>
  4404.     </COOKIES>
  4405.     <REGISTRY>
  4406.         <KEYS>
  4407.           <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software\\VB and VBA Program Settings" VALUE="IeMsnSbSrch_1"></REGKEY>
  4408.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{1D870C86-AA3C-4451-81E4-71D480A1A652}"></REGKEY>
  4409.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{31995C64-CB4D-483E-82C2-CCFFE2F66CAB}"></REGKEY>
  4410.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{4C4871FD-30F6-4430-8834-BC75D58F1529}"></REGKEY>
  4411.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{90DA654C-083C-11D6-8A9D-0050BA8452C0}"></REGKEY>
  4412.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{D9A5A49C-60EB-4C07-8570-8FB8FE825E7C}"></REGKEY>
  4413.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\BrowserHelperObjects" VALUE="{1D870C86-AA3C-4451-81E4-71D480A1A652}"></REGKEY>
  4414.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\BrowserHelperObjects" VALUE="{31995C64-CB4D-483E-82C2-CCFFE2F66CAB}"></REGKEY>
  4415.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\BrowserHelperObjects" VALUE="{4C4871FD-30F6-4430-8834-BC75D58F1529}"></REGKEY>
  4416.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\BrowserHelperObjects" VALUE="{90DA654C-083C-11D6-8A9D-0050BA8452C0}"></REGKEY>
  4417.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\BrowserHelperObjects" VALUE="{D9A5A49C-60EB-4C07-8570-8FB8FE825E7C}"></REGKEY>
  4418.           <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{00f16dc8-1b2a-42f4-b18b-e21da9d2d7fd}"></REGKEY> 
  4419.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{00f16dc8-1b2a-42f4-b18b-e21da9d2d7fd}"></REGKEY> 
  4420.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{00f16dc8-1b2a-42f4-b18b-e21da9d2d7fd}"></REGKEY>
  4421.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{00f16dc8-1b2a-42f4-b18b-e21da9d2d7fd}"></REGKEY> 
  4422.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{00f16dc8-1b2a-42f4-b18b-e21da9d2d7fd}"></REGKEY> 
  4423.         </KEYS>
  4424.         <VALUES>
  4425.         </VALUES>
  4426.     </REGISTRY>
  4427. <DANGER_LEVEL>4</DANGER_LEVEL>
  4428. <DESCRIPTION>SubSearch is a browser helper, which opens its own sponsored listings when certain terms are searched for</DESCRIPTION>
  4429. </SW>
  4430. <SW NAME="Keylogger - Hack 99">
  4431.     <DIRECTORIES>
  4432.     </DIRECTORIES>
  4433.     <FILES>
  4434.         <FILE NAME="HKeyLog.exe" PATH="SysDir"></FILE>
  4435.     </FILES>
  4436.     <COOKIES>
  4437.     </COOKIES>
  4438.     <REGISTRY>
  4439.         <KEYS>
  4440.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="HKeyLog"></REGKEY>
  4441.         </KEYS>
  4442.         <VALUES>
  4443.         </VALUES>
  4444.     </REGISTRY>
  4445. <DANGER_LEVEL>2</DANGER_LEVEL>
  4446. <DESCRIPTION>Hack 99 is a keylogger which can record all keystrokes from the PC</DESCRIPTION>
  4447. </SW>
  4448. <SW NAME="AdMonitor">
  4449.     <DIRECTORIES>
  4450.     </DIRECTORIES>
  4451.     <FILES>
  4452.     </FILES>
  4453.     <COOKIES>
  4454.         <COOKIE NAME="L90"></COOKIE>
  4455.     </COOKIES>
  4456.     <REGISTRY>
  4457.         <KEYS>
  4458.         </KEYS>
  4459.         <VALUES>
  4460.         </VALUES>
  4461.     </REGISTRY>
  4462. <DANGER_LEVEL>0</DANGER_LEVEL>
  4463. <DESCRIPTION>AdMonitor is an ad network that uses cookies to store and track user information</DESCRIPTION>
  4464. </SW>
  4465. <SW NAME="Advertising.com">
  4466.     <DIRECTORIES>
  4467.     </DIRECTORIES>
  4468.     <FILES>
  4469.     </FILES>
  4470.     <COOKIES>
  4471.         <COOKIE NAME="teknosurf"></COOKIE>
  4472.     </COOKIES>
  4473.     <REGISTRY>
  4474.         <KEYS>
  4475.         </KEYS>
  4476.         <VALUES>
  4477.         </VALUES>
  4478.     </REGISTRY>
  4479. <DANGER_LEVEL>0</DANGER_LEVEL>
  4480. <DESCRIPTION>Advertising.com is an ad network that uses cookies to store and track user information</DESCRIPTION>
  4481. </SW>
  4482. <SW NAME="Bfast">
  4483.     <DIRECTORIES>
  4484.     </DIRECTORIES>
  4485.     <FILES>
  4486.     </FILES>
  4487.     <COOKIES>
  4488.         <COOKIE NAME="befree"></COOKIE>
  4489.     </COOKIES>
  4490.     <REGISTRY>
  4491.         <KEYS>
  4492.         </KEYS>
  4493.         <VALUES>
  4494.         </VALUES>
  4495.     </REGISTRY>
  4496. <DANGER_LEVEL>0</DANGER_LEVEL>
  4497. <DESCRIPTION>Bfast is an ad network that uses cookies to store and track user information</DESCRIPTION>
  4498. </SW>
  4499. <SW NAME="BonziBuddy">
  4500.     <DIRECTORIES>
  4501.             <DIR NAME="bonzibuddy" PATH="PFDir"></DIR>
  4502.     </DIRECTORIES>
  4503.     <FILES>
  4504.         <FILE NAME="bbsmartstubfal.exe" PATH="PFDir\\bonzibuddy"></FILE>
  4505.          <FILE NAME="bonzitapfilters.dll" PATH="SysDir"></FILE>
  4506.         <FILE NAME="bonzitapfilters.dll" PATH="Sys32Dir"></FILE>
  4507.         <FILE NAME="BonziBDY.EXE" PATH=""></FILE>
  4508.          <FILE NAME="bonzibuddy.lnk" PATH=""></FILE>
  4509.         <FILE NAME="bbshortcut.ico" PATH="PFDir\\audiogalaxy satellite"></FILE>
  4510.         <FILE NAME="wcinst.exe" PATH="PFDir\\bonzi.com web compass"></FILE>
  4511.         <FILE NAME="wclogic.dll" PATH="PFDir\\bonzi.com web compass"></FILE>
  4512.         <FILE NAME="webcompass.dll" PATH="PFDir\\bonzi.com web compass"></FILE>
  4513.         <FILE NAME="bbsmartsetup.exe" PATH="PFDir\\bonzibuddy"></FILE>
  4514.         <FILE NAME="bbuddymini.exe" PATH="PFDir\\bonzibuddy"></FILE>    
  4515.         <FILE NAME="bonzibuddyuninstall.exe" PATH="PFDir\\bonzibuddy"></FILE>
  4516.         <FILE NAME="bonzictb.dll" PATH="PFDir\\bonzibuddy"></FILE>
  4517.         <FILE NAME="savenowinst.exe" PATH="PFDir\\bonzibuddy"></FILE>
  4518.         <FILE NAME="bonzibuddy.lnk" PATH="WinDir\\desktop"></FILE>
  4519.         <FILE NAME="free bonzibuddy.lnk" PATH="WinDir\\desktop"></FILE>
  4520.         <FILE NAME="bonzi.acs" PATH="WinDir\\msagent\\chars"></FILE>
  4521.         <FILE NAME="bonzibuddy.lnk" PATH="WinDir\\start menu\\programs"></FILE>
  4522.         <FILE NAME="webcompass.dll" PATH="Sys32Dir"></FILE>
  4523.         <FILE NAME="bonzi.url" PATH=""></FILE>
  4524.         <FILE NAME="webcompassbar.dll" PATH=""></FILE>
  4525.     </FILES>
  4526.     <COOKIES>
  4527.         <COOKIE NAME="bonzi"></COOKIE>
  4528.     </COOKIES>
  4529.     <REGISTRY>
  4530.         <KEYS>
  4531.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE" VALUE="bonzi"></REGKEY>
  4532.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE" VALUE="bonzi"></REGKEY>
  4533.         </KEYS>
  4534.         <VALUES>
  4535.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="bonzi"></REGVALUE>
  4536.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Bonzi Buddy"></REGVALUE>
  4537.         </VALUES>
  4538.     </REGISTRY>
  4539. <DANGER_LEVEL>1</DANGER_LEVEL>
  4540. <DESCRIPTION>BonziBuddy is responsible for delivering advertisements in various forms to the PC</DESCRIPTION>
  4541. </SW>
  4542. <SW NAME="Centrport">
  4543.     <DIRECTORIES>
  4544.     </DIRECTORIES>
  4545.     <FILES>
  4546.     </FILES>
  4547.     <COOKIES>
  4548.     </COOKIES>
  4549.     <REGISTRY>
  4550.         <KEYS>
  4551.         </KEYS>
  4552.         <VALUES>
  4553.         </VALUES>
  4554.     </REGISTRY>
  4555. <DANGER_LEVEL>0</DANGER_LEVEL>
  4556. <DESCRIPTION>Centrport is a marketing network that uses cookies to store and track user information</DESCRIPTION>
  4557. </SW>
  4558. <SW NAME="DSS Agent">
  4559.     <DIRECTORIES>
  4560.     </DIRECTORIES>
  4561.     <FILES>
  4562.         <FILE NAME="DSSAGENT.EXE" PATH="WinDir\\BBStore\\DSS"></FILE>
  4563.     </FILES>
  4564.     <COOKIES>
  4565.         <COOKIE NAME="broderbund"></COOKIE>
  4566.     </COOKIES>
  4567.     <REGISTRY>
  4568.         <KEYS>
  4569.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs\\C:\\WINDOWS\\BBStore\\DSS" VALUE="DSSAGENT.EXE"></REGKEY>
  4570.         </KEYS>
  4571.         <VALUES>
  4572.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="dss"></REGVALUE>
  4573.         </VALUES>
  4574.     </REGISTRY>
  4575. <DANGER_LEVEL>0</DANGER_LEVEL>
  4576. <DESCRIPTION>DSS Agent is designed to facilitate product updates, and allow vendors to push out updates at any time.</DESCRIPTION>
  4577. </SW>
  4578. <SW NAME="Focalink">
  4579.     <DIRECTORIES>
  4580.     </DIRECTORIES>
  4581.     <FILES>
  4582.     </FILES>
  4583.     <COOKIES>
  4584.         <COOKIE NAME="engage"></COOKIE>
  4585.         <COOKIE NAME="adknowledge"></COOKIE>
  4586.     </COOKIES>
  4587.     <REGISTRY>
  4588.     <KEYS>
  4589.     </KEYS>
  4590.     <VALUES>
  4591.     </VALUES>
  4592.     </REGISTRY>
  4593. <DANGER_LEVEL>0</DANGER_LEVEL>
  4594. <DESCRIPTION>Focalink is a marketing network that uses cookies to store and track user information</DESCRIPTION>
  4595. </SW>
  4596. <SW NAME="LinkSynergy">
  4597.     <DIRECTORIES>
  4598.     </DIRECTORIES>
  4599.     <FILES>
  4600.     </FILES>
  4601.     <COOKIES>
  4602.         <COOKIE NAME="linkshare"></COOKIE>
  4603.     </COOKIES>
  4604.     <REGISTRY>
  4605.         <KEYS>
  4606.         </KEYS>
  4607.         <VALUES>
  4608.         </VALUES>
  4609.     </REGISTRY>
  4610. <DANGER_LEVEL>0</DANGER_LEVEL>
  4611. <DESCRIPTION>LinkSynergy is a marketing network that uses cookies to store and track user information</DESCRIPTION>
  4612. </SW>
  4613. <SW NAME="Mediaplex">
  4614.     <DIRECTORIES>
  4615.     </DIRECTORIES>
  4616.     <FILES>
  4617.     </FILES>
  4618.     <COOKIES>
  4619.         <COOKIE NAME="mediaplex"></COOKIE>
  4620.     </COOKIES>
  4621.     <REGISTRY>
  4622.         <KEYS>
  4623.         </KEYS>
  4624.         <VALUES>
  4625.         </VALUES>
  4626.     </REGISTRY>
  4627. <DANGER_LEVEL>0</DANGER_LEVEL>
  4628. <DESCRIPTION>Mediaplex is a marketing network that uses cookies to store and track user information</DESCRIPTION>
  4629. </SW>
  4630. <SW NAME="web3000">
  4631.     <DIRECTORIES>
  4632.     </DIRECTORIES>
  4633.     <FILES>
  4634.         <FILE NAME="instnetmgr.dll" PATH="WinDir"></FILE>
  4635.         <FILE NAME="w3knet.dll" PATH="WinDir"></FILE>
  4636.         <FILE NAME="W3KNet.w3k" PATH="WinDir"></FILE>
  4637.         <FILE NAME="W3KNET_W3l.DLL" PATH="WinDir"></FILE>
  4638.         <FILE NAME="W3kSelfInst.exe" PATH=""></FILE>
  4639.     </FILES>
  4640.     <COOKIES>
  4641.     </COOKIES>
  4642.     <REGISTRY>
  4643.         <KEYS>
  4644.             <REGKEY MAIN="HKEY_USERS" SUB=".default\\software" VALUE="web3000.com"></REGKEY>
  4645.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="software" VALUE="web3000.com"></REGKEY>
  4646.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software" VALUE="web3000.com"></REGKEY>
  4647.         </KEYS>
  4648.         <VALUES>
  4649.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="w3knetwork"></REGVALUE>
  4650.         </VALUES>
  4651.     </REGISTRY>
  4652. <DANGER_LEVEL>1</DANGER_LEVEL>
  4653. <DESCRIPTION>Web3000 is an ad network that uses cookies to store and track user information, as well as deliver pop ups</DESCRIPTION>
  4654. </SW>
  4655. <SW NAME="sextracker">
  4656.     <DIRECTORIES>
  4657.     </DIRECTORIES>
  4658.     <FILES>
  4659.     </FILES>
  4660.     <COOKIES>
  4661.         <COOKIE NAME="sextracker"></COOKIE>
  4662.     </COOKIES>
  4663.     <REGISTRY>
  4664.         <KEYS>
  4665.         </KEYS>
  4666.         <VALUES>
  4667.         </VALUES>
  4668.     </REGISTRY>
  4669. <DANGER_LEVEL>1</DANGER_LEVEL>
  4670. <DESCRIPTION>Sextracker are cookies used to track user information primarily used by adult sites</DESCRIPTION>
  4671. </SW>
  4672. <SW NAME="Targetnet">
  4673.     <DIRECTORIES>
  4674.     </DIRECTORIES>
  4675.     <FILES>
  4676.     </FILES>
  4677.     <COOKIES>
  4678.         <COOKIE NAME="zaq"></COOKIE>
  4679.     </COOKIES>
  4680.     <REGISTRY>
  4681.         <KEYS>
  4682.         </KEYS>
  4683.         <VALUES>
  4684.         </VALUES>
  4685.     </REGISTRY>
  4686. <DANGER_LEVEL>0</DANGER_LEVEL>
  4687. <DESCRIPTION>Targetnet is a marketing network that uses cookies to store and track user information</DESCRIPTION>
  4688. </SW>
  4689. <SW NAME="VX2.BetterInternet/VX2.ABetterInternet">
  4690.     <DIRECTORIES>
  4691.     </DIRECTORIES>
  4692.     <FILES>
  4693.         <FILE NAME="belt.exe" PATH=""></FILE>
  4694.         <FILE NAME="Belt.exe" PATH="WinDir"></FILE>
  4695.         <FILE NAME="Belt.ini" PATH="WinDir"></FILE>
  4696.     </FILES>
  4697.     <COOKIES>
  4698.     </COOKIES>
  4699.     <REGISTRY>
  4700.         <KEYS>
  4701.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{000006B1-19B5-414A-849F-2A3C64AE6939}"></REGKEY>
  4702.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{000006B1-19B5-414A-849F-2A3C64AE6939}"></REGKEY>
  4703.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\BrowserHelperObjects" VALUE="{000006B1-19B5-414A-849F-2A3C64AE6939}"></REGKEY> 
  4704.         </KEYS>
  4705.         <VALUES>
  4706.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\run" VALUE="belt"></REGVALUE>
  4707.         </VALUES>
  4708.     </REGISTRY>
  4709. <DANGER_LEVEL>2</DANGER_LEVEL>
  4710. <DESCRIPTION>Tracks your browsing behavior as well as notoriously adds additional spyware/adware to your PC</DESCRIPTION>
  4711. </SW>
  4712. <SW NAME="VX2/LinkReplacer">
  4713.     <DIRECTORIES>
  4714.     </DIRECTORIES>
  4715.     <FILES>
  4716.         <FILE NAME="IEHelper.DLL" PATH="SysDir"></FILE>
  4717.         <FILE NAME="iehelper.dll" PATH="Sys32Dir"></FILE>
  4718.         <FILE NAME="VX2.dll" PATH="SysDir"></FILE>
  4719.         <FILE NAME="vx2.dll" PATH="Sys32Dir"></FILE>
  4720.     </FILES>
  4721.     <COOKIES>
  4722.         <COOKIE NAME="mindset"></COOKIE>
  4723.         <COOKIE NAME="aadcom"></COOKIE>
  4724.         <COOKIE NAME="itc"></COOKIE>
  4725.         <COOKIE NAME="internettechcorp"></COOKIE>
  4726.         <COOKIE NAME="disk11"></COOKIE>
  4727.     </COOKIES>
  4728.     <REGISTRY>
  4729.         <KEYS>
  4730.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{DDFFA75A-E81D-4454-89FC-B9FD0631E726}"></REGKEY>
  4731.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{000006B1-19B5-414A-849F-2A3C64AE6939}"></REGKEY>
  4732.         </KEYS>
  4733.         <VALUES>
  4734.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\shell extensions\\approved" VALUE="{ddffa75a-e81d-4454-89fc-b9fd0631e726}"></REGVALUE>
  4735.         </VALUES>
  4736.     </REGISTRY>
  4737. <DANGER_LEVEL>4</DANGER_LEVEL>
  4738. <DESCRIPTION>VX2 is a variant of the netpal/transponder spyware that is responsible for browser hijacking and pop up ads</DESCRIPTION>
  4739. </SW>
  4740. <SW NAME="WebTrends">
  4741.     <DIRECTORIES>
  4742.     </DIRECTORIES>
  4743.     <FILES>
  4744.     </FILES>
  4745.     <COOKIES>
  4746.         <COOKIE NAME="NetIQ"></COOKIE>
  4747.     </COOKIES>
  4748.     <REGISTRY>
  4749.         <KEYS>
  4750.         </KEYS>
  4751.         <VALUES>
  4752.         </VALUES>
  4753.     </REGISTRY>
  4754. <DANGER_LEVEL>0</DANGER_LEVEL>
  4755. <DESCRIPTION>WebTrends is a web analysis company that uses cookies to store and track user information</DESCRIPTION>
  4756. </SW>
  4757. <SW NAME="BookmarkExpress">
  4758.     <DIRECTORIES>
  4759.     </DIRECTORIES>
  4760.     <FILES>
  4761.         <FILE NAME="BMLauncher.exe" PATH=""></FILE>
  4762.     </FILES>
  4763.     <COOKIES>
  4764.     </COOKIES>
  4765.     <REGISTRY>
  4766.         <KEYS>
  4767.         </KEYS>
  4768.         <VALUES>
  4769.         </VALUES>
  4770.     </REGISTRY>
  4771. <DANGER_LEVEL>1</DANGER_LEVEL>
  4772. <DESCRIPTION>BookmarkExpress is discontinued, but used to manage bookmarks for users - bundled with some older applications</DESCRIPTION>
  4773. </SW>
  4774. <SW NAME="AutoUpdater/Envolo">
  4775.     <DIRECTORIES>
  4776.         <DIR NAME="autoupdate" PATH="PFDir"></DIR>
  4777.     </DIRECTORIES>
  4778.     <FILES>
  4779.          <FILE NAME="auto_update_uninstall.exe" PATH="Sys32Dir"></FILE>
  4780.         <FILE NAME="AutoUpdate.exe" PATH="PFDir\\AutoUpdate"></FILE>    </FILES>
  4781.     <COOKIES>
  4782.     </COOKIES>
  4783.     <REGISTRY>
  4784.        <KEYS>
  4785.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE" VALUE="Envolo"></REGKEY>
  4786.        </KEYS>
  4787.        <VALUES>
  4788.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="autoupdater"></REGVALUE>
  4789.        </VALUES>
  4790.     </REGISTRY>
  4791. <DANGER_LEVEL>1</DANGER_LEVEL>
  4792. <DESCRIPTION>Allows automatic download and execution of additional adware related components</DESCRIPTION>
  4793. </SW>
  4794. <SW NAME="Trojan - Element">
  4795.     <DIRECTORIES>
  4796.     </DIRECTORIES>
  4797.     <FILES>
  4798.         <FILE NAME="element.txt" PATH="WinDir"></FILE>
  4799.         <FILE NAME="element.ico" PATH="WinDir"></FILE>
  4800.         <FILE NAME="Element3.Lnk" PATH=""></FILE>
  4801.         <FILE NAME="Element.Lnk" PATH=""></FILE>
  4802.         <FILE NAME="Boot.Lnk" PATH=""></FILE>
  4803.     </FILES>
  4804.     <COOKIES>
  4805.     </COOKIES>
  4806.     <REGISTRY>
  4807.         <KEYS>
  4808.         </KEYS>
  4809.         <VALUES>
  4810.         </VALUES>
  4811.     </REGISTRY>
  4812. <DANGER_LEVEL>2</DANGER_LEVEL>
  4813. <DESCRIPTION>The Element Trojan wreaks havoc on the machine, and replaces several key files necessary to run Windows</DESCRIPTION>
  4814. </SW>
  4815. <SW NAME="Trojan - DocTor">
  4816.     <DIRECTORIES>
  4817.     </DIRECTORIES>
  4818.     <FILES>
  4819.         <FILE NAME="doctor.exe" PATH="WinDir"></FILE>
  4820.     </FILES>
  4821.     <COOKIES>
  4822.     </COOKIES>
  4823.     <REGISTRY>
  4824.         <KEYS>
  4825.         </KEYS>
  4826.         <VALUES>
  4827.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="DocTor"></REGVALUE>
  4828.         </VALUES>
  4829.     </REGISTRY>
  4830. <DANGER_LEVEL>2</DANGER_LEVEL>
  4831. <DESCRIPTION>The doctor trojan wreaks havoc on the machine</DESCRIPTION>
  4832. </SW>
  4833. <SW NAME="WebAssist">
  4834.     <DIRECTORIES>
  4835.     </DIRECTORIES>
  4836.     <FILES>
  4837.         <FILE NAME="webassist.exe" PATH="WinDir"></FILE>
  4838.     </FILES>
  4839.     <COOKIES>
  4840.     </COOKIES>
  4841.     <REGISTRY>
  4842.         <KEYS>
  4843.         </KEYS>
  4844.         <VALUES>
  4845.         </VALUES>
  4846.     </REGISTRY>
  4847. <DANGER_LEVEL>1</DANGER_LEVEL>
  4848. <DESCRIPTION>WebAssist is responsible for delivering pop up advertisements</DESCRIPTION>
  4849. </SW>
  4850. <SW NAME="PrizeSurfer">
  4851.     <DIRECTORIES>
  4852.         <DIR NAME="rcprograms" PATH="PFDir"></DIR>
  4853.     </DIRECTORIES>
  4854.     <FILES>
  4855.         <FILE NAME="RCSync.exe" PATH="PFDir\\rcprograms"></FILE>
  4856.         <FILE NAME="prizesurfer.exe" PATH="PFDir\\rcprograms\\v2"></FILE>
  4857.     </FILES>
  4858.     <COOKIES>
  4859.     </COOKIES>
  4860.     <REGISTRY>
  4861.         <KEYS>
  4862.         </KEYS>
  4863.         <VALUES>
  4864.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\run" VALUE="RCSync"></REGVALUE>
  4865.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\run" VALUE="PrizeSurfer"></REGVALUE>
  4866.         </VALUES>
  4867.     </REGISTRY>
  4868. <DANGER_LEVEL>1</DANGER_LEVEL>
  4869. <DESCRIPTION>PrizeSurfer is responsible for delivering pop up advertisements</DESCRIPTION>
  4870. </SW>
  4871. <SW NAME="GAIN">
  4872.     <DIRECTORIES>
  4873.         <DIR NAME="adware" PATH="WinDir\\Temp"></DIR>
  4874.     </DIRECTORIES>
  4875.     <FILES>
  4876.         <FILE NAME="trickler_bic_gatordm_4010.exe" PATH=""></FILE>
  4877.         <FILE NAME="gatorpdpsetup.log" PATH="WinDir"></FILE>
  4878.         <FILE NAME="dashbar15.dll" PATH="Sys32Dir"></FILE>
  4879.         <FILE NAME="dashbar15.dll" PATH="SysDir"></FILE>
  4880.         <FILE NAME="cmesys.exe" PATH="PFDir\\common files\\cmeii"></FILE>
  4881.         <FILE NAME="iegator.dll" PATH="WinDir\\downloaded program files\\conflict.1"></FILE>
  4882.         <FILE NAME="fsg_4104.exe" PATH="WinDir\\temp\\adware"></FILE>
  4883.         <FILE NAME="fsg.exe" PATH="PFDir\\gator.com\\fsg"></FILE>
  4884.         <FILE NAME="gain_trickler_3202.exe" PATH="PFDir\\divx\\divx pro codec"></FILE>
  4885.         <FILE NAME="gain_trickler_3102.exe" PATH="PFDir\\divx\\divx pro codec"></FILE>
  4886.         <FILE NAME="fsg-ag.exe" PATH=""></FILE>
  4887.         <FILE NAME="Weatherscope.exe" PATH="PFDir\\Weatherscope"></FILE>
  4888.         <FILE NAME="GatorUninstaller_cme.log" PATH="WinDir"></FILE>
  4889.         <FILE NAME="GatorUninstaller_cme_u.log" PATH="WinDir"></FILE>
  4890.     </FILES>
  4891.     <COOKIES>
  4892.     </COOKIES>
  4893.     <REGISTRY>
  4894.         <KEYS>
  4895.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{CC90CDA0-74A0-45b4-80EF-D89CA8C249B8}"> </REGKEY>
  4896.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{CC90CDA0-74A0-45b4-80EF-D89CA8C249B8}"> </REGKEY>
  4897.         </KEYS>
  4898.         <VALUES>
  4899.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{cc90cda0-74a0-45b4-80ef-d89ca8c249b8}"></REGVALUE>
  4900.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="CMESys"></REGVALUE>
  4901.         </VALUES>
  4902.     </REGISTRY>
  4903. <DANGER_LEVEL>1</DANGER_LEVEL>
  4904. <DESCRIPTION>The Gator Advertising and Information Network, this is the company behind gator and the ads associated with GAIN related applications, known to produce popups</DESCRIPTION>
  4905. </SW>
  4906. <SW NAME="Hi-Wire">
  4907.     <DIRECTORIES>
  4908.     </DIRECTORIES>
  4909.     <FILES>
  4910.     </FILES>
  4911.     <COOKIES>
  4912.     </COOKIES>
  4913.     <REGISTRY>
  4914.         <KEYS>
  4915.                 <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{08e05eee-5ee9-11d4-9caf-00d0b76063fd}"></REGKEY>
  4916.                 <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{28f00b0f-dc4e-11d3-abec-005004a44eeb}"></REGKEY>
  4917.                 <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{5ca9d47f-4bbc-45e0-815f-670ae736a678}"></REGKEY>
  4918.                 <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{80f1b906-d066-11d3-ad70-009027b8adbc}"></REGKEY>
  4919.                 <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{bcddab74-c3a8-11d3-ad69-009027b8adbc}"></REGKEY>
  4920.                 <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{c357398a-8e21-4505-8bd7-784a4e9ac659}"></REGKEY>
  4921.                 <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{c357398b-8e21-4505-8bd7-784a4e9ac659}"></REGKEY>
  4922.                 <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{08e05ee1-5ee9-11d4-9caf-00d0b76063fd}"></REGKEY>
  4923.                 <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{f5ee52d3-2ecc-409e-a92f-a73f2b8dd407}"></REGKEY>
  4924.                 <REGKEY MAIN="HKEY_CURRENT_USER" SUB="software" VALUE="hiwire"></REGKEY>
  4925.          </KEYS>
  4926.         <VALUES>
  4927.         </VALUES>
  4928.     </REGISTRY>
  4929. <DANGER_LEVEL>1</DANGER_LEVEL>
  4930. <DESCRIPTION>Hi-Wire is adware that delivers popup ads to your PC</DESCRIPTION>
  4931. </SW>
  4932. <SW NAME="Xrenoder/xxxToolbar/SearchBarCash">
  4933.     <DIRECTORIES>
  4934.     </DIRECTORIES>
  4935.     <FILES>
  4936.         <FILE NAME="toolbar_nieuw13.dll " PATH="WinDir\\downloaded program files\\conflict.1"></FILE>
  4937.         <FILE NAME="aupdate_uninstall.exe" PATH="SysDir"></FILE>
  4938.         <FILE NAME="aupdate.exe" PATH="SysDir"></FILE>
  4939.         <FILE NAME="aupdate.conf" PATH="SysDir"></FILE>
  4940.         <FILE NAME="aupdate.trk" PATH="SysDir"></FILE>
  4941.         <FILE NAME="aupdate.exe" PATH="Sys32Dir"></FILE>
  4942.         <FILE NAME="aupdate.conf" PATH="Sys32Dir"></FILE>
  4943.         <FILE NAME="aupdate.trk" PATH="Sys32Dir"></FILE>
  4944.         <FILE NAME="aupdate_uninstall.exe" PATH="Sys32Dir"></FILE>
  4945.     </FILES>
  4946.     <COOKIES>
  4947.     </COOKIES>
  4948.     <REGISTRY>
  4949.         <KEYS>
  4950.           <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{c357398c-8e21-4505-8bd7-784a4e9ac659}"></REGKEY>
  4951.          </KEYS>
  4952.         <VALUES>
  4953.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="AutoUpdater"></REGVALUE>
  4954.         </VALUES>
  4955.     </REGISTRY>
  4956. <DANGER_LEVEL>2</DANGER_LEVEL>
  4957. <DESCRIPTION>Xrenoder hijacks your search settings, as well as displays porn advertisements</DESCRIPTION>
  4958. </SW>
  4959. <SW NAME="NCase">
  4960.     <DIRECTORIES>
  4961.         <DIR NAME="ncase" PATH="PFDir"></DIR>
  4962.           <DIR NAME="n-case" PATH="PFDir"></DIR>
  4963.         <DIR NAME="fleok" PATH="WinDir"></DIR>
  4964.         <DIR NAME="audio tools" PATH="PFDir\\rosoft"></DIR>
  4965.     </DIRECTORIES>
  4966.     <FILES>
  4967.         <FILE NAME="msbb.exe" PATH="PFDir\\n-case\\fleok"></FILE>
  4968.         <FILE NAME="msbb.exe" PATH="PFDir\\180Solutions"></FILE>
  4969.           <FILE NAME="msbb.exe" PATH="Sys32Dir"></FILE>
  4970.           <FILE NAME="msbb.exe" PATH="SysDir"></FILE>
  4971.         <FILE NAME="msbb.exe" PATH="PFDir\\n-case"></FILE>
  4972.           <FILE NAME="ncmyb.dll" PATH="WinDir"></FILE>
  4973.         <FILE NAME="msbb.dll" PATH="Sys32Dir"></FILE>
  4974.         <FILE NAME="msbb.dll" PATH="SysDir"></FILE>
  4975.         <FILE NAME="ncmyb.dll" PATH="SysDir"></FILE>
  4976.         <FILE NAME="ncmyb.dll" PATH="Sys32Dir"></FILE>
  4977.         <FILE NAME="WINPROC32.EXE" PATH="Sys32Dir"></FILE>    
  4978.     </FILES>
  4979.     <COOKIES>
  4980.     </COOKIES>
  4981.     <REGISTRY>
  4982.        <KEYS>
  4983.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{6eb5b540-1e74-4d91-a7f0-5b758d333702}"></REGKEY>
  4984.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{6eb5b540-1e74-4d91-a7f0-5b758d333702}"></REGKEY>
  4985.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\code store database\\distribution units" VALUE="{6eb5b540-1e74-4d91-a7f0-5b758d333702}"></REGKEY>
  4986.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="typelib" VALUE="{6eb5b540-1e74-4d91-a7f0-5b758d333702}"></REGKEY>
  4987.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall" VALUE="ncase"></REGKEY>
  4988.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall" VALUE="msbb"></REGKEY>
  4989.                <REGKEY MAIN="HKEY_CURRENT_USER" SUB="software" VALUE="180solutions"></REGKEY>
  4990.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{E2DDF680-9905-4dee-8C64-0A5DE7FE133C}"></REGKEY>
  4991.        </KEYS>
  4992.        <VALUES>
  4993.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Windows Internet Protocol"></REGVALUE>
  4994.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="msbb"></REGVALUE>
  4995.        </VALUES>
  4996.     </REGISTRY>
  4997. <DANGER_LEVEL>2</DANGER_LEVEL>
  4998. <DESCRIPTION>NCase is adware which displays advertisements on your PC</DESCRIPTION>
  4999. </SW>
  5000. <SW NAME="ClearSearch/ClearSearch.csie">
  5001.     <DIRECTORIES>
  5002.         <DIR NAME="ClearSearch" PATH="PFDir"></DIR>
  5003.     </DIRECTORIES>
  5004.     <FILES>
  5005.           <FILE NAME="CSIE.DLL" PATH="PFDir\\lycos\\ieagent"></FILE>
  5006.           <FILE NAME="IE_ClrSch.DLL" PATH="PFDir\\clearsearch"></FILE>
  5007.           <FILE NAME="IE_ClrSch.DLL" PATH="Sys32Dir"></FILE>
  5008.           <FILE NAME="IE_ClrSch.DLL" PATH="SysDir"></FILE>
  5009.            <FILE NAME="loader.exe" PATH="PFDir\\clearsearch"></FILE>
  5010.            <FILE NAME="CSIE.DLL" PATH="PFDir\\ClearSearch"></FILE>
  5011.            <FILE NAME="CSIE16.DLL" PATH="PFDir\\ClearSearch"></FILE>
  5012.            <FILE NAME="CSIE32.DLL" PATH="PFDir\\ClearSearch"></FILE>
  5013.     </FILES>
  5014.     <COOKIES>
  5015.     </COOKIES>
  5016.     <REGISTRY>
  5017.        <KEYS>
  5018.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software" VALUE="clrsch"></REGKEY>
  5019.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{00000000-0000-0000-0000-000000000221}"></REGKEY>
  5020.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{947e6d5a-4b9f-4cf4-91b3-562ca8d03313}"></REGKEY>
  5021.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{00000000-0000-0000-0000-000000000240}"></REGKEY>
  5022.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{00000000-0000-0000-0000-000000000221}"></REGKEY>
  5023.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{00000000-0000-0000-0000-000000000240}"></REGKEY>
  5024.        </KEYS>
  5025.        <VALUES>
  5026.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="clrschloader"></REGVALUE>
  5027.        </VALUES>
  5028.     </REGISTRY>
  5029. <DANGER_LEVEL>2</DANGER_LEVEL>
  5030. <DESCRIPTION>Redirects to certain sites based on where you browse</DESCRIPTION>
  5031. </SW>
  5032. <SW NAME="LizardBar/Free Community">  
  5033.     <DIRECTORIES>
  5034.         <DIR NAME="submit" PATH="PFDir"></DIR>
  5035.     </DIRECTORIES>
  5036.     <FILES>
  5037.         <FILE NAME="submithook.dll" PATH="PFDir\\submit"></FILE>
  5038.     </FILES>
  5039.     <COOKIES>
  5040.     </COOKIES>
  5041.     <REGISTRY>
  5042.         <KEYS>
  5043.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{2E9CAFF6-30C7-4208-8807-E79D4EC6F806}"></REGKEY>
  5044.         </KEYS>
  5045.         <VALUES>
  5046.         </VALUES>
  5047.     </REGISTRY>
  5048. <DANGER_LEVEL>2</DANGER_LEVEL>
  5049. <DESCRIPTION>Free Community is an Internet Explorer browser helper object that is pornography related</DESCRIPTION>
  5050. </SW>
  5051. <SW NAME="ChineseHack">  
  5052.     <DIRECTORIES>
  5053.     </DIRECTORIES>
  5054.     <FILES>
  5055.         <FILE NAME="explores.exe" PATH=""></FILE>
  5056.     </FILES>
  5057.     <COOKIES>
  5058.     </COOKIES>
  5059.     <REGISTRY>
  5060.         <KEYS>
  5061.         </KEYS>
  5062.         <VALUES>
  5063.         </VALUES>
  5064.     </REGISTRY>
  5065. <DANGER_LEVEL>2</DANGER_LEVEL>
  5066. <DESCRIPTION>Worm that attempts to spread itself and allows access to unauthorized people</DESCRIPTION>
  5067. </SW>
  5068. <SW NAME="HelpExpress/HXDL">
  5069.     <DIRECTORIES>
  5070.       <DIR NAME="alset" PATH="PFDir"></DIR>
  5071.       <DIR NAME="alset network" PATH="PFDir"></DIR>
  5072.     </DIRECTORIES>
  5073.     <FILES>
  5074.        <FILE NAME="HXDL.EXE" PATH=""></FILE>
  5075.        <FILE NAME="HXIUL.EXE" PATH=""></FILE>
  5076.        <FILE NAME="HelpExp.exe" PATH=""></FILE>
  5077.        <FILE NAME="emsw.exe" PATH=""></FILE>
  5078.        <FILE NAME="HXDLDMDM.EXE" PATH=""></FILE>
  5079.        <FILE NAME="wsme.ini" PATH=""></FILE>
  5080.        <FILE NAME="HXDLAZWM.exe" PATH="WinDir"></FILE>
  5081.     </FILES>
  5082.     <COOKIES>
  5083.     </COOKIES>
  5084.     <REGISTRY>
  5085.        <KEYS>
  5086.        </KEYS>
  5087.        <VALUES>
  5088.          <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="hxiul.exe"></REGVALUE>
  5089.          <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="helpexp.exe"></REGVALUE>
  5090.          <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="hxdl.exe"></REGVALUE>
  5091.          <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="emsw.exe"></REGVALUE>
  5092.          <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="hxiul.exe"></REGVALUE>
  5093.          <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="helpexp.exe"></REGVALUE>
  5094.          <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="hxdl.exe"></REGVALUE>
  5095.          <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="emsw.exe"></REGVALUE>
  5096.        </VALUES>
  5097.     </REGISTRY>
  5098. <DANGER_LEVEL>4</DANGER_LEVEL>
  5099. <DESCRIPTION>Adware which delivers ads to your PC as well as takes up your system space</DESCRIPTION>
  5100. </SW>
  5101. <SW NAME="ISTbar/Powerscan">
  5102.     <DIRECTORIES>
  5103.         <DIR NAME="istbar" PATH="PFDir"></DIR>
  5104.         <DIR NAME="istbarsvc" PATH="PFDir"></DIR>
  5105.         <DIR NAME="ISTsvc" PATH="PFDir"></DIR>
  5106.         <DIR NAME="power scan" PATH="PFDir"></DIR>
  5107.         <DIR NAME="TOTEM SHARED" PATH="PFDir\\Common Files"></DIR>
  5108.         <DIR NAME="Update" PATH="PFDir\\Common Files\\TOTEM SHARED"></DIR>
  5109.             <DIR NAME="totem shared" PATH="PFDir\\common files"></DIR>
  5110.             <DIR NAME="free amature movie" PATH="PFDir"></DIR>
  5111.             <DIR NAME="search bar" PATH="PFDir"></DIR>
  5112.     </DIRECTORIES>
  5113.     <FILES>
  5114.        <FILE NAME="aupdate.conf" PATH="Sys32Dir"></FILE>
  5115.        <FILE NAME="aupdate.exe" PATH="Sys32Dir"></FILE>
  5116.        <FILE NAME="aupdate_uninstall.exe" PATH="Sys32Dir"></FILE>
  5117.        <FILE NAME="acsproxy.dll" PATH="Sys32Dir"></FILE>
  5118.        <FILE NAME="acsproxy.lib" PATH="Sys32Dir"></FILE>
  5119.        <FILE NAME="bw6mds51.ocx" PATH="Sys32Dir"></FILE>
  5120.        <FILE NAME="fwntoolbar.dll" PATH="Sys32Dir"></FILE>
  5121.        <FILE NAME="intrigue.dll" PATH="Sys32Dir"></FILE>
  5122.        <FILE NAME="istbar.dll" PATH="Sys32Dir"></FILE>
  5123.        <FILE NAME="kmisxk.exe" PATH="Sys32Dir"></FILE>
  5124.        <FILE NAME="longtimer.ocx" PATH="Sys32Dir"></FILE>
  5125.        <FILE NAME="mciwndx.ocx" PATH="Sys32Dir"></FILE>
  5126.        <FILE NAME="srchbar.dll" PATH="Sys32Dir"></FILE>
  5127.        <FILE NAME="unregister.exe" PATH="Sys32Dir"></FILE>
  5128.        <FILE NAME="tinybar.exe" PATH="WinDir"></FILE>
  5129.        <FILE NAME="unstsa3.exe" PATH="WinDir"></FILE>
  5130.        <FILE NAME="alchem.ini" PATH="WinDir"></FILE>
  5131.        <FILE NAME="espam.exe" PATH="WinDir"></FILE>
  5132.        <FILE NAME="fon14100.exe" PATH="WinDir"></FILE>
  5133.        <FILE NAME="fyd.exe" PATH="WinDir"></FILE>
  5134.        <FILE NAME="msbb.exe" PATH="WinDir"></FILE>
  5135.        <FILE NAME="nem218.dll" PATH="WinDir"></FILE>
  5136.        <FILE NAME="ist.exe" PATH=""></FILE>
  5137.        <FILE NAME="ist.inf" PATH=""></FILE>
  5138.        <FILE NAME="istactivex.inf" PATH=""></FILE>
  5139.        <FILE NAME="istbar.txt" PATH=""></FILE>
  5140.        <FILE NAME="istsvc.exe" PATH=""></FILE>
  5141.        <FILE NAME="kyf.dat" PATH=""></FILE>
  5142.        <FILE NAME="paysites.dat" PATH=""></FILE>
  5143.        <FILE NAME="msbb.exe" PATH="PFDir\\180solutions\\fleok"></FILE>
  5144.        <FILE NAME="msbb.exe" PATH="PFDir\\180solutions"></FILE>
  5145.        <FILE NAME="ncmyb.dll" PATH="PFDir\\180solutions"></FILE>
  5146.        <FILE NAME="ads.html" PATH="PFDir\\free amature movie"></FILE>
  5147.        <FILE NAME="config.ini" PATH="PFDir\\free amature movie"></FILE>
  5148.        <FILE NAME="naughty_setup.exe" PATH="PFDir\\free amature movie"></FILE>
  5149.        <FILE NAME="naughtyplayer.exe" PATH="PFDir\\free amature movie"></FILE>
  5150.        <FILE NAME="srchbar.dll.manifest" PATH=""></FILE>
  5151.        <FILE NAME="istbar.dll" PATH="WinDir\\Temp"></FILE>
  5152.        <FILE NAME="trojandownloader.win32.istbar.aj.exe" PATH=""></FILE>
  5153.        <FILE NAME="trojandownloader.win32.istbar.aj[2].exe" PATH=""></FILE>
  5154.        <FILE NAME="trojandownloader.win32.istbar.ap.dll" PATH=""></FILE>
  5155.        <FILE NAME="trojandownloader.win32.istbar.bm.exe" PATH=""></FILE>
  5156.        <FILE NAME="trojandownloader.win32.istbar.bo.exe" PATH=""></FILE>
  5157.        <FILE NAME="trojandownloader.win32.istbar.bp.exe" PATH=""></FILE>
  5158.        <FILE NAME="trojandownloader.win32.istbar.bu.exe" PATH=""></FILE>
  5159.        <FILE NAME="trojandownloader.win32.istbar.bx.exe" PATH=""></FILE>
  5160.        <FILE NAME="trojandownloader.win32.istbar.cl.exe" PATH=""></FILE>
  5161.        <FILE NAME="trojandownloader.win32.istbar.dh_(40).dll" PATH=""></FILE>
  5162.        <FILE NAME="trojandownloader.win32.istbar.i.exe" PATH=""></FILE>
  5163.         <FILE NAME="trojandownloader.win32.istbar.p.dll" PATH=""></FILE>
  5164.         <FILE NAME="trojandownloader.win32.istbar.u.exe" PATH=""></FILE>
  5165.         <FILE NAME="xml_istbar.php" PATH=""></FILE>
  5166.       <FILE NAME="aupdate_uninstall.exeist.exe" PATH="Sys32Dir"></FILE>
  5167.       <FILE NAME="powerscan.exe" PATH="PFDir\\power scan"></FILE>
  5168.       <FILE NAME="mscache.exe" PATH="WinDir"></FILE>
  5169.       <FILE NAME="Iesearchbar.dll" PATH="Sys32Dir"></FILE>
  5170.       <FILE NAME="mscache2.exe" PATH="Sys32Dir"></FILE>
  5171.       <FILE NAME="mscache2.dll" PATH="Sys32Dir"></FILE>
  5172.       <FILE NAME="istsvc.exe" PATH="PFDir\\istsvc"></FILE>
  5173.       <FILE NAME="mscache.dll" PATH="WinDir"></FILE>
  5174.       <FILE NAME="Istbar.dll" PATH="PFDir\\ISTBar"></FILE>
  5175.       <FILE NAME="penoghih.exe" PATH="WinDir"></FILE>
  5176.       <FILE NAME="istbar.dll" PATH="SysDir"></FILE>
  5177.       <FILE NAME="csearch.dll" PATH="SysDir"></FILE>
  5178.       <FILE NAME="istactivex.inf" PATH="WinDir\\downloaded program files"></FILE>
  5179.       <FILE NAME="isttoolbar.mdb" PATH=""></FILE>
  5180.       <FILE NAME="istactivex.dll" PATH="WinDir\\downloaded program files"></FILE>
  5181.     </FILES>
  5182.     <COOKIES>
  5183.     </COOKIES>
  5184.     <REGISTRY>
  5185.        <KEYS>
  5186.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{69555be2-9a78-11d2-ba91-00600827878d}"></REGKEY>
  5187.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="istactivex.installer"></REGKEY>
  5188.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="istactivex.installer.1"></REGKEY>
  5189.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="istactivex.installer.2"></REGKEY>
  5190.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="pugi.pugiobj"></REGKEY>
  5191.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="pugi.pugiobj.1"></REGKEY>
  5192.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{67907b3c-a6ef-4a01-99ad-3fcd5f526429}"></REGKEY>
  5193.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{6d3f5de4-e980-4407-a10f-9ac771abaae6}"></REGKEY>
  5194.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{6fd5192-a97c-4b48-a5d7-2420cfdcfdf2}"></REGKEY>
  5195.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{8c752c5e-3c10-4076-af0a-ffc69fa20d1b}"></REGKEY>
  5196.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{8c752c5e-3c10-4076-af0a-ffc69fa20d1c}"></REGKEY>
  5197.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{8d038f3d-7a31-42fa-8233-edf3ddd9fc25}"></REGKEY>
  5198.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{d0288a41-9855-4a9b-8316-babe243648da}"></REGKEY>
  5199.            <REGKEY MAIN="HKEY_CURRENT_USER" SUB="software" VALUE="1stbar"></REGKEY>
  5200.            <REGKEY MAIN="HKEY_CURRENT_USER" SUB="software" VALUE="iesearchbar"></REGKEY>
  5201.            <REGKEY MAIN="HKEY_CURRENT_USER" SUB="software\\microsoft\\windows\\currentversion\\uninstall" VALUE="ms aupdate"></REGKEY>
  5202.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{072a348a-ae68-465d-8321-ac2d171ba06f}"></REGKEY>
  5203.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{12398dd6-40aa-4c40-a4ec-a42cfc0de797}"></REGKEY>
  5204.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{496bef85-a112-496f-a2aa-3cfd083d4a75}"></REGKEY>
  5205.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{5e45df59-09bb-4b5d-82e9-d5069119dd6d}"></REGKEY>
  5206.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{66098dd4-e5cd-47c7-822d-a5b78248c4a9}"></REGKEY>
  5207.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{6a6be3b6-5b37-4340-b387-dd45af7710e5}"></REGKEY>
  5208.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{6cc173c0-e352-4a9c-90ba-cfabc622d6e7}"></REGKEY>
  5209.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{708fea00-ebb5-494f-b9c1-aee8f84260f6}"></REGKEY>
  5210.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{7ccbcd26-7f35-423b-84b5-3bd88ca0cc7d}"></REGKEY>
  5211.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{93bd7246-5ac1-48f0-8de9-6a0edd6a7e0e}"></REGKEY>
  5212.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{98a8315e-667a-11d5-87a3-bb213c32b44b}"></REGKEY>
  5213.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{a9faf495-fef6-4608-b17a-7afe51d7016a}"></REGKEY>
  5214.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{aa8c93e1-7e5f-497e-b67c-cc8fe2a40d3b}"></REGKEY>
  5215.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{ca4e7333-c145-48b5-b763-e758351a4ba9}"></REGKEY>
  5216.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{f2e9e3c6-0375-45a3-8ae6-7f7a1a1e703a}"></REGKEY>
  5217.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{f3e7ff6d-dca1-11d4-95df-00c0dfe9982c}"></REGKEY>
  5218.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{fdad9eed-da3d-4c66-9435-065878f3d5b0}"></REGKEY>
  5219.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="dyfuca_bh.bhobj"></REGKEY>
  5220.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="dyfuca_bh.bhobj.1"></REGKEY>
  5221.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="dyfuca_bh.bhobj\\clsid"></REGKEY>
  5222.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="dyfuca_bh.bhobj\\curver"></REGKEY>
  5223.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="dyfuca_bh.sinkobj"></REGKEY>
  5224.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="dyfuca_bh.sinkobj.1"></REGKEY>
  5225.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="dyfuca_bh.sinkobj\\clsid"></REGKEY>
  5226.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="dyfuca_bh.sinkobj\\curver"></REGKEY>
  5227.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="imgconv.clsimgconv"></REGKEY>
  5228.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{029e5f3b-7729-498d-989e-e275d9c2f60b}"></REGKEY>
  5229.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{1005d7ba-23ba-4839-8e9c-6e68eefea6e0}"></REGKEY>
  5230.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{18d33e45-f3cc-4d3b-99eb-177c9ba0f9a8}"></REGKEY>
  5231.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{29effdcf-0e6e-4e1b-9baa-d78faf7662b8}"></REGKEY>
  5232.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{2ddd90d6-f153-4ea7-a324-4b2d83d1027e}"></REGKEY>
  5233.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{3642f2e2-e08d-4bc0-88c4-a78cc4f885bb}"></REGKEY>
  5234.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{386e0945-26c9-4334-b298-099d81c0c023}"></REGKEY>
  5235.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{401f6d33-83cd-4b19-82ab-cc834c8e6cb2}"></REGKEY>
  5236.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{4f21c163-444e-4c9f-af91-321cad8dc3e6}"></REGKEY>
  5237.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{51459dd8-95a7-4a42-a3b4-23e28214ee2b}"></REGKEY>
  5238.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{6189e5f8-0e23-42ef-828f-47d69c5ecc32}"></REGKEY>
  5239.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{68749d06-e0a1-42ed-9e52-d0cc88460ef8}"></REGKEY>
  5240.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{73efc9b8-9e6a-4bee-80af-88a5c8d4c73b}"></REGKEY>
  5241.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{75e6c3b8-5a41-4f89-b329-94580fa2ca3c}"></REGKEY>
  5242.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{772f76fa-3d5d-49e0-8196-ee3a0b6ffca5}"></REGKEY>
  5243.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{79bf9dcd-c52d-4da8-b15e-ac2a88e96b0a}"></REGKEY>
  5244.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{837043ae-4276-4e3d-be32-fc334dc95fb7}"></REGKEY>
  5245.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{96b8ff30-f94d-43e7-b6d2-1a47c32b9083}"></REGKEY>
  5246.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{98a8315d-667a-11d5-87a3-bb213c32b44b}"></REGKEY>
  5247.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{98a8315f-667a-11d5-87a3-bb213c32b44b}"></REGKEY>
  5248.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{996b33c1-8e19-4f4f-ab6c-52a2c523b7d3}"></REGKEY>
  5249.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{9ce15eb5-6b39-4656-9e1f-2d219ee42e0e}"></REGKEY>
  5250.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{a4711882-dcb2-46ba-aeb1-d74e49aa331f}"></REGKEY>
  5251.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{a7445c82-cfe3-4782-a5a0-df333ee4f7b0}"></REGKEY>
  5252.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{bc99a7d5-6251-4378-b6af-dc08bdf85b63}"></REGKEY>
  5253.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{c5c9cda8-fb37-45b1-9ad2-733bb5dae64b}"></REGKEY>
  5254.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{cdb15f4b-de0f-4434-b8b3-45bf005249f1}"></REGKEY>
  5255.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{cf447b3e-4ebc-4fac-8957-176a8d634670}"></REGKEY>
  5256.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{d128e6c8-6ae7-4ecd-939e-e2e6ca7d035d}"></REGKEY>
  5257.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{d5c5bc09-9631-4c4e-860c-f6d497173a15}"></REGKEY>
  5258.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{d8ad96b6-39a6-4eda-9104-cfe49fb29f26}"></REGKEY>
  5259.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{dea5a099-e534-425f-8eb2-80fe8da7e86d}"></REGKEY>
  5260.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{f00219a4-9748-4e8c-aa16-4e7c549d5482}"></REGKEY>
  5261.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{f39011ef-5b60-4088-84ba-b66ffa7d5655}"></REGKEY>
  5262.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="intriguefunctions.clscheckforupdates"></REGKEY>
  5263.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="intriguefunctions.clscommon"></REGKEY>
  5264.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="intriguefunctions.clsencryption"></REGKEY>
  5265.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="intriguefunctions.clsftpv2"></REGKEY>
  5266.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="intriguefunctions.clshttpv2"></REGKEY>
  5267.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="intriguefunctions.clsini"></REGKEY>
  5268.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="intriguefunctions.clsinternet"></REGKEY>
  5269.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="intriguefunctions.clsprocess"></REGKEY>
  5270.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="intriguefunctions.clsregistery"></REGKEY>
  5271.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="intriguefunctions.clsregistration"></REGKEY>
  5272.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="intriguefunctions.clstimer"></REGKEY>
  5273.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="intriguefunctions.clsupdate"></REGKEY>
  5274.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="intriguefunctions.clsversion"></REGKEY>
  5275.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="istactivex.installer"></REGKEY>
  5276.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="istactivex.installer.2"></REGKEY>
  5277.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\typelib" VALUE="{11269241-f241-11cf-bd9a-00aa00575603}"></REGKEY>
  5278.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\typelib" VALUE="{17ed04b9-6c71-11d4-87a3-daa6b6b40e8f}"></REGKEY>
  5279.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\typelib" VALUE="{308a04d3-084d-43aa-a3e6-0d12bcca3ce6}"></REGKEY>
  5280.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\typelib" VALUE="{7c9e9a74-1922-409e-ab46-e48784336c3a}"></REGKEY>
  5281.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\typelib" VALUE="{c6afa5ad-c7de-44e3-aeda-41e2dd7a4e1a}"></REGKEY>
  5282.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\typelib" VALUE="{f3e7ff6b-dca1-11d4-95df-00c0dfe9982c}"></REGKEY>
  5283.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\code store database\\distribution units" VALUE="{018b7ec3-eeca-11d3-8e71-0000e82c6c0d}"></REGKEY>
  5284.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\code store database\\distribution units" VALUE="{12398dd6-40aa-4c40-a4ec-a42cfc0de797}"></REGKEY>
  5285.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion" VALUE="mediaswitch"></REGKEY>
  5286.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\moduleusage" VALUE="c/windows/downloaded program files/istactivex.dll"></REGKEY>
  5287.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\moduleusage" VALUE="c/winnt/downloaded program files/istactivex.dll\\.owner"></REGKEY>
  5288.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\moduleusage" VALUE="c/winnt/downloaded program files/istactivex.dll\\{12398dd6-40aa-4c40-a4ec-a42cfc0de797}"></REGKEY>
  5289.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\moduleusage" VALUE="c/winnt/downloaded program files/pcpowerscan.exe\\.owner"></REGKEY>
  5290.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\moduleusage" VALUE="c/winnt/downloaded program files/pcpowerscan.exe\\{dc187740-46a9-11d5-a815-00b0d0428c0c}"></REGKEY>
  5291.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall" VALUE="iesearchbariesearchbar"></REGKEY>
  5292.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="typelib" VALUE="{69550be2-9a78-11d2-ba91-00600827878d}"></REGKEY>
  5293.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{c82b55f0-60e0-478c-bc55-e4e22f11301d}"></REGKEY>
  5294.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="apuc.urlcatcher"></REGKEY>
  5295.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="apuc.urlcatcher.1"></REGKEY>
  5296.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{014da6c4-189f-421a-88cd-07cfe51cff10}"></REGKEY>
  5297.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{014da6c5-189f-421a-88cd-07cfe51cff10}"></REGKEY>
  5298.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{49c3014f-03ed-4634-9fb2-2881f2c7a057}"></REGKEY>
  5299.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{4eb7bbe8-2e15-424b-9ddb-2cdb9516a2a3}"></REGKEY>
  5300.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{4f9d4163-23f0-42e1-afda-4c1a6f8607e7}"></REGKEY>
  5301.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{60f8fb2a-9915-4202-967d-1fa694a8bcf5}"></REGKEY>
  5302.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{676058db-89bd-11d6-8a8c-0050ba8452c0}"></REGKEY>
  5303.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{676058e3-89bd-11d6-8a8c-0050ba8452c0}"></REGKEY>
  5304.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{676058e4-89bd-11d6-8a8c-0050ba8452c0}"></REGKEY>
  5305.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{6e1c7285-263b-431d-8b83-c3cbce301704}"></REGKEY>
  5306.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{72f81209-6c73-4de7-a3dc-408a8bd472fb}"></REGKEY>
  5307.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{974cc25e-d62c-4278-84e6-a806726e37bc}"></REGKEY>
  5308.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{9d1b86c7-1b93-4586-9009-ea3bd0ad63a5}"></REGKEY>
  5309.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{9dbafccf-592f-ffff-ffff-00608cec297b}"></REGKEY>
  5310.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{b8afa251-4efb-4703-87d4-da7d2435ba5e}"></REGKEY>
  5311.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{be35582c-9796-4cf1-aed9-556ada120b38}"></REGKEY>
  5312.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{c6906a23-4717-4e1f-b6fd-f06ebed14177}"></REGKEY>
  5313.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{ce31a1f7-3d90-4874-8fbe-a5d97f8bc8f1}"></REGKEY>
  5314.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{cf1e49b3-24a6-4b17-94be-c25102e3bf04}"></REGKEY>
  5315.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{df7d760c-b7e2-4735-bb77-f5a1a9745e16}"></REGKEY>
  5316.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{f94c0089-9394-4e44-b4ea-58dba1f7b84e}"></REGKEY>
  5317.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="interface" VALUE="{c6906a23-4717-4e1f-b6fd-f06ebed14177}"></REGKEY>
  5318.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{ce31a1f7-3d90-4874-8fbe-a5d97f8bc8f1}"></REGKEY>
  5319.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{4eb7bbe8-2e15-424b-9ddb-2cdb9516a2a3}"></REGKEY>
  5320.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software" VALUE="bargains"></REGKEY>
  5321.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{000004cc-e4ff-4f2c-bc30-dbef0b983bc9}"></REGKEY>
  5322.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{00000ef1-34e3-4633-87c6-1aa7a44296da}"></REGKEY>
  5323.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{014da6c1-189f-421a-88cd-07cfe51cff10}"></REGKEY>
  5324.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{014da6c2-189f-421a-88cd-07cfe51cff10}"></REGKEY>
  5325.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{014da6c3-189f-421a-88cd-07cfe51cff10}"></REGKEY>
  5326.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{014da6c5-189f-421a-88cd-07cfe51cff10}"></REGKEY>
  5327.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{014da6c7-189f-421a-88cd-07cfe51cff10}"></REGKEY>
  5328.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{014da6c9-189f-421a-88cd-07cfe51cff10}"></REGKEY>
  5329.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{014da6cb-189f-421a-88cd-07cfe51cff10}"></REGKEY>
  5330.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{018b7ec3-eeca-11d3-8e71-0000e82c6c0d}"></REGKEY>
  5331.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{136a9d1d-1f4b-43d4-8359-6f2382449255}"></REGKEY>
  5332.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{49c3014f-03ed-4634-9fb2-2881f2c7a057}"></REGKEY>
  5333.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{4f9d4163-23f0-42e1-afda-4c1a6f8607e7}"></REGKEY>
  5334.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{676058e4-89bd-11d6-8a8c-0050ba8452c0}"></REGKEY>
  5335.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{6e1c7285-263b-431d-8b83-c3cbce301704}"></REGKEY>
  5336.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{730f2451-a3fe-4a72-938c-fc8a74f15978}"></REGKEY>
  5337.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{ce31a1f7-3d90-4874-8fbe-a5d97f8bc8f1}"></REGKEY>
  5338.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{cf1e49b3-24a6-4b17-94be-c25102e3bf04}"></REGKEY>
  5339.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{d7f2fd62-6c1b-4b52-85b1-f65a414bf050}"></REGKEY>
  5340.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{e5dfb380-3988-4c07-8afb-8a47769d9db5}"></REGKEY>
  5341.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{014da6c4-189f-421a-88cd-07cfe51cff10}"></REGKEY>
  5342.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{014da6c6-189f-421a-88cd-07cfe51cff10}"></REGKEY>
  5343.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{014da6ca-189f-421a-88cd-07cfe51cff10}"></REGKEY>
  5344.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{014da6cc-189f-421a-88cd-07cfe51cff10}"></REGKEY>
  5345.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{297afc77-2039-4d3c-bef9-598819eb2c8a}"></REGKEY>
  5346.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{676058e3-89bd-11d6-8a8c-0050ba8452c0}"></REGKEY>
  5347.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{9388907f-82f5-434d-a941-bb802c6dd7c1}"></REGKEY>
  5348.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{9d1b86c7-1b93-4586-9009-ea3bd0ad63a5}"></REGKEY>
  5349.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{b8afa251-4efb-4703-87d4-da7d2435ba5e}"></REGKEY>
  5350.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{c6906a23-4717-4e1f-b6fd-f06ebed14177}"></REGKEY>
  5351.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{df7d760c-b7e2-4735-bb77-f5a1a9745e16}"></REGKEY>
  5352.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\interface" VALUE="{f94c0089-9394-4e44-b4ea-58dba1f7b84e}"></REGKEY>
  5353.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\typelib" VALUE="{014da6c0-189f-421a-88cd-07cfe51cff10}"></REGKEY>
  5354.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\typelib" VALUE="{4eb7bbe8-2e15-424b-9ddb-2cdb9516a2a3}"></REGKEY>
  5355.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\typelib" VALUE="{60f8fb2a-9915-4202-967d-1fa694a8bcf5}"></REGKEY>
  5356.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\typelib" VALUE="{676058db-89bd-11d6-8a8c-0050ba8452c0}"></REGKEY>
  5357.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\typelib" VALUE="{8c752c5e-3c10-4076-af0a-ffc69fa20d1b}"></REGKEY>
  5358.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\typelib" VALUE="{974cc25e-d62c-4278-84e6-a806726e37bc}"></REGKEY>
  5359.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\typelib" VALUE="{be35582c-9796-4cf1-aed9-556ada120b38}"></REGKEY>
  5360.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\typelib" VALUE="{ef100607-f409-426a-9e7c-cb211f2a9030}"></REGKEY>
  5361.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{ce31a1f7-3d90-4874-8fbe-a5d97f8bc8f1}"></REGKEY>
  5362.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\moduleusage" VALUE="c/winnt/downloaded program files/istactivex.dll{018b7ec3-eeca-11d3-8e71-0000e82c6c0d}"></REGKEY>
  5363.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{8fb0f3e2-5193-11d7-9f88-0050fc5441cb}"></REGKEY>
  5364.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\explorer bars" VALUE="{69550be2-9a78-11d2-ba91-00600827878d}"></REGKEY>
  5365.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\explorer bars" VALUE="{69555be2-9a78-11d2-ba91-00600827878d}"></REGKEY>
  5366.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\explorer bars" VALUE="{8fb0f3e2-5193-11d7-9f88-0050fc5441cb}"></REGKEY>
  5367.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{69550be2-9a78-11d2-ba91-00600827878d}"></REGKEY>
  5368.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall" VALUE="autoupdate"></REGKEY>
  5369.               <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{5f1abcdb-a875-46c1-8345-b72a4567e486}"></REGKEY>
  5370.               <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{6fd5192-a97c-4b48-a5d7-2420cfdcfdf2}"></REGKEY>
  5371.               <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{69550BE2-9A78-11D2-BA91-00600827878D}"></REGKEY>
  5372.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{ef86873f-04c2-4a95-a373-5703c08efc7b}"></REGKEY>
  5373.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="Pugi.PugiObj (and .1)"></REGKEY>
  5374.            <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="ISTbar"></REGKEY>
  5375.            <REGKEY MAIN="HKEY_CURRENT_USER" SUB="software" VALUE="ist"></REGKEY>
  5376.            <REGKEY MAIN="HKEY_CURRENT_USER" SUB="software" VALUE="POWERSCAN"></REGKEY>
  5377.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software" VALUE="istsvc"></REGKEY>
  5378.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\code store database\\distribution units" VALUE="{ef86873f-04c2-4a95-a373-5703c08efc7b}"></REGKEY>
  5379.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software" VALUE="totem"></REGKEY>
  5380.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{5F1ABCDB-A875-46c1-8345-B72A4567E486}"></REGKEY>
  5381.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\ISTsvc" VALUE="DisplayName"></REGKEY>
  5382.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" VALUE="ISTsvc"></REGKEY>
  5383.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\ISTbarISTbar" VALUE="DisplayName"></REGKEY>
  5384.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" VALUE="ISTbarISTbar"></REGKEY>
  5385.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\TypeLib" VALUE="{1bcd446e-7095-11d0-9c4e-00aa00bdd685}"></REGKEY>
  5386.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\Interface" VALUE="{1bcd446b-7095-11d0-9c4e-00aa00bdd685}"></REGKEY>
  5387.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\clsid" VALUE="{1bcd446c-7095-11d0-9c4e-00aa00bdd685}"></REGKEY>
  5388.        </KEYS>
  5389.        <VALUES>
  5390.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="software\\POWERSCAN" VALUE="account_id"></REGVALUE>
  5391.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="software\\POWERSCAN" VALUE="LoadNum"></REGVALUE>
  5392.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar\\WebBrowser" VALUE="{5F1ABCDB-A875-46c1-8345-B72A4567E486}"></REGVALUE>
  5393.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="ms updates"></REGVALUE>
  5394.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="IST Service"></REGVALUE>
  5395.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="power scan"></REGVALUE>
  5396.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Avenue Media\\Internet Optimizer" VALUE="CLS"></REGVALUE>
  5397.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Avenue Media\\Internet Optimizer" VALUE="InstallTime"></REGVALUE>
  5398.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Avenue Media\\Internet Optimizer" VALUE="PendingRemoval"></REGVALUE>
  5399.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Avenue Media\\Internet Optimizer" VALUE="RID"></REGVALUE>
  5400.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Avenue Media\\Internet Optimizer" VALUE="TAC"></REGVALUE>
  5401.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Avenue Media\\Internet Optimizer" VALUE="Version"></REGVALUE>
  5402.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{5F1ABCDB-A875-46c1-8345-B72A4567E486}"></REGVALUE>
  5403.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="bargains"></REGVALUE>
  5404.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="autoupdater"></REGVALUE>
  5405.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="dkry"></REGVALUE>
  5406.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\avenue media\\internet optimizer" VALUE="403"></REGVALUE>
  5407.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\avenue media\\internet optimizer" VALUE="404"></REGVALUE>
  5408.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\avenue media\\internet optimizer" VALUE="410"></REGVALUE>
  5409.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\avenue media\\internet optimizer" VALUE="500"></REGVALUE>
  5410.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\avenue media\\internet optimizer" VALUE="active alert conf"></REGVALUE>
  5411.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\avenue media\\internet optimizer" VALUE="active alert timestamp"></REGVALUE>
  5412.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\avenue media\\internet optimizer\\active alert" VALUE="target"></REGVALUE>
  5413.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\avenue media\\internet optimizer\\active alert" VALUE="version"></REGVALUE>
  5414.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\avenue media\\internet optimizer\\browser helper" VALUE="modulefilename"></REGVALUE>
  5415.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\avenue media\\internet optimizer\\browser helper" VALUE="options"></REGVALUE>
  5416.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\avenue media\\internet optimizer\\browser helper" VALUE="version"></REGVALUE>
  5417.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\avenue media\\internet optimizer" VALUE="id"></REGVALUE>
  5418.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\avenue media\\internet optimizer" VALUE="servervisited"></REGVALUE>
  5419.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\avenue media\\internet optimizer" VALUE="uninstallurl"></REGVALUE>
  5420.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\avenue media\\internet optimizer" VALUE="updateinterval"></REGVALUE>
  5421.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\avenue media\\internet optimizer" VALUE="wse conf"></REGVALUE>
  5422.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\avenue media\\internet optimizer" VALUE="wse timestamp"></REGVALUE>
  5423.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\avenue media\\internet optimizer\\wse" VALUE="modulefilename"></REGVALUE>
  5424.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\avenue media\\internet optimizer\\wse" VALUE="options"></REGVALUE>
  5425.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\avenue media\\internet optimizer\\wse" VALUE="version"></REGVALUE>
  5426.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\internet optimizer active alert" VALUE="displayicon"></REGVALUE>
  5427.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\internet optimizer active alert" VALUE="displayname"></REGVALUE>
  5428.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\internet optimizer active alert" VALUE="uninstallstring"></REGVALUE>
  5429.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\internet optimizer" VALUE="displayicon"></REGVALUE>
  5430.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\internet optimizer" VALUE="displayname"></REGVALUE>
  5431.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\internet optimizer" VALUE="uninstallstring"></REGVALUE>
  5432.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{014da6c9-189f-421a-88cd-07cfe51cff10}"></REGVALUE>
  5433.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{6e1c7285-263b-431d-8b83-c3cbce301704}"></REGVALUE>
  5434.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{69550be2-9a78-11d2-ba91-00600827878d}"></REGVALUE>
  5435.                 <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="software\\microsoft\\internet explorer\\toolbar\\webbrowser" VALUE="{5d60ff48-95be-4956-b4c6-6bb168a70310}"></REGVALUE>
  5436.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{0a8ce102-fa03-4612-9bee-7fe5452f4cb1}"></REGVALUE>
  5437.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\istsvc" VALUE="account_id"></REGVALUE>
  5438.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\istsvc" VALUE="app_date"></REGVALUE>
  5439.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\istsvc" VALUE="app_name"></REGVALUE>
  5440.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\istsvc" VALUE="config_count"></REGVALUE>
  5441.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\istsvc" VALUE="config_interval"></REGVALUE>
  5442.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\istsvc" VALUE="config_last"></REGVALUE>
  5443.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\istsvc" VALUE="config_url"></REGVALUE>
  5444.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\istsvc" VALUE="popup_count"></REGVALUE>
  5445.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\istsvc" VALUE="popup_initial_delay"></REGVALUE>
  5446.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\istsvc" VALUE="popup_interval"></REGVALUE>
  5447.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\istsvc" VALUE="popup_last"></REGVALUE>
  5448.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\istsvc" VALUE="popup_url"></REGVALUE>
  5449.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\istsvc" VALUE="update_count"></REGVALUE>
  5450.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\istsvc" VALUE="update_interval"></REGVALUE>
  5451.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\istsvc" VALUE="update_last"></REGVALUE>
  5452.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\istsvc" VALUE="update_url"></REGVALUE>
  5453.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\istsvc" VALUE="update_version"></REGVALUE>
  5454.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\istsvc" VALUE="version"></REGVALUE>
  5455.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\lycos\\sidesearch" VALUE="locale"></REGVALUE>
  5456.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\lycos\\sidesearch" VALUE="partner"></REGVALUE>
  5457.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\lycos\\sidesearch" VALUE="silentwelcome"></REGVALUE>
  5458.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\mysearch\\bar" VALUE="partnerexe"></REGVALUE>
  5459.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\mysearch\\bar" VALUE="partnername"></REGVALUE>
  5460.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\mysearch\\bar" VALUE="partnerurl"></REGVALUE>
  5461.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\istsvc" VALUE="displayname"></REGVALUE>
  5462.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\istsvc" VALUE="nomodify"></REGVALUE>
  5463.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\istsvc" VALUE="uninstallstring"></REGVALUE>
  5464.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\lycos sidesearch" VALUE="displayicon"></REGVALUE>
  5465.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\lycos sidesearch" VALUE="displayname"></REGVALUE>
  5466.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\lycos sidesearch" VALUE="helplink"></REGVALUE>
  5467.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\lycos sidesearch" VALUE="nomodify"></REGVALUE>
  5468.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\lycos sidesearch" VALUE="norepair"></REGVALUE>
  5469.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\lycos sidesearch" VALUE="uninstallstring"></REGVALUE>
  5470.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\lycos sidesearch" VALUE="urlinfoabout"></REGVALUE>
  5471.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\msbb" VALUE="displayicon"></REGVALUE>
  5472.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\msbb" VALUE="displayname"></REGVALUE>
  5473.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\msbb" VALUE="uninstallstring"></REGVALUE>
  5474.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\pc powerscan" VALUE="displayname"></REGVALUE>
  5475.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\pc powerscan" VALUE="publisher"></REGVALUE>
  5476.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\pc powerscan" VALUE="uninstallstring"></REGVALUE>
  5477.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\pc powerscan" VALUE="urlinfoabout"></REGVALUE>
  5478.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\search bar" VALUE="displayname"></REGVALUE>
  5479.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\search bar" VALUE="uninstallstring"></REGVALUE>
  5480.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\wsem update" VALUE="displayname"></REGVALUE>
  5481.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\wsem update" VALUE="uninstallstring"></REGVALUE>
  5482.                 <REGVALUE MAIN="HKEY_CLASSES_ROOT" SUB="component categories\\{00021493-0000-0000-c000-000000000046}" VALUE="enum"></REGVALUE>
  5483.                 <REGVALUE MAIN="HKEY_CLASSES_ROOT" SUB="component categories\\{00021494-0000-0000-c000-000000000046}" VALUE="enum"></REGVALUE>
  5484.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="hardware\\resourcemap\\pnp manager\\pnpmanager" VALUE="device\\resource008659.raw"></REGVALUE>
  5485.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="hardware\\resourcemap\\pnp manager\\pnpmanager" VALUE="device\\resource008659.translated"></REGVALUE>
  5486.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\istactivex.installer" VALUE="clsid"></REGVALUE>
  5487.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\istactivex.installer" VALUE="curver"></REGVALUE>
  5488.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer" VALUE="shstyle"></REGVALUE>
  5489.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\shareddlls" VALUE="c\\windows\\downloaded program files\\istactivex.dll"></REGVALUE>
  5490.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\shell extensions\\approved" VALUE="{0a8ce102-fa03-4612-9bee-7fe5452f4cb1}"></REGVALUE>
  5491.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\extensions\\{000007c6-17df-4438-92a4-de5537471ba3}" VALUE="bandclsid"></REGVALUE>
  5492.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\extensions\\{000007c6-17df-4438-92a4-de5537471ba3}" VALUE="buttontext"></REGVALUE>
  5493.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\extensions\\{000007c6-17df-4438-92a4-de5537471ba3}" VALUE="clsid"></REGVALUE>
  5494.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\extensions\\{000007c6-17df-4438-92a4-de5537471ba3}" VALUE="default visible"></REGVALUE>
  5495.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\extensions\\{000007c6-17df-4438-92a4-de5537471ba3}" VALUE="hoticon"></REGVALUE>
  5496.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\extensions\\{000007c6-17df-4438-92a4-de5537471ba3}" VALUE="icon"></REGVALUE>
  5497.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\code store database\\distribution units\\{12398dd6-40aa-4c40-a4ec-a42cfc0de797}" VALUE="installer"></REGVALUE>
  5498.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\code store database\\distribution units\\{12398dd6-40aa-4c40-a4ec-a42cfc0de797}" VALUE="systemcomponent"></REGVALUE>
  5499.        </VALUES>
  5500.     </REGISTRY>
  5501. <DANGER_LEVEL>2</DANGER_LEVEL>
  5502. <DESCRIPTION>Hijacks your system search settings and browser settings</DESCRIPTION>
  5503. </SW>
  5504. <SW NAME="Spector Keylogger">  
  5505.     <DIRECTORIES>
  5506.     </DIRECTORIES>
  5507.     <FILES>
  5508.         <FILE NAME="netknl.dll" PATH="Sys32Dir"></FILE>
  5509.         <FILE NAME="netknlhm.dll" PATH="Sys32Dir"></FILE>
  5510.         <FILE NAME="winnetcl.exe" PATH="Sys32Dir"></FILE>
  5511.         <FILE NAME="sp40setup.exe" PATH=""></FILE>
  5512.         <FILE NAME="spadmin.exe" PATH=""></FILE>
  5513.         <FILE NAME="spector_eval.exe" PATH=""></FILE>
  5514.         <FILE NAME="spsetup.exe" PATH=""></FILE>
  5515.         <FILE NAME="webebot.exe" PATH=""></FILE>
  5516.         <FILE NAME="wswinntfp.exe" PATH="SysDir"></FILE>
  5517.         <FILE NAME="wswinntfp.exe" PATH="Sys32Dir"></FILE>
  5518.         <FILE NAME="abfrnex.dll" PATH="SysDir"></FILE>
  5519.         <FILE NAME="abfrnex.dll" PATH="Sys32Dir"></FILE>
  5520.     </FILES> 
  5521.     <COOKIES>
  5522.     </COOKIES>
  5523.     <REGISTRY>
  5524.         <KEYS>
  5525.         </KEYS>
  5526.         <VALUES>
  5527.         </VALUES>
  5528.     </REGISTRY>
  5529. <DANGER_LEVEL>1</DANGER_LEVEL>
  5530. <DESCRIPTION>Spector is a keylogger that records all computer activity</DESCRIPTION>
  5531. </SW>
  5532. <SW NAME="SYSsfitb/TestTimer">  
  5533.     <DIRECTORIES>
  5534.     </DIRECTORIES>
  5535.     <FILES>
  5536.         <FILE NAME="syssfitb.exe" PATH="WinDir"></FILE>
  5537.     </FILES> 
  5538.     <COOKIES>
  5539.     </COOKIES>
  5540.     <REGISTRY>
  5541.         <KEYS>
  5542.         </KEYS>
  5543.         <VALUES>
  5544.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="syssfitb"></REGVALUE>
  5545.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="syssfitb"></REGVALUE>
  5546.         </VALUES>
  5547.     </REGISTRY>
  5548. <DANGER_LEVEL>2</DANGER_LEVEL>
  5549. <DESCRIPTION>Displays pornographic popups</DESCRIPTION>
  5550. </SW>
  5551. <SW NAME="SmartSearch.iexplorer">  
  5552.     <DIRECTORIES>
  5553.     </DIRECTORIES>
  5554.     <FILES>
  5555.         <FILE NAME="iexplorer.exe" PATH="WinDir"></FILE>
  5556.         <FILE NAME="iexplorer.exe" PATH="Sys32Dir"></FILE>
  5557.     </FILES> 
  5558.     <COOKIES>
  5559.     </COOKIES>
  5560.     <REGISTRY>
  5561.         <KEYS>
  5562.         </KEYS>
  5563.         <VALUES>
  5564.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="UserSystem"></REGVALUE>
  5565.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="UserSystem"></REGVALUE>
  5566.         </VALUES>
  5567.     </REGISTRY>
  5568. <DANGER_LEVEL>1</DANGER_LEVEL>
  5569. <DESCRIPTION>SmartSearch hijacker that hijacks your internet settings, including homepage, searchpages, etc</DESCRIPTION>
  5570. </SW>
  5571. <SW NAME="STARR Keylogger">  
  5572.     <DIRECTORIES>
  5573.         <DIR NAME="starr" PATH="PFDir"></DIR>
  5574.     </DIRECTORIES>
  5575.     <FILES>
  5576.         <FILE NAME="wsys.exe" PATH="PFDir\\starr"></FILE>
  5577.     </FILES> 
  5578.     <COOKIES>
  5579.     </COOKIES>
  5580.     <REGISTRY>
  5581.         <KEYS>
  5582.         </KEYS>
  5583.         <VALUES>
  5584.         </VALUES>
  5585.     </REGISTRY>
  5586. <DANGER_LEVEL>2</DANGER_LEVEL>
  5587. <DESCRIPTION>Records all keystrokes and related computer activity</DESCRIPTION>
  5588. </SW>
  5589. <SW NAME="SpyAnytime PC Spy">  
  5590.     <DIRECTORIES>
  5591.     </DIRECTORIES>
  5592.     <FILES>
  5593.         <FILE NAME="sysmgr32.exe" PATH="PFDir\\WareSight"></FILE>
  5594.     </FILES> 
  5595.     <COOKIES>
  5596.     </COOKIES>
  5597.     <REGISTRY>
  5598.         <KEYS>
  5599.         </KEYS>
  5600.         <VALUES>
  5601.         </VALUES>
  5602.     </REGISTRY>
  5603. <DANGER_LEVEL>2</DANGER_LEVEL>
  5604. <DESCRIPTION>Records all keystrokes and related computer activity</DESCRIPTION>
  5605. </SW>
  5606. <SW NAME="ShowBehind">  
  5607.     <DIRECTORIES>
  5608.         <DIR NAME="sbnet" PATH="WinDir"></DIR>
  5609.     </DIRECTORIES>
  5610.     <FILES>
  5611.         <FILE NAME="showbehind.exe" PATH="WinDir\\sbnet"></FILE>
  5612.     </FILES> 
  5613.     <COOKIES>
  5614.     </COOKIES>
  5615.     <REGISTRY>
  5616.         <KEYS>
  5617.         </KEYS>
  5618.         <VALUES>
  5619.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="showbehind"></REGVALUE>
  5620.         </VALUES>
  5621.     </REGISTRY>
  5622. <DANGER_LEVEL>1</DANGER_LEVEL>
  5623. <DESCRIPTION>Spawns popup windows while you browse the internet</DESCRIPTION>
  5624. </SW>
  5625. <SW NAME="SpotOn">  
  5626.     <DIRECTORIES>
  5627.     </DIRECTORIES>
  5628.     <FILES>
  5629.         <FILE NAME="Spotonbh.dll" PATH=""></FILE>
  5630.     </FILES> 
  5631.     <COOKIES>
  5632.     </COOKIES>
  5633.     <REGISTRY>
  5634.         <KEYS>
  5635.         </KEYS>
  5636.         <VALUES>
  5637.         </VALUES>
  5638.     </REGISTRY>
  5639. <DANGER_LEVEL>1</DANGER_LEVEL>
  5640. <DESCRIPTION>Used to hijack internet settings</DESCRIPTION>
  5641. </SW>
  5642. <SW NAME="Statblaster">  
  5643.      <DIRECTORIES>
  5644.      </DIRECTORIES>
  5645.      <FILES>
  5646.          <FILE NAME="Statblaster.exe" PATH="PFDir\\media\\media"></FILE>
  5647.           <FILE NAME="updatestats.exe" PATH="PFDir\\media\\media"></FILE>
  5648.        </FILES>
  5649.      <COOKIES>
  5650.      </COOKIES>
  5651.      <REGISTRY>
  5652.          <KEYS>
  5653.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{3F3DA1C1-024E-41E6-BE83-B22C5181A869}"></REGKEY>
  5654.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{A1A53286-D448-44EE-9660-F60A620A24B1}"></REGKEY>
  5655.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE" VALUE="Statblaster"></REGKEY>
  5656.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="TypeLib" VALUE="{2FE53E31-8FCD-4C4E-8567-B6449295F9F3}"></REGKEY>
  5657.            </KEYS>
  5658.          <VALUES>
  5659.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="UpdateStats"></REGVALUE>
  5660.          </VALUES>
  5661.      </REGISTRY>
  5662.  <DANGER_LEVEL>1</DANGER_LEVEL>
  5663.  <DESCRIPTION>Statblaster is used to deliver advertisements to your PC</DESCRIPTION>
  5664. </SW>
  5665. <SW NAME="Madise">  
  5666.     <DIRECTORIES>
  5667.     </DIRECTORIES>
  5668.     <FILES>
  5669.         <FILE NAME="madise.dll" PATH="WinDir"></FILE>
  5670.     </FILES> 
  5671.     <COOKIES>
  5672.     </COOKIES>
  5673.     <REGISTRY>
  5674.         <KEYS>
  5675.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{f760cb9e-c60f-4a89-890e-fae8b849493e}"></REGKEY>
  5676.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{f760cb9e-c60f-4a89-890e-fae8b849493e}"></REGKEY>
  5677.         </KEYS>
  5678.         <VALUES>
  5679.         </VALUES>
  5680.     </REGISTRY>
  5681. <DANGER_LEVEL>1</DANGER_LEVEL>
  5682. <DESCRIPTION>Opens pop up windows while browsing the web</DESCRIPTION>
  5683. </SW>
  5684. <SW NAME="IE SearchBar">  
  5685.     <DIRECTORIES>
  5686.         <DIR NAME="IESEARCHBAR" PATH="PFDir"></DIR>
  5687.     </DIRECTORIES>
  5688.     <FILES>
  5689.         <FILE NAME="IESEARCHBAR.DLL" PATH="PFDir\\IESEARCHBAR"></FILE>
  5690.     </FILES>
  5691.     <COOKIES>
  5692.     </COOKIES>
  5693.     <REGISTRY>
  5694.         <KEYS>
  5695.          </KEYS>
  5696.         <VALUES>
  5697.         </VALUES>
  5698.     </REGISTRY>
  5699. <DANGER_LEVEL>1</DANGER_LEVEL>
  5700. <DESCRIPTION>Toolbar that also hijacks your internet settings, home page settings, etc</DESCRIPTION>
  5701. </SW>
  5702. <SW NAME="HTASploit - winmain">  
  5703.     <DIRECTORIES>
  5704.     </DIRECTORIES>
  5705.     <FILES>
  5706.         <FILE NAME="winmain.exe" PATH="SysDir"></FILE>
  5707.         <FILE NAME="winmain.exe" PATH="Sys32Dir"></FILE>
  5708.         <FILE NAME="winmain.exe" PATH="ProfilePath\\local settings\\temp"></FILE>
  5709.     </FILES> 
  5710.     <COOKIES>
  5711.     </COOKIES>
  5712.     <REGISTRY>
  5713.         <KEYS>
  5714.         </KEYS>
  5715.         <VALUES>
  5716.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="winmain"></REGVALUE>
  5717.         </VALUES>
  5718.     </REGISTRY>
  5719. <DANGER_LEVEL>2</DANGER_LEVEL>
  5720. <DESCRIPTION>Leaves an open door to allow any malicious webpage access to your personal files</DESCRIPTION>
  5721. </SW>
  5722. <SW NAME="ClientMan">
  5723.     <DIRECTORIES>
  5724.         <DIR NAME="ClientMan" PATH="PFDir"></DIR>
  5725.         <DIR NAME="run" PATH="PFDir\\clientman"></DIR>
  5726.     </DIRECTORIES>
  5727.     <FILES>
  5728.           <FILE NAME="mscman.exe" PATH="PFDir\\clientman"></FILE>
  5729.           <FILE NAME="msckin.exe" PATH="PFDir\\clientman\\run"></FILE>
  5730.           <FILE NAME="msmc.exe" PATH="Sys32Dir"></FILE>
  5731.           <FILE NAME="mskceo.dll" PATH="Sys32Dir"></FILE>
  5732.           <FILE NAME="ause3.exe" PATH="PFDir\\clientman\\run"></FILE>
  5733.     </FILES>
  5734.     <COOKIES>
  5735.     </COOKIES>
  5736.       <REGISTRY>
  5737.         <KEYS>
  5738.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{447160cd-ecf5-4ea2-8a8a-1f70ca363f85}"></REGKEY>
  5739.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{94927a13-4aaa-476a-989d-392456427688}"></REGKEY>
  5740.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{cc916b4b-be44-4026-a19d-8c74bbd23361}"></REGKEY>
  5741.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{fcaddc14-bd46-408a-9842-cdbe1c6d37eb}"></REGKEY>
  5742.               <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{00a0a40c-f432-4c59-ba11-b25d142c7ab7}"></REGKEY>
  5743.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{00a0a40c-f432-4c59-ba11-b25d142c7ab7}"></REGKEY>
  5744.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{0982868C-47F0-4EFB-A664-C7B0B1015808}"></REGKEY>
  5745.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{0BA1C6EB-D062-4E37-9DB5-B07743276324}"></REGKEY>
  5746.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{25F7FA20-3FC3-11D7-B487-00D05990014C}"></REGKEY>
  5747.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{447160CD-ECF5-4EA2-8A8A-1F70CA363F85}"></REGKEY>
  5748.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{0982868C-47F0-4EFB-A664-C7B0B1015808}"></REGKEY>
  5749.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{0BA1C6EB-D062-4E37-9DB5-B07743276324}"></REGKEY>
  5750.         </KEYS>
  5751.         <VALUES>
  5752.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="clientman"></REGVALUE>
  5753.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="clientman1"></REGVALUE>
  5754.         </VALUES>
  5755.      </REGISTRY>
  5756. <DANGER_LEVEL>1</DANGER_LEVEL>
  5757. <DESCRIPTION>Starts up everytime the computer is run and comes bundled with many software applications</DESCRIPTION>
  5758. </SW>
  5759. <SW NAME="SearchSprint Toolbar">  
  5760.     <DIRECTORIES>
  5761.     </DIRECTORIES>
  5762.     <FILES>
  5763.     </FILES> 
  5764.     <COOKIES>
  5765.     </COOKIES>
  5766.     <REGISTRY>
  5767.         <KEYS>
  5768.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{aee46806-2c5a-4a4e-a5dd-b4531f64a187}"></REGKEY>
  5769.         </KEYS>
  5770.         <VALUES>
  5771.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{aee46806-2c5a-4a4e-a5dd-b4531f64a187}"></REGVALUE>
  5772.         </VALUES>
  5773.     </REGISTRY>
  5774. <DANGER_LEVEL>1</DANGER_LEVEL>
  5775. <DESCRIPTION>Toolbar that attaches to internet explorer</DESCRIPTION>
  5776. </SW>
  5777. <SW NAME="Chota">  
  5778.     <DIRECTORIES>
  5779.     </DIRECTORIES>
  5780.     <FILES>
  5781.         <FILE NAME="chota.exe" PATH=""></FILE>
  5782.     </FILES>
  5783.     <COOKIES>
  5784.     </COOKIES>
  5785.     <REGISTRY>
  5786.         <KEYS>
  5787.         </KEYS>
  5788.         <VALUES>
  5789.         </VALUES>
  5790.     </REGISTRY>
  5791. <DANGER_LEVEL>1</DANGER_LEVEL>
  5792. <DESCRIPTION>Chota is a Keylogger that runs silently in the background, recording all keystrokes.</DESCRIPTION>
  5793. </SW>
  5794. <SW NAME="SearchAndClick">
  5795.     <DIRECTORIES>
  5796.     </DIRECTORIES>
  5797.     <FILES>
  5798.     </FILES>
  5799.     <COOKIES>
  5800.     </COOKIES>
  5801.       <REGISTRY>
  5802.         <KEYS>
  5803.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{2cf0b992-5eeb-4143-99c0-5297ef71f443}"></REGKEY>
  5804.         </KEYS>
  5805.         <VALUES>
  5806.         </VALUES>
  5807.      </REGISTRY>
  5808. <DANGER_LEVEL>1</DANGER_LEVEL>
  5809. <DESCRIPTION>Toolbar that adds itself to your browser</DESCRIPTION>
  5810. </SW>
  5811. <SW NAME="Winshow/WinLink">
  5812.     <DIRECTORIES>
  5813.     </DIRECTORIES>
  5814.     <FILES>
  5815.       <FILE NAME="winshow.dll" PATH="ProfilePath\\application data\\winshow"></FILE> 
  5816.       <FILE NAME="winlink.dll" PATH="ProfilePath\\application data\\winlink"></FILE>
  5817.       <FILE NAME="winshow.dll" PATH="Sys32Dir"></FILE>
  5818.       <FILE NAME="winshow.dll" PATH="SysDir"></FILE>
  5819.       <FILE NAME="winlink.dll" PATH="WinDir"></FILE>
  5820.       <FILE NAME="winshow.cfg" PATH="WinDir"></FILE>
  5821.       <FILE NAME="dict.dat" PATH="WinDir"></FILE>
  5822.       <FILE NAME="winshow.dll" PATH="WinDir"></FILE> 
  5823.     </FILES>
  5824.     <COOKIES>
  5825.     </COOKIES>
  5826.       <REGISTRY>
  5827.         <KEYS>
  5828.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{6CC1C918-AE8B-4373-A5B4-28BA1851E39A}"></REGKEY>
  5829.               <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{6cc1c91a-ae8b-4373-a5b4-28ba1851e39a}"></REGKEY>
  5830.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{6CC1C91A-AE8B-4373-A5B4-28BA1851E39A}"></REGKEY>
  5831.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{6CC1C91A-AE8B-4373-A5B4-28BA1851E39A}"></REGKEY>
  5832.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{6CC1C918-AE8B-4373-A5B4-28BA1851E39A}"></REGKEY>
  5833.         </KEYS>
  5834.         <VALUES>
  5835.         </VALUES>
  5836.      </REGISTRY>
  5837. <DANGER_LEVEL>3</DANGER_LEVEL>
  5838. <DESCRIPTION>Winshow is adware that will display ads to your PC</DESCRIPTION>
  5839. </SW>
  5840. <SW NAME="Oodlz">
  5841.     <DIRECTORIES>
  5842.     </DIRECTORIES>
  5843.     <FILES>
  5844.         <FILE NAME="oodlz.exe" PATH="PFDir\\acceleration software\\oodlz"></FILE>
  5845.     </FILES>
  5846.     <COOKIES>
  5847.     </COOKIES>
  5848.     <REGISTRY>
  5849.        <KEYS>
  5850.        </KEYS>
  5851.        <VALUES>
  5852.        </VALUES>
  5853.     </REGISTRY>
  5854. <DANGER_LEVEL>2</DANGER_LEVEL>
  5855. <DESCRIPTION>Many serve both ads to your PC as well as install without your permission</DESCRIPTION>
  5856. </SW>
  5857. <SW NAME="Zipclix">
  5858.     <DIRECTORIES>
  5859.          <DIR NAME="zipclix" PATH="PFDir"></DIR>
  5860.     </DIRECTORIES>
  5861.     <FILES>
  5862.         <FILE NAME="zipclix.dll" PATH="PFDir\\zipclix"></FILE>
  5863.         <FILE NAME="zipclix.ini" PATH="PFDir\\zipclix"></FILE>
  5864.     </FILES>
  5865.     <COOKIES>
  5866.     </COOKIES>
  5867.     <REGISTRY>
  5868.        <KEYS>
  5869.              <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="zipclix"></REGKEY>
  5870.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{319a68db-06d0-46da-9f93-a810d5a70836}"></REGKEY>
  5871.        </KEYS>
  5872.        <VALUES>
  5873.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{319a68db-06d0-46da-9f93-a810d5a70836}"></REGVALUE>
  5874.        </VALUES>
  5875.     </REGISTRY>
  5876. <DANGER_LEVEL>1</DANGER_LEVEL>
  5877. <DESCRIPTION>Toolbar that attaches itself to your browser</DESCRIPTION>
  5878. </SW>
  5879. <SW NAME="SeekSeek">
  5880.     <DIRECTORIES>
  5881.         <DIR NAME="slmss" PATH="PFDir\\Common Files"></DIR>
  5882.     </DIRECTORIES>
  5883.     <FILES>
  5884.           <FILE NAME="slmss.exe" PATH="PFDir\\common files\\slmss"></FILE>
  5885.           <FILE NAME="mwsvm.exe" PATH="WinDir"></FILE>
  5886.     </FILES>
  5887.     <COOKIES>
  5888.     </COOKIES>
  5889.     <REGISTRY>
  5890.        <KEYS>
  5891.        </KEYS>
  5892.        <VALUES>
  5893.           <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="mwsvm"></REGVALUE>
  5894.           <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="slmss"></REGVALUE>
  5895.        </VALUES>
  5896.     </REGISTRY>
  5897. <DANGER_LEVEL>1</DANGER_LEVEL>
  5898. <DESCRIPTION>SeekSeek is a browser hijacker that takes control of your web settings</DESCRIPTION>
  5899. </SW>
  5900. <SW NAME="ShopNav">
  5901.       <DIRECTORIES>
  5902.           <DIR NAME="Srng" PATH="PFDir"></DIR>    
  5903.     </DIRECTORIES>
  5904.     <FILES>
  5905.       <FILE NAME="SNHelper.dll" PATH="Sys32Dir"></FILE>
  5906.       <FILE NAME="SNHelper.dll" PATH="SysDir"></FILE>
  5907.       <FILE NAME="SNHelper.dll" PATH="PFDir"></FILE>
  5908.       <FILE NAME="searchhook.dll" PATH="PFDir\\srng"></FILE>
  5909.       <FILE NAME="Srng.exe" PATH="PFDir\\srng"></FILE>
  5910.       <FILE NAME="SrngHelper.exe" PATH="PFDir\\srng"></FILE>
  5911.       <FILE NAME="SrngUtil.exe" PATH="PFDir\\srng"></FILE>
  5912.       <FILE NAME="IEHelper.dll" PATH="PFDir\\srng"></FILE>
  5913.       <FILE NAME="SNHelper.dll" PATH="PFDir\\srng"></FILE>
  5914.     </FILES>
  5915.     <COOKIES>
  5916.     </COOKIES>
  5917.     <REGISTRY>
  5918.        <KEYS>
  5919.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{14B3D246-6274-40B5-8D50-6C2ADE2AB29B}"></REGKEY>
  5920.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{CE7C3CF0-4B15-11D1-ABED-709549C10000}"></REGKEY>
  5921.        </KEYS>
  5922.        <VALUES>
  5923.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="srng"></REGVALUE>
  5924.        </VALUES>
  5925.     </REGISTRY>
  5926. <DANGER_LEVEL>4</DANGER_LEVEL>
  5927. <DESCRIPTION>Shopnav hijacks your internet browser settings</DESCRIPTION>
  5928. </SW>
  5929. <SW NAME="Httper">
  5930.     <DIRECTORIES>
  5931.         <DIR NAME="httper" PATH="PFDir"></DIR>
  5932.     </DIRECTORIES>
  5933.     <FILES>
  5934.           <FILE NAME="httper.dll" PATH="SysDir"></FILE>
  5935.           <FILE NAME="httper.dll" PATH="Sys32Dir"></FILE>
  5936.           <FILE NAME="httper.dll" PATH="PFDir\\httper"></FILE>
  5937.           <FILE NAME="httper.ini" PATH=""></FILE>
  5938.     </FILES>
  5939.     <COOKIES>
  5940.     </COOKIES>
  5941.     <REGISTRY>
  5942.        <KEYS>
  5943.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="CLSID" VALUE="{a5483501-070c-41dd-af44-9bd8864b3015}"></REGKEY>
  5944.          <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{a5483501-070c-41dd-af44-9bd8864b3015}"></REGKEY>
  5945.          <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{a5483501-070c-41dd-af44-9bd8864b3015}"></REGKEY>
  5946.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{a5483501-070c-41dd-af44-9bd8864b3015}"></REGKEY>
  5947.        </KEYS>
  5948.        <VALUES>
  5949.        </VALUES>
  5950.     </REGISTRY>
  5951. <DANGER_LEVEL>3</DANGER_LEVEL>
  5952. <DESCRIPTION>Httper is a searchbar that attaches itself to your browser</DESCRIPTION>
  5953. </SW>
  5954. <SW NAME="TOPicks">
  5955.     <DIRECTORIES>
  5956.        <DIR NAME="ToPicks" PATH="PFDir"></DIR>
  5957.     </DIRECTORIES>
  5958.     <FILES>
  5959.        <FILE NAME="hthost.exe" PATH="PFDir\\topicks\\bin"></FILE>
  5960.        <FILE NAME="idmun.exe" PATH="PFDir\\topicks\\bin"></FILE>
  5961.        <FILE NAME="idhost.exe" PATH="PFDir\\topicks\\bin"></FILE>
  5962.        <FILE NAME="idmup.dll" PATH="PFDir\\topicks\\bin"></FILE>
  5963.        <FILE NAME="htcheck2.dll" PATH="PFDir\\topicks\\bin"></FILE>
  5964.        <FILE NAME="tpreg.dll" PATH="PFDir\\topicks\\bin"></FILE>
  5965.        <FILE NAME="htps.dll" PATH="PFDir\\topicks\\bin"></FILE>
  5966.        <FILE NAME="idmcom.dll" PATH="PFDir\\topicks\\bin"></FILE>
  5967.        <FILE NAME="datamgr.dll" PATH="PFDir\\topicks\\bin"></FILE>
  5968.        <FILE NAME="tpbar.dll" PATH="PFDir\\topicks\\bin"></FILE>
  5969.        <FILE NAME="topicks.reg" PATH="PFDir\\topicks\\bin"></FILE>
  5970.     </FILES>
  5971.     <COOKIES>
  5972.     </COOKIES>
  5973.     <REGISTRY>
  5974.        <KEYS>
  5975.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{0352960f-47be-11d5-ab93-00d0b760b4eb}"></REGKEY>
  5976.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{80e81a0e-9741-4fbc-8ee3-3b78c04ada1d}"></REGKEY>
  5977.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{0352960f-47be-11d5-ab93-00d0b760b4eb}"></REGKEY>
  5978.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software" VALUE="Topicks"></REGKEY>
  5979.        </KEYS>
  5980.        <VALUES>
  5981.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="topicks starter"></REGVALUE>
  5982.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{80e81a0e-9741-4fbc-8ee3-3b78c04ada1d}"></REGVALUE>
  5983.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\appid\\adm.exe" VALUE="appid"></REGVALUE>
  5984.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\appid\\altnet signing module.exe" VALUE="appid"></REGVALUE>
  5985.        </VALUES>
  5986.     </REGISTRY>
  5987. <DANGER_LEVEL>1</DANGER_LEVEL>
  5988. <DESCRIPTION>Toolbar that displays sponsored results and links</DESCRIPTION>
  5989. </SW>
  5990. <SW NAME="KeenVALUE/KeenVALUE.updmgr/Keenware/EUniverse">
  5991.     <DIRECTORIES>
  5992.         <DIR NAME="keenvalue" PATH="PFDir\\common files"></DIR>
  5993.         <DIR NAME="keenware" PATH="PFDir\\common files"></DIR>
  5994.         <DIR NAME="incredifind" PATH="PFDir"></DIR>
  5995.         <DIR NAME="updater" PATH="PFDir"></DIR>
  5996.         <DIR NAME="pwrs0rbi" PATH="PFDir\\dynamic toolbar"></DIR>
  5997.         <DIR NAME="updmgr" PATH="PFDir\\common files"></DIR>
  5998.     </DIRECTORIES>
  5999.     <FILES>
  6000.          <FILE NAME="updmgr.exe" PATH="PFDir\\Common Files\\updmgr"></FILE>
  6001.          <FILE NAME="BHO.dll" PATH="PFDir\\incredifind\\bho"></FILE>
  6002.          <FILE NAME="pwrs0rbi.dll" PATH="PFDir\\powersearch\\toolbar"></FILE>
  6003.          <FILE NAME="infobar.dll" PATH="SysDir"></FILE>
  6004.          <FILE NAME="infobar.dll" PATH="Sys32Dir"></FILE>
  6005.          <FILE NAME="Searchbr.dll" PATH="SysDir"></FILE>
  6006.          <FILE NAME="Searchbr.dll" PATH="Sys32Dir"></FILE>
  6007.          <FILE NAME="wupdater.exe" PATH="PFDir\\Common files\\Keenware"></FILE>
  6008.          <FILE NAME="rvupdmgr.exe" PATH="PFDir\\Common Files\\updmgr"></FILE>
  6009.          <FILE NAME="simgr.exe" PATH="PFDir\\Common Files\\updmgr"></FILE>
  6010.          <FILE NAME="sui.exe" PATH="PFDir\\common files\\updater"></FILE>
  6011.          <FILE NAME="delupdat.exe" PATH="PFDir\\common files\\updater"></FILE>
  6012.          <FILE NAME="keenvalue.exe" PATH="PFDir\\common files\\keenvalue"></FILE>
  6013.            <FILE NAME="wupdater.exe" PATH="PFDir\\common files\\updater"></FILE>
  6014.           <FILE NAME="KeenVALUEInstall_with_track_120.exe" PATH="PFDir\\Common Files\\KeenVALUE"></FILE>
  6015.           <FILE NAME="Setup_incredifind_ultimatesaver_with_track.exe" PATH="PFDir\\Common Files\\KeenVALUE"></FILE>
  6016.           <FILE NAME="Setup_powersearch_ultimateSaver_with_track.exe" PATH="PFDir\\Common Files\\KeenVALUE"></FILE>
  6017.          <FILE NAME="iesliderwin32.dll" PATH="PFDir\\common files\\keenvalue"></FILE>
  6018.          <FILE NAME="kv001.dat" PATH="PFDir\\common files\\keenvalue"></FILE>
  6019.          <FILE NAME="kv002.dat" PATH="PFDir\\common files\\keenvalue"></FILE>
  6020.          <FILE NAME="kv099.dat" PATH="PFDir\\common files\\keenvalue"></FILE>
  6021.          <FILE NAME="uninstall.exe" PATH="PFDir\\common files\\keenvalue"></FILE>
  6022.          <FILE NAME="tipb.exe" PATH="PFDir\\perfectnav\\bho"></FILE>
  6023.           <FILE NAME="perfectnav.dll" PATH="PFDir\\perfectnav\\bho"></FILE>
  6024.          <FILE NAME="bho.dll" PATH="PFDir\\indredifind\\bho"></FILE>
  6025.          <FILE NAME="pwrs0rbi.dll" PATH="PFDir\\indredifind\\bho"></FILE>
  6026.          <FILE NAME="kvlhookwin.dll" PATH="PFDir\\common files\\keenvalue"></FILE>
  6027.          <FILE NAME="killkeenvalue.exe" PATH="PFDir\\common files\\keenvalue"></FILE>
  6028.          <FILE NAME="kwm.exe" PATH="PFDir\\common files\\keenvalue"></FILE>
  6029.          <FILE NAME="senduninstallinfo.exe" PATH="PFDir\\common files\\keenvalue"></FILE>
  6030.          <FILE NAME="incredifind.dll" PATH="PFDir\\incredifind\\bho"></FILE>
  6031.     </FILES>
  6032.     <COOKIES>
  6033.     </COOKIES>
  6034.     <REGISTRY>
  6035.        <KEYS>
  6036.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software" VALUE="euniverse"></REGKEY>
  6037.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software" VALUE="perfectnav"></REGKEY>
  6038.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{a045dc85-fc44-45be-8a50-e4f9c62c9a84}"></REGKEY>
  6039.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software" VALUE="keenvalue"></REGKEY>
  6040.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall" VALUE="keenvalue"></REGKEY>
  6041.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{269b6797-664e-48aa-b283-b012bdf6e525}"></REGKEY>
  6042.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{269b6797-664e-48aa-b283-b012bdf6e525}"></REGKEY>
  6043.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall" VALUE="powersearch"></REGKEY>
  6044.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software" VALUE="keenvalue"></REGKEY>
  6045.            <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software\\Visicom Media" VALUE="PWRS0RBI"></REGKEY>
  6046.        </KEYS>
  6047.        <VALUES>
  6048.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="updater"></REGVALUE>
  6049.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="updmgr"></REGVALUE>
  6050.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\PerfectNav" VALUE="UID"></REGVALUE>
  6051.        </VALUES>
  6052.     </REGISTRY>
  6053. <DANGER_LEVEL>2</DANGER_LEVEL>
  6054. <DESCRIPTION>Generates advertisements as well as tracks user activity</DESCRIPTION>
  6055. </SW>
  6056. <SW NAME="TopText">
  6057.     <DIRECTORIES>
  6058.     </DIRECTORIES>
  6059.     <FILES>
  6060.         <FILE NAME="stub.exe" PATH="SysDir"></FILE>
  6061.     </FILES>
  6062.     <COOKIES>
  6063.     </COOKIES>
  6064.     <REGISTRY>
  6065.         <KEYS>
  6066.         </KEYS>
  6067.         <VALUES>
  6068.         </VALUES>
  6069.     </REGISTRY>
  6070. <DANGER_LEVEL>1</DANGER_LEVEL>
  6071. <DESCRIPTION>TopText will alter all pages displayed in the browser, underlining keywords to generate responses for sponsored results</DESCRIPTION>
  6072. </SW>
  6073. <SW NAME="Winhost32">
  6074.     <DIRECTORIES>
  6075.     </DIRECTORIES>
  6076.     <FILES>
  6077.         <FILE NAME="Winhost32.exe" PATH="SysDir"></FILE>
  6078.         <FILE NAME="Winhost32.exe" PATH="Sys32Dir"></FILE>
  6079.     </FILES>
  6080.     <COOKIES>
  6081.     </COOKIES>
  6082.     <REGISTRY>
  6083.         <KEYS>
  6084.         </KEYS>
  6085.         <VALUES>
  6086.         </VALUES>
  6087.     </REGISTRY>
  6088. <DANGER_LEVEL>1</DANGER_LEVEL>
  6089. <DESCRIPTION>File that is pre-packaged with certain pieces of software that always actively runs on your PC</DESCRIPTION>
  6090. </SW>
  6091. <SW NAME="TwainTech"> 
  6092.     <FILES>
  6093.           <FILE NAME="biprep.exe" PATH="WinDir"></FILE>
  6094.            <FILE NAME="b_371_0_1_585800.htm" PATH="WinDir\\cache371"></FILE>
  6095.            <FILE NAME="ft1_01_0_279_gepfah.exe" PATH="WinDir"></FILE>
  6096.            <FILE NAME="smdat32a.sys" PATH="WinDir"></FILE>
  6097.            <FILE NAME="smdat32m.sys" PATH="WinDir"></FILE>
  6098.            <FILE NAME="mxtarget.dll" PATH="SysDir"></FILE>
  6099.            <FILE NAME="mxtarget.dll" PATH="Sys32Dir"></FILE>
  6100.            <FILE NAME="uduftm.exe" PATH="Sys32Dir"></FILE>
  6101.            <FILE NAME="preinstt.exe" PATH="WinDir\\Temp\\thi43e2.tmp"></FILE>
  6102.            <FILE NAME="twaintec.inf" PATH="WinDir\\Temp\\thi43e2.tmp"></FILE>
  6103.            <FILE NAME="preinstt.exe" PATH="WinDir\\Temp\\thi4487.tmp"></FILE>
  6104.            <FILE NAME="\\twaintec.inf" PATH="WinDir\\Temp\\thi4487.tmp"></FILE>
  6105.            <FILE NAME="preinstt.exe" PATH="WinDir\\Temp\\thi5a9c.tmp"></FILE>
  6106.            <FILE NAME="twaintec.inf" PATH="WinDir\\Temp\\thi5a9c.tmp"></FILE>
  6107.            <FILE NAME="twaintec.dll" PATH="WinDir\\Temp\\thi6026.tmp"></FILE>
  6108.            <FILE NAME="preinstt.exe" PATH="WinDir\\Temp\\thi72ea.tmp"></FILE>
  6109.            <FILE NAME="twaintec.dll" PATH="WinDir\\Temp\\thi72ea.tmp"></FILE>
  6110.            <FILE NAME="twaintec.inf" PATH="WinDir\\Temp\\thi72ea.tmp"></FILE>
  6111.            <FILE NAME="twaintec.ini" PATH="WinDir"></FILE>
  6112.            <FILE NAME="urls.bin" PATH="WinDir"></FILE>
  6113.            <FILE NAME="vurls.bin" PATH="WinDir"></FILE>
  6114.            <FILE NAME="wast2.exe" PATH="WinDir"></FILE>
  6115.            <FILE NAME="wsem218.dll" PATH="WinDir"></FILE>
  6116.             <FILE NAME="xgn.exe" PATH="WinDir"></FILE>
  6117.         <FILE NAME="mxTarget.dll" PATH="WinDir"></FILE>
  6118.         <FILE NAME="twaintec.dll" PATH="WinDir"></FILE>
  6119.         <FILE NAME="twaintec.dll" PATH="Sys32Dir"></FILE>
  6120.         <FILE NAME="twaintec.dll" PATH="SysDir"></FILE>
  6121.     </FILES>
  6122.     <REGISTRY>
  6123.         <KEYS>
  6124.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{000020dd-c72e-4113-af77-dd56626c6c42}"></REGKEY>
  6125.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{0000607d-d204-42c7-8e46-216055bf9918}"></REGKEY>
  6126.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{386a771c-e96a-421f-8ba7-32f1b706892f}"></REGKEY>
  6127.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{000020dd-c72e-4113-af77-dd56626c6c42}"></REGKEY>
  6128.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{0000607d-d204-42c7-8e46-216055bf9918}"></REGKEY>
  6129.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="twaintecdll.twaintecdllobj.1"></REGKEY>
  6130.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{000020dd-c72e-4113-af77-dd56626c6c42}"></REGKEY>
  6131.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{0000607d-d204-42c7-8e46-216055bf9918}"></REGKEY>
  6132.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{0000607d-d204-42c7-8e46-216055bf9918}"></REGKEY>
  6133.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{386a771c-e96a-421f-8ba7-32f1b706892f}"></REGKEY>
  6134.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="twaintecdll.twaintecdllobj.1"></REGKEY>
  6135.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\typelib" VALUE="{690bccb4-6b83-4203-ae77-038c116594ec}"></REGKEY>
  6136.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\activex compatibility" VALUE="{000020dd-c72e-4113-af77-dd56626c6c42}"></REGKEY>
  6137.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{000020dd-c72e-4113-af77-dd56626c6c42}"></REGKEY>
  6138.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{0000607D-D204-42C7-8E46-216055BF9918}"></REGKEY>
  6139.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\explorer\\browser helper objects" VALUE="{000020dd-c72e-4113-af77-dd56626c6c42}"></REGKEY>
  6140.         </KEYS>
  6141.             <VALUES>
  6142.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="xgn"></REGVALUE>
  6143.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\twaintec" VALUE="displayname"></REGVALUE>
  6144.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall\\twaintec" VALUE="uninstallstring"></REGVALUE>
  6145.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="tt4c5ntrstransac"></REGVALUE>
  6146.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="tt4n5a6tionscode"></REGVALUE>
  6147.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="ttc1o4d5eofsfinalad"></REGVALUE>
  6148.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="ttc4n5tfyl"></REGVALUE>
  6149.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="ttc4n5trmsgsdisp"></REGVALUE>
  6150.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="ttc4n5trsevnt"></REGVALUE>
  6151.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="ttc4s5insur"></REGVALUE>
  6152.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="ttc4u5rrentsmode"></REGVALUE>
  6153.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="ttd4s5tschost"></REGVALUE>
  6154.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="ttd4s5tscpath"></REGVALUE>
  6155.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="ttd4s5tssend"></REGVALUE>
  6156.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="tti4d5ofsdist"></REGVALUE>
  6157.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="tti4d5ofsinst"></REGVALUE>
  6158.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="tti4g5nores"></REGVALUE>
  6159.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="tti4n5progscab"></REGVALUE>
  6160.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="tti4n5progsex"></REGVALUE>
  6161.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="tti4n5progslstest"></REGVALUE>
  6162.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="ttl3a4stmotssday"></REGVALUE>
  6163.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="ttl3a4stsschckin"></REGVALUE>
  6164.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="ttm4o5dessync"></REGVALUE>
  6165.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="tts4t5atusofsinst"></REGVALUE>
  6166.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="tts4t5i6cky1s"></REGVALUE>
  6167.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="tts4t5icky2s"></REGVALUE>
  6168.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="ttt4h5rshsbath"></REGVALUE>
  6169.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="ttt4h5rshschecksin"></REGVALUE>
  6170.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="ttt4h5rshsmots"></REGVALUE>
  6171.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="ttt4h5rshsyssinf"></REGVALUE>
  6172.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="ttt4i5m6eofsfinalad"></REGVALUE>
  6173.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\twaintec" VALUE="ttt4o5plistspos"></REGVALUE>
  6174.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\activex compatibility\\{000020dd-c72e-4113-af77-dd56626c6c42}" VALUE="compatibility flags"></REGVALUE>
  6175.             </VALUES>
  6176.     </REGISTRY>
  6177. <DANGER_LEVEL>1</DANGER_LEVEL>
  6178. <DESCRIPTION>Twaintech delivers targeted advertisements</DESCRIPTION>
  6179. </SW>
  6180. <SW NAME="Jraun">
  6181.     <DIRECTORIES>
  6182.     </DIRECTORIES>
  6183.     <FILES>
  6184.        <FILE NAME="keyhost.exe" PATH="SysDir"></FILE>
  6185.        <FILE NAME="keyhost.exe" PATH="Sys32Dir"></FILE>
  6186.        <FILE NAME="VERSION.exe" PATH="SysDir"></FILE>
  6187.        <FILE NAME="VERSION.exe" PATH="Sys32Dir"></FILE>
  6188.     </FILES>
  6189.     <COOKIES>
  6190.     </COOKIES>
  6191.     <REGISTRY>
  6192.         <KEYS>
  6193.         </KEYS>
  6194.         <VALUES>
  6195.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="WinEssential"></REGVALUE>
  6196.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="version"></REGVALUE>
  6197.         </VALUES>
  6198.     </REGISTRY>
  6199. <DANGER_LEVEL>1</DANGER_LEVEL>
  6200. <DESCRIPTION>Browser Hijacker that takes over your browser settings</DESCRIPTION>
  6201. </SW>
  6202. <SW NAME="MaConnect">
  6203.     <DIRECTORIES>
  6204.     </DIRECTORIES>
  6205.     <FILES>
  6206.         <FILE NAME="maconnect.inf" PATH=""></FILE>
  6207.     </FILES>
  6208.     <COOKIES>
  6209.     </COOKIES>
  6210.     <REGISTRY>
  6211.         <KEYS>
  6212.         </KEYS>
  6213.         <VALUES>
  6214.         </VALUES>
  6215.     </REGISTRY>
  6216. <DANGER_LEVEL>2</DANGER_LEVEL>
  6217. <DESCRIPTION>MaConnect is a dialer used to dial high cost pornographic services</DESCRIPTION>
  6218. </SW>
  6219. <SW NAME="ToolbarStarter.dll">
  6220.     <DIRECTORIES>
  6221.     </DIRECTORIES>
  6222.     <FILES>
  6223.     </FILES>
  6224.     <COOKIES>
  6225.     </COOKIES>
  6226.     <REGISTRY>
  6227.         <KEYS>
  6228.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{c77e900a-ff55-400e-9baa-e042c8212898}"></REGKEY>
  6229.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{c77e900a-ff55-400e-9baa-e042c8212898}"></REGKEY>
  6230.         </KEYS>
  6231.         <VALUES>
  6232.         </VALUES>
  6233.     </REGISTRY>
  6234. <DANGER_LEVEL>1</DANGER_LEVEL>
  6235. <DESCRIPTION>Changes the settings of your browser</DESCRIPTION>
  6236. </SW>
  6237. <SW NAME="NetSpy KeyLogger">
  6238.     <DIRECTORIES>
  6239.     </DIRECTORIES>
  6240.     <FILES>
  6241.         <FILE NAME="_ISREG32.DLL" PATH="SysDir"></FILE>
  6242.         <FILE NAME="_ISREG32.DLL" PATH="Sys32Dir"></FILE>
  6243.         <FILE NAME="nsys.exe" PATH="Sys32Dir"></FILE>
  6244.         <FILE NAME="nsutil.exe" PATH="Sys32Dir"></FILE>
  6245.         <FILE NAME="nconfig.exe" PATH="Sys32Dir"></FILE>
  6246.         <FILE NAME="kbhook.dll" PATH="Sys32Dir"></FILE>
  6247.         <FILE NAME="file_keys.txtQ" PATH="Sys32Dir"></FILE>
  6248.         <FILE NAME="nsys.exe" PATH="SysDir"></FILE>
  6249.         <FILE NAME="nsutil.exe" PATH="SysDir"></FILE>
  6250.         <FILE NAME="nconfig.exe" PATH="SysDir"></FILE>
  6251.         <FILE NAME="kbhook.dll" PATH="SysDir"></FILE>
  6252.         <FILE NAME="file_keys.txtQ" PATH="SysDir"></FILE>        
  6253.     </FILES>
  6254.     <COOKIES>
  6255.     </COOKIES>
  6256.     <REGISTRY>
  6257.         <KEYS>
  6258.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\app paths" VALUE="nsys"></REGKEY>
  6259.         </KEYS>
  6260.         <VALUES>
  6261.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="nsys"></REGVALUE>
  6262.         </VALUES>
  6263.     </REGISTRY>
  6264. <DANGER_LEVEL>1</DANGER_LEVEL>
  6265. <DESCRIPTION>Keylogger that will record all keystrokes types at your PC</DESCRIPTION>
  6266. </SW>
  6267. <SW NAME="Flyswat">
  6268.     <DIRECTORIES>
  6269.     </DIRECTORIES>
  6270.     <FILES>
  6271.         <FILE NAME="flylib.dll" PATH="PFDir\\netcaptor"></FILE>
  6272.         <FILE NAME="flydesk.exe" PATH=""></FILE>
  6273.     </FILES>
  6274.     <COOKIES>
  6275.     </COOKIES>
  6276.     <REGISTRY>
  6277.         <KEYS>
  6278.         </KEYS>
  6279.         <VALUES>
  6280.         </VALUES>
  6281.     </REGISTRY>
  6282. <DANGER_LEVEL>2</DANGER_LEVEL>
  6283. <DESCRIPTION>Creates links to sponsored sites as you browse, as well as transmits information about your browsing activity</DESCRIPTION>
  6284. </SW>
  6285. <SW NAME="MasterBar">
  6286.     <DIRECTORIES>
  6287.         <DIR NAME="MasterBar" PATH="PFDir"></DIR>
  6288.     </DIRECTORIES>
  6289.     <FILES>
  6290.         <FILE NAME="masterbar.dll" PATH="PFDir\\MasterBar"></FILE>
  6291.         <FILE NAME="qi32.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
  6292.     </FILES>
  6293.     <COOKIES>
  6294.     </COOKIES>
  6295.     <REGISTRY>
  6296.         <KEYS>
  6297.         </KEYS>
  6298.         <VALUES>
  6299.         </VALUES>
  6300.     </REGISTRY>
  6301. <DANGER_LEVEL>1</DANGER_LEVEL>
  6302. <DESCRIPTION>Browser toolbar that slows down browsing/PC performance</DESCRIPTION>
  6303. </SW>
  6304. <SW NAME="PRW Hijacker">
  6305.      <DIRECTORIES>
  6306.      </DIRECTORIES>
  6307.      <FILES>
  6308.          <FILE NAME="PWRSC037.DLL" PATH="SysDir"></FILE>
  6309.          <FILE NAME="PWRSC037.DLL" PATH="Sys32Dir"></FILE>
  6310.      </FILES>
  6311.      <COOKIES>
  6312.      </COOKIES>
  6313.      <REGISTRY>
  6314.          <KEYS>
  6315.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{4e7bd74f-2b8d-469e-a58d-8f6fa787ad2d}"></REGKEY>
  6316.         </KEYS>
  6317.          <VALUES>
  6318.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{4e7bd74f-2b8d-469e-a58d-8f6fa787ad2d}"></REGVALUE>
  6319.          </VALUES>
  6320.      </REGISTRY>
  6321. <DANGER_LEVEL>1</DANGER_LEVEL>
  6322. <DESCRIPTION>Browser hijacker that will change your internet settings</DESCRIPTION>
  6323. </SW>
  6324. <SW NAME="Checkin.B">
  6325.     <DIRECTORIES>
  6326.     </DIRECTORIES>
  6327.     <FILES>
  6328.         <FILE NAME="owmngr.exe" PATH="SysDir"></FILE>
  6329.         <FILE NAME="ttps.exe" PATH="Sys32Dir"></FILE>
  6330.     </FILES>
  6331.     <COOKIES>
  6332.     </COOKIES>
  6333.     <REGISTRY>
  6334.         <KEYS>
  6335.                 <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="Iexplore"></REGKEY>
  6336.         </KEYS>
  6337.         <VALUES>
  6338.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="OWMngr"></REGVALUE>
  6339.         </VALUES>
  6340.     </REGISTRY>
  6341. <DANGER_LEVEL>2</DANGER_LEVEL>
  6342. <DESCRIPTION>Download trojan that facilitates the installation of other adware/spyware components</DESCRIPTION>
  6343. </SW>
  6344. <SW NAME="Whazit">
  6345.     <DIRECTORIES>
  6346.     </DIRECTORIES>
  6347.     <FILES>
  6348.        <FILE NAME="bho.dll" PATH="WinDir"></FILE>
  6349.        <FILE NAME="whattt.dll" PATH="WinDir"></FILE>
  6350.        <FILE NAME="whattn.dll" PATH="WinDir"></FILE>
  6351.        <FILE NAME="newones.dll" PATH="WinDir"></FILE>
  6352.           <FILE NAME="WANOBSI.exe" PATH="WinDir"></FILE>
  6353.        <FILE NAME="whattt.dll" PATH="Sys32Dir"></FILE>
  6354.        <FILE NAME="whattt.dll" PATH="SysDir"></FILE>
  6355.        <FILE NAME="outones.dll" PATH="Sys32Dir"></FILE>
  6356.        <FILE NAME="outones.dll" PATH="SysDir"></FILE>
  6357.        <FILE NAME="newones.dll" PATH="SysDir"></FILE>
  6358.        <FILE NAME="newones.dll" PATH="Sys32Dir"></FILE>
  6359.        <FILE NAME="whattn.dll" PATH="Sys32Dir"></FILE>
  6360.        <FILE NAME="whattn.dll" PATH="SysDir"></FILE>
  6361.     </FILES>
  6362.     <COOKIES>
  6363.     </COOKIES>
  6364.     <REGISTRY>
  6365.        <KEYS>
  6366.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software" VALUE="wms"></REGKEY>
  6367.        </KEYS>
  6368.        <VALUES>
  6369.        </VALUES>
  6370.     </REGISTRY>
  6371. <DANGER_LEVEL>1</DANGER_LEVEL>
  6372. <DESCRIPTION>Whazit is a browser hijacker and adder of toolbars as well</DESCRIPTION>
  6373. </SW>
  6374. <SW NAME="E2Give">
  6375.     <DIRECTORIES>
  6376.       <DIR NAME="E2Give" PATH="PFDir"></DIR>
  6377.     </DIRECTORIES>
  6378.     <FILES>
  6379.        <FILE NAME="iebhos.dll" PATH="PFDir\\e2g"></FILE>
  6380.        <FILE NAME="e2gbho.dll" PATH="PFDir\\E2Give"></FILE>
  6381.        <FILE NAME="iebhos.dll" PATH="SysDir"></FILE>
  6382.        <FILE NAME="iebhos.dll" PATH="Sys32Dir"></FILE>
  6383.     </FILES>
  6384.     <COOKIES>
  6385.     </COOKIES>
  6386.     <REGISTRY>
  6387.        <KEYS>
  6388.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Software" VALUE="E2Give"></REGKEY>
  6389.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{3643abc2-21bf-46b9-b230-f247db0c6fd6}"></REGKEY>
  6390.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{3643abc2-21bf-46b9-b230-f247db0c6fd6}"></REGKEY>
  6391.        </KEYS>
  6392.        <VALUES>
  6393.        </VALUES>
  6394.     </REGISTRY>
  6395. <DANGER_LEVEL>2</DANGER_LEVEL>
  6396. <DESCRIPTION>Redirects searches to webmerchants in order to steal affiliate commissions</DESCRIPTION>
  6397. </SW>
  6398. <SW NAME="BrowserAid/X"> 
  6399.     <DIRECTORIES>
  6400.     </DIRECTORIES>
  6401.     <FILES>
  6402.        <FILE NAME="stlbdist.dll" PATH="Sys32Dir"></FILE>
  6403.        <FILE NAME="stlbdist.dll" PATH="SysDir"></FILE>
  6404.        <FILE NAME="stlbupdt.dll" PATH="Sys32Dir"></FILE>
  6405.        <FILE NAME="msiefr40.dll" PATH="Sys32Dir"></FILE>
  6406.        <FILE NAME="msiefr40.dll" PATH="SysDir"></FILE>
  6407.        <FILE NAME="LetsSearch.exe" PATH="WinDir\\downloaded program files"></FILE>
  6408.        <FILE NAME="BrowserAid.exe" PATH="WinDir\\Downloaded Program Files"></FILE>
  6409.        <FILE NAME="bpsinstall.exe" PATH="WinDir"></FILE>
  6410.        <FILE NAME="uptodate.exe" PATH="WinDir"></FILE>
  6411.        <FILE NAME="ctb_s.exe" PATH="WinDir"></FILE>
  6412.        <FILE NAME="BrowserAidBarWnd.dll" PATH="WinDir\\downloaded program files"></FILE>
  6413.        <FILE NAME="LetsSearchIE.dll" PATH="WinDir\\downloaded program files"></FILE>
  6414.        <FILE NAME="BABarWnd.dll" PATH="WinDir\\downloaded program files"></FILE>
  6415.        <FILE NAME="QuickLaunchIE.dll" PATH="WinDir"></FILE>
  6416.        <FILE NAME="QuickLaunchIE.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
  6417.        <FILE NAME="BrowserAidToolbar.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
  6418.        <FILE NAME="HighlightHelper.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
  6419.        <FILE NAME="blckbho.dll" PATH=""></FILE>
  6420.        <FILE NAME="bptlb.dll" PATH=""></FILE>
  6421.        <FILE NAME="Rundll16.dll" PATH="WinDir"></FILE>
  6422.        <FILE NAME="stlbad123.dll" PATH="SysDir"></FILE>
  6423.        <FILE NAME="stlbad123.dll" PATH="Sys32Dir"></FILE>
  6424.         <FILE NAME="inetp60.dll" PATH="SysDir"></FILE>
  6425.        <FILE NAME="inetp60.dll" PATH="Sys32Dir"></FILE>
  6426.        <FILE NAME="e2gbho.dll" PATH=""></FILE>
  6427.        <FILE NAME="QuickLaunch.exe" PATH="WinDir\\Downloaded Program Files"></FILE>
  6428.        <FILE NAME="stlbad123.xml" PATH="SysDir"></FILE>
  6429.        <FILE NAME="lstoolbarconfig.inf" PATH="WinDir\\downloaded program files"></FILE>
  6430.     </FILES>
  6431.     <COOKIES>
  6432.     </COOKIES>
  6433.     <REGISTRY>
  6434.         <KEYS>
  6435.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CashToolbar" VALUE="ido"></REGKEY>
  6436.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CSHTLBAR" VALUE="braid_did"></REGKEY>
  6437.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{087173ef-9829-4f49-8340-a524177d3f60}"></REGKEY>
  6438.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{0ddbb570-0396-44c9-986a-8f6f61a51c2f}"></REGKEY>
  6439.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE" VALUE="CashToolbar"></REGKEY>
  6440.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE" VALUE="CSHTLBAR"></REGKEY>
  6441.         </KEYS>
  6442.         <VALUES>
  6443.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="{2CF0B992-5EEB-4143-99C0-5297EF71F44A}"></REGVALUE>
  6444.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="{0DDBB570-0396-44C9-986A-8F6F61A51C2F}"></REGVALUE>
  6445.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="{2CF0B992-5EEB-4143-99C0-5297EF71F443}"></REGVALUE>
  6446.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="{2CF0B992-5EEB-4143-99C0-5297EF71F44B}"></REGVALUE>
  6447.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="{2CF0B992-5EEB-4143-99C2-5297EF71F44A}"></REGVALUE>
  6448.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="{2CF0B992-5EEB-4143-99C2-5297EF71F44B}"></REGVALUE>
  6449.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="{337D0C1D-4053-4FAB-AF2B-45C2F7B0FAA6}"></REGVALUE>
  6450.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="{337D0C1D-4053-4FAB-AF2B-45C2F7B0FAA7}"></REGVALUE>
  6451.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="{5F5564AC-DE7A-4DCD-9296-32E71A35DCB6}"></REGVALUE>
  6452.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="{72CEAE02-DF9C-49F3-9689-10D1B82DC343}"></REGVALUE>
  6453.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="{80672997-D58C-4190-9843-C6C61AF8FE97}"></REGVALUE>
  6454.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="{D34F641F-5210-4EB0-8ED5-9179F47E15B7}"></REGVALUE>
  6455.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="{D7258ABE-571F-4DC2-ABD1-8393B13B1269}"></REGVALUE>            
  6456.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Rundll16"></REGVALUE>
  6457.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{2cf0b992-5eeb-4143-99c0-5297ef71f444}"></REGVALUE>
  6458.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="RunWindowsUpdate"></REGVALUE>
  6459.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Rundll32_7"></REGVALUE>
  6460.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="{2CF0B992-5EEB-4143-99C0-5297EF71F444}"></REGVALUE>
  6461.         </VALUES>
  6462.     </REGISTRY>
  6463. <DANGER_LEVEL>1</DANGER_LEVEL>
  6464. <DESCRIPTION>Manufactures many internet toolbars, all of which deliver ads and slow down the PC</DESCRIPTION>
  6465. </SW>
  6466. <SW NAME="DelFin Media Viewer">
  6467.     <DIRECTORIES>
  6468.       <DIR NAME="delfin" PATH="PFDir"></DIR>
  6469.       <DIR NAME="Dpi" PATH="PFDir\\Common Files"></DIR> 
  6470.     </DIRECTORIES>
  6471.     <FILES>
  6472.          <FILE NAME="pcsvc.exe" PATH="Sys32Dir\\pcs"></FILE>
  6473.        <FILE NAME="pgmonitr.exe" PATH="PFDir\\delfin\\promulgate"></FILE>
  6474.        <FILE NAME="dpi.exe" PATH="PFDir\\common files\\dpi"></FILE>   
  6475.     </FILES>
  6476.     <COOKIES>
  6477.     </COOKIES>
  6478.     <REGISTRY>
  6479.        <KEYS>
  6480.        </KEYS>
  6481.        <VALUES>
  6482.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="dpi"></REGVALUE>
  6483.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="pcsv"></REGVALUE>
  6484.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="promulgate"></REGVALUE>
  6485.        </VALUES>
  6486.     </REGISTRY>
  6487. <DANGER_LEVEL>1</DANGER_LEVEL>
  6488. <DESCRIPTION>Adware based media player used to deliver ads to your PC</DESCRIPTION>
  6489. </SW>
  6490. <SW NAME="Lycos SideSearch"> 
  6491.      <DIRECTORIES>
  6492.          <DIR NAME="lycos" PATH="PFDir"></DIR>
  6493.          <DIR NAME="sidesearch" PATH="PFDir\\lycos"></DIR>
  6494.      </DIRECTORIES>
  6495.      <FILES>
  6496.             <FILE NAME="SIDESEARCH1307.DLL" PATH="PFDir\\lycos\\sidesearch"></FILE>
  6497.           <FILE NAME="lycos sidesearch.lnk" PATH="ProfilePath\\desktop"></FILE>
  6498.          <FILE NAME="sidesearch.dll" PATH="PFDir\\Lycos\\Sidesearch"></FILE>
  6499.          <FILE NAME="sidesearch1211.dll" PATH="PFDir\\Lycos\\Sidesearch"></FILE>
  6500.          <FILE NAME="sidesearch1311.dll" PATH="PFDir\\Lycos\\Sidesearch"></FILE>
  6501.      </FILES>
  6502.      <COOKIES>
  6503.      </COOKIES>
  6504.      <REGISTRY>
  6505.          <KEYS>
  6506.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{000007AB-7059-463E-BD44-101A1750D732}"></REGKEY>
  6507.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{000007AB-7059-463E-BD44-101A1750D732}"></REGKEY>
  6508.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Classes\\Clsid" VALUE="{00000762-3965-4A1A-98CE-3D4BF457D4C8}"></REGKEY>
  6509.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{00000762-3965-4A1A-98CE-3D4BF457D4C8}"></REGKEY>
  6510.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\explorer bars" VALUE="{000007ab-7059-463e-bd44-101a1750d732}"></REGKEY>
  6511.         </KEYS>
  6512.          <VALUES>
  6513.          </VALUES>
  6514.      </REGISTRY>
  6515. <DANGER_LEVEL>0</DANGER_LEVEL>
  6516. <DESCRIPTION>Produced by Lycos, sidesearch displays sponsored results when using other search engines</DESCRIPTION>
  6517. </SW>
  6518. <SW NAME="SuperBar">
  6519.     <DIRECTORIES>
  6520.       <DIR NAME="superbar" PATH="PFDir"></DIR>
  6521.     </DIRECTORIES>
  6522.     <FILES>
  6523.            <FILE NAME="sbhc.exe" PATH="PFDIR\\SuperBar"></FILE>
  6524.            <FILE NAME="SuperBar.Dll" PATH="PFDir\\superbar"></FILE>
  6525.            <FILE NAME="SuperBar.Dll" PATH="Sys32Dir"></FILE>
  6526.            <FILE NAME="SuperBar.Dll" PATH="SysDir"></FILE>
  6527.            <FILE NAME="SuperBarExts.Dll" PATH="PFDir\\superbar"></FILE>
  6528.     </FILES>
  6529.     <COOKIES>
  6530.         <COOKIE NAME="gigatech"></COOKIE>
  6531.         <COOKIE NAME="greasycow"></COOKIE>
  6532.     </COOKIES>
  6533.     <REGISTRY>
  6534.        <KEYS>
  6535.          <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{1548c55c-b1e7-483f-973d-11c58ad44d4a}"></REGKEY> 
  6536.          <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{3C525947-F2B1-4237-A02B-2AC0FFDAB8FB}"></REGKEY>
  6537.          <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{136A9D1D-1F4B-43D4-8359-6F2382449255}"></REGKEY>
  6538.          <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{00ec76b0-1952-4f0e-a5e0-f14ffaf01f61}"></REGKEY>
  6539.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{136A9D1D-1F4B-43D4-8359-6F2382449255}"></REGKEY>
  6540.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{136a9d1d-1f4b-43d4-8359-6f2382449255}"></REGKEY>
  6541.          <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{136a9d1d-1f4b-43d4-8359-6f2382449255}"></REGKEY>
  6542.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{136A9D1D-1F4B-43D4-8359-6F2382449255}"></REGKEY>
  6543.          <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{1548c55c-b1e7-483f-973d-11c58ad44d4a}"></REGKEY>
  6544.          <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{3c525947-f2b1-4237-a02b-2ac0ffdab8fb}"></REGKEY>
  6545.          <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{a693a29b-931c-4367-9c60-ca3c303e35fb3}"></REGKEY>
  6546.          <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{c5a80b44-892e-4f46-be6e-db45479787e7}"></REGKEY>
  6547.          <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{d33aaf20-50c1-4a4c-9b83-b3b1946aa821}"></REGKEY>
  6548.          <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{e513445c-e14a-4b63-8092-49fe687ae023}"></REGKEY>
  6549.          <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{C5A80B44-892E-4F46-BE6E-DB45479787E7}"></REGKEY>
  6550.        </KEYS>
  6551.        <VALUES>
  6552.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="sbhc"></REGVALUE>
  6553.        </VALUES>
  6554.     </REGISTRY>
  6555. <DANGER_LEVEL>1</DANGER_LEVEL>
  6556. <DESCRIPTION>Superbar is a search toolbar that slows down browsing/PC performance</DESCRIPTION>
  6557. </SW>
  6558. <SW NAME="WORM_OPASERV.E">
  6559.       <DIRECTORIES>
  6560.       </DIRECTORIES>
  6561.       <FILES>
  6562.           <FILE NAME="BRASIL.PIF" PATH="WinDir"></FILE>
  6563.        </FILES>
  6564.       <COOKIES>
  6565.       </COOKIES>
  6566.       <REGISTRY>
  6567.           <KEYS>
  6568.         </KEYS>
  6569.           <VALUES>
  6570.               <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Brasil"></REGVALUE>
  6571.           </VALUES>
  6572.       </REGISTRY>
  6573. <DANGER_LEVEL>1</DANGER_LEVEL>
  6574. <DESCRIPTION>Worm that spreads itself across networks</DESCRIPTION>
  6575. </SW>
  6576. <SW NAME="W32.Instit.Worm">
  6577.      <DIRECTORIES>
  6578.      </DIRECTORIES>
  6579.      <FILES>
  6580.          <FILE NAME="instit.bat" PATH="WinDir"></FILE>
  6581.       </FILES>
  6582.      <COOKIES>
  6583.      </COOKIES>
  6584.      <REGISTRY>
  6585.          <KEYS>
  6586.         </KEYS>
  6587.          <VALUES>
  6588.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="instit"></REGVALUE>
  6589.          </VALUES>
  6590.      </REGISTRY>
  6591. <DANGER_LEVEL>2</DANGER_LEVEL>
  6592. <DESCRIPTION>Worm that attempts to spread itself across networks</DESCRIPTION>
  6593. </SW>
  6594. <SW NAME="WinFavorites/LoudMarketing.Casino">  
  6595.      <DIRECTORIES>
  6596.          <DIR NAME="winfavorites" PATH="PFDir"></DIR>
  6597.      </DIRECTORIES>
  6598.      <FILES>
  6599.          <FILE NAME="WinFavorites.exe" PATH="PFDir\\winfavorites"></FILE>
  6600.          <FILE NAME="WinFavorites.exe1" PATH="PFDir\\winfavorites"></FILE>
  6601.       </FILES>
  6602.      <COOKIES>
  6603.      </COOKIES>
  6604.      <REGISTRY>
  6605.          <KEYS>
  6606.         </KEYS>
  6607.          <VALUES>
  6608.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="WinFavorites"></REGVALUE>
  6609.          </VALUES>
  6610.      </REGISTRY>
  6611. <DANGER_LEVEL>1</DANGER_LEVEL>
  6612. <DESCRIPTION>Adware related component that delivers advertisements</DESCRIPTION>
  6613. </SW>
  6614. <SW NAME="WinPup32/Winpup">
  6615.     <DIRECTORIES>
  6616.     </DIRECTORIES>
  6617.     <FILES>
  6618.          <FILE NAME="Winpup.exe" PATH="WinDir"></FILE>
  6619.         <FILE NAME="Winpup32.exe" PATH="WinDir"></FILE>
  6620.         <FILE NAME="winpup32.exe" PATH="SysDir"></FILE>
  6621.         <FILE NAME="winpup32.exe" PATH="Sys32Dir"></FILE>
  6622.     </FILES>
  6623.     <COOKIES>
  6624.     </COOKIES>
  6625.     <REGISTRY>
  6626.         <KEYS>
  6627.         </KEYS>
  6628.         <VALUES>
  6629.         </VALUES>
  6630.     </REGISTRY>
  6631. <DANGER_LEVEL>1</DANGER_LEVEL>
  6632. <DESCRIPTION>Known to cause popup advertisements.</DESCRIPTION>
  6633. </SW>
  6634. <SW NAME="NewtonKnows/Newton Knows.Bar"> 
  6635.     <DIRECTORIES>
  6636.         <DIR NAME="newton knows" PATH="PFDir"></DIR>
  6637.     </DIRECTORIES>
  6638.     <FILES>
  6639.           <FILE NAME="NewtKnow.exe" PATH="PFDir\\Newton Knows"></FILE>
  6640.           <FILE NAME="NewtnTra.exe" PATH=""></FILE>
  6641.           <FILE NAME="bar.dll" PATH=""></FILE>
  6642.     </FILES>
  6643.     <COOKIES>
  6644.     </COOKIES>
  6645.     <REGISTRY>
  6646.        <KEYS>
  6647.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{EE392A64-F30B-47C8-A363-CDA1CEC7DC1B}"></REGKEY>
  6648.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{EE392A64-F30B-47C8-A363-CDA1CEC7DC1B}"></REGKEY>
  6649.        </KEYS>
  6650.        <VALUES>
  6651.        </VALUES>
  6652.     </REGISTRY>
  6653. <DANGER_LEVEL>1</DANGER_LEVEL>
  6654. <DESCRIPTION>NewtonKnows is an IE search hijacker as well as browser settings hijacker</DESCRIPTION>
  6655. </SW>
  6656. <SW NAME="VirtualBouncer">
  6657.     <DIRECTORIES>
  6658.         <DIR NAME="vbouncer" PATH="PFDir"></DIR>
  6659.         <DIR NAME="virtual bouncer" PATH="ProfilePath\\start menu\\programs"></DIR>
  6660.     </DIRECTORIES>
  6661.     <FILES>
  6662.            <FILE NAME="VirtualBouncer.exe" PATH="PFDir\\vbouncer"></FILE>
  6663.         <FILE NAME="vbouncerouter1402030731.exe" PATH="WinDir\\downloaded program files\\conflict.1"></FILE>
  6664.         <FILE NAME="vbouncerouter1402030731.exe" PATH="WinDir\\downloaded program files"></FILE>
  6665.         <FILE NAME="virtual bouncer.lnk" PATH="ProfilePath\\start menu\\programs\\startup"></FILE>
  6666.     </FILES>
  6667.     <COOKIES>
  6668.     </COOKIES>
  6669.     <REGISTRY>
  6670.        <KEYS>
  6671.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\cryptography\\services" VALUE="durl"></REGKEY>
  6672.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall" VALUE="virtual bouncer"></REGKEY>
  6673.        </KEYS>
  6674.        <VALUES>
  6675.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Virtual Bouncer"></REGVALUE>
  6676.        </VALUES>
  6677.     </REGISTRY>
  6678. <DANGER_LEVEL>3</DANGER_LEVEL>
  6679. <DESCRIPTION>Known to reside in the memory of your PC, therefore slowing it down, as well as deliver occasional popup ads</DESCRIPTION>
  6680. </SW>
  6681. <SW NAME="NavExcel">
  6682.     <DIRECTORIES>
  6683.        <DIR NAME="NavExcel" PATH="PFDir"></DIR>
  6684.     </DIRECTORIES>
  6685.     <FILES>
  6686.        <FILE NAME="NavHelper" PATH="WinDir/DownloadProgramfile"></FILE>
  6687.        <FILE NAME="NHelper.dll" PATH="PFDir\\navexcel\\navhelper\\v2.0.4"></FILE>
  6688.        <FILE NAME="NHelper.dll" PATH="Sys32Dir"></FILE>
  6689.        <FILE NAME="NHelper.dll" PATH="SysDir"></FILE>
  6690.        <FILE NAME="NHUninstaller.exe" PATH="PFDir\\navexcel\\navhelper\\v2.0.4"></FILE>
  6691.        <FILE NAME="NHUpdater.exe" PATH="PFDir\\navexcel\\navhelper\\v2.0.4"></FILE>
  6692.        <FILE NAME="NHelper.htm" PATH="PFDir\\navexcel\\navhelper\\v2.0.4"></FILE>
  6693.     </FILES>
  6694.     <COOKIES>
  6695.     </COOKIES>
  6696.     <REGISTRY>
  6697.         <KEYS>
  6698.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{C1E58A84-95B3-4630-B8C2-D06B77B7A0FC}"></REGKEY>
  6699.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{C1E58A84-95B3-4630-B8C2-D06B77B7A0FC}"></REGKEY>
  6700.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{C1E58A84-95B3-4630-B8C2-D06B77B7A0FC}"></REGKEY>
  6701.         </KEYS>
  6702.         <VALUES>
  6703.     </VALUES>
  6704.     </REGISTRY>
  6705. <DANGER_LEVEL>1</DANGER_LEVEL>
  6706. <DESCRIPTION>NavExcel is a search hijacker</DESCRIPTION>
  6707. </SW>
  6708. <SW NAME="Look2Me">
  6709.     <DIRECTORIES>
  6710.     </DIRECTORIES>
  6711.     <FILES>
  6712.        <FILE NAME="msg116.dll" PATH="Sys32Dir"></FILE>
  6713.        <FILE NAME="msg116.dll" PATH="SysDir"></FILE>
  6714.        <FILE NAME="msg117.dll" PATH="Sys32Dir"></FILE>
  6715.        <FILE NAME="msg117.dll" PATH="SysDir"></FILE>
  6716.        <FILE NAME="upd116.exe" PATH=""></FILE>
  6717.        <FILE NAME="upd117.exe" PATH=""></FILE>
  6718.        <FILE NAME="msg{1e253d5d-6add-4fe9-829c-f51038158be5}0110.dll" PATH="Sys32Dir"></FILE>
  6719.        <FILE NAME="msg{1e253d5d-6add-4fe9-829c-f51038158be5}0111.dll" PATH="Sys32Dir"></FILE>
  6720.        <FILE NAME="msg{46b08877-2be4-4f35-8e77-034c2142321c}0115.dll" PATH="Sys32Dir"></FILE>
  6721.        <FILE NAME="msg{e8d8ffef-30a4-4df1-a618-e0599a0d0a15}0111.dllno.exe" PATH="Sys32Dir"></FILE>
  6722.        <FILE NAME="msg{e8d8ffef-30a4-4df1-a618-e0599a0d0a15}0110.dll" PATH="Sys32Dir"></FILE>
  6723.        <FILE NAME="msg{e01b47a7-a499-4fee-83c2-b0684ca28e6b}0115.dll" PATH="Sys32Dir"></FILE>
  6724.        <FILE NAME="msg{d331b768-d6da-41e8-a7b6-78ed724126c0}0115.dll" PATH="Sys32Dir"></FILE>
  6725.        <FILE NAME="msg{b9a9ac6a-2cc9-4a24-a250-bea974703ff8}0111.dll" PATH="Sys32Dir"></FILE>
  6726.        <FILE NAME="msg{b9a9ac6a-2cc9-4a24-a250-bea974703ff8}0110.dll" PATH="Sys32Dir"></FILE>
  6727.        <FILE NAME="msg{aac5700f-954a-47b7-9746-871ae8e634e4}0115.dll" PATH="Sys32Dir"></FILE>
  6728.        <FILE NAME="msg{9d4f5b7c-2a4b-46c5-99a7-4c775b688d45}0111.dll" PATH="Sys32Dir"></FILE>
  6729.        <FILE NAME="msg{93396c3f-aea3-4ac0-bb55-81f0f0414a24}0113.dll" PATH="Sys32Dir"></FILE>
  6730.        <FILE NAME="msg{63de1ad9-f0c6-4dac-886a-5a9707b0d23c}0111.dll" PATH="Sys32Dir"></FILE>
  6731.        <FILE NAME="msg{63de1ad9-f0c6-4dac-886a-5a9707b0d23c}0110.dll" PATH="Sys32Dir"></FILE>
  6732.        <FILE NAME="msg{5bef546a-e3c1-489c-996a-c9688d985ae0}0111.dll" PATH="Sys32Dir"></FILE>
  6733.        <FILE NAME="msg{5bef546a-e3c1-489c-996a-c9688d985ae0}0110.dll" PATH="Sys32Dir"></FILE>
  6734.        <FILE NAME="msg{9d4f5b7c-2a4b-46c5-99a7-4c775b688d45}0110.dll" PATH="Sys32Dir"></FILE>
  6735.     </FILES>
  6736.     <COOKIES>
  6737.     </COOKIES>
  6738.     <REGISTRY>
  6739.         <KEYS>
  6740.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{DDFFA75A-E81D-4454-89FC-B9FD0631E726}"></REGKEY>
  6741.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellExtensions\\Approved" VALUE="{DDFFA75A-E81D-4454-89FC-B9FD0631E726}"></REGKEY>
  6742.           <REGKEY MAIN="HKEY_USERS" SUB="s-1-5-21-1409082233-1390067357-1801674531-500\\software" VALUE="look2me"></REGKEY>
  6743.           <REGKEY MAIN="HKEY_USERS" SUB="s-1-5-21-1801674531-854245398-839522115-1120\\software" VALUE="look2me"></REGKEY>
  6744.           <REGKEY MAIN="HKEY_USERS" SUB="s-1-5-21-1960408961-1993962763-1343024091-1003\\software" VALUE="look2me"></REGKEY>
  6745.              <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="Look2Me"></REGKEY>
  6746.           <REGKEY MAIN="HKEY_USERS" SUB="s-1-5-21-343818398-73586283-839522115-500\\software" VALUE="look2me"></REGKEY>
  6747.           <REGKEY MAIN="HKEY_USERS" SUB="s-1-5-21-3581291086-1789104883-3112336242-1005\\software" VALUE="look2me"></REGKEY>
  6748.         </KEYS>
  6749.         <VALUES>    
  6750.         </VALUES>
  6751.     </REGISTRY>
  6752. <DANGER_LEVEL>2</DANGER_LEVEL>
  6753. <DESCRIPTION>Monitors websites you visit and sends the information to a central server</DESCRIPTION>
  6754. </SW>
  6755. <SW NAME="BroadcastPC">
  6756.     <DIRECTORIES>
  6757.        <DIR NAME="RVP" PATH="PFDir"></DIR>
  6758.     </DIRECTORIES>
  6759.     <FILES>
  6760.        <FILE NAME="bpc.exe" PATH="PFDir\\rvp"></FILE>
  6761.     </FILES>
  6762.     <COOKIES>
  6763.     </COOKIES>
  6764.     <REGISTRY>
  6765.        <KEYS>
  6766.        </KEYS>
  6767.        <VALUES>
  6768.           <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="rvp"></REGVALUE>
  6769.        </VALUES>
  6770.     </REGISTRY>
  6771. <DANGER_LEVEL>2</DANGER_LEVEL>
  6772. <DESCRIPTION>Downloads movie clips to your computer and plays them at pre-designated times without your consent</DESCRIPTION>
  6773. </SW>
  6774. <SW NAME="Stop-Popup-Ads-Now/Adware.Binet/StopPop"> 
  6775.      <DIRECTORIES>
  6776.      </DIRECTORIES>
  6777.      <FILES>
  6778.          <FILE NAME="payload.inf" PATH="WinDir\\inf"></FILE>
  6779.          <FILE NAME="Bi.dll" PATH="WinDir"></FILE>
  6780.         <FILE NAME="Biprep.exe" PATH="WinDir"></FILE>
  6781.     </FILES>
  6782.      <COOKIES>
  6783.      </COOKIES>
  6784.      <REGISTRY>
  6785.          <KEYS>
  6786.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software" VALUE="dhost"></REGKEY>
  6787.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{10000273-8230-4dd4-be4f-6889d1e74167}"></REGKEY> 
  6788.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{10000273-8230-4dd4-be4f-6889d1e74167}"></REGKEY> 
  6789.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE="bidll.bidllobj.1"></REGKEY> 
  6790.         </KEYS>
  6791.          <VALUES>
  6792.          </VALUES>
  6793.      </REGISTRY>
  6794.  <DANGER_LEVEL>1</DANGER_LEVEL>
  6795.  <DESCRIPTION>It is a Browser Helper Object that displays advertisements and downloads and installs files.</DESCRIPTION>
  6796.  </SW>
  6797. <SW NAME="DailyToolbar">  
  6798.     <DIRECTORIES>
  6799.     </DIRECTORIES>
  6800.     <FILES>
  6801.         <FILE NAME="dailytoolbar.dll" PATH="WinDir\\downloaded program files"></FILE>
  6802.     </FILES>
  6803.     <COOKIES>
  6804.     </COOKIES>
  6805.     <REGISTRY>
  6806.         <KEYS>
  6807.         </KEYS>
  6808.         <VALUES>
  6809.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{8333c319-0669-4893-a418-f56d9249fca6}"></REGVALUE>
  6810.         </VALUES>
  6811.     </REGISTRY>
  6812. <DANGER_LEVEL>1</DANGER_LEVEL>
  6813. <DESCRIPTION>Toolbar that attaches to Internet Explorer</DESCRIPTION>
  6814. </SW>
  6815. <SW NAME="EasyWWW">  
  6816.     <DIRECTORIES>
  6817.     </DIRECTORIES>
  6818.     <FILES>
  6819.         <FILE NAME="easywww.exe" PATH="WinDir"></FILE>
  6820.         <FILE NAME="redirect5.exe" PATH="WinDir"></FILE>
  6821.     </FILES>
  6822.     <COOKIES>
  6823.     </COOKIES>
  6824.     <REGISTRY>
  6825.         <KEYS>
  6826.         </KEYS>
  6827.         <VALUES>
  6828.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="easywww"></REGVALUE>
  6829.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="redirect"></REGVALUE>
  6830.         </VALUES>
  6831.     </REGISTRY>
  6832. <DANGER_LEVEL>1</DANGER_LEVEL>
  6833. <DESCRIPTION>Hijacks your Internet Explorer settings</DESCRIPTION>
  6834. </SW>
  6835. <SW NAME="W32.Badtrans.B@mm">
  6836.     <DIRECTORIES>
  6837.     </DIRECTORIES>
  6838.     <FILES>
  6839.         <FILE NAME="kern32.exe" PATH=""></FILE>
  6840.     </FILES>
  6841.     <COOKIES>
  6842.     </COOKIES>
  6843.     <REGISTRY>
  6844.         <KEYS>
  6845.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce" VALUE="Kernel32"></REGKEY>
  6846.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce" VALUE="Kernel32.exe"></REGKEY>
  6847.         </KEYS>
  6848.         <VALUES>
  6849.         </VALUES>
  6850.     </REGISTRY>
  6851. <DANGER_LEVEL>2</DANGER_LEVEL>
  6852. <DESCRIPTION>Worm that can log all keystroaks types at your PC</DESCRIPTION>
  6853. </SW>
  6854. <SW NAME="Frsk">  
  6855.     <DIRECTORIES>
  6856.     </DIRECTORIES>
  6857.     <FILES>
  6858.         <FILE NAME="frsk.exe" PATH="WinDir"></FILE>
  6859.          <FILE NAME="dp-b23011805.exe" PATH=""></FILE>
  6860.     </FILES>
  6861.     <COOKIES>
  6862.     </COOKIES>
  6863.     <REGISTRY>
  6864.         <KEYS>
  6865.         </KEYS>
  6866.         <VALUES>
  6867.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="frsk"></REGVALUE>
  6868.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="PGStub.exe"></REGVALUE>
  6869.         </VALUES>
  6870.     </REGISTRY>
  6871. <DANGER_LEVEL>1</DANGER_LEVEL>
  6872. <DESCRIPTION>Changes your Internet Explorer settings</DESCRIPTION>
  6873. </SW>
  6874. <SW NAME="Worm.MsBlast.A">
  6875.     <DIRECTORIES>
  6876.     </DIRECTORIES>
  6877.     <FILES>
  6878.         <FILE NAME="MSBLAST.EXE" PATH="SysDir"></FILE>
  6879.         <FILE NAME="MSBLAST.EXE" PATH="Sys32Dir"></FILE>
  6880.     </FILES>
  6881.     <COOKIES>
  6882.     </COOKIES>
  6883.     <REGISTRY>
  6884.        <KEYS>
  6885.        </KEYS>
  6886.        <VALUES>
  6887.        </VALUES>
  6888.     </REGISTRY>
  6889. <DANGER_LEVEL>1</DANGER_LEVEL>
  6890. <DESCRIPTION>MSblaster worm widely spread through networks on the internet</DESCRIPTION>
  6891. </SW>
  6892. <SW NAME="CleverIEHooker.Jeired/Jeired">
  6893.         <DIRECTORIES>
  6894.         </DIRECTORIES>
  6895.     <FILES>
  6896.          <FILE NAME="jeired.dll" PATH="WinDir"></FILE>
  6897.     </FILES>
  6898.     <COOKIES>
  6899.     </COOKIES>
  6900.     <REGISTRY>
  6901.        <KEYS>
  6902.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{707e6f76-9ffb-4920-a976-ea101271bc25}"></REGKEY>
  6903.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{707e6f76-9ffb-4920-a976-ea101271bc25}"></REGKEY>
  6904.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\typelib" VALUE="{707e6f76-9ffb-4920-a976-ea101271bc25}"></REGKEY>
  6905.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="interface" VALUE="{707e6f76-9ffb-4920-a976-ea101271bc25}"></REGKEY>
  6906.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{707e6f76-9ffb-4920-a976-ea101271bc25}"></REGKEY>
  6907.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{707e6f76-9ffb-4920-a976-ea101271bc25}"></REGKEY>
  6908.        </KEYS>
  6909.        <VALUES>
  6910.        </VALUES>
  6911.     </REGISTRY>
  6912. <DANGER_LEVEL>1</DANGER_LEVEL>
  6913. <DESCRIPTION>Browser Hijacker that changes your Internet Explorer settings</DESCRIPTION>
  6914. </SW>
  6915. <SW NAME="NetRatings Premeter">
  6916.     <DIRECTORIES>
  6917.        <DIR NAME="netratings" PATH="PFDir"></DIR>
  6918.     </DIRECTORIES>
  6919.     <FILES>
  6920.         <FILE NAME="nmtracer.dll" PATH="Sys32Dir"></FILE>
  6921.          <FILE NAME="NetMeter.exe" PATH="PFDir\\netratings\\netmeter"></FILE>
  6922.          <FILE NAME="prmt.exe" PATH=""></FILE>
  6923.         <FILE NAME="nrpr.exe" PATH="PFDir\\netratings\\premeter"></FILE>
  6924.     </FILES>
  6925.     <COOKIES>
  6926.     </COOKIES>
  6927.     <REGISTRY>
  6928.         <KEYS>
  6929.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall" VALUE="premeter"></REGKEY>
  6930.         </KEYS>
  6931.         <VALUES>
  6932.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="netmeter"></REGVALUE>
  6933.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="premeter"></REGVALUE>
  6934.         </VALUES>
  6935.     </REGISTRY>
  6936. <DANGER_LEVEL>1</DANGER_LEVEL>
  6937. <DESCRIPTION>Tracks internet usage and other statistics and sends them to a central server</DESCRIPTION>
  6938. </SW>
  6939. <SW NAME="AdRoar">
  6940.     <DIRECTORIES>
  6941.     </DIRECTORIES>
  6942.     <FILES>
  6943.        <FILE NAME="cpruninst.exe" PATH="WinDir"></FILE>
  6944.        <FILE NAME="Cpr.dll" PATH="SysDir"></FILE>
  6945.        <FILE NAME="ADROAR.DLL" PATH="Sys32Dir"></FILE>
  6946.        <FILE NAME="ADROAR.DLL" PATH="SysDir"></FILE>
  6947.        <FILE NAME="Cpr.dll" PATH="Sys32Dir"></FILE>
  6948.        <FILE NAME="ARUpdate.exe" PATH="WinDir"></FILE>
  6949.        <FILE NAME="ADROAR.DLL" PATH="WinDir"></FILE>
  6950.     </FILES>
  6951.     <COOKIES>
  6952.     </COOKIES>
  6953.     <REGISTRY>
  6954.         <KEYS>
  6955.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{FAC6E0E1-5D45-4907-BC00-302D702DCC73}"></REGKEY>
  6956.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{BDF6CE3D-F5C5-4462-9814-3C8EAC330CA8}"></REGKEY>
  6957.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\BrowserHelperObjects" VALUE="{FAC6E0E1-5D45-4907-BC00-302D702DCC73}"></REGKEY>
  6958.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\BrowserHelperObjects" VALUE="{BDF6CE3D-F5C5-4462-9814-3C8EAC330CA8}"></REGKEY>
  6959.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\InternetExplorer\\Toolbar" VALUE="{BDF6CE3D-F5C5-4462-9814-3C8EAC330CA8}"></REGKEY>
  6960.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\InternetExplorer\\Toolbar\\WebBrowser" VALUE="{BDF6CE3D-F5C5-4462-9814-3C8EAC330CA8}"></REGKEY>
  6961.         </KEYS>
  6962.         <VALUES>
  6963.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\InternetExplorer\\Toolbar" VALUE="{BDF6CE3D-F5C5-4462-9814-3C8EAC330CA8}"></REGVALUE>
  6964.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="AdRoarUpdate"></REGVALUE>
  6965.         </VALUES>
  6966.     </REGISTRY>
  6967. <DANGER_LEVEL>1</DANGER_LEVEL>
  6968. <DESCRIPTION>Browser Helper Object used to display advertisements on your PC</DESCRIPTION>
  6969. </SW>
  6970. <SW NAME="WebSearch Toolbar.bho1/WebSearch Toolbar.bho2">  
  6971.     <DIRECTORIES>
  6972.     </DIRECTORIES>
  6973.     <FILES>
  6974.     </FILES> 
  6975.     <COOKIES>
  6976.     </COOKIES>
  6977.     <REGISTRY>
  6978.         <KEYS>
  6979.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{07B18EA1-A523-4961-B6BB-170DE4475CCA}"></REGKEY>
  6980.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{00A6FAF1-072E-44cf-8957-5838F569A31D}"></REGKEY>
  6981.         </KEYS>
  6982.         <VALUES>
  6983.         </VALUES>
  6984.     </REGISTRY>
  6985. <DANGER_LEVEL>1</DANGER_LEVEL>
  6986. <DESCRIPTION>Variant of Websearch, used to alter your internet explorer settings.</DESCRIPTION>
  6987. </SW>
  6988. <SW NAME="SearchWWW">
  6989.      <DIRECTORIES>
  6990.      </DIRECTORIES>
  6991.      <FILES>
  6992.          <FILE NAME="ietoolbar.dll" PATH="Sys32Dir"></FILE>
  6993.          <FILE NAME="ietoolbar.htm" PATH="Sys32Dir"></FILE>
  6994.      </FILES>
  6995.      <COOKIES>
  6996.      </COOKIES>
  6997.      <REGISTRY>
  6998.          <KEYS>
  6999.         </KEYS>
  7000.          <VALUES>
  7001.          </VALUES>
  7002.      </REGISTRY>
  7003.  <DANGER_LEVEL>1</DANGER_LEVEL>
  7004.  <DESCRIPTION>SearchWWW is an internet explorer toolbar and homepage hijacker</DESCRIPTION>
  7005.  </SW>
  7006. <SW NAME="SearchScout Toolbar">
  7007.      <DIRECTORIES>
  7008.      </DIRECTORIES>
  7009.      <FILES>
  7010.          <FILE NAME="SearchScoutToolbar.dll" PATH="SysDir"></FILE>
  7011.          <FILE NAME="SearchScoutToolbar.dll" PATH="Sys32Dir"></FILE>
  7012.      </FILES>
  7013.      <COOKIES>
  7014.      </COOKIES>
  7015.      <REGISTRY>
  7016.          <KEYS>
  7017.          </KEYS>
  7018.          <VALUES>
  7019.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{fd7d6851-616e-48de-af55-ee2e34f389b0}"></REGVALUE>
  7020.          </VALUES>
  7021.      </REGISTRY>
  7022. <DANGER_LEVEL>1</DANGER_LEVEL>
  7023. <DESCRIPTION>Internet Explorer toolbar that bundles other adware as well</DESCRIPTION>
  7024. </SW>
  7025. <SW NAME="Searchspace Hijacker">
  7026.      <FILES>
  7027.          <FILE NAME="NavExt.dll" PATH="WinDir"></FILE>
  7028.       </FILES>
  7029.      <REGISTRY>
  7030.          <KEYS>
  7031.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\explorer\\browser helper objects" VALUE="{00110011-4b0b-44d5-9718-90c88817369b}"></REGKEY>
  7032.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{00110011-4b0b-44d5-9718-90c88817369b}"></REGKEY>
  7033.           </KEYS>
  7034.      </REGISTRY>
  7035. <DANGER_LEVEL>1</DANGER_LEVEL>
  7036. <DESCRIPTION>Hijacks your internet settings and points them to search-space.com</DESCRIPTION>
  7037. </SW>
  7038. <SW NAME="CoolWebSearch/IEfeats">
  7039.     <DIRECTORIES>
  7040.        <DIR NAME="msinfo" PATH="PFDir\\common files"></DIR>
  7041.        <DIR NAME="iefeatsl" PATH="ProfilePath\\application data"></DIR>
  7042.     </DIRECTORIES>
  7043.     <FILES>
  7044.           <FILE NAME="AddClass.exe" PATH="WinDir"></FILE>
  7045.        <FILE NAME="dnsrelay.dll" PATH="SysDir"></FILE>
  7046.        <FILE NAME="ld.exe" PATH="WinDir"></FILE>
  7047.        <FILE NAME="msinfo.exe" PATH="PFDir\\common files\\microsoft shared\\msinfo"></FILE>
  7048.        <FILE NAME="bootconf.exe" PATH="SysDir"></FILE>
  7049.        <FILE NAME="svchost32.exe" PATH="SysDir"></FILE>
  7050.        <FILE NAME="oemsysinf.pnp" PATH="WinDir\\inf"></FILE>
  7051.        <FILE NAME="msspi.dll" PATH="SysDir"></FILE>
  7052.        <FILE NAME="mupdate.exe" PATH="SysDir"></FILE>
  7053.        <FILE NAME="tapicfg.exe" PATH="Sys32Dir"></FILE>
  7054.        <FILE NAME="AddClass.exe" PATH="WinDir\\temp"></FILE>
  7055.        <FILE NAME="ctfmon32.exe" PATH="SysDir"></FILE>
  7056.        <FILE NAME="svcinit.exe" PATH="Sys32Dir"></FILE>
  7057.        <FILE NAME="svcinit.exe" PATH="SysDir"></FILE>
  7058.        <FILE NAME="dreplace.dll" PATH="SysDir"></FILE>
  7059.        <FILE NAME="dreplace.dll" PATH="Sys32Dir"></FILE>
  7060.        <FILE NAME="dnsrelay.dll" PATH="Sys32Dir"></FILE>
  7061.        <FILE NAME="mupdate.exe" PATH="Sys32Dir"></FILE>
  7062.        <FILE NAME="bootconf.exe" PATH="Sys32Dir"></FILE>
  7063.        <FILE NAME="svchost32.exe" PATH="Sys32Dir"></FILE>
  7064.        <FILE NAME="iefeatsl.dll" PATH="ProfilePath\\application data\\iefeatsl"></FILE>
  7065.        <FILE NAME="msspi.dll" PATH="Sys32Dir"></FILE>
  7066.        <FILE NAME="iefeatsl.dll" PATH="SysDir"></FILE>
  7067.        <FILE NAME="msiesh.dll" PATH="SysDir"></FILE>
  7068.        <FILE NAME="msiesh.dll" PATH="ProfilePath\\application data\\iefeatsl"></FILE>
  7069.        <FILE NAME="msiesh.dll" PATH="ProfilePath\\application data\\systh"></FILE>
  7070.        <FILE NAME="msiesh.dll" PATH="ProfilePath\\application data\\sysxd"></FILE>
  7071.        <FILE NAME="msiesh.dll" PATH="ProfilePath\\application data\\winzf"></FILE>
  7072.        <FILE NAME="msiesh.dll" PATH="ProfilePath\\application data\\sysgy"></FILE>
  7073.        <FILE NAME="iefeatsl.dll" PATH="Sys32Dir"></FILE>
  7074.        <FILE NAME="msiesh.dll" PATH="Sys32Dir"></FILE>
  7075.        <FILE NAME="ctfmon32.exe" PATH="Sys32Dir"></FILE>
  7076.        <FILE NAME="iedll.exe" PATH="WinDir"></FILE>
  7077.        <FILE NAME="loader.exe" PATH="WinDir"></FILE>
  7078.        <FILE NAME="oslogo.bmp" PATH="WinDir\\Web"></FILE>
  7079.        <FILE NAME="default.css" PATH="WinDir"></FILE>
  7080.        <FILE NAME="fntldr.exe" PATH=""></FILE>
  7081.     </FILES>
  7082.     <COOKIES>
  7083.     </COOKIES>
  7084.     <REGISTRY>
  7085.         <KEYS>
  7086.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1}"></REGKEY>
  7087.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{587DBF2D-9145-4c9e-92C2-1F953DA73773}"></REGKEY>
  7088.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{FD9BC004-8331-4457-B830-4759FF704C22}"></REGKEY>
  7089.                  <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{17DA0C9E-4A27-4ac5-BB75-5D24B8CDB972}"></REGKEY> 
  7090.                  <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{17DA0C9E-4A27-4ac5-BB75-5D24B8CDB972}"></REGKEY>
  7091.         </KEYS>
  7092.         <VALUES>
  7093.               <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="msupdate"></REGVALUE>
  7094.               <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="bootconf.exe"></REGVALUE>
  7095.               <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="svchost.exe"></REGVALUE>
  7096.               <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="SysPnP"></REGVALUE>
  7097.                <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="AddClass"></REGVALUE>
  7098.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{086AE192-23A6-48D6-96EC-715F53797E85}"></REGKEY>
  7099.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="QuickTime Task"></REGVALUE>
  7100.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="iedll"></REGVALUE>
  7101.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="loader"></REGVALUE>
  7102.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="ctfmon32.exe"></REGVALUE>
  7103.         </VALUES>
  7104.     </REGISTRY>
  7105. <DANGER_LEVEL>2</DANGER_LEVEL>
  7106. <DESCRIPTION>Wide range of different browser hijackers</DESCRIPTION>
  7107. </SW>
  7108. <SW NAME="NJStar Asian Explorer">
  7109.     <DIRECTORIES>
  7110.     </DIRECTORIES>
  7111.     <FILES>
  7112.         <FILE NAME="etop100.dll" PATH="SysDir"></FILE>
  7113.         <FILE NAME="etop100.dll" PATH="Sys32Dir"></FILE>
  7114.     </FILES>
  7115.     <COOKIES>
  7116.     </COOKIES>
  7117.     <REGISTRY>
  7118.        <KEYS>
  7119.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{1E1B2879-30C7-11D4-8DDF-525400E483E3}"></REGKEY> 
  7120.        </KEYS>
  7121.        <VALUES>
  7122.        </VALUES>
  7123.     </REGISTRY>
  7124. <DANGER_LEVEL>1</DANGER_LEVEL>
  7125. <DESCRIPTION>NJStar Asian Explorer is a Browser Helper Object.  It is known to slow down your PC.</DESCRIPTION>
  7126. </SW>
  7127. <SW NAME="CoolWebSearch.soundmx">
  7128.     <DIRECTORIES>
  7129.     </DIRECTORIES>
  7130.     <FILES>
  7131.         <FILE NAME="soundmx.exe" PATH="SysDir"></FILE>
  7132.         <FILE NAME="soundmx.exe" PATH="Sys32Dir"></FILE>
  7133.     </FILES>
  7134.     <COOKIES>
  7135.     </COOKIES>
  7136.     <REGISTRY>
  7137.        <KEYS>
  7138.        </KEYS>
  7139.        <VALUES>
  7140.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Soundmx"></REGVALUE>
  7141.        </VALUES>
  7142.     </REGISTRY>
  7143. <DANGER_LEVEL>1</DANGER_LEVEL>
  7144. <DESCRIPTION>Browser Hijacker related to CoolWebsearch</DESCRIPTION>
  7145. </SW>
  7146. <SW NAME="Migmaf Worm">  
  7147.     <DIRECTORIES>
  7148.     </DIRECTORIES>
  7149.     <FILES>
  7150.         <FILE NAME="wingate.exe" PATH="Sys32Dir"></FILE>
  7151.     </FILES>
  7152.     <COOKIES>
  7153.     </COOKIES>
  7154.     <REGISTRY>
  7155.         <KEYS>
  7156.         </KEYS>
  7157.         <VALUES>
  7158.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Login Service"></REGVALUE>
  7159.         </VALUES>
  7160.     </REGISTRY>
  7161. <DANGER_LEVEL>2</DANGER_LEVEL>
  7162. <DESCRIPTION>Worm that allows use of your machine for devious purposes, including sending spam email</DESCRIPTION>
  7163. </SW>
  7164. <SW NAME="W32/Netsky.c@MM/WinLogonEXE">
  7165.     <DIRECTORIES>
  7166.     </DIRECTORIES>
  7167.     <FILES>
  7168.         <FILE NAME="winlogon.exe" PATH="WinDir"></FILE>
  7169.     </FILES>
  7170.     <COOKIES>
  7171.     </COOKIES>
  7172.     <REGISTRY>
  7173.         <KEYS>
  7174.         </KEYS>
  7175.         <VALUES>
  7176.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="winlogon"></REGVALUE>
  7177.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="ICQ NET"></REGVALUE>
  7178.         </VALUES>
  7179.     </REGISTRY>
  7180. <DANGER_LEVEL>2</DANGER_LEVEL>
  7181. <DESCRIPTION>Netsky worm that is spread through email and attempts to spread itself using your PC</DESCRIPTION>
  7182. </SW>
  7183. <SW NAME="AutoSearch">
  7184.     <DIRECTORIES>
  7185.     </DIRECTORIES>
  7186.     <FILES>
  7187.        <FILE NAME="safesearch.dll" PATH="SysDir"></FILE> 
  7188.        <FILE NAME="safesearch.dll" PATH="Sys32Dir"></FILE>
  7189.        <FILE NAME="msinfosys.dll" PATH="Sys32Dir"></FILE>
  7190.        <FILE NAME="msinfosys.dll" PATH="SysDir"></FILE>
  7191.     </FILES>
  7192.     <COOKIES>
  7193.         </COOKIES>
  7194.     <REGISTRY>
  7195.        <KEYS>
  7196.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{00000000-0000-0000-0000-000000000001}"></REGKEY>
  7197.        </KEYS>
  7198.        <VALUES>
  7199.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{00000000-0000-0000-0000-000000000001}"></REGVALUE>
  7200.        </VALUES>
  7201.     </REGISTRY>
  7202. <DANGER_LEVEL>1</DANGER_LEVEL>
  7203. <DESCRIPTION>Hijacks address bar searches to partnered websites</DESCRIPTION>
  7204. </SW>
  7205. <SW NAME="Aornum">
  7206.     <DIRECTORIES>
  7207.        <DIR NAME="Ornum" PATH="PFDir"></DIR>
  7208.     </DIRECTORIES>
  7209.     <FILES>
  7210.         <FILE NAME="IWONBAR.DLL" PATH="PFDir\\iwon\\iwonbar\\1.bin"></FILE>
  7211.          <FILE NAME="I1SRCHAS.DLL" PATH="SysDir"></FILE>
  7212.         <FILE NAME="I1SRCHAS.DLL" PATH="Sys32Dir"></FILE>
  7213.         <FILE NAME="IWONBAR.DLL" PATH="SysDir"></FILE>
  7214.         <FILE NAME="IWONBAR.DLL" PATH="Sys32Dir"></FILE>
  7215.         <FILE NAME="aornum.exe" PATH="PFDir\\ornum"></FILE>
  7216.     </FILES>
  7217.     <COOKIES>
  7218.     </COOKIES>
  7219.     <REGISTRY>
  7220.        <KEYS>
  7221.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{08E1C8E1-E565-44fc-A766-C9539BB3ABB7}"></REGKEY>
  7222.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{C298FB42-E3E2-11D3-ADCD-0050DAC24E8F}"></REGKEY>
  7223.        </KEYS>
  7224.        <VALUES>
  7225.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Aornum"></REGVALUE>
  7226.        </VALUES>
  7227.     </REGISTRY>
  7228. <DANGER_LEVEL>1</DANGER_LEVEL>
  7229. <DESCRIPTION>Delivers ads to your PC in the form of popup ads</DESCRIPTION>
  7230. </SW>
  7231. <SW NAME="AIM updater/Outwar">
  7232.     <DIRECTORIES>
  7233.     </DIRECTORIES>
  7234.     <FILES>
  7235.         <FILE NAME="mxbovtg.dll" PATH="SysDir"></FILE>
  7236.         <FILE NAME="bi.dll" PATH="SysDir"></FILE>
  7237.         <FILE NAME="url.txt" PATH="SysDir"></FILE>
  7238.         <FILE NAME="0.log" PATH="SysDir"></FILE>
  7239.         <FILE NAME="biprep.exe" PATH="SysDir"></FILE>
  7240.         <FILE NAME="av.exe" PATH="SysDir"></FILE>
  7241.         <FILE NAME="bbb.exe" PATH="SysDir"></FILE>
  7242.         <FILE NAME="bi.exe" PATH="SysDir"></FILE>
  7243.         <FILE NAME="cdt_bbi8016.exe" PATH="SysDir"></FILE>
  7244.         <FILE NAME="cnbabeie.exe" PATH="SysDir"></FILE>
  7245.         <FILE NAME="ejfymsqx.exe" PATH="SysDir"></FILE>
  7246.         <FILE NAME="av.exe" PATH="c:\\"></FILE>
  7247.         <FILE NAME="syslaunch.exe" PATH="PFDir"></FILE>
  7248.         <FILE NAME="msgcenter_lminv1.exe" PATH="SysDir"></FILE>
  7249.         <FILE NAME="winfavorites.exe" PATH="SysDir"></FILE>
  7250.         <FILE NAME="randomiser.exe" PATH="Sys32Dir"></FILE>
  7251.     </FILES>
  7252.     <COOKIES>
  7253.     </COOKIES>
  7254.     <REGISTRY>
  7255.         <KEYS>
  7256.         </KEYS>
  7257.         <VALUES>
  7258.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="QISUNBZ"></REGVALUE>
  7259.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="cyytqgax"></REGVALUE>
  7260.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="iehelper"></REGVALUE>
  7261.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Outwar"></REGVALUE>        
  7262.         </VALUES>
  7263.     </REGISTRY>
  7264. <DANGER_LEVEL>1</DANGER_LEVEL>
  7265. <DESCRIPTION>Hijacker of AOL profiles, provides no uninstall</DESCRIPTION>
  7266. </SW>
  7267. <SW NAME="NETObserve">
  7268.     <DIRECTORIES>
  7269.     </DIRECTORIES>
  7270.     <FILES>
  7271.           <FILE NAME="netobserve.exe" PATH="PFDir\\exploreanywhere\\netobserve"></FILE>
  7272.     </FILES>
  7273.     <COOKIES>
  7274.     </COOKIES>
  7275.     <REGISTRY>
  7276.         <KEYS>
  7277.         </KEYS>
  7278.         <VALUES>
  7279.         </VALUES>
  7280.     </REGISTRY>
  7281. <DANGER_LEVEL>1</DANGER_LEVEL>
  7282. <DESCRIPTION>Allows someone to monitor all actions performed on your PC</DESCRIPTION>
  7283. </SW>
  7284. <SW NAME="ISpyNow">
  7285.     <DIRECTORIES>
  7286.           <DIR NAME="iSpyNOW" PATH="PFDir"></DIR>
  7287.     </DIRECTORIES>
  7288.     <FILES>
  7289.           <FILE NAME="ispynow.exe" PATH="PFDir\\iSpyNOW"></FILE>
  7290.     </FILES>
  7291.     <COOKIES>
  7292.     </COOKIES>
  7293.     <REGISTRY>
  7294.         <KEYS>
  7295.         </KEYS>
  7296.         <VALUES>
  7297.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="iSpyNOW"></REGVALUE>
  7298.         </VALUES>
  7299.     </REGISTRY>
  7300. <DANGER_LEVEL>1</DANGER_LEVEL>
  7301. <DESCRIPTION>Allows someone to monitor all actions performed on your PC</DESCRIPTION>
  7302. </SW>
  7303. <SW NAME="Backdoor.AcidBattery">
  7304.     <DIRECTORIES>
  7305.     </DIRECTORIES>
  7306.     <FILES>
  7307.         <FILE NAME="acid.exe" PATH="WinDir"></FILE>
  7308.     </FILES>
  7309.     <COOKIES>
  7310.     </COOKIES>
  7311.     <REGISTRY>
  7312.         <KEYS>
  7313.         </KEYS>
  7314.         <VALUES>
  7315.         </VALUES>
  7316.     </REGISTRY>
  7317. <DANGER_LEVEL>2</DANGER_LEVEL>
  7318. <DESCRIPTION>Backdoor program used by hackers to control your PC.</DESCRIPTION>
  7319. </SW>
  7320. <SW NAME="Backdoor.IRC.Tastyred">  
  7321.      <DIRECTORIES>
  7322.      </DIRECTORIES>
  7323.      <FILES>
  7324.          <FILE NAME="metalrock.exe" PATH="SysDir"></FILE>
  7325.          <FILE NAME="metalrock.exe" PATH="Sys32Dir"></FILE>
  7326.        </FILES>
  7327.      <COOKIES>
  7328.      </COOKIES>
  7329.      <REGISTRY>
  7330.          <KEYS>
  7331.          </KEYS>
  7332.          <VALUES>
  7333.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Windows MeTaLRoCk service"></REGVALUE>
  7334.          </VALUES>
  7335.      </REGISTRY>
  7336.  <DANGER_LEVEL>2</DANGER_LEVEL>
  7337.  <DESCRIPTION>Worm that allows hackers unauthorized access to your PC.</DESCRIPTION>
  7338. </SW>
  7339. <SW NAME="Malpayo backdoor">  
  7340.     <DIRECTORIES>
  7341.     </DIRECTORIES>
  7342.     <FILES>
  7343.         <FILE NAME="sys.exe" PATH="SysDir"></FILE>
  7344.         <FILE NAME="sys.exe" PATH="Sys32Dir"></FILE>
  7345.     </FILES>
  7346.     <COOKIES>
  7347.     </COOKIES>
  7348.     <REGISTRY>
  7349.         <KEYS>
  7350.         </KEYS>
  7351.         <VALUES>
  7352.         </VALUES>
  7353.     </REGISTRY>
  7354. <DANGER_LEVEL>2</DANGER_LEVEL>
  7355. <DESCRIPTION>Worm that allows hackers unauthorized access to your PC.</DESCRIPTION>
  7356. </SW>
  7357. <SW NAME="Backdoor.Jeem">  
  7358.      <DIRECTORIES>
  7359.      </DIRECTORIES>
  7360.      <FILES>
  7361.          <FILE NAME="msrexe.exe" PATH="SysDir"></FILE>
  7362.          <FILE NAME="msrexe.exe" PATH="Sys32Dir"></FILE>
  7363.        </FILES>
  7364.      <COOKIES>
  7365.      </COOKIES>
  7366.      <REGISTRY>
  7367.          <KEYS>
  7368.          </KEYS>
  7369.          <VALUES>
  7370.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="System Service"></REGVALUE>
  7371.          </VALUES>
  7372.      </REGISTRY>
  7373.  <DANGER_LEVEL>2</DANGER_LEVEL>
  7374.  <DESCRIPTION>Worm that allows hackers unauthorized access to your PC.</DESCRIPTION>
  7375. </SW> 
  7376. <SW NAME="Backdoor.Lithium.103">
  7377.     <DIRECTORIES>
  7378.     </DIRECTORIES>
  7379.     <FILES>
  7380.         <FILE NAME="Shell32.exe" PATH="WinDir"></FILE>
  7381.     </FILES>
  7382.     <COOKIES>
  7383.     </COOKIES>
  7384.     <REGISTRY>
  7385.         <KEYS>
  7386.         </KEYS>
  7387.         <VALUES>
  7388.         </VALUES>
  7389.     </REGISTRY>
  7390. <DANGER_LEVEL>2</DANGER_LEVEL>
  7391. <DESCRIPTION>Worm that allows hackers unauthorized access to your PC.</DESCRIPTION>
  7392. </SW>
  7393. <SW NAME="Backdoor.Sdbot.F">  
  7394.        <DIRECTORIES>
  7395.        </DIRECTORIES>
  7396.        <FILES>
  7397.            <FILE NAME="RunDll16.exe" PATH="WinDir"></FILE>
  7398.            <FILE NAME="RunDll16.exe" PATH="SysDir"></FILE>
  7399.         <FILE NAME="RunDll16.exe" PATH="Sys32Dir"></FILE>
  7400.        </FILES>
  7401.        <COOKIES>
  7402.        </COOKIES>
  7403.        <REGISTRY>
  7404.            <KEYS>
  7405.            </KEYS>
  7406.            <VALUES>
  7407.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="RDLL"></REGVALUE>
  7408.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="RDLL"></REGVALUE>
  7409.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{85C2C2A1-3F20-4EAD-ADC3-BD3217391543}"></REGVALUE>
  7410.            </VALUES>
  7411.        </REGISTRY>
  7412. <DANGER_LEVEL>2</DANGER_LEVEL>
  7413. <DESCRIPTION>Backdoor Trojan that allows maliicious people direct access to your PC</DESCRIPTION>
  7414. </SW>
  7415. <SW NAME="Backdoor.Cabro">  
  7416.     <DIRECTORIES>
  7417.     </DIRECTORIES>
  7418.     <FILES>
  7419.         <FILE NAME="ASDAPI.exe" PATH="WinDir"></FILE>
  7420.     </FILES>
  7421.     <COOKIES>
  7422.     </COOKIES>
  7423.     <REGISTRY>
  7424.         <KEYS>
  7425.             </KEYS>
  7426.         <VALUES>
  7427.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="LoadPowerProfile windir%\\ASDAPI.exe"></REGVALUE>
  7428.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="LoadPowerProfile windir%\\ASDAPI.exe"></REGVALUE>
  7429.         </VALUES>
  7430.     </REGISTRY>
  7431. <DANGER_LEVEL>2</DANGER_LEVEL>
  7432. <DESCRIPTION>Backdoor that allows unauthorized access to your PC</DESCRIPTION>
  7433. </SW>
  7434. <SW NAME="Backdoor.Sdbot.S">  
  7435.     <DIRECTORIES>
  7436.     </DIRECTORIES>
  7437.     <FILES>
  7438.         <FILE NAME="ntspcv.exe" PATH="SysDir"></FILE>
  7439.         <FILE NAME="ntspcv.exe" PATH="Sys32Dir"></FILE>
  7440.     </FILES> 
  7441.     <COOKIES>
  7442.     </COOKIES>
  7443.     <REGISTRY>
  7444.         <KEYS>
  7445.         </KEYS>
  7446.         <VALUES>
  7447.         </VALUES>
  7448.     </REGISTRY>
  7449. <DANGER_LEVEL>2</DANGER_LEVEL>
  7450. <DESCRIPTION>Worm that allows unauthorized access to your PC</DESCRIPTION>
  7451. </SW>
  7452. <SW NAME="Backdoor.Netsnake">
  7453.      <DIRECTORIES>
  7454.      </DIRECTORIES>
  7455.      <FILES>
  7456.          <FILE NAME="internat.exe" PATH="WinDir"></FILE>
  7457.      </FILES>
  7458.      <COOKIES>
  7459.      </COOKIES>
  7460.      <REGISTRY>
  7461.         <KEYS>
  7462.         </KEYS>
  7463.         <VALUES>
  7464.                 <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Internat.exe"></REGVALUE>
  7465.         </VALUES>
  7466.      </REGISTRY>
  7467. <DANGER_LEVEL>2</DANGER_LEVEL>
  7468. <DESCRIPTION>Copies your password information and emails it to the intruder</DESCRIPTION>
  7469. </SW>
  7470. <SW NAME="Backdoor.Lixy.B">
  7471.     <DIRECTORIES>
  7472.     </DIRECTORIES>
  7473.     <FILES>
  7474.         <FILE NAME="ssocks5.dll" PATH="SysDir"></FILE>
  7475.         <FILE NAME="ssocks5.dll" PATH="Sys32Dir"></FILE>
  7476.     </FILES>
  7477.     <COOKIES>
  7478.     </COOKIES>
  7479.     <REGISTRY>
  7480.         <KEYS>
  7481.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{1e1b2879-88ff-11d2-8d96-000000000004}"></REGKEY>
  7482.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{1e1b2879-88ff-11d2-8d96-000000000004}"></REGKEY>
  7483.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="HTMLEdit.SSocks32"></REGKEY>
  7484.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="HTMLEdit.SSocks32.1"></REGKEY>
  7485.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES" VALUE="HTMLEdit.SSocks32"></REGKEY>
  7486.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\CLASSES" VALUE="HTMLEdit.SSocks32.1"></REGKEY>
  7487.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\explorer\\Browser Helper Objects" VALUE="{1E1B2879-88FF-11D2-8D96-000000000004}"></REGKEY>
  7488.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{1E1B2879-88FF-11D2-8D96-000000000003}"></REGKEY>
  7489.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\explorer\\Browser Helper Objects" VALUE="{1E1B2879-88FF-11D2-8D96-000000000003}"></REGKEY>
  7490.         </KEYS>
  7491.         <VALUES>
  7492.         </VALUES>
  7493.     </REGISTRY>
  7494. <DANGER_LEVEL>2</DANGER_LEVEL>
  7495. <DESCRIPTION>Backdoor trojan horse that allows unauthorized access to your PC</DESCRIPTION>
  7496. </SW>
  7497. <SW NAME="PowerStrip">
  7498.     <DIRECTORIES>
  7499.          <DIR NAME="Presentia" PATH="PFDir\\Common Files"></DIR>
  7500.         <DIR NAME="PowerStrip" PATH="PFDir"></DIR>
  7501.     </DIRECTORIES>
  7502.     <FILES>
  7503.           <FILE NAME="PowrStrp.dll" PATH="PFDir\\PowerStrip"></FILE>
  7504.           <FILE NAME="LTDMgr.exe" PATH="PFDir\\Common Files\\Presentia"></FILE>
  7505.           <FILE NAME="LSvr.exe" PATH="PFDir\\Common Files\\Presentia"></FILE>
  7506.           <FILE NAME="PSSetup.exe" PATH="PFDir\\Common Files\\Presentia"></FILE>
  7507.           <FILE NAME="PSOCX.DLL" PATH="PFDir\\Common Files\\Presentia"></FILE>
  7508.      </FILES>
  7509.     <COOKIES>
  7510.     </COOKIES>
  7511.     <REGISTRY>
  7512.         <KEYS>
  7513.         </KEYS>
  7514.         <VALUES>
  7515.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="LSvr"></REGVALUE>
  7516.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="LTDMgr"></REGVALUE>
  7517.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="PSSetup"></REGVALUE>
  7518.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="PowerStrip"></REGVALUE>
  7519.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE " SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="LTDMgr"></REGVALUE>
  7520.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE " SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="PSSetup"></REGVALUE>
  7521.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE " SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="LSvr"></REGVALUE>
  7522.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{669695BC-A811-4A9D-8CDF-BA8C795F261C}"></REGVALUE>
  7523.         </VALUES>
  7524.     </REGISTRY>
  7525. <DANGER_LEVEL>1</DANGER_LEVEL>
  7526. <DESCRIPTION>Internet toolbar with a search box and some sponsored links</DESCRIPTION>
  7527. </SW>
  7528. <SW NAME="SearchSeekFind">
  7529.     <DIRECTORIES>
  7530.     </DIRECTORIES>
  7531.     <FILES>
  7532.           <FILE NAME="Sysreg.exe" PATH="SysDir"></FILE>
  7533.           <FILE NAME="Sysreg.exe" PATH="Sys32Dir"></FILE>
  7534.           <FILE NAME="OWMngr.exe" PATH="Sys32Dir"></FILE>
  7535.     </FILES>
  7536.     <COOKIES>
  7537.     </COOKIES>
  7538.     <REGISTRY>
  7539.         <KEYS>
  7540.         </KEYS>
  7541.         <VALUES>
  7542.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Sysreg"></REGVALUE>
  7543.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="OWMngr"></REGVALUE>
  7544.         </VALUES>
  7545.     </REGISTRY>
  7546. <DANGER_LEVEL>1</DANGER_LEVEL>
  7547. <DESCRIPTION>Updates itself to keep your PC infected with adware/spyware</DESCRIPTION>
  7548. </SW>
  7549. <SW NAME="WebMail Spy">
  7550.     <DIRECTORIES>
  7551.     </DIRECTORIES>
  7552.     <FILES>
  7553.           <FILE NAME="webmailspy.exe" PATH="PFDir\\exploreanywhere\\webmail spy"></FILE>
  7554.     </FILES>
  7555.     <COOKIES>
  7556.     </COOKIES>
  7557.     <REGISTRY>
  7558.         <KEYS>
  7559.         </KEYS>
  7560.         <VALUES>
  7561.         </VALUES>
  7562.     </REGISTRY>
  7563. <DANGER_LEVEL>1</DANGER_LEVEL>
  7564. <DESCRIPTION>Claims to be "award winning" software that will record all web based email</DESCRIPTION>
  7565. </SW>
  7566. <SW NAME="WinLocator/WinLocatorHelper.dll">
  7567.     <DIRECTORIES>
  7568.     </DIRECTORIES>
  7569.     <FILES>
  7570.           <FILE NAME="winlocator.dll" PATH="SysDir"></FILE>
  7571.           <FILE NAME="winlocator.dll" PATH="Sys32Dir"></FILE>
  7572.           <FILE NAME="winlocatorhelper.dll" PATH="SysDir"></FILE>
  7573.           <FILE NAME="winlocatorhelper.dll" PATH="Sys32Dir"></FILE>
  7574.           <FILE NAME="updatewinlocator.exe" PATH="SysDir"></FILE>
  7575.           <FILE NAME="updatewinlocator.exe" PATH="Sys32Dir"></FILE>
  7576.           <FILE NAME="updatewinlocator.exe" PATH="WinDir"></FILE>
  7577.     </FILES>
  7578.     <COOKIES>
  7579.     </COOKIES>
  7580.     <REGISTRY>
  7581.         <KEYS>
  7582.                 <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{89aeab46-8e8a-4045-9003-5614bfbfe90b}"></REGKEY>
  7583.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{89AEAB46-8E8A-4045-9003-5614BFBFE90B}"></REGKEY>
  7584.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{89AEAB46-8E8A-4045-9003-5614BFBFE90B}"></REGKEY>
  7585.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved" VALUE="{89AEAB46-8E8A-4045-9003-5614BFBFE90B}"></REGKEY>
  7586.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{8F0D6EED-BC11-4E7F-8276-9748947E4A50}"></REGKEY>
  7587.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved" VALUE="{8F0D6EED-BC11-4E7F-8276-9748947E4A50}"></REGKEY>
  7588.         </KEYS>
  7589.         <VALUES>
  7590.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{8F0D6EED-BC11-4E7F-8276-9748947E4A50}"></REGVALUE>
  7591.         </VALUES>
  7592.     </REGISTRY>
  7593. <DANGER_LEVEL>2</DANGER_LEVEL>
  7594. <DESCRIPTION>Search toolbar with pornographic content</DESCRIPTION>
  7595. </SW>
  7596. <SW NAME="ClientMan.MSMC">
  7597.     <DIRECTORIES>
  7598.     </DIRECTORIES>
  7599.     <FILES>
  7600.           <FILE NAME="msccof.exe" PATH="Sys32Dir"></FILE>
  7601.           <FILE NAME="mscpbo.exe" PATH="Sys32Dir"></FILE>
  7602.           <FILE NAME="msgdmf.exe" PATH="Sys32Dir"></FILE>
  7603.           <FILE NAME="msccof.exe" PATH="SysDir"></FILE>
  7604.           <FILE NAME="mscpbo.exe" PATH="SysDir"></FILE>
  7605.           <FILE NAME="msgdmf.exe" PATH="SysDir"></FILE>
  7606.     </FILES>
  7607.     <COOKIES>
  7608.     </COOKIES>
  7609.     <REGISTRY>
  7610.         <KEYS>
  7611.         </KEYS>
  7612.         <VALUES>
  7613.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="msmc"></REGVALUE>
  7614.         </VALUES>
  7615.     </REGISTRY>
  7616. <DANGER_LEVEL>1</DANGER_LEVEL>
  7617. <DESCRIPTION>Clientman is a widespread advertising parasite used to deliver advertisements to your PC</DESCRIPTION>
  7618. </SW>
  7619. <SW NAME="e-Group">
  7620.     <DIRECTORIES>
  7621.     </DIRECTORIES>
  7622.     <FILES>
  7623.        <FILE NAME="egdial.dll" PATH="SysDir"></FILE>
  7624.        <FILE NAME="egdial.dll" PATH="Sys32Dir"></FILE>
  7625.        <FILE NAME="eghtmldialer.dll" PATH="Sys32Dir"></FILE>
  7626.        <FILE NAME="eghtmldialer.dll" PATH="SysDir"></FILE>
  7627.        <FILE NAME="egdhtml_1019.dll" PATH="Sys32`Dir"></FILE>
  7628.     </FILES>
  7629.     <COOKIES>
  7630.     </COOKIES>
  7631.     <REGISTRY>
  7632.     <KEYS>
  7633.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\code store database\\distribution units" VALUE="{94742e3f-d9a1-4780-9a87-2ffa43655da2}"></REGKEY>
  7634.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{486E48B5-ABF2-42BB-A327-2679DF3FB822}"></REGKEY>
  7635.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\code store database\\distribution units" VALUE="{486E48B5-ABF2-42BB-A327-2679DF3FB822}"></REGKEY>
  7636.     </KEYS>
  7637.     <VALUES>
  7638.     </VALUES>
  7639.     </REGISTRY>
  7640. <DANGER_LEVEL>1</DANGER_LEVEL>
  7641. <DESCRIPTION>Delivers popup ads to your PC</DESCRIPTION>
  7642. </SW>
  7643. <SW NAME="ClipGenie">
  7644.     <DIRECTORIES>
  7645.        <DIR NAME="ClipGenie" PATH="PFDir"></DIR>
  7646.     </DIRECTORIES>
  7647.     <FILES>
  7648.        <FILE NAME="cg.exe" PATH="PFDir\\ClipGenie\\v1"></FILE>
  7649.     </FILES>
  7650.     <COOKIES>
  7651.     </COOKIES>
  7652.     <REGISTRY>
  7653.     <KEYS>
  7654.         <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="ClipGenie"></REGKEY>
  7655.         <REGKEY MAIN="HKEY_LOCAL_MACHINE " SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" VALUE="ClipGenie"></REGKEY>
  7656.     </KEYS>
  7657.     <VALUES>
  7658.     </VALUES>
  7659.     </REGISTRY>
  7660. <DANGER_LEVEL>1</DANGER_LEVEL>
  7661. <DESCRIPTION>Displays banner ads and usually is installed with secondary applications</DESCRIPTION>
  7662. </SW>
  7663. <SW NAME="ClientMan.2in1">
  7664.     <DIRECTORIES>
  7665.     </DIRECTORIES>
  7666.     <FILES>
  7667.         <FILE NAME="urlcli25e74486.dll" PATH="PFDir\\clientman\\run"></FILE>
  7668.         <FILE NAME="urlclia30956de.dll" PATH="PFDir\\clientman\\run"></FILE>
  7669.         <FILE NAME="trackurl5f9d991e.dll" PATH="PFDir\\clientman\\run"></FILE>
  7670.         <FILE NAME="trackurl7f663945.dll" PATH="PFDir\\clientman\\run"></FILE>
  7671.         <FILE NAME="searchrep8181a0e2.dll" PATH="PFDir\\clientman\\run"></FILE>
  7672.         <FILE NAME="searchrep6706569a.dll" PATH="PFDir\\clientman\\run"></FILE>
  7673.         <FILE NAME="msvrfy804449fd.dll" PATH="PFDir\\clientman\\run"></FILE>
  7674.         <FILE NAME="gstylebhob76a4c84.dll" PATH="PFDir\\clientman\\run"></FILE>
  7675.         <FILE NAME="dnsrepa9c22ca5.dll" PATH="PFDir\\clientman\\run"></FILE>
  7676.         <FILE NAME="2in1fd04f73f.dll" PATH="PFDir\\clientman\\run"></FILE>
  7677.     </FILES>
  7678.     <COOKIES>
  7679.     </COOKIES>
  7680.     <REGISTRY>
  7681.         <KEYS>
  7682.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="CliMan"></REGKEY>
  7683.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="iPend"></REGKEY>
  7684.        </KEYS>
  7685.         <VALUES>
  7686.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="ClientMan1"></REGVALUE>
  7687.              <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="clientman"></REGVALUE>
  7688.         </VALUES>
  7689.     </REGISTRY>
  7690. <DANGER_LEVEL>1</DANGER_LEVEL>
  7691. <DESCRIPTION>Clientman is a widespread advertising parasite used to deliver advertisements to your PC</DESCRIPTION>
  7692. </SW>
  7693. <SW NAME="MediaLoads Enhanced">
  7694.     <DIRECTORIES>
  7695.     </DIRECTORIES>
  7696.     <FILES>
  7697.         <FILE NAME="ss1.dll" PATH="PFDir\\Support Software"></FILE>
  7698.         <FILE NAME="ss2.dll" PATH="PFDir\\Support Software"></FILE>
  7699.         <FILE NAME="ME1.DLL" PATH="PFDir\\Medialoads Enhanced"></FILE>
  7700.         <FILE NAME="ME2.DLL" PATH="PFDir\\Medialoads Enhanced"></FILE>
  7701.     </FILES>
  7702.     <COOKIES>
  7703.     </COOKIES>
  7704.     <REGISTRY>
  7705.         <KEYS>
  7706.         </KEYS>
  7707.            <VALUES>
  7708.         </VALUES>
  7709.     </REGISTRY>
  7710. <DANGER_LEVEL>1</DANGER_LEVEL>
  7711. <DESCRIPTION>Monitors websites that you visit</DESCRIPTION>
  7712. </SW>
  7713. <SW NAME="ToolbarCC/Rnd">
  7714.     <DIRECTORIES>
  7715.     </DIRECTORIES>
  7716.     <FILES>
  7717.         <FILE NAME="xxxx.dll" PATH="SysDir\\temp"></FILE>
  7718.         <FILE NAME="MSS.EXE" PATH="SysDir\\temp"></FILE>
  7719.     </FILES>
  7720.     <COOKIES>
  7721.     </COOKIES>
  7722.     <REGISTRY>
  7723.         <KEYS>
  7724.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{1f48aa48-c53a-4e21-85e7-ac7cc6b5ffaf}"></REGKEY>
  7725.         </KEYS>
  7726.            <VALUES>
  7727.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="MatrixScreenSaver"></REGVALUE>
  7728.         </VALUES>
  7729.     </REGISTRY>
  7730. <DANGER_LEVEL>3</DANGER_LEVEL>
  7731. <DESCRIPTION>Steals searches and directs them to their sponsored results</DESCRIPTION>
  7732. </SW>
  7733. <SW NAME="WNAD">
  7734.     <DIRECTORIES>
  7735.     </DIRECTORIES>
  7736.     <FILES>
  7737.         <FILE NAME="wnad.exe" PATH="WinDir"></FILE>
  7738.     </FILES>
  7739.     <COOKIES>
  7740.     </COOKIES>
  7741.     <REGISTRY>
  7742.         <KEYS>
  7743.         </KEYS>
  7744.            <VALUES>
  7745.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="wnad"></REGVALUE>
  7746.         </VALUES>
  7747.     </REGISTRY>
  7748. <DANGER_LEVEL>2</DANGER_LEVEL>
  7749. <DESCRIPTION>Trojan that will multiply, as well as email people on your contact lists to infect them</DESCRIPTION>
  7750. </SW>
  7751. <SW NAME="Surfairy">
  7752.     <DIRECTORIES>
  7753.         <DIR NAME="Surfairy" PATH="PFDir"></DIR>
  7754.     </DIRECTORIES>
  7755.     <FILES>
  7756.         <FILE NAME="SurfairyHelp.dll" PATH="PFDir\\Surfairy"></FILE>
  7757.         <FILE NAME="SurfairyPP.dll" PATH="PFDir\\Surfairy"></FILE>
  7758.     </FILES>
  7759.     <COOKIES>
  7760.     </COOKIES>
  7761.     <REGISTRY>
  7762.         <KEYS>
  7763.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE" VALUE="surfairy"></REGKEY>
  7764.         </KEYS>
  7765.         <VALUES>
  7766.         </VALUES>
  7767.     </REGISTRY>
  7768. <DANGER_LEVEL>2</DANGER_LEVEL>
  7769. <DESCRIPTION>Surfairy is an error page hijacker that redirects all error traffic to their pages</DESCRIPTION>
  7770. </SW>
  7771. <SW NAME="Aconti">
  7772.     <DIRECTORIES>
  7773.     </DIRECTORIES>
  7774.     <FILES>
  7775.         <FILE NAME="aconti.exe" PATH="WinDir"></FILE>
  7776.         <FILE NAME="aconti.ini" PATH="WinDir"></FILE>
  7777.         <FILE NAME="aconti.log" PATH="WinDir"></FILE>
  7778.         <FILE NAME="aconti.sdb" PATH="WinDir"></FILE>
  7779.         <FILE NAME="acontidialer.txt" PATH="WinDir"></FILE>
  7780.     </FILES>
  7781.     <COOKIES>
  7782.     </COOKIES>
  7783.     <REGISTRY>
  7784.         <KEYS>
  7785.         </KEYS>
  7786.         <VALUES>
  7787.         </VALUES>
  7788.     </REGISTRY>
  7789. <DANGER_LEVEL>2</DANGER_LEVEL>
  7790. <DESCRIPTION>Dialer program that dials a very expensive number to access pornography, many times without user's knowledge</DESCRIPTION>
  7791. </SW>
  7792. <SW NAME="ShopForGood/TGDC">
  7793.     <DIRECTORIES>
  7794.         <DIR NAME="tgdc" PATH="PFDir"></DIR>
  7795.     </DIRECTORIES>
  7796.     <FILES>
  7797.         <FILE NAME="Winy.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
  7798.         <FILE NAME="tgdc.exe" PATH="PFDir\\tgdc"></FILE>
  7799.     </FILES>
  7800.     <COOKIES>
  7801.     </COOKIES>
  7802.     <REGISTRY>
  7803.         <KEYS>
  7804.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{05bbb56a-2a69-4a5c-bfda-43295dd67434}"></REGKEY>        
  7805.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{05BBB56A-2A69-4A5C-BFDA-43295DD67434}"></REGKEY> 
  7806.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{05BBB56A-2A69-4A5C-BFDA-43295DD67434}"></REGKEY>
  7807.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{05BBB56A-2A69-4A5C-BFDA-43295DD67434}"></REGKEY> 
  7808.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{05BBB56A-2A69-4A5C-BFDA-43295DD67434}"></REGKEY> 
  7809.         </KEYS>
  7810.         <VALUES>
  7811.         </VALUES>
  7812.     </REGISTRY>
  7813. <DANGER_LEVEL>1</DANGER_LEVEL>
  7814. <DESCRIPTION>Redirects proper affiliate traffic to steal commissions</DESCRIPTION>
  7815. </SW>
  7816. <SW NAME="ZeroPopupBar"> 
  7817.     <DIRECTORIES>
  7818.     </DIRECTORIES>
  7819.     <FILES>
  7820.         <FILE NAME="zp.dll" PATH="SysDir"></FILE>
  7821.         <FILE NAME="zeropopupbar.dll" PATH="SysDir"></FILE>
  7822.         <FILE NAME="zeropopupbar.dll" PATH="Sys32Dir"></FILE>
  7823.     </FILES>
  7824.     <COOKIES>
  7825.     </COOKIES>
  7826.     <REGISTRY>
  7827.         <KEYS>
  7828.         </KEYS>
  7829.         <VALUES>
  7830.         </VALUES>
  7831.     </REGISTRY>
  7832. <DANGER_LEVEL>2</DANGER_LEVEL>
  7833. <DESCRIPTION>Hijacks homepage and search settings with a provided popup blocker toolbar</DESCRIPTION>
  7834. </SW>
  7835. <SW NAME="AdvSearch"> 
  7836.     <DIRECTORIES>
  7837.         <DIR NAME="BrowseProxy" PATH="WinDir"></DIR> 
  7838.         <DIR NAME="AdvSearch" PATH="PFDir"></DIR>           
  7839.         <DIR NAME="cache" PATH="PFDir\\AdvSearch"></DIR>       
  7840.     </DIRECTORIES>
  7841.     <FILES>
  7842.         <FILE NAME="spredirect.dll" PATH="SysDir"></FILE>
  7843.         <FILE NAME="spredirect.dll" PATH="Sys32Dir"></FILE>
  7844.         <FILE NAME="cliner.exe" PATH="PFDir\\AdvSearch"></FILE>
  7845.         <FILE NAME="FindDll.dll" PATH="PFDir\\AdvSearch"></FILE>
  7846.         <FILE NAME="MailBook.exe" PATH="PFDir\\AdvSearch"></FILE>
  7847.         <FILE NAME="mailbookproxy.dll" PATH="PFDir\\AdvSearch"></FILE>
  7848.         <FILE NAME="MyDll.dll" PATH="PFDir\\AdvSearch"></FILE>
  7849.         <FILE NAME="Nn7Dll.dll" PATH="PFDir\\AdvSearch"></FILE>
  7850.         <FILE NAME="NnDll.dll" PATH="PFDir\\AdvSearch"></FILE>
  7851.         <FILE NAME="pluginst.dll" PATH="PFDir\\AdvSearch"></FILE>
  7852.         <FILE NAME="spredirect.dll" PATH="PFDir\\AdvSearch"></FILE>
  7853.         <FILE NAME="findservice.exe" PATH="PFDir\\AdvSearch"></FILE>
  7854.         <FILE NAME="regsvr32.exe" PATH="PFDir\\AdvSearch"></FILE>
  7855.         <FILE NAME="update.exe" PATH="PFDir\\AdvSearch"></FILE>
  7856.         <FILE NAME="updater.exe" PATH="PFDir\\AdvSearch"></FILE>
  7857.         <FILE NAME="updaterproxy.dll" PATH="PFDir\\AdvSearch"></FILE>
  7858.     </FILES>
  7859.     <COOKIES>
  7860.     </COOKIES>
  7861.     <REGISTRY>
  7862.         <KEYS>
  7863.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{92C7D65C-52F3-4545-8A35-213D730DB1ED}"></REGKEY>
  7864.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{92C7D65C-52F3-4545-8A35-213D730DB1ED}"></REGKEY>
  7865.         </KEYS>
  7866.         <VALUES>
  7867.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="BrowseProxy"></REGVALUE>
  7868.         </VALUES>
  7869.     </REGISTRY>
  7870. <DANGER_LEVEL>2</DANGER_LEVEL>
  7871. <DESCRIPTION>Address bar hijacker for internet explorer</DESCRIPTION>
  7872. </SW>
  7873. <SW NAME="W32.Sobig.F@mm">
  7874.     <DIRECTORIES>
  7875.     </DIRECTORIES>
  7876.     <FILES>
  7877.         <FILE NAME="winppr32.exe" PATH="WinDir"></FILE>
  7878.     </FILES>
  7879.     <COOKIES>
  7880.     </COOKIES>
  7881.     <REGISTRY>
  7882.         <KEYS>
  7883.         </KEYS>
  7884.         <VALUES>
  7885.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="trayx"></REGVALUE>
  7886.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="trayx"></REGVALUE>
  7887.         </VALUES>
  7888.     </REGISTRY>
  7889. <DANGER_LEVEL>2</DANGER_LEVEL>
  7890. <DESCRIPTION>Worm that sounds out massive amounts of email from your PC, slowing your internet and PC performance</DESCRIPTION>
  7891. </SW>
  7892. <SW NAME="MadFinder">
  7893.     <DIRECTORIES>
  7894.     </DIRECTORIES>
  7895.     <FILES>
  7896.         <FILE NAME="svc.exe" PATH="Sys32Dir"></FILE>
  7897.         <FILE NAME="svc.exe" PATH="SysDir"></FILE>
  7898.     </FILES>
  7899.     <COOKIES>
  7900.     </COOKIES>
  7901.     <REGISTRY>
  7902.         <KEYS>
  7903.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\BrowserHelperObjects" VALUE="{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}"></REGKEY> 
  7904.         </KEYS>
  7905.         <VALUES>
  7906.                <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="svc"></REGVALUE>
  7907.         </VALUES>
  7908.     </REGISTRY>
  7909. <DANGER_LEVEL>1</DANGER_LEVEL>
  7910. <DESCRIPTION>Hijacker that will change your internet browser settings and redirect your search traffic</DESCRIPTION>
  7911. </SW>
  7912. <SW NAME="MediaUpdate - SafeSurfing/MediaUpdate">
  7913.     <DIRECTORIES>
  7914.         <DIR NAME="MediaUpdate" PATH="PFDir"></DIR>
  7915.     </DIRECTORIES>
  7916.     <FILES>
  7917.             <FILE NAME="ssurf022.dll" PATH="Sys32Dir"></FILE>
  7918.             <FILE NAME="ssurf022.dll" PATH="SysDir"></FILE>
  7919.             <FILE NAME="ssurf022.dll" PATH="WinDir"></FILE>
  7920.             <FILE NAME="medup012.dll" PATH="Sys32Dir"></FILE>
  7921.             <FILE NAME="medup012.dll" PATH="SysDir"></FILE> 
  7922.             <FILE NAME="medup012.dll" PATH="WinDir"></FILE> 
  7923.             <FILE NAME="SSUpdate.exe" PATH="SysDir"></FILE>
  7924.             <FILE NAME="SSUpdate.exe" PATH="Sys32Dir"></FILE>
  7925.             <FILE NAME="SSUpdate.exe" PATH="WinDir"></FILE>
  7926.             <FILE NAME="medup020.dll" PATH="SysDir"></FILE>
  7927.             <FILE NAME="medup020.dll" PATH="Sys32Dir"></FILE>
  7928.             <FILE NAME="medup020.dll" PATH="WinDir"></FILE> 
  7929.     </FILES>
  7930.     <COOKIES>
  7931.     </COOKIES>
  7932.     <REGISTRY>
  7933.         <KEYS>
  7934.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE" VALUE="Invictus"></REGKEY>
  7935.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE" VALUE="SafeSurfing"></REGKEY>
  7936.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID " VALUE="{D8E25C53-9508-4f5c-9249-D98D438891D5}"></REGKEY>
  7937.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\BrowserHelperObjects" VALUE="{D8E25C53-9508-4f5c-9249-D98D438891D5}"></REGKEY>
  7938.         </KEYS>
  7939.         <VALUES>
  7940.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="SafeSurfingUpdate"></REGVALUE>
  7941.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="UpdateMedia"></REGVALUE>
  7942.         </VALUES>
  7943.     </REGISTRY>
  7944. <DANGER_LEVEL>2</DANGER_LEVEL>
  7945. <DESCRIPTION>Opens popup windows as well as monitors the webpages you visit</DESCRIPTION>
  7946. </SW>    
  7947. <SW NAME="Whenu-ClockSync">
  7948.     <DIRECTORIES>
  7949.         <DIR NAME="ClockSync" PATH="PFDir"></DIR>
  7950.     </DIRECTORIES>
  7951.     <FILES>
  7952.         <FILE NAME="uninst.exe" PATH="PFDir\\ClockSync"></FILE> 
  7953.         <FILE NAME="sync.exe" PATH="PFDir\\ClockSync"></FILE>
  7954.     </FILES>
  7955.     <COOKIES>
  7956.     </COOKIES>
  7957.     <REGISTRY>
  7958.         <KEYS>
  7959.         </KEYS>
  7960.         <VALUES>
  7961.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="ClockSync"></REGVALUE>
  7962.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="ClockSync"></REGVALUE>
  7963.         </VALUES>
  7964.     </REGISTRY>
  7965. <DANGER_LEVEL>1</DANGER_LEVEL>
  7966. <DESCRIPTION>Delivers pop up advertisements to your PC</DESCRIPTION>
  7967. </SW>
  7968. <SW NAME="SpyBlast">
  7969.     <DIRECTORIES>
  7970.         <DIR NAME="spyblast" PATH="PFDir"></DIR>
  7971.     </DIRECTORIES>
  7972.     <FILES>
  7973.         <FILE NAME="SpyBlast.exe" PATH="PFDir\\SpyBlast"></FILE>
  7974.     </FILES>
  7975.     <COOKIES>
  7976.     </COOKIES>
  7977.     <REGISTRY>
  7978.         <KEYS>
  7979.         </KEYS>
  7980.         <VALUES>
  7981.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="SpyBlast"></REGVALUE>
  7982.         </VALUES>
  7983.     </REGISTRY>
  7984. <DANGER_LEVEL>2</DANGER_LEVEL>
  7985. <DESCRIPTION>Pretends to be a spyware blocker, but instead injects spyware into the PC</DESCRIPTION>
  7986. </SW>
  7987. <SW NAME="BookedSpace/Remanent/BS2">
  7988.     <DIRECTORIES>
  7989.     </DIRECTORIES>
  7990.     <FILES>
  7991.        <FILE NAME="rem00001.dll" PATH="WinDir"></FILE>
  7992.        <FILE NAME="bs2.dll" PATH="WinDir"></FILE>
  7993.        <FILE NAME="bs3.dll" PATH="Windir"></FILE>
  7994.        <FILE NAME="oo4.dll" PATH="Windir"></FILE>
  7995.        <FILE NAME="bsx5.dll" PATH="Windir"></FILE>
  7996.        <FILE NAME="bxxs5.dll" PATH="Windir"></FILE>
  7997.        <FILE NAME="bs2.dll" PATH="SysDir"></FILE>
  7998.        <FILE NAME="bs2.dll" PATH="Sys32Dir"></FILE>
  7999.        <FILE NAME="bs3.dll" PATH="SysDir"></FILE>
  8000.        <FILE NAME="bs3.dll" PATH="Sys32Dir"></FILE>
  8001.        <FILE NAME="rem00001.dll" PATH="SysDir"></FILE>
  8002.        <FILE NAME="rem00001.dll" PATH="Sys32Dir"></FILE>
  8003.     </FILES>
  8004.     <COOKIES>
  8005.     </COOKIES>
  8006.     <REGISTRY>
  8007.         <KEYS>
  8008.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software" VALUE="bookedspace"></REGKEY>
  8009.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{0019c3e2-dd48-4a6d-ab2d-8d32436313d9}"></REGKEY>
  8010.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{0019c3e2-dd48-4a6d-abcd-8d32436323d9}"></REGKEY>
  8011.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{2b3452c5-1b9a-440f-a203-f6ed0f64c895}"></REGKEY>
  8012.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{392be62b-e7de-430a-8859-0afe677de6e1}"></REGKEY>
  8013.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{a85c4a1b-bd36-44e5-a70f-8ec347d9b24f}"></REGKEY>
  8014.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{0019c3e2-dd48-4a6d-ab2d-8d32436313d9}"></REGKEY>
  8015.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{0019c3e2-dd48-4a6d-abcd-8d32436323d9}"></REGKEY>
  8016.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{2b3452c5-1b9a-440f-a203-f6ed0f64c895}"></REGKEY>
  8017.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{392be62b-e7de-430a-8859-0afe677de6e1}"></REGKEY>
  8018.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{a85c4a1b-bd36-44e5-a70f-8ec347d9b24f}"></REGKEY>
  8019.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE" VALUE="Remanent"></REGKEY>
  8020.         </KEYS>
  8021.         <VALUES>
  8022.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="bxsx5"></REGVALUE>
  8023.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="bxxsx5"></REGVALUE>
  8024.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="bookedspace"></REGVALUE>
  8025.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="bsx3"></REGVALUE>
  8026.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="bxxs5"></REGVALUE>
  8027.         </VALUES>
  8028.     </REGISTRY>
  8029. <DANGER_LEVEL>1</DANGER_LEVEL>
  8030. <DESCRIPTION>Browser helper object that is silently installed and used to show advertisements.</DESCRIPTION>
  8031. </SW>
  8032. <SW NAME="DefaultSearch.SeekSeek">
  8033.     <DIRECTORIES>
  8034.     </DIRECTORIES>
  8035.     <FILES>
  8036.       <FILE NAME="ieasst.dll" PATH="WinDir"></FILE>
  8037.     </FILES>
  8038.     <COOKIES>
  8039.     </COOKIES>
  8040.     <REGISTRY>
  8041.       <KEYS>
  8042.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{5074851C-F67A-488E-A9C9-C244573F4068}"></REGKEY>
  8043.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\BrowserHelperObjects" VALUE="{5074851C-F67A-488E-A9C9-C244573F4068}"></REGKEY>
  8044.       </KEYS>
  8045.       <VALUES>
  8046.       </VALUES>
  8047.     </REGISTRY>
  8048. <DANGER_LEVEL>1</DANGER_LEVEL>
  8049. <DESCRIPTION>Browser hijacker that changes your browser settings</DESCRIPTION>
  8050. </SW>
  8051. <SW NAME="IncrediFind/flowgobar">
  8052.     <DIRECTORIES>
  8053.         <DIR NAME="flowgobar" PATH="PFDir"></DIR>
  8054.     </DIRECTORIES>
  8055.     <FILES>
  8056.        <FILE NAME="incfindbho.dll" PATH="PFDir\\IncrediFind\\BHO"></FILE>
  8057.        <FILE NAME="flgobar.dll" PATH="PFDir\\flowgobar\\toolbar"></FILE>
  8058.        <FILE NAME="flgobar.dll" PATH="SysDir"></FILE>
  8059.        <FILE NAME="flgobar.dll" PATH="Sys32Dir"></FILE>       
  8060.        <FILE NAME="incfindbho.dll" PATH=""></FILE>
  8061.     </FILES>
  8062.     <COOKIES>
  8063.     </COOKIES>
  8064.     <REGISTRY>
  8065.       <KEYS>
  8066.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{5D60FF48-95BE-4956-B4C6-6BB168A70310}"></REGKEY>
  8067.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\BrowserHelperObjects" VALUE="{5D60FF48-95BE-4956-B4C6-6BB168A70310}"></REGKEY>
  8068.       </KEYS>
  8069.       <VALUES>
  8070.           <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="software\\microsoft\\internet explorer\\toolbar\\webbrowser" VALUE="{4e7bd74f-2b8d-469e-c0ff-fd63b399bc7d}"></REGVALUE>
  8071.           <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{4e7bd74f-2b8d-469e-c0ff-fd63b399bc7d}"></REGVALUE>
  8072.       </VALUES>
  8073.     </REGISTRY>
  8074. <DANGER_LEVEL>1</DANGER_LEVEL>
  8075. <DESCRIPTION>Hijacks your error page settings as well as browser settings</DESCRIPTION>
  8076. </SW>
  8077. <SW NAME="GSim">
  8078.     <DIRECTORIES>
  8079.     </DIRECTORIES>
  8080.     <FILES>
  8081.       <FILE NAME="gsim.dll" PATH="WinDir"></FILE>
  8082.     </FILES>
  8083.     <COOKIES>
  8084.     </COOKIES>
  8085.     <REGISTRY>
  8086.       <KEYS>
  8087.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{4E7BD74F-2B8D-469E-DFF7-EC6BF4D5FA7D}"></REGKEY>
  8088.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\BrowserHelperObjects" VALUE="{4E7BD74F-2B8D-469E-DFF7-EC6BF4D5FA7D}"></REGKEY>
  8089.       </KEYS>
  8090.       <VALUES>
  8091.       </VALUES>
  8092.     </REGISTRY>
  8093. <DANGER_LEVEL>1</DANGER_LEVEL>
  8094. <DESCRIPTION>Hijacker that changes your browser settings</DESCRIPTION>
  8095. </SW>
  8096. <SW NAME="DialXS">
  8097.     <DIRECTORIES>
  8098.     </DIRECTORIES>
  8099.     <FILES>
  8100.     </FILES>
  8101.     <COOKIES>
  8102.     </COOKIES>
  8103.     <REGISTRY>
  8104.       <KEYS>
  8105.          <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Classid" VALUE="{9b4aa442-9ebf-11d5-8c11-0050da4957f5}"></REGKEY>
  8106.       </KEYS>
  8107.       <VALUES>
  8108.       </VALUES>
  8109.     </REGISTRY>
  8110. <DANGER_LEVEL>1</DANGER_LEVEL>
  8111. <DESCRIPTION>Used by high cost dialers to install their software on your PC to dial out without your permission</DESCRIPTION>
  8112. </SW>
  8113. <SW NAME="ExpExt">
  8114.     <DIRECTORIES>
  8115.     </DIRECTORIES>
  8116.     <FILES>
  8117.       <FILE NAME="expext.dll" PATH="SysDir"></FILE>
  8118.       <FILE NAME="expext.dll" PATH="Sys32Dir"></FILE>
  8119.     </FILES>
  8120.     <COOKIES>
  8121.     </COOKIES>
  8122.     <REGISTRY>
  8123.       <KEYS>
  8124.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\BrowserHelperObjects" VALUE="{23BC1CCF-4BE7-497F-B154-6ADA68425FBB}"></REGKEY>
  8125.          <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{23bc1ccf-4be7-497f-b154-6ada68425fbb}"></REGKEY> 
  8126.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{23bc1ccf-4be7-497f-b154-6ada68425fbb}"></REGKEY>
  8127.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{23bc1ccf-4be7-497f-b154-6ada68425fbb}"></REGKEY>
  8128.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{23bc1ccf-4be7-497f-b154-6ada68425fbb}"></REGKEY>
  8129.       </KEYS>
  8130.       <VALUES>
  8131.       </VALUES>
  8132.     </REGISTRY>
  8133. <DANGER_LEVEL>1</DANGER_LEVEL>
  8134. <DESCRIPTION>Malicious .dll whose purpose is unknown</DESCRIPTION>
  8135. </SW>
  8136. <SW NAME="WStart.dll">  
  8137.     <DIRECTORIES>
  8138.     </DIRECTORIES>
  8139.     <FILES>
  8140.         <FILE NAME="WStart.dll" PATH="Sys32Dir"></FILE>
  8141.     </FILES>
  8142.     <COOKIES>
  8143.     </COOKIES>
  8144.     <REGISTRY>
  8145.         <KEYS>
  8146.         </KEYS>
  8147.         <VALUES>
  8148.         </VALUES>
  8149.     </REGISTRY>
  8150. <DANGER_LEVEL>1</DANGER_LEVEL>
  8151. <DESCRIPTION>A browser helper object reported to slow down internet explorer</DESCRIPTION>
  8152. </SW>
  8153. <SW NAME="SearchCounter">  
  8154.      <DIRECTORIES>
  8155.      </DIRECTORIES>
  8156.      <FILES>
  8157.          <FILE NAME="tips.ini" PATH="WinDir\\Web"></FILE>
  8158.          <FILE NAME="hh.htt" PATH="WinDir"></FILE>
  8159.      </FILES>
  8160.      <COOKIES>
  8161.      </COOKIES>
  8162.      <REGISTRY>
  8163.          <KEYS>
  8164.          </KEYS>
  8165.            <VALUES>
  8166.           <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Main\\Use Search Assistant" VALUE="yes"></REGVALUE>
  8167.           <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Styles\\User Stylesheet" VALUE="C:\\WINDOWS\\hh.htt"></REGVALUE>
  8168.           <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Styles\\User Stylesheet" VALUE="c:\\Winnt\\hh.htt"></REGVALUE>
  8169.           <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Styles\\User Stylesheet\\Use My Stylesheet" VALUE="dword:00000001"></REGVALUE>
  8170.           <REGVALUE MAIN="HKEY_USERS" SUB=".DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ReconfLast" VALUE="dword:07D30C01"></REGVALUE>
  8171.           <REGVALUE MAIN="HKEY_USERS" SUB=".DEFAULT\\Software\\Microsoft\\Internet Explorer\\Main\\Use SearchAssistant" VALUE="yes"></REGVALUE>
  8172.           <REGVALUE MAIN="HKEY_USERS" SUB=".DEFAULT\\Software\\Microsoft\\Internet Explorer\\Styles\\User Stylesheet" VALUE="C:\\WINDOWS\\Web\\tips.ini"></REGVALUE>
  8173.           <REGVALUE MAIN="HKEY_USERS" SUB=".DEFAULT\\Software\\Microsoft\\Internet Explorer\\Styles\\User Stylesheet" VALUE="C:\\Winnt\\Web\\tips.ini"></REGVALUE>
  8174.           <REGVALUE MAIN="HKEY_USERS" SUB=".DEFAULT\\Software\\Microsoft\\Internet Explorer\\Styles\\Use My Stylesheet" VALUE="dword:00000001"></REGVALUE>
  8175.  </VALUES>
  8176.      </REGISTRY>
  8177.  <DANGER_LEVEL>1</DANGER_LEVEL>
  8178.  <DESCRIPTION>Stylesheet hijacks used by the Coolwebsearch hijacker</DESCRIPTION>
  8179. </SW>
  8180. <SW NAME="W32.Kwbot.P.Worm">
  8181.     <DIRECTORIES>
  8182.     </DIRECTORIES>
  8183.     <FILES>
  8184.         <FILE NAME="mscommand.exe" PATH="SysDir"></FILE>
  8185.         <FILE NAME="mscommand.exe" PATH="Sys32Dir"></FILE>
  8186.     </FILES> 
  8187.     <COOKIES>
  8188.     </COOKIES>
  8189.     <REGISTRY>
  8190.         <KEYS>
  8191.         </KEYS>
  8192.         <VALUES>
  8193.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="System Efficiency Monitor"></REGVALUE>
  8194.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="System Efficiency Monitor"></REGVALUE>
  8195.         </VALUES>
  8196.     </REGISTRY>
  8197. <DANGER_LEVEL>2</DANGER_LEVEL>
  8198. <DESCRIPTION>Worm that attempts to spread itself and allows unauthorized persons to control your PC</DESCRIPTION>
  8199. </SW>
  8200. <SW NAME="W32.P2P.Tanked/W32.Kwbot.C.Worm">  
  8201.     <DIRECTORIES>
  8202.     </DIRECTORIES>
  8203.     <FILES>
  8204.         <FILE NAME="system32.exe" PATH="SysDir"></FILE>
  8205.         <FILE NAME="system32.exe" PATH="Sys32Dir"></FILE>
  8206.         <FILE NAME="cmd32.exe" PATH="SysDir"></FILE>
  8207.         <FILE NAME="cmd32.exe" PATH="Sys32Dir"></FILE>
  8208.     </FILES>
  8209.     <COOKIES>
  8210.     </COOKIES>
  8211.     <REGISTRY>
  8212.         <KEYS>
  8213.         </KEYS>
  8214.         <VALUES>
  8215.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="SystemSAS"></REGVALUE>
  8216.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="SystemSAS"></REGVALUE>
  8217.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce" VALUE="SystemSAS"></REGVALUE>
  8218.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="CMD"></REGVALUE>
  8219.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="CMD"></REGVALUE>
  8220.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce" VALUE="CMD"></REGVALUE>
  8221.         </VALUES>
  8222.     </REGISTRY>
  8223. <DANGER_LEVEL>1</DANGER_LEVEL>
  8224. <DESCRIPTION>Worm that allows hackers unauthorized access to your PC</DESCRIPTION>
  8225. </SW>
  8226. <SW NAME="2020Search">
  8227.     <DIRECTORIES>
  8228.     </DIRECTORIES>
  8229.     <FILES>
  8230.       <FILE NAME="2020Search.dll" PATH="SysDir"></FILE> 
  8231.       <FILE NAME="2020Search.dll" PATH="Sys32Dir"></FILE>
  8232.       <FILE NAME="2020Search.dll" PATH="WinDir"></FILE>
  8233.       <FILE NAME="2020search2.dll" PATH=""></FILE>
  8234.       <FILE NAME="2020install.exe" PATH=""></FILE>
  8235.       <FILE NAME="mssvr.exe" PATH=""></FILE>
  8236.       <FILE NAME="irsetup.exe" PATH="WinDir\\temp"></FILE>
  8237.          <FILE NAME="bjam.dll" PATH=""></FILE>
  8238.          <FILE NAME="mspphe.dll" PATH=""></FILE>
  8239.          <FILE NAME="2020install.exe" PATH="WinDir"></FILE>
  8240.          <FILE NAME="2020search2.dll" PATH="WinDir"></FILE>
  8241.          <FILE NAME="2020search.dll" PATH="WinDir\\downloaded program files"></FILE>
  8242.          <FILE NAME="2020search.inf" PATH="WinDir\\downloaded program files"></FILE>
  8243.          <FILE NAME="mssvr.exe" PATH="WinDir"></FILE>
  8244.          <FILE NAME="2020search2.dll" PATH="SysDir"></FILE>
  8245.     <FILE NAME="2020search2.dll" PATH="Sys32Dir"></FILE>
  8246.     </FILES>
  8247.     <COOKIES>
  8248.     </COOKIES>
  8249.     <REGISTRY>
  8250.       <KEYS>
  8251.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{4E1075F4-EEC4-4a86-ADD7-CD5F52858C31}"></REGKEY>
  8252.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{4e7bd74f-2b8d-469e-92c6-ce7eb590a94d}"></REGKEY> 
  8253.          <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{4e7bd74f-2b8d-469e-92c6-ce7eb590a94d}"></REGKEY> 
  8254.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{4e1075f4-eec4-4a86-add7-cd5f52858c31}"></REGKEY>
  8255.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{4e7bd74f-2b8d-469e-92c6-ce7eb590a94d}"></REGKEY>
  8256.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{fc2493d6-a673-49fe-a2ee-efe03e95c27c}"></REGKEY>
  8257.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="gorsdn.contextitem"></REGKEY>
  8258.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="gorsdn.contextitem.1"></REGKEY>
  8259.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="interface" VALUE="{eaf2ccee-21a1-4203-9f36-4929fd104d43}"></REGKEY>
  8260.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{48da6120-a779-4c12-8584-47b625efb469}"></REGKEY>
  8261.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{4e1075f4-eec4-4a86-add7-cd5f52858c31}"></REGKEY>
  8262.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{4e7bd74f-2b8d-469e-92c6-ce7eb590a94d}"></REGKEY>
  8263.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{4e7bd74f-2b8d-469e-92c6-ce7eb590a94d}"></REGKEY>
  8264.       </KEYS>
  8265.       <VALUES>
  8266.            <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\InternetExplorer\\Toolbar\\WebBrowser" VALUE="{4E1075F4-EEC4-4A86-ADD7-CD5F52858C31}"></REGVALUE>
  8267.          <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\InternetExplorer\\Toolbar" VALUE="{4E1075F4-EEC4-4a86-ADD7-CD5F52858C31}"></REGVALUE>
  8268.          <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{4e7bd74f-2b8d-469e-92c6-ce7eb590a94d}"></REGVALUE>
  8269.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{4e1075f4-eec4-4a86-add7-cd5f52858c31}"></REGVALUE>
  8270.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="software\\microsoft\\internet explorer\\toolbar\\webbrowser" VALUE="{4e7bd74f-2b8d-469e-92c6-ce7eb590a94d}"></REGVALUE>
  8271.       </VALUES>
  8272.     </REGISTRY>
  8273. <DANGER_LEVEL>1</DANGER_LEVEL>
  8274. <DESCRIPTION>Internet explorer toolbar with a silent update feature</DESCRIPTION>
  8275. </SW>
  8276. <SW NAME="W32.Randex.S">  
  8277.      <DIRECTORIES>
  8278.      </DIRECTORIES>
  8279.      <FILES>
  8280.          <FILE NAME="CSysTime.exe" PATH="SysDir"></FILE>
  8281.          <FILE NAME="CSysTime.exe" PATH="Sys32Dir"></FILE>
  8282.        </FILES>
  8283.      <COOKIES>
  8284.      </COOKIES>
  8285.      <REGISTRY>
  8286.          <KEYS>
  8287.          </KEYS>
  8288.          <VALUES>
  8289.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="System time updator"></REGVALUE>
  8290.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="System time updator"></REGVALUE>
  8291.          </VALUES>
  8292.      </REGISTRY>
  8293.  <DANGER_LEVEL>1</DANGER_LEVEL>
  8294.  <DESCRIPTION>Worm that is spread through file sharing networks.slow down your PC</DESCRIPTION>
  8295. </SW>
  8296. <SW NAME="W32.HLLW.Anig">  
  8297.      <DIRECTORIES>
  8298.      </DIRECTORIES>
  8299.      <FILES>
  8300.          <FILE NAME="NTOSA32.exe" PATH=""></FILE>
  8301.        </FILES>
  8302.      <COOKIES>
  8303.      </COOKIES>
  8304.      <REGISTRY>
  8305.          <KEYS>
  8306.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="System\\CurrentControlSet\\Services" VALUE="dfcsvc"></REGKEY>
  8307.          </KEYS>
  8308.          <VALUES>
  8309.               <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Osa32"></REGVALUE>
  8310.          </VALUES>
  8311.      </REGISTRY>
  8312.  <DANGER_LEVEL>2</DANGER_LEVEL>
  8313.  <DESCRIPTION>Worm that allows hackers unauthorized access to your PC</DESCRIPTION>
  8314. </SW>
  8315. <SW NAME="W32.Beagle.C@mm/W32.Bagle.c@MM">  
  8316.      <DIRECTORIES>
  8317.      </DIRECTORIES>
  8318.      <FILES>
  8319.          <FILE NAME="README.EXE" PATH="SysDir"></FILE>
  8320.          <FILE NAME="README.EXE" PATH="Sys32Dir"></FILE>
  8321.          <FILE NAME="DOC.EXE" PATH="SysDir"></FILE>
  8322.          <FILE NAME="DOC.EXE" PATH="Sys32Dir"></FILE>
  8323.          <FILE NAME="ONDE.EXE" PATH="SysDir"></FILE>
  8324.          <FILE NAME="ONDE.EXE" PATH="Sys32Dir"></FILE>
  8325.          <FILE NAME="README.EXEOPEN" PATH="SysDir"></FILE>
  8326.          <FILE NAME="README.EXEOPEN" PATH="Sys32Dir"></FILE>
  8327.          </FILES>
  8328.      <COOKIES>
  8329.      </COOKIES>
  8330.      <REGISTRY>
  8331.          <KEYS>
  8332.          </KEYS>
  8333.          <VALUES>
  8334.               <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="gouday.exe"></REGVALUE>
  8335.          </VALUES>
  8336.      </REGISTRY>
  8337.  <DANGER_LEVEL>2</DANGER_LEVEL>
  8338.  <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC</DESCRIPTION>
  8339. </SW>
  8340. <SW NAME="W32.HLLW.Deadhat">  
  8341.      <DIRECTORIES>
  8342.      </DIRECTORIES>
  8343.      <FILES>
  8344.          <FILE NAME="sms.exe" PATH="SysDir"></FILE>
  8345.          <FILE NAME="sms.exe" PATH="Sys32Dir"></FILE>
  8346.          </FILES>
  8347.      <COOKIES>
  8348.      </COOKIES>
  8349.      <REGISTRY>
  8350.          <KEYS>
  8351.          </KEYS>
  8352.          <VALUES>
  8353.               <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="KernelFaultChk"></REGVALUE>
  8354.          </VALUES>
  8355.      </REGISTRY>
  8356.  <DANGER_LEVEL>2</DANGER_LEVEL>
  8357.  <DESCRIPTION>Worm that allows hackers unauthorized access to your PC</DESCRIPTION>
  8358. </SW>
  8359. <SW NAME="Instant Access Dialer.C">
  8360.     <DIRECTORIES>
  8361.     </DIRECTORIES>
  8362.     <FILES>
  8363.         <FILE NAME="EGDHTML_1024.dll" PATH="SysDir"></FILE>
  8364.         <FILE NAME="EGDHTML_1024.dll" PATH="Sys32Dir"></FILE>
  8365.         <FILE NAME="Instant Access.lnk" PATH=""></FILE>
  8366.     </FILES>
  8367.     <COOKIES> 
  8368.     </COOKIES>
  8369.     <REGISTRY>
  8370.        <KEYS>
  8371.        </KEYS> 
  8372.        <VALUES>
  8373.                <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Instant Access"></REGVALUE>
  8374.        </VALUES>
  8375.     </REGISTRY>
  8376. <DANGER_LEVEL>2</DANGER_LEVEL>
  8377. <DESCRIPTION>Dialer program that dials a very expensive number to access pornography, many times without user's knowledge</DESCRIPTION>
  8378. </SW>
  8379. <SW NAME="W32.Netsky@mm">
  8380.     <DIRECTORIES>
  8381.     </DIRECTORIES>
  8382.     <FILES>
  8383.         <FILE NAME="services.exe" PATH="WinDir"></FILE>
  8384.     </FILES>
  8385.     <COOKIES> 
  8386.     </COOKIES>
  8387.     <REGISTRY>
  8388.        <KEYS>
  8389.        </KEYS> 
  8390.        <VALUES>
  8391.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Service"></REGVALUE>
  8392.        </VALUES>
  8393.     </REGISTRY>
  8394. <DANGER_LEVEL>1</DANGER_LEVEL>
  8395. <DESCRIPTION>It is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning the hard drives and mapped drives.</DESCRIPTION>
  8396. </SW>
  8397. <SW NAME="W32.Gaobot.WO">
  8398.     <DIRECTORIES>
  8399.     </DIRECTORIES>
  8400.     <FILES>
  8401.         <FILE NAME="netlink32.exe" PATH="Sys32Dir"></FILE>
  8402.     </FILES>
  8403.     <COOKIES> 
  8404.     </COOKIES>
  8405.     <REGISTRY>
  8406.        <KEYS>
  8407.        </KEYS> 
  8408.        <VALUES>
  8409.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="NetLink"></REGVALUE>
  8410.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="NetLink"></REGVALUE>
  8411.        </VALUES>
  8412.     </REGISTRY>
  8413. <DANGER_LEVEL>1</DANGER_LEVEL>
  8414. <DESCRIPTION>W32.Gaobot.WO is a variant of W32.Gaobot.gen.This Worm spread through file sharing networks.Will slow down your PC</DESCRIPTION>
  8415. </SW>
  8416. <SW NAME="W32.Beagle.K@mm">  
  8417.      <DIRECTORIES>
  8418.      </DIRECTORIES>
  8419.      <FILES>
  8420.              <FILE NAME="winsys.exe" PATH="Sys32Dir"></FILE>
  8421.              <FILE NAME="winsys.exeopen" PATH="SysDir"></FILE>
  8422.              <FILE NAME="winsys.exeopen" PATH="Sys32Dir"></FILE>
  8423.              <FILE NAME="winsys.exeopenopen" PATH="SysDir"></FILE>
  8424.              <FILE NAME="winsys.exeopenopen" PATH="Sys32Dir"></FILE>
  8425.         </FILES>
  8426.      <COOKIES>
  8427.      </COOKIES>
  8428.      <REGISTRY>
  8429.          <KEYS>
  8430.          </KEYS>
  8431.          <VALUES>
  8432.          </VALUES>
  8433.      </REGISTRY>
  8434.  <DANGER_LEVEL>2</DANGER_LEVEL>
  8435.  <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  8436. </SW> 
  8437. <SW NAME="W32.Gaobot.AAY">  
  8438.      <DIRECTORIES>
  8439.      </DIRECTORIES>
  8440.      <FILES>
  8441.          <FILE NAME="winlink32.exe" PATH=""></FILE>
  8442.     </FILES>
  8443.      <COOKIES>
  8444.      </COOKIES>
  8445.      <REGISTRY>
  8446.          <KEYS>
  8447.          </KEYS>
  8448.          <VALUES>
  8449.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Winlink"></REGVALUE>
  8450.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="Winlink"></REGVALUE>
  8451.          </VALUES>
  8452.      </REGISTRY>
  8453.  <DANGER_LEVEL>2</DANGER_LEVEL>
  8454.  <DESCRIPTION>Worm that allows hackers unauthorized access to your PC.</DESCRIPTION>
  8455. </SW>
  8456. <SW NAME="CoolWebSearch.xpsystem">  
  8457.      <DIRECTORIES>
  8458.      </DIRECTORIES>
  8459.      <FILES>
  8460.          <FILE NAME="y.exe" PATH="Sys32Dir\\services"></FILE>
  8461.          <FILE NAME="1.00.07.dll" PATH="SysDir\\services"></FILE>
  8462.          <FILE NAME="SERVICES.EXE" PATH="SysDir32\\services"></FILE>
  8463.        </FILES>
  8464.      <COOKIES>
  8465.      </COOKIES>
  8466.      <REGISTRY>
  8467.          <KEYS>
  8468.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{5321E378-FFAD-4999-8C62-03CA8155F0B3}"></REGKEY>
  8469.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{5321E378-FFAD-4999-8C62-03CA8155F0B3}"></REGKEY>
  8470.          </KEYS>
  8471.          <VALUES>
  8472.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="xpsystem"></REGVALUE>
  8473.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="xpsystem"></REGVALUE>
  8474.          </VALUES>
  8475.      </REGISTRY>
  8476.  <DANGER_LEVEL>1</DANGER_LEVEL>
  8477.  <DESCRIPTION>Wide range of different browser hijackers - related to CoolWebSearch.</DESCRIPTION>
  8478. </SW>
  8479. <SW NAME="W32.Gibe@mm/Slammer worm">  
  8480.      <DIRECTORIES>
  8481.      </DIRECTORIES>
  8482.      <FILES>
  8483.          <FILE NAME="BcTool.exe" PATH="WinDir"></FILE>
  8484.          <FILE NAME="GFXACC.exe" PATH="WinDir"></FILE>
  8485.     </FILES>
  8486.      <COOKIES>
  8487.      </COOKIES>
  8488.      <REGISTRY>
  8489.          <KEYS>
  8490.         </KEYS>
  8491.          <VALUES>
  8492.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="3dfx Acc"></REGVALUE>
  8493.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="LoadDBackup"></REGVALUE>
  8494.          </VALUES>
  8495.      </REGISTRY>
  8496.  <DANGER_LEVEL>2</DANGER_LEVEL>
  8497.  <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  8498. </SW>
  8499. <SW NAME="W32.HLLW.Daboom">  
  8500.      <DIRECTORIES>
  8501.      </DIRECTORIES>
  8502.      <FILES>
  8503.          <FILE NAME="systray32.exe" PATH="SysDir"></FILE>
  8504.          <FILE NAME="systray32.exe" PATH="Sys32Dir"></FILE>
  8505.     </FILES>
  8506.      <COOKIES>
  8507.      </COOKIES>
  8508.      <REGISTRY>
  8509.          <KEYS>
  8510.          </KEYS>
  8511.          <VALUES>
  8512.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="ActiveDesktop"></REGVALUE>
  8513.          </VALUES>
  8514.           </REGISTRY>
  8515.  <DANGER_LEVEL>2</DANGER_LEVEL>
  8516.  <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  8517. </SW>
  8518.  
  8519. <SW NAME="W32.Backzat.Worm">  
  8520.      <DIRECTORIES>
  8521.      </DIRECTORIES>
  8522.      <FILES>
  8523.          <FILE NAME="BatzBack.scr" PATH="WinDir"></FILE>
  8524.     </FILES>
  8525.      <COOKIES>
  8526.      </COOKIES>
  8527.      <REGISTRY>
  8528.          <KEYS>
  8529.          </KEYS>
  8530.          <VALUES>
  8531.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="BatzBack"></REGVALUE>
  8532.          </VALUES>
  8533.           </REGISTRY>
  8534.  <DANGER_LEVEL>2</DANGER_LEVEL>
  8535.  <DESCRIPTION>Worm that will attempt to spread itself and remove security software on your computer.</DESCRIPTION>
  8536. </SW>
  8537. <SW NAME="IAGold">  
  8538.      <DIRECTORIES>
  8539.      </DIRECTORIES>
  8540.      <FILES>
  8541.        </FILES>
  8542.      <COOKIES>
  8543.      </COOKIES>
  8544.      <REGISTRY>
  8545.          <KEYS>
  8546.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{0a1a2a3a-4a5a-6a7a-8a9a-aabacadaeafa}"></REGKEY>
  8547.          </KEYS>
  8548.          <VALUES>
  8549.          </VALUES>
  8550.      </REGISTRY>
  8551.  <DANGER_LEVEL>1</DANGER_LEVEL>
  8552.  <DESCRIPTION>Adware that will display advertisements on your PC.</DESCRIPTION>
  8553. </SW>
  8554. <SW NAME="HTMLEdit">  
  8555.      <DIRECTORIES>
  8556.      </DIRECTORIES>
  8557.      <FILES>
  8558.          <FILE NAME="lie1d6ff.dll" PATH="SysDir"></FILE>
  8559.          <FILE NAME="lie1d6ff.dll" PATH="Sys32Dir"></FILE>
  8560.     </FILES>
  8561.      <COOKIES>
  8562.      </COOKIES>
  8563.      <REGISTRY>
  8564.          <KEYS>
  8565.          </KEYS>
  8566.          <VALUES>
  8567.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{81270159-e8f9-4713-9646-03531e0eef58}"></REGVALUE>
  8568.          </VALUES>
  8569.           </REGISTRY>
  8570.  <DANGER_LEVEL>1</DANGER_LEVEL>
  8571.  <DESCRIPTION>Browser hijacker that will change your internet settings.</DESCRIPTION>
  8572. </SW>
  8573. <SW NAME="Activity Monitor/Probot activity monitor">  
  8574.     <DIRECTORIES>
  8575.     </DIRECTORIES>
  8576.     <FILES>
  8577.         <FILE NAME="pbcommon.dll" PATH="SysDir"></FILE>
  8578.         <FILE NAME="pbcommon.dll" PATH="Sys32Dir"></FILE>
  8579.         <FILE NAME="actmon.chm" PATH=""></FILE>
  8580.         <FILE NAME="amagent35.exe" PATH=""></FILE>
  8581.         <FILE NAME="amaware.dll" PATH=""></FILE>
  8582.         <FILE NAME="amhelp.chm" PATH=""></FILE>
  8583.         <FILE NAME="amonitor35f.exe" PATH=""></FILE>
  8584.         <FILE NAME="awmsg.dat" PATH=""></FILE>
  8585.         <FILE NAME="bcgcbpro671.dll" PATH=""></FILE>
  8586.         <FILE NAME="dconsole.dll" PATH=""></FILE>
  8587.         <FILE NAME="dpexec.exe" PATH=""></FILE>
  8588.         <FILE NAME="iphelper.dll" PATH=""></FILE>
  8589.         <FILE NAME="logexp.dll" PATH=""></FILE>
  8590.         <FILE NAME="slgr.dll" PATH=""></FILE>
  8591.         <FILE NAME="swatcher.exe" PATH=""></FILE>
  8592.         <FILE NAME="swkbhk.dll" PATH=""></FILE>
  8593.         <FILE NAME="swmain.dll" PATH=""></FILE>
  8594.         <FILE NAME="swsys.exe" PATH=""></FILE>
  8595.     </FILES>
  8596.     <COOKIES>
  8597.     </COOKIES>
  8598.     <REGISTRY>
  8599.         <KEYS>
  8600.         </KEYS>
  8601.         <VALUES>
  8602.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="swclient"></REGVALUE>
  8603.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{312fa154-e1b7-4336-9833-ee6b38d58b56}"></REGKEY>
  8604.         </VALUES>
  8605.     </REGISTRY>
  8606. <DANGER_LEVEL>1</DANGER_LEVEL>
  8607. <DESCRIPTION>It is a Key Logger that runs in the background, recording all the keystrokes.</DESCRIPTION>
  8608. </SW>
  8609. <SW NAME="WishBone/WishBone Toolbar">  
  8610.     <DIRECTORIES>
  8611.     </DIRECTORIES>
  8612.     <FILES>
  8613.          <FILE NAME="wbm.dll" PATH="Sys32Dir"></FILE>
  8614.          <FILE NAME="wbm.dll" PATH="SysDir"></FILE>
  8615.         <FILE NAME="minst.dll" PATH="SysDir"></FILE>
  8616.         <FILE NAME="minst.dll" PATH="Sys32Dir"></FILE>
  8617.     </FILES>
  8618.     <COOKIES>
  8619.     </COOKIES>
  8620.     <REGISTRY>
  8621.         <KEYS>
  8622.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{3aa90bc2-58c0-4f4d-a87c-2c6f3d3cd5fe}"></REGKEY>
  8623.         </KEYS>
  8624.         <VALUES>
  8625.         </VALUES>
  8626.     </REGISTRY>
  8627. <DANGER_LEVEL>1</DANGER_LEVEL>
  8628. <DESCRIPTION>Browser hijacker that will change your internet settings.</DESCRIPTION>
  8629. </SW> 
  8630. <SW NAME="TheLocalSearch/TheLocalSearch Toolbar">  
  8631.     <DIRECTORIES>
  8632.     </DIRECTORIES>
  8633.     <FILES>
  8634.         <FILE NAME="qi32.dll" PATH="WinDir"></FILE>
  8635.         <FILE NAME="Tlsbar.dll" PATH="SysDir"></FILE>
  8636.         <FILE NAME="Tlsbar.dll" PATH="Sys32Dir"></FILE>
  8637.         <FILE NAME="Tlsbar.dll" PATH="WinDir"></FILE>
  8638.     </FILES>
  8639.     <COOKIES>
  8640.     </COOKIES>
  8641.     <REGISTRY>
  8642.         <KEYS>
  8643.         </KEYS>
  8644.         <VALUES>
  8645.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{4B8E6575-1013-45e9-BF77-9852ECEF07A9}"></REGVALUE>
  8646.         </VALUES>
  8647.     </REGISTRY>
  8648. <DANGER_LEVEL>1</DANGER_LEVEL>
  8649. <DESCRIPTION>Search toolbar known to install stealthily and also displays advertisements.</DESCRIPTION>
  8650. </SW>
  8651. <SW NAME="W32.Vote.D/W32.Vote.E/W32.Vote.K">  
  8652.     <DIRECTORIES>
  8653.     </DIRECTORIES>
  8654.     <FILES>
  8655.         <FILE NAME="WTC32.scr" PATH="WinDir"></FILE>
  8656.     </FILES>
  8657.     <COOKIES>
  8658.     </COOKIES>
  8659.     <REGISTRY>
  8660.         <KEYS>
  8661.         </KEYS>
  8662.         <VALUES>
  8663.         </VALUES>
  8664.     </REGISTRY>
  8665. <DANGER_LEVEL>2</DANGER_LEVEL>
  8666. <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  8667. </SW>
  8668. <SW NAME="VBS.Notup.A@mm">  
  8669.     <DIRECTORIES>
  8670.     </DIRECTORIES>
  8671.     <FILES>
  8672.         <FILE NAME="ChkMgr32.vbs" PATH="SysDir"></FILE>
  8673.         <FILE NAME="ChkMgr32.vbs" PATH="Sys32Dir"></FILE>
  8674.     </FILES>
  8675.     <COOKIES>
  8676.     </COOKIES>
  8677.     <REGISTRY>
  8678.         <KEYS>
  8679.         </KEYS>
  8680.         <VALUES>
  8681.         </VALUES>
  8682.     </REGISTRY>
  8683. <DANGER_LEVEL>2</DANGER_LEVEL>
  8684. <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  8685. </SW>
  8686. <SW NAME="W32.Titog.C.Worm">  
  8687.     <DIRECTORIES>
  8688.     </DIRECTORIES>
  8689.     <FILES>
  8690.         <FILE NAME="nabv32.exe" PATH="SysDir"></FILE>
  8691.         <FILE NAME="nabv32.exe" PATH="Sys32Dir"></FILE>
  8692.     </FILES>
  8693.     <COOKIES>
  8694.     </COOKIES>
  8695.     <REGISTRY>
  8696.         <KEYS>
  8697.         </KEYS>
  8698.         <VALUES>
  8699.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="anbv32"></REGVALUE>
  8700.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="anbv32"></REGVALUE>
  8701.         </VALUES>
  8702.     </REGISTRY>
  8703. <DANGER_LEVEL>2</DANGER_LEVEL>
  8704. <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  8705. </SW>
  8706. <SW NAME="W32.Swen.A">  
  8707.     <DIRECTORIES>
  8708.     </DIRECTORIES>
  8709.     <FILES>
  8710.         <FILE NAME="Germs0.dbv" PATH="WinDir"></FILE>
  8711.         <FILE NAME="Swen1.dat" PATH="WinDir"></FILE>
  8712.     </FILES>
  8713.     <COOKIES>
  8714.     </COOKIES>
  8715.     <REGISTRY>
  8716.         <KEYS>
  8717.         </KEYS>
  8718.         <VALUES>
  8719.         </VALUES>
  8720.     </REGISTRY>
  8721. <DANGER_LEVEL>2</DANGER_LEVEL>
  8722. <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  8723. </SW>
  8724. <SW NAME="W32.Smibag.Worm">  
  8725.     <DIRECTORIES>
  8726.     </DIRECTORIES>
  8727.     <FILES>
  8728.         <FILE NAME="raw32x.dll" PATH="WinDir"></FILE>
  8729.         <FILE NAME="sm.dll" PATH="WinDir"></FILE>
  8730.     </FILES>
  8731.     <COOKIES>
  8732.     </COOKIES>
  8733.     <REGISTRY>
  8734.         <KEYS>
  8735.         </KEYS>
  8736.         <VALUES>
  8737.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="svchost"></REGVALUE>
  8738.         </VALUES>
  8739.     </REGISTRY>
  8740. <DANGER_LEVEL>1</DANGER_LEVEL>
  8741. <DESCRIPTION>Attempts to spread itself through MSN messenger.</DESCRIPTION>
  8742. </SW>
  8743. <SW NAME="W32.Repad.Worm">  
  8744.     <DIRECTORIES>
  8745.     </DIRECTORIES>
  8746.     <FILES>
  8747.         <FILE NAME="st01b.exe" PATH="SysDir"></FILE>
  8748.         <FILE NAME="st01b.exe" PATH="Sys32Dir"></FILE>
  8749.     </FILES>
  8750.     <COOKIES>
  8751.     </COOKIES>
  8752.     <REGISTRY>
  8753.         <KEYS>
  8754.         </KEYS>
  8755.         <VALUES>
  8756.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="System Tray32"></REGVALUE>
  8757.         </VALUES>
  8758.     </REGISTRY>
  8759. <DANGER_LEVEL>1</DANGER_LEVEL>
  8760. <DESCRIPTION>Worm that is spread through file sharing networks.  Will slow down your PC.</DESCRIPTION>
  8761. </SW>
  8762. <SW NAME="W32.Ronoper.B">  
  8763.     <DIRECTORIES>
  8764.     </DIRECTORIES>
  8765.     <FILES>
  8766.         <FILE NAME="Systools.exe" PATH="WinDir"></FILE>
  8767.     </FILES>
  8768.     <COOKIES>
  8769.     </COOKIES>
  8770.     <REGISTRY>
  8771.         <KEYS>
  8772.         </KEYS>
  8773.         <VALUES>
  8774.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="System Toolkit"></REGVALUE>
  8775.         </VALUES>
  8776.     </REGISTRY>
  8777. <DANGER_LEVEL>1</DANGER_LEVEL>
  8778. <DESCRIPTION>Worm that is spread through file sharing networks.  Will slow down your PC.</DESCRIPTION>
  8779. </SW>
  8780. <SW NAME="W32.Randex.Q">  
  8781.     <DIRECTORIES>
  8782.     </DIRECTORIES>
  8783.     <FILES>
  8784.         <FILE NAME="musirc4.71.exe" PATH="SysDir"></FILE>
  8785.         <FILE NAME="musirc4.71.exe" PATH="Sys32Dir"></FILE>
  8786.     </FILES>
  8787.     <COOKIES>
  8788.     </COOKIES>
  8789.     <REGISTRY>
  8790.         <KEYS>
  8791.         </KEYS>
  8792.         <VALUES>
  8793.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="MusIRC (irc.musirc.com) client"></REGVALUE>
  8794.         </VALUES>
  8795.     </REGISTRY>
  8796. <DANGER_LEVEL>2</DANGER_LEVEL>
  8797. <DESCRIPTION>Worm that allows hackers unauthorized access to your PC.</DESCRIPTION>
  8798. </SW>
  8799. <SW NAME="W32.Randex.P">  
  8800.     <DIRECTORIES>
  8801.     </DIRECTORIES>
  8802.     <FILES>
  8803.         <FILE NAME="Cnqmax.exe" PATH="SysDir"></FILE>
  8804.         <FILE NAME="Cnqmax.exe" PATH="Sys32Dir"></FILE>
  8805.     </FILES>
  8806.     <COOKIES>
  8807.     </COOKIES>
  8808.     <REGISTRY>
  8809.         <KEYS>
  8810.         </KEYS>
  8811.         <VALUES>
  8812.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Mspatch89"></REGVALUE>
  8813.         </VALUES>
  8814.     </REGISTRY>
  8815. <DANGER_LEVEL>2</DANGER_LEVEL>
  8816. <DESCRIPTION>Worm that allows hackers unauthorized access to your PC.</DESCRIPTION>
  8817. </SW>
  8818. <SW NAME="W32.Randex.J">  
  8819.     <DIRECTORIES>
  8820.     </DIRECTORIES>
  8821.     <FILES>
  8822.         <FILE NAME="spoler.exe" PATH="SysDir"></FILE>
  8823.         <FILE NAME="spoler.exe" PATH="Sys32Dir"></FILE>
  8824.     </FILES>
  8825.     <COOKIES>
  8826.     </COOKIES>
  8827.     <REGISTRY>
  8828.         <KEYS>
  8829.         </KEYS>
  8830.         <VALUES>
  8831.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="helpmanager"></REGVALUE>
  8832.         </VALUES>
  8833.     </REGISTRY>
  8834. <DANGER_LEVEL>2</DANGER_LEVEL>
  8835. <DESCRIPTION>Worm that allows hackers unauthorized access to your PC.</DESCRIPTION>
  8836. </SW>
  8837. <SW NAME="W32.Randex.C">  
  8838.     <DIRECTORIES>
  8839.     </DIRECTORIES>
  8840.     <FILES>
  8841.         <FILE NAME="gesfm32.exe" PATH="SysDir"></FILE>
  8842.         <FILE NAME="gesfm32.exe" PATH="Sys32Dir"></FILE>
  8843.     </FILES>
  8844.     <COOKIES>
  8845.     </COOKIES>
  8846.     <REGISTRY>
  8847.         <KEYS>
  8848.         </KEYS>
  8849.         <VALUES>
  8850.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Microsoft Netview"></REGVALUE>
  8851.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="Microsoft Netview"></REGVALUE>
  8852.         </VALUES>
  8853.     </REGISTRY>
  8854. <DANGER_LEVEL>2</DANGER_LEVEL>
  8855. <DESCRIPTION>Worm that allows hackers unauthorized access to your PC.</DESCRIPTION>
  8856. </SW>
  8857. <SW NAME="W32.Quaters.A@mm/W32.Blare@mm">  
  8858.     <DIRECTORIES>
  8859.     </DIRECTORIES>
  8860.     <FILES>
  8861.         <FILE NAME="ACCOUNT_DETAILS.DOC.exe" PATH="PFDir"></FILE>
  8862.     </FILES>
  8863.     <COOKIES>
  8864.     </COOKIES>
  8865.     <REGISTRY>
  8866.         <KEYS>
  8867.         </KEYS>
  8868.         <VALUES>
  8869.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Windows Task Manager"></REGVALUE>
  8870.         </VALUES>
  8871.     </REGISTRY>
  8872. <DANGER_LEVEL>1</DANGER_LEVEL>
  8873. <DESCRIPTION>Worm that is spread through file sharing networks.  Will slow down your PC.</DESCRIPTION>
  8874. </SW>
  8875. <SW NAME="W32.Patoo@mm">  
  8876.     <DIRECTORIES>
  8877.     </DIRECTORIES>
  8878.     <FILES>
  8879.         <FILE NAME="Msngrblock.exe" PATH="WinDir"></FILE>
  8880.         <FILE NAME="MSN Ad Blocker.exe" PATH="PFDir\\Kazaa\\My Shared Folder"></FILE>
  8881.     </FILES>
  8882.     <COOKIES>
  8883.     </COOKIES>
  8884.     <REGISTRY>
  8885.         <KEYS>
  8886.         </KEYS>
  8887.         <VALUES>
  8888.         </VALUES>
  8889.     </REGISTRY>
  8890. <DANGER_LEVEL>2</DANGER_LEVEL>
  8891. <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  8892. </SW>
  8893. <SW NAME="W32.Pandem.C.Worm">  
  8894.     <DIRECTORIES>
  8895.     </DIRECTORIES>
  8896.     <FILES>
  8897.         <FILE NAME="videomgr.exe" PATH="SysDir"></FILE>
  8898.         <FILE NAME="videomgr.exe" PATH="Sys32Dir"></FILE>
  8899.     </FILES>
  8900.     <COOKIES>
  8901.     </COOKIES>
  8902.     <REGISTRY>
  8903.         <KEYS>
  8904.         </KEYS>
  8905.         <VALUES>
  8906.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Video Manager"></REGVALUE>
  8907.         </VALUES>
  8908.     </REGISTRY>
  8909. <DANGER_LEVEL>2</DANGER_LEVEL>
  8910. <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  8911. </SW>
  8912. <SW NAME="W32.Neroma@mm">  
  8913.     <DIRECTORIES>
  8914.     </DIRECTORIES>
  8915.     <FILES>
  8916.         <FILE NAME="Nerosys.exe" PATH="WinDir"></FILE>
  8917.     </FILES>
  8918.     <COOKIES>
  8919.     </COOKIES>
  8920.     <REGISTRY>
  8921.         <KEYS>
  8922.         </KEYS>
  8923.         <VALUES>
  8924.         </VALUES>
  8925.     </REGISTRY>
  8926. <DANGER_LEVEL>2</DANGER_LEVEL>
  8927. <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  8928. </SW>
  8929. <SW NAME="Trojan.Win32.DSS">
  8930.     <DIRECTORIES>
  8931.     </DIRECTORIES>
  8932.     <FILES>
  8933.     </FILES>
  8934.     <COOKIES>
  8935.     </COOKIES>
  8936.     <REGISTRY>
  8937.         <KEYS>
  8938.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\WindowsNT\\CurrentVersion\\Winlogon" VALUE="openme.exe"></REGKEY>        
  8939.         </KEYS>
  8940.         <VALUES>
  8941.         </VALUES>
  8942.     </REGISTRY>
  8943. <DANGER_LEVEL>2</DANGER_LEVEL>
  8944. <DESCRIPTION>Worm that allows hackers unauthorized access to your PC.</DESCRIPTION>
  8945. </SW>
  8946. <SW NAME="Win32Info/TROJ_DLUCA.F">
  8947.     <DIRECTORIES>
  8948.     </DIRECTORIES>
  8949.     <FILES>
  8950.         <FILE NAME="Win32info.exe" PATH="Sys32Dir"></FILE>
  8951.     </FILES>
  8952.     <COOKIES>
  8953.     </COOKIES>
  8954.     <REGISTRY>
  8955.         <KEYS>
  8956.         </KEYS>
  8957.         <VALUES>
  8958.                  <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="win32info"></REGVALUE>
  8959.         </VALUES>
  8960.     </REGISTRY>
  8961. <DANGER_LEVEL>1</DANGER_LEVEL>
  8962. <DESCRIPTION>Downloading trojan used to download various applications to your PC.</DESCRIPTION>
  8963. </SW>
  8964. <SW NAME="ClickToSearch/BestPhrases">  
  8965.      <DIRECTORIES>
  8966.       </DIRECTORIES>
  8967.      <FILES>
  8968.          <FILE NAME="BPV2S.DLL" PATH="SysDir"></FILE>
  8969.          <FILE NAME="BPV2S.DLL" PATH="Sys32Dir"></FILE>
  8970.          <FILE NAME="BPV2T.DLL" PATH="SysDir"></FILE>
  8971.          <FILE NAME="BPV2T.DLL" PATH="Sys32Dir"></FILE>
  8972.      </FILES>
  8973.      <COOKIES>
  8974.      </COOKIES>
  8975.      <REGISTRY>
  8976.          <KEYS>
  8977.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{F4A645D0-D4D5-439E-9DBC-B31BBD9CB890}"></REGKEY>
  8978.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{F4A645D0-D4D5-439E-9DBC-B31BBD9CB890}"></REGKEY>
  8979.          </KEYS>
  8980.          <VALUES>
  8981.          </VALUES>
  8982.      </REGISTRY>
  8983. <DANGER_LEVEL>1</DANGER_LEVEL>
  8984. <DESCRIPTION>Browser hijacker that will change your internet settings.</DESCRIPTION>
  8985. </SW>
  8986. <SW NAME="PeopleOnPage/PeopleOnPage.AproposMedia">
  8987.     <DIRECTORIES>
  8988.             <DIR NAME="pop" PATH="PFDir"></DIR>
  8989.     </DIRECTORIES>
  8990.     <FILES>
  8991.         <FILE NAME="sysmonn.exe" PATH=""></FILE>
  8992.         <FILE NAME="sysmono.exe" PATH=""></FILE>
  8993.         <FILE NAME="popsrv184.exe" PATH=""></FILE>
  8994.         <FILE NAME="popsrv205.exe" PATH="PFDir\\pop"></FILE>
  8995.         <FILE NAME="pop205.dll" PATH=""></FILE>
  8996.         <FILE NAME="monpop.exe" PATH="WinDir\\downloaded program files"></FILE>
  8997.          <FILE NAME="aproposplugin.dll" PATH="PFDir\\aproposclient"></FILE>
  8998.          <FILE NAME="aproposplugin.dll" PATH="PFDir\\sysai"></FILE>
  8999.         </FILES>
  9000.     <COOKIES>
  9001.     </COOKIES>
  9002.     <REGISTRY>
  9003.         <KEYS>
  9004.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\explorer\\browser helper objects" VALUE="{01C5BF6C-E699-4CD7-BEA1-786FA05C83AB}"></REGKEY>
  9005.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{01C5BF6C-E699-4CD7-BEA1-786FA05C83AB}"></REGKEY>
  9006.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE" VALUE="Apropos"></REGKEY>
  9007.               <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{01C5BF6C-E699-4CD7-BEA1-786FA05C83AB}"></REGKEY>
  9008.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{645FD3BC-C314-4F7A-9D2E-64D62A0FDD78}"></REGKEY>
  9009.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{65c8c1f5-230e-4dc9-9a0d-f3159a5e7778}"></REGKEY>
  9010.         </KEYS>
  9011.         <VALUES>
  9012.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="pop"></REGVALUE>        
  9013.         </VALUES>
  9014.     </REGISTRY>
  9015. <DANGER_LEVEL>1</DANGER_LEVEL>
  9016. <DESCRIPTION>Toolbar consisting of an advertising component.</DESCRIPTION>
  9017. </SW>
  9018. <SW NAME="WeatherCast">
  9019.     <DIRECTORIES>
  9020.     </DIRECTORIES>
  9021.     <FILES>
  9022.         <FILE NAME="Weather.exe" PATH="PFDir\\WeatherCast"></FILE>
  9023.     </FILES>
  9024.     <COOKIES>
  9025.     </COOKIES>
  9026.     <REGISTRY>
  9027.         <KEYS>
  9028.         </KEYS>
  9029.         <VALUES>
  9030.                  <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="weathercast"></REGVALUE>
  9031.         </VALUES>
  9032.     </REGISTRY>
  9033. <DANGER_LEVEL>1</DANGER_LEVEL>
  9034. <DESCRIPTION>Weather program distributed by WhenU, an adware company, used to deliver advertisements to your PC.</DESCRIPTION>
  9035. </SW>
  9036. <SW NAME="WebDialer">
  9037.     <DIRECTORIES>
  9038.     </DIRECTORIES>
  9039.     <FILES>
  9040.         <FILE NAME="od-dflt0001.exe" PATH=""></FILE>
  9041.     </FILES>
  9042.     <COOKIES>
  9043.     </COOKIES>
  9044.     <REGISTRY>
  9045.         <KEYS>
  9046.         </KEYS>
  9047.         <VALUES>
  9048.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="C:\\Program Files\\Webdialer"></REGVALUE>
  9049.         </VALUES>
  9050.     </REGISTRY>
  9051. <DANGER_LEVEL>2</DANGER_LEVEL>
  9052. <DESCRIPTION>Dialer program that dials a very expensive number to access pornography, many times without user's knowledge.</DESCRIPTION>
  9053. </SW>
  9054. <SW NAME="MemoryMeter">  
  9055.     <DIRECTORIES>
  9056.     <DIR NAME="memorymeter" PATH="PFDir"></DIR>
  9057.     </DIRECTORIES>
  9058.     <FILES>
  9059.         <FILE NAME="memorymeter.exe" PATH="PFDir\\memorymeter"></FILE>
  9060.     </FILES>
  9061.     <COOKIES>
  9062.     </COOKIES>
  9063.     <REGISTRY>
  9064.         <KEYS>
  9065.         </KEYS>
  9066.         <VALUES>
  9067.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="memorymeter"></REGVALUE>
  9068.         </VALUES>
  9069.     </REGISTRY>
  9070. <DANGER_LEVEL>1</DANGER_LEVEL>
  9071. <DESCRIPTION>Adware that monitors your system memory, comes with advertising.</DESCRIPTION>
  9072. </SW>
  9073. <SW NAME="IETray">  
  9074.     <DIRECTORIES>
  9075.     </DIRECTORIES>
  9076.     <FILES>
  9077.         <FILE NAME="iemsg.dll" PATH="Sys32Dir"></FILE>
  9078.         <FILE NAME="ers_def.htm" PATH="WinDir\\web"></FILE>
  9079.         <FILE NAME="ers_src.htm" PATH="WinDir\\web"></FILE>
  9080.         <FILE NAME="iemsg.dll" PATH="SysDir"></FILE>
  9081.         <FILE NAME="csrss.exe" PATH="WinDir"></FILE>
  9082.     </FILES>
  9083.     <COOKIES>
  9084.     </COOKIES>
  9085.     <REGISTRY>
  9086.         <KEYS>
  9087.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{BD51AEC6-7991-4A60-94D6-D5FEBB655D10}"></REGKEY>
  9088.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{BD51AEC6-7991-4A60-94D6-D5FEBB655D10}"></REGKEY>
  9089.         </KEYS>
  9090.         <VALUES>
  9091.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="CSRSS"></REGVALUE>
  9092.         </VALUES>
  9093.     </REGISTRY>
  9094. <DANGER_LEVEL>1</DANGER_LEVEL>
  9095. <DESCRIPTION>Search Sidebar hijacker known to display advertisements.</DESCRIPTION>
  9096. </SW>
  9097. <SW NAME="Apophis Spy">  
  9098.     <DIRECTORIES>
  9099.     </DIRECTORIES>
  9100.     <FILES>
  9101.         <FILE NAME="zxrwvh.dll" PATH="SysDir"></FILE>
  9102.         <FILE NAME="zxrwvh.exe" PATH="SysDir"></FILE>
  9103.         <FILE NAME="aspy_srv.exe" PATH=""></FILE>
  9104.         <FILE NAME="editkeylogger.exe" PATH=""></FILE>
  9105.         <FILE NAME="keylogger.exe" PATH=""></FILE>
  9106.         <FILE NAME="lisez moi.txt" PATH=""></FILE>
  9107.     </FILES>
  9108.     <COOKIES>
  9109.     </COOKIES>
  9110.     <REGISTRY>
  9111.         <KEYS>
  9112.         </KEYS>
  9113.         <VALUES>
  9114.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\runservices" VALUE="regkeyname"></REGVALUE>
  9115.         </VALUES>
  9116.     </REGISTRY>
  9117. <DANGER_LEVEL>1</DANGER_LEVEL>
  9118. <DESCRIPTION>It is a Key Logger that runs in the background, recording all the keystrokes. </DESCRIPTION>
  9119. </SW>
  9120. <SW NAME="Adtomi">  
  9121.      <DIRECTORIES>
  9122.      </DIRECTORIES>
  9123.      <FILES>
  9124.          <FILE NAME="pRmvr.exe" PATH=""></FILE>
  9125.         <FILE NAME="YSTCKAO32.EXE" PATH=""></FILE>
  9126.       </FILES>
  9127.      <COOKIES>
  9128.      </COOKIES>
  9129.      <REGISTRY>
  9130.          <KEYS>
  9131.          </KEYS>
  9132.          <VALUES>
  9133.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="YahooStock"></REGVALUE>
  9134.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="pRmvr.exe"></REGVALUE>
  9135.          </VALUES>
  9136.      </REGISTRY>
  9137.  <DANGER_LEVEL>1</DANGER_LEVEL>
  9138.  <DESCRIPTION>Adtomi hi-jacks your home page and open pop-up windows.</DESCRIPTION>
  9139. </SW>
  9140. <SW NAME="Adgoblin/Adsincontext">
  9141.     <DIRECTORIES>
  9142.     </DIRECTORIES>
  9143.     <FILES>
  9144.         <FILE NAME="ftpcutrs2.dll" PATH="SysDir"></FILE>
  9145.         <FILE NAME="iudq.dll" PATH="Sys32Dir"></FILE>
  9146.         <FILE NAME="icbmp.dll" PATH="Sys32Dir"></FILE>
  9147.         <FILE NAME="DRMV2ICLT.DLL" PATH="Sys32Dir"></FILE>
  9148.         <FILE NAME="Daxtime.dll" PATH="Sys32Dir"></FILE>
  9149.         <FILE NAME="thid.dll" PATH="Sys32Dir"></FILE>
  9150.         <FILE NAME="eventlowg.dll" PATH="Sys32Dir"></FILE>
  9151.        <FILE NAME="ftpcutrs2.dll" PATH=""></FILE>
  9152.        <FILE NAME="iudq.dll" PATH=""></FILE>
  9153.        <FILE NAME="icbmp.dll" PATH=""></FILE>
  9154.        <FILE NAME="DRMV2ICLT.DLL" PATH=""></FILE>
  9155.        <FILE NAME="Daxtime.dll" PATH=""></FILE>
  9156.        <FILE NAME="thid.dll" PATH=""></FILE>
  9157.        <FILE NAME="eventlowg.dll" PATH=""></FILE>
  9158.        <FILE NAME="dandgerous creatures.dll" PATH=""></FILE>
  9159.     </FILES>
  9160.     <COOKIES>
  9161.     </COOKIES>
  9162.     <REGISTRY>
  9163.        <KEYS>
  9164.        </KEYS>
  9165.        <VALUES>
  9166.        </VALUES>
  9167.     </REGISTRY>
  9168. <DANGER_LEVEL>1</DANGER_LEVEL>
  9169. <DESCRIPTION>Browser Hijacker that hijacks your internet settings</DESCRIPTION>
  9170. </SW>
  9171. <SW NAME="AdGoblin.plathping">  
  9172.      <DIRECTORIES>
  9173.     </DIRECTORIES>
  9174.      <FILES>
  9175.          <FILE NAME="plathping.exe" PATH=""></FILE>
  9176.         <FILE NAME="plathping.exe" PATH="SysDir"></FILE>
  9177.         <FILE NAME="plathping.exe" PATH="Sys32Dir"></FILE>
  9178.       </FILES>
  9179.      <COOKIES>
  9180.      </COOKIES>
  9181.      <REGISTRY>
  9182.          <KEYS>
  9183.          </KEYS>
  9184.          <VALUES>
  9185.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="plathping.exe"></REGVALUE>
  9186.          </VALUES>
  9187.      </REGISTRY>
  9188.      <DANGER_LEVEL>1</DANGER_LEVEL>
  9189. <DESCRIPTION>It changes browser settings and shows commercial adverts. It stays resident in background. </DESCRIPTION>
  9190. </SW>
  9191. <SW NAME="AdGoblin.foontext">  
  9192.      <DIRECTORIES>
  9193.      </DIRECTORIES>
  9194.      <FILES>
  9195.          <FILE NAME="foontext.dll" PATH="SysDir"></FILE>
  9196.          <FILE NAME="foontext.dll" PATH="Sys32Dir"></FILE>
  9197.       </FILES>
  9198.      <COOKIES>
  9199.      </COOKIES>
  9200.      <REGISTRY>
  9201.          <KEYS>
  9202.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{3182C8AB-5A3E-4644-80DA-647417799B11}"></REGKEY>
  9203.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{3182C8AB-5A3E-4644-80DA-647417799B11}"></REGKEY>
  9204.          </KEYS>
  9205.          <VALUES>
  9206.          </VALUES>
  9207.      </REGISTRY>
  9208.  <DANGER_LEVEL>1</DANGER_LEVEL>
  9209.  <DESCRIPTION>It is a browser helper object that open pop-up windows. </DESCRIPTION>
  9210. </SW>
  9211. <SW NAME="Adtest">  
  9212.      <DIRECTORIES>
  9213.     </DIRECTORIES>
  9214.      <FILES>
  9215.          <FILE NAME="msfiles.exe" PATH="WinDir"></FILE>
  9216.         <FILE NAME="intnets.exe" PATH="Sys32Dir"></FILE>
  9217.          <FILE NAME="scridows.exe" PATH="Sys32Dir"></FILE>
  9218.          <FILE NAME="sysinfer.exe" PATH="Sys32Dir"></FILE>
  9219.       </FILES>
  9220.      <COOKIES>
  9221.      </COOKIES>
  9222.      <REGISTRY>
  9223.          <KEYS>
  9224.          </KEYS>
  9225.          <VALUES>
  9226.          </VALUES>
  9227.      </REGISTRY>
  9228.      <DANGER_LEVEL>1</DANGER_LEVEL>
  9229.  <DESCRIPTION>It is a browser hijacker that resets your browser's settings to point to other sites. </DESCRIPTION>
  9230. </SW>
  9231. <SW NAME="TopSearch">
  9232.      <DIRECTORIES>
  9233.         <DIR NAME="altnet" PATH="PFDir"></DIR>
  9234.         <DIR NAME="altnet" PATH="WinDir\\Temp"></DIR>
  9235.         <DIR NAME="points manager" PATH="PFDir\\altnet"></DIR>
  9236.         <DIR NAME="My Altnet Shares" PATH="PFDir\\altnet"></DIR>
  9237.         <DIR NAME="Bullguard Protection" PATH="PFDir\\altnet\\My Altnet Shares"></DIR>
  9238.         <DIR NAME="localpages" PATH="PFDir\\altnet\\points manager"></DIR>
  9239.      </DIRECTORIES>
  9240.      <FILES>
  9241.          <FILE NAME="topsearch.dll" PATH="PFDir\\kazaa lite"></FILE>
  9242.          <FILE NAME="altnet.css" PATH="PFDir\\altnet\\points manager\\localpages"></FILE>
  9243.          <FILE NAME="asmps.dll" PATH=""></FILE>
  9244.          <FILE NAME="points manager.exe" PATH=""></FILE>
  9245.         <FILE NAME="pminstall.cab" PATH="WinDir\\Temp\\altnet"></FILE>
  9246.         <FILE NAME="pmfiles.cab" PATH="WinDir\\Temp\\altnet"></FILE>
  9247.         <FILE NAME="pmexe.cab" PATH="WinDir\\Temp\\altnet"></FILE>
  9248.         <FILE NAME="mysearch.cab" PATH="WinDir\\Temp\\altnet"></FILE>
  9249.         <FILE NAME="dminstall3.cab" PATH="WinDir\\Temp\\altnet"></FILE>
  9250.         <FILE NAME="dmfiles.cab" PATH="WinDir\\Temp\\altnet"></FILE>
  9251.         <FILE NAME="setup.cab" PATH="WinDir\\Temp\\altnet"></FILE>
  9252.         <FILE NAME="dminfo3.cab" PATH="WinDir\\Temp\\altnet"></FILE>        
  9253.       </FILES>
  9254.      <COOKIES>
  9255.      </COOKIES>
  9256.      <REGISTRY>
  9257.          <KEYS>
  9258.          </KEYS>
  9259.          <VALUES>
  9260.          </VALUES>
  9261.      </REGISTRY>
  9262.      <DANGER_LEVEL>1</DANGER_LEVEL>
  9263.  <DESCRIPTION>It is a Browser Helper Object. A component that Internet Explorer will load whenever it starts, shares IE's memory context, can perform any action on the available windows and modules.</DESCRIPTION>
  9264. </SW>
  9265. <SW NAME="RelatedLinks">  
  9266.      <DIRECTORIES>
  9267.       </DIRECTORIES>
  9268.      <FILES>
  9269.          <FILE NAME="lbbho.dll" PATH="SysDir"></FILE>
  9270.          <FILE NAME="lbbho.dll" PATH="Sys32Dir"></FILE>
  9271.         <FILE NAME="lbbho.dll" PATH=""></FILE>
  9272.       </FILES>
  9273.      <COOKIES>
  9274.      </COOKIES>
  9275.      <REGISTRY>
  9276.          <KEYS>
  9277.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{efd84954-6b46-42f4-81f3-94ce9a77052d}"></REGKEY>
  9278.          </KEYS>
  9279.          <VALUES>
  9280.          </VALUES>
  9281.      </REGISTRY>
  9282.      <DANGER_LEVEL>1</DANGER_LEVEL>
  9283.  <DESCRIPTION>It is an Adware that brings ads to your computer.</DESCRIPTION>
  9284. </SW>
  9285. <SW NAME="Infotel srl">
  9286.      <DIRECTORIES>
  9287.      </DIRECTORIES>
  9288.      <FILES>
  9289.      </FILES>
  9290.      <COOKIES>
  9291.      </COOKIES>
  9292.      <REGISTRY>
  9293.          <KEYS>
  9294.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\code store database\\distribution units" VALUE="{ffff0003-0001-101a-a3c9-08002b2f49fb}"></REGKEY> 
  9295.         </KEYS>
  9296.          <VALUES>
  9297.          </VALUES>
  9298.      </REGISTRY>
  9299.  <DANGER_LEVEL>1</DANGER_LEVEL>
  9300.  <DESCRIPTION>It is an Adware that brings ads to your computer.</DESCRIPTION>
  9301.  </SW>
  9302. <SW NAME="ABetterInternet.susp">
  9303.     <DIRECTORIES>
  9304.     </DIRECTORIES>
  9305.     <FILES>
  9306.         <FILE NAME="susp.exe" PATH="WinDir"></FILE>
  9307.         <FILE NAME="Susp.ini" PATH="WinDir"></FILE>
  9308.         <FILE NAME="Susp.inf" PATH="WinDir"></FILE>
  9309.     </FILES>
  9310.     <COOKIES>
  9311.     </COOKIES>
  9312.     <REGISTRY>
  9313.        <KEYS>
  9314.        </KEYS> 
  9315.        <VALUES>
  9316.         <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="SUSP"></REGVALUE>
  9317.        </VALUES>
  9318.     </REGISTRY>
  9319. <DANGER_LEVEL>1</DANGER_LEVEL>
  9320. <DESCRIPTION>ABetterInternet.susp is runs at start up. It has been reported to display targeted pop-up ads.</DESCRIPTION>
  9321. </SW>
  9322. <SW NAME="VBS.FREELINK">
  9323.     <DIRECTORIES>
  9324.     </DIRECTORIES>
  9325.     <FILES>
  9326.         <FILE NAME="links.vbs" PATH="WinDir"></FILE>
  9327.         <FILE NAME="rundll.vbs" PATH="SysDir"></FILE>
  9328.     </FILES>
  9329.     <COOKIES>
  9330.     </COOKIES>
  9331.     <REGISTRY>
  9332.        <KEYS>
  9333.        </KEYS> 
  9334.        <VALUES>
  9335.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="rundll"></REGVALUE>
  9336.        </VALUES>
  9337.     </REGISTRY>
  9338. <DANGER_LEVEL>1</DANGER_LEVEL>
  9339. <DESCRIPTION>It is an encrypted worm virus written in VBScript language that is capable of infecting Windows 95/98/2000. This destructive virus is capable of sending a copy of itself through MSOutlook, MIRC, PIRCH and mapped network directories.</DESCRIPTION>
  9340. </SW>
  9341. <SW NAME="CoolSavings">
  9342.      <DIRECTORIES>
  9343.      </DIRECTORIES>
  9344.      <FILES>
  9345.          <FILE NAME="cpnmgr.dll" PATH="WinDir\\downloaded program files"></FILE>
  9346.     </FILES>
  9347.      <COOKIES>
  9348.      </COOKIES>
  9349.      <REGISTRY>
  9350.          <KEYS>
  9351.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{549F957E-2F89-11D6-8CFE-00C04F52B225}"></REGKEY> 
  9352.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\code store database\\distribution units" VALUE="{549F957E-2F89-11D6-8CFE-00C04F52B225}"></REGKEY> 
  9353.         </KEYS>
  9354.          <VALUES>
  9355.          </VALUES>
  9356.      </REGISTRY>
  9357.  <DANGER_LEVEL>1</DANGER_LEVEL>
  9358.  <DESCRIPTION>It is an Adware that brings ads to your computer.</DESCRIPTION>
  9359.  </SW>
  9360. <SW NAME="ChatBlocker">
  9361.      <DIRECTORIES>
  9362.      </DIRECTORIES>
  9363.      <FILES>
  9364.          <FILE NAME="chatblocker.exe" PATH="PFDir\\exploreanywhere\\chatblocker"></FILE>
  9365.     </FILES>
  9366.      <COOKIES>
  9367.      </COOKIES>
  9368.      <REGISTRY>
  9369.          <KEYS>
  9370.         </KEYS>
  9371.          <VALUES>
  9372.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="1Win32Cfg"></REGVALUE>
  9373.          </VALUES>
  9374.      </REGISTRY>
  9375.  <DANGER_LEVEL>1</DANGER_LEVEL>
  9376.  <DESCRIPTION>It is a KeyLogger that runs in the background, recording all the keystrokes.</DESCRIPTION>
  9377.  </SW>
  9378. <SW NAME="AtHoc Toolbar">
  9379.      <DIRECTORIES>
  9380.      </DIRECTORIES>
  9381.      <FILES>
  9382.          <FILE NAME="athoctbr.dll" PATH="SysDir"></FILE>
  9383.          <FILE NAME="athoctbr.dll" PATH="Sys32Dir"></FILE>
  9384.     </FILES>
  9385.      <COOKIES>
  9386.      </COOKIES>
  9387.      <REGISTRY>
  9388.          <KEYS>
  9389.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{001f2470-5df5-11d3-b991-00a0c9bb0874}"></REGKEY> 
  9390.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{001f2470-5df5-11d3-b991-00a0c9bb0874}"></REGKEY> 
  9391.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{001f2470-5df5-11d3-b991-00a0c9bb0874}"></REGKEY> 
  9392.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{001f2470-5df5-11d3-b991-00a0c9bb0874}"></REGKEY> 
  9393.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{001f2470-5df5-11d3-b991-00a0c9bb0874}"></REGKEY> 
  9394.          </KEYS>
  9395.          <VALUES>
  9396.          </VALUES>
  9397.      </REGISTRY>
  9398.  <DANGER_LEVEL>1</DANGER_LEVEL>
  9399.  <DESCRIPTION>It is an Adware that brings ads to your computer.</DESCRIPTION>
  9400.  </SW>
  9401. <SW NAME="AdLogix">
  9402.      <DIRECTORIES>
  9403.      </DIRECTORIES>
  9404.      <FILES>
  9405.          <FILE NAME="phelper.dll" PATH="SysDir"></FILE>
  9406.          <FILE NAME="phelper.dll" PATH="Sys32Dir"></FILE>
  9407.     </FILES>
  9408.      <COOKIES>
  9409.      </COOKIES>
  9410.      <REGISTRY>
  9411.          <KEYS>
  9412.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{024de5eb-3649-445e-8d57-c09a9a33d479}"></REGKEY> 
  9413.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{024de5eb-3649-445e-8d57-c09a9a33d479}"></REGKEY> 
  9414.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{024de5eb-3649-445e-8d57-c09a9a33d479}"></REGKEY> 
  9415.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{024de5eb-3649-445e-8d57-c09a9a33d479}"></REGKEY> 
  9416.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{024de5eb-3649-445e-8d57-c09a9a33d479}"></REGKEY> 
  9417.          </KEYS>
  9418.          <VALUES>
  9419.          </VALUES>
  9420.      </REGISTRY>
  9421.  <DANGER_LEVEL>1</DANGER_LEVEL>
  9422.  <DESCRIPTION>It is a browser helper object and brings ads to your computer.</DESCRIPTION>
  9423.  </SW>
  9424. <SW NAME="WebSearch">
  9425.      <DIRECTORIES>
  9426.          <DIR NAME="websearch" PATH="PFDir"></DIR>
  9427.      </DIRECTORIES>
  9428.      <FILES>
  9429.          <FILE NAME="websearch1.exe" PATH="PFDir\\websearch"></FILE>
  9430.          <FILE NAME="spotonbh.dll" PATH="SysDir"></FILE>
  9431.          <FILE NAME="spotonbh.dll" PATH="Sys32Dir"></FILE>
  9432.          <FILE NAME="xzxsv.wzg" PATH=""></FILE>
  9433.         <FILE NAME="Stoolbar.dll" PATH="SysDir"></FILE>
  9434.         <FILE NAME="Stoolbar.dll" PATH="Sys32Dir"></FILE>
  9435.     </FILES>
  9436.      <COOKIES>
  9437.      </COOKIES>
  9438.      <REGISTRY>
  9439.          <KEYS>
  9440.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{001DAE60-95C0-11d3-924E-009027950886}"></REGKEY> 
  9441.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{001DAE60-95C0-11d3-924E-009027950886}"></REGKEY> 
  9442.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{001DAE60-95C0-11d3-924E-009027950886}"></REGKEY> 
  9443.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{001DAE60-95C0-11d3-924E-009027950886}"></REGKEY> 
  9444.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{001DAE60-95C0-11d3-924E-009027950886}"></REGKEY> 
  9445.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{6A85D97D-665D-4825-8341-9501AD9F56A3}"></REGKEY>
  9446.         </KEYS>
  9447.          <VALUES>
  9448.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{4e7bd74f-2b8d-469e-a3fa-f363b384b77d}"></REGVALUE>
  9449.          </VALUES>
  9450.      </REGISTRY>
  9451.  <DANGER_LEVEL>1</DANGER_LEVEL>
  9452.  <DESCRIPTION>It is a Hijacker that resets your browser's settings to point to other sites.</DESCRIPTION>
  9453.  </SW>
  9454. <SW NAME="W32.Netsky.H@mm">  
  9455.     <DIRECTORIES>
  9456.     </DIRECTORIES>
  9457.     <FILES>
  9458.         <FILE NAME="maja.exe" PATH="WinDir"></FILE>
  9459.     </FILES>
  9460.     <COOKIES>
  9461.     </COOKIES>
  9462.     <REGISTRY>
  9463.         <KEYS>
  9464.         </KEYS>
  9465.         <VALUES>
  9466.            </VALUES>
  9467.     </REGISTRY>
  9468. <DANGER_LEVEL>1</DANGER_LEVEL>
  9469. <DESCRIPTION>It is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives. </DESCRIPTION>
  9470. </SW>
  9471. <SW NAME="AutoStartup">  
  9472.     <DIRECTORIES>
  9473.     </DIRECTORIES>
  9474.     <FILES>
  9475.         <FILE NAME="ac.aut" PATH="WinDir"></FILE>
  9476.         <FILE NAME="ib.exe" PATH="WinDir"></FILE>
  9477.         <FILE NAME="unast.exe" PATH="WinDir"></FILE>
  9478.         <FILE NAME="AST.EXE" PATH="WinDir"></FILE>
  9479.         <FILE NAME="AST.EXE" PATH="SysDir"></FILE>
  9480.         <FILE NAME="AST.EXE" PATH="Sys32Dir"></FILE>
  9481.     </FILES>
  9482.     <COOKIES>
  9483.     </COOKIES>
  9484.     <REGISTRY>
  9485.         <KEYS>
  9486.         </KEYS>
  9487.         <VALUES>
  9488.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="ast"></REGVALUE>
  9489.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="astart"></REGVALUE>
  9490.            </VALUES>
  9491.     </REGISTRY>
  9492. <DANGER_LEVEL>1</DANGER_LEVEL>
  9493. <DESCRIPTION>It employs a user's Internet connection in the background without their knowledge or explicit permission, and gathers/transmits info on the user, their machine, or their behavior.</DESCRIPTION>
  9494. </SW>
  9495. <SW NAME="I Love You">  
  9496.     <DIRECTORIES>
  9497.     </DIRECTORIES>
  9498.     <FILES>
  9499.         <FILE NAME="iloveyou.txt" PATH=""></FILE>
  9500.         <FILE NAME="iloveyou.vbs" PATH=""></FILE>
  9501.         <FILE NAME="lovele~1.vbs" PATH=""></FILE>
  9502.         <FILE NAME="vbs-mail.vbs" PATH=""></FILE>
  9503.         <FILE NAME="_ilove~1.txt" PATH=""></FILE>
  9504.     </FILES>
  9505.     <COOKIES>
  9506.     </COOKIES>
  9507.     <REGISTRY>
  9508.         <KEYS>
  9509.         </KEYS>
  9510.         <VALUES>
  9511.            </VALUES>
  9512.     </REGISTRY>
  9513. <DANGER_LEVEL>1</DANGER_LEVEL>
  9514. <DESCRIPTION>It is a Worm that propagates by attacking other machines and copying itself to them.It may replace files, but do not insert themselves into files (as viruses do).</DESCRIPTION>
  9515. </SW>
  9516. <SW NAME="MSBlast.b">  
  9517.     <DIRECTORIES>
  9518.     </DIRECTORIES>
  9519.     <FILES>
  9520.         <FILE NAME="msblast.exe" PATH=""></FILE>
  9521.         <FILE NAME="msblast_unpacked.exe" PATH=""></FILE>
  9522.     </FILES>
  9523.     <COOKIES>
  9524.     </COOKIES>
  9525.     <REGISTRY>
  9526.         <KEYS>
  9527.         </KEYS>
  9528.         <VALUES>
  9529.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="windows auto update"></REGVALUE>
  9530.            </VALUES>
  9531.     </REGISTRY>
  9532. <DANGER_LEVEL>1</DANGER_LEVEL>
  9533. <DESCRIPTION>It is a Worm that propagates by attacking other machines and copying itself to them.It may replace files, but do not insert themselves into files (as viruses do).</DESCRIPTION>
  9534. </SW>
  9535. <SW NAME="W32.Spybot Worm">
  9536.     <DIRECTORIES>
  9537.     </DIRECTORIES>
  9538.     <FILES>
  9539.     </FILES>
  9540.     <COOKIES>
  9541.     </COOKIES>
  9542.     <REGISTRY>
  9543.        <KEYS>
  9544.        </KEYS>
  9545.        <VALUES>
  9546.        </VALUES>
  9547.     </REGISTRY>
  9548. <DANGER_LEVEL>1</DANGER_LEVEL>
  9549. <DESCRIPTION>It is a Worm that propagates by attacking other machines and copying itself to them.It may replace files, but do not insert themselves into files (as viruses do).</DESCRIPTION>
  9550. </SW>
  9551. <SW NAME="I-Worm.Mimail.i">
  9552.     <DIRECTORIES>
  9553.     </DIRECTORIES>
  9554.     <FILES>
  9555.         <FILE NAME="mimail-l_unpacked.exe" PATH=""></FILE>
  9556.     </FILES>
  9557.     <COOKIES>
  9558.     </COOKIES>
  9559.     <REGISTRY>
  9560.        <KEYS>
  9561.        </KEYS>
  9562.        <VALUES>
  9563.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="svchost32"></REGVALUE>
  9564.        </VALUES>
  9565.     </REGISTRY>
  9566. <DANGER_LEVEL>1</DANGER_LEVEL>
  9567. <DESCRIPTION>It is a Worm that propagates by attacking other machines and copying itself to them.It may replace files, but do not insert themselves into files (as viruses do).</DESCRIPTION>
  9568. </SW>
  9569. <SW NAME="W32.Netsky.I@mm">
  9570.     <DIRECTORIES>
  9571.     </DIRECTORIES>
  9572.     <FILES>
  9573.         <FILE NAME="fooding.exe" PATH="WinDir"></FILE>
  9574.     </FILES>
  9575.     <COOKIES>
  9576.     </COOKIES>
  9577.     <REGISTRY>
  9578.        <KEYS>
  9579.        </KEYS>
  9580.        <VALUES>
  9581.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Tiny AV"></REGVALUE>
  9582.        </VALUES>
  9583.     </REGISTRY>
  9584. <DANGER_LEVEL>1</DANGER_LEVEL>
  9585. <DESCRIPTION>It is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses.</DESCRIPTION>
  9586. </SW>
  9587. <SW NAME="Global Killer 1.0">
  9588.     <DIRECTORIES>
  9589.     </DIRECTORIES>
  9590.     <FILES>
  9591.         <FILE NAME="ieloader.dll" PATH="WinDir\\downloaded program files"></FILE>
  9592.         <FILE NAME="cliente.exe" PATH=""></FILE>
  9593.         <FILE NAME="instrucciones de uso.txt" PATH=""></FILE>
  9594.     </FILES>
  9595.     <COOKIES>
  9596.     </COOKIES>
  9597.     <REGISTRY>
  9598.        <KEYS>
  9599.        </KEYS>
  9600.        <VALUES>
  9601.        </VALUES>
  9602.     </REGISTRY>
  9603. <DANGER_LEVEL>1</DANGER_LEVEL>
  9604. <DESCRIPTION>It is a trojan that provides an attacker with the capability of remotely controlling a machine.</DESCRIPTION>
  9605. </SW>
  9606. <SW NAME="SiteHistory">
  9607.      <DIRECTORIES>
  9608.      </DIRECTORIES>
  9609.      <FILES>
  9610.          <FILE NAME="changeurl_30.dll" PATH="SysDir"></FILE>
  9611.          <FILE NAME="changeurl_30.dll" PATH="Sys32Dir"></FILE>
  9612.     </FILES>
  9613.      <COOKIES>
  9614.      </COOKIES>
  9615.      <REGISTRY>
  9616.          <KEYS>
  9617.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{0345b059-8731-42bc-b7b7-5121014b02c6}"></REGKEY> 
  9618.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{0345b059-8731-42bc-b7b7-5121014b02c6}"></REGKEY> 
  9619.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{0345b059-8731-42bc-b7b7-5121014b02c6}"></REGKEY> 
  9620.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{0345b059-8731-42bc-b7b7-5121014b02c6}"></REGKEY> 
  9621.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{0345b059-8731-42bc-b7b7-5121014b02c6}"></REGKEY> 
  9622.          </KEYS>
  9623.          <VALUES>
  9624.          </VALUES>
  9625.      </REGISTRY>
  9626.  <DANGER_LEVEL>1</DANGER_LEVEL>
  9627.  <DESCRIPTION>It is a Hijacker that resets your browser's settings to point to other sites.</DESCRIPTION>
  9628.  </SW>
  9629.  <SW NAME="Excite Search bar">
  9630.       <DIRECTORIES>
  9631.       </DIRECTORIES>
  9632.       <FILES>
  9633.           <FILE NAME="x8bar.dll" PATH="SysDir"></FILE>
  9634.           <FILE NAME="x8bar.dll" PATH="Sys32Dir"></FILE>
  9635.           <FILE NAME="x8bar.dll" PATH="PFDir\\excite\\x8bar\\1.bin"></FILE>
  9636.      </FILES>
  9637.       <COOKIES>
  9638.       </COOKIES>
  9639.       <REGISTRY>
  9640.           <KEYS>
  9641.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{04719991-296F-4958-AA0F-FA25FFA5008B}"></REGKEY> 
  9642.               <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{04719991-296F-4958-AA0F-FA25FFA5008B}"></REGKEY> 
  9643.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{04719991-296F-4958-AA0F-FA25FFA5008B}"></REGKEY> 
  9644.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{04719991-296F-4958-AA0F-FA25FFA5008B}"></REGKEY> 
  9645.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{04719991-296F-4958-AA0F-FA25FFA5008B}"></REGKEY> 
  9646.         </KEYS>
  9647.           <VALUES>
  9648.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{04719991-296F-4958-AA0F-FA25FFA5008B}"></REGVALUE> 
  9649.           </VALUES>
  9650.       </REGISTRY>
  9651.   <DANGER_LEVEL>1</DANGER_LEVEL>
  9652.   <DESCRIPTION>Likely to slow performance of Internet Explorer.</DESCRIPTION>
  9653.  </SW>
  9654. <SW NAME="B-S Spy/PWSteal.BStroj">  
  9655.     <DIRECTORIES>
  9656.     </DIRECTORIES>
  9657.     <FILES>
  9658.         <FILE NAME="YUpdater.exe" PATH="SysDir"></FILE>
  9659.         <FILE NAME="YPager.exe" PATH="SysDir"></FILE>
  9660.         <FILE NAME="msmsngs.exe" PATH="SysDir"></FILE>
  9661.         <FILE NAME="YUpdater.exe" PATH="Sys32Dir"></FILE>
  9662.         <FILE NAME="YPager.exe" PATH="Sys32Dir"></FILE>
  9663.         <FILE NAME="msmsngs.exe" PATH="Sys32Dir"></FILE>
  9664.     </FILES>
  9665.     <COOKIES>
  9666.     </COOKIES>
  9667.     <REGISTRY>
  9668.         <KEYS>
  9669.         </KEYS>
  9670.         <VALUES>
  9671.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Sys"></REGVALUE>
  9672.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Sys"></REGVALUE>
  9673.                <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="System"></REGVALUE>
  9674.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Sysmsn"></REGVALUE>
  9675.           </VALUES>
  9676.     </REGISTRY>
  9677. <DANGER_LEVEL>1</DANGER_LEVEL>
  9678. <DESCRIPTION>It is a Trojan that when run, provides an attacker with the capability of remotely controlling a machine.</DESCRIPTION>
  9679. </SW>
  9680. <SW NAME="IBIS Toolbar">
  9681.      <DIRECTORIES>
  9682.          <DIR NAME="btlink" PATH="PFDir\\common files"></DIR>
  9683.         <DIR NAME="toolbar" PATH="PFDir"></DIR>
  9684.      </DIRECTORIES>
  9685.      <FILES>
  9686.      </FILES>
  9687.      <COOKIES>
  9688.      </COOKIES>
  9689.      <REGISTRY>
  9690.          <KEYS>
  9691.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{26e8361f-bce7-4f75-a347-98c88b418322}"></REGKEY> 
  9692.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\code store database\\distribution units" VALUE="{26e8361f-bce7-4f75-a347-98c88b418322}"></REGKEY> 
  9693.         </KEYS>
  9694.          <VALUES>
  9695.          </VALUES>
  9696.      </REGISTRY>
  9697.  <DANGER_LEVEL>1</DANGER_LEVEL>
  9698.  <DESCRIPTION>It is a Browser Helper Object. A component that Internet Explorer will load whenever it starts, shares IE's memory context, can perform any action on the available windows and modules.</DESCRIPTION>
  9699.  </SW>
  9700. <SW NAME="W32.Sasser.B.Worm/W32.Sasser.C.Worm">  
  9701.     <DIRECTORIES>
  9702.     </DIRECTORIES>
  9703.     <FILES>
  9704.         <FILE NAME="avserve2.exe" PATH="WinDir"></FILE>
  9705.     </FILES>
  9706.     <COOKIES>
  9707.     </COOKIES>
  9708.     <REGISTRY>
  9709.         <KEYS>
  9710.         </KEYS>
  9711.         <VALUES>
  9712.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="avserve2.exe"></REGVALUE>
  9713.            </VALUES>
  9714.     </REGISTRY>
  9715. <DANGER_LEVEL>1</DANGER_LEVEL>
  9716. <DESCRIPTION>This worm exploits the Windows LSASS vulnerability, which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of affected systems.</DESCRIPTION>
  9717. </SW>
  9718. <SW NAME="W32.Sasser.A.Worm">  
  9719.     <DIRECTORIES>
  9720.     </DIRECTORIES>
  9721.     <FILES>
  9722.         <FILE NAME="avserve.exe" PATH="WinDir"></FILE>
  9723.     </FILES>
  9724.     <COOKIES>
  9725.     </COOKIES>
  9726.     <REGISTRY>
  9727.         <KEYS>
  9728.         </KEYS>
  9729.         <VALUES>
  9730.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="avserve.exe"></REGVALUE>
  9731.            </VALUES>
  9732.     </REGISTRY>
  9733. <DANGER_LEVEL>1</DANGER_LEVEL>
  9734. <DESCRIPTION>This worm exploits the Windows LSASS vulnerability, which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of affected systems.</DESCRIPTION>
  9735. </SW>
  9736. <SW NAME="W32.Sasser.D.Worm">  
  9737.     <DIRECTORIES>
  9738.     </DIRECTORIES>
  9739.     <FILES>
  9740.         <FILE NAME="skynetave.exe" PATH="WinDir"></FILE>
  9741.     </FILES>
  9742.     <COOKIES>
  9743.     </COOKIES>
  9744.     <REGISTRY>
  9745.         <KEYS>
  9746.         </KEYS>
  9747.         <VALUES>
  9748.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="skynetave.exe"></REGVALUE>
  9749.            </VALUES>
  9750.     </REGISTRY>
  9751. <DANGER_LEVEL>1</DANGER_LEVEL>
  9752. <DESCRIPTION>This worm exploits the Windows LSASS vulnerability, which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of affected systems.</DESCRIPTION>
  9753. </SW>
  9754. <SW NAME="W32.Sasser.E.Worm">  
  9755.     <DIRECTORIES>
  9756.     </DIRECTORIES>
  9757.     <FILES>
  9758.         <FILE NAME="lsasss.exe" PATH="WinDir"></FILE>
  9759.     </FILES>
  9760.     <COOKIES>
  9761.     </COOKIES>
  9762.     <REGISTRY>
  9763.         <KEYS>
  9764.         </KEYS>
  9765.         <VALUES>
  9766.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="lsasss.exe"></REGVALUE>
  9767.            </VALUES>
  9768.     </REGISTRY>
  9769. <DANGER_LEVEL>1</DANGER_LEVEL>
  9770. <DESCRIPTION>This worm exploits the Windows LSASS vulnerability, which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of affected systems.</DESCRIPTION>
  9771. </SW>
  9772. <SW NAME="Beast">  
  9773.     <DIRECTORIES>
  9774.     </DIRECTORIES>
  9775.     <FILES>
  9776.         <FILE NAME="msaria.com" PATH="WinDir\\command"></FILE>
  9777.         <FILE NAME="msdgqt.com" PATH="WinDir\\command"></FILE>
  9778.         <FILE NAME="msdvnp.com" PATH="WinDir\\command"></FILE>
  9779.         <FILE NAME="mshiye.com" PATH="WinDir\\command"></FILE>
  9780.         <FILE NAME="msisai.com" PATH="WinDir\\command"></FILE>
  9781.         <FILE NAME="msndxp.com" PATH="WinDir\\command"></FILE>
  9782.         <FILE NAME="msocge.com" PATH="WinDir\\command"></FILE>
  9783.         <FILE NAME="msqlxh.com" PATH="WinDir\\command"></FILE>
  9784.         <FILE NAME="mswnqu.com" PATH="WinDir\\command"></FILE>
  9785.         <FILE NAME="dxdgns.dll" PATH="WinDir"></FILE>
  9786.         <FILE NAME="msag.com" PATH="WinDir\\msagent"></FILE>
  9787.         <FILE NAME="comsv.com" PATH="SysDir\\com"></FILE>
  9788.         <FILE NAME="mscom32.com" PATH="SysDir\\com"></FILE>
  9789.         <FILE NAME="hlir.blf" PATH="SysDir"></FILE>
  9790.         <FILE NAME="hservms.exe" PATH="SysDir"></FILE>
  9791.         <FILE NAME="kb.tlg" PATH="SysDir"></FILE>
  9792.         <FILE NAME="kd.txs" PATH="SysDir"></FILE>
  9793.         <FILE NAME="kl.dli" PATH="SysDir"></FILE>
  9794.         <FILE NAME="kl.tti" PATH="SysDir"></FILE>
  9795.         <FILE NAME="msbeku.com" PATH="SysDir"></FILE>
  9796.         <FILE NAME="msbwdr.com" PATH="SysDir"></FILE>
  9797.         <FILE NAME="msbxbs.com" PATH="SysDir"></FILE>
  9798.         <FILE NAME="mshlir.com" PATH="SysDir"></FILE>
  9799.         <FILE NAME="mshost.exe" PATH="SysDir"></FILE>
  9800.         <FILE NAME="msoksw.com" PATH="SysDir"></FILE>
  9801.         <FILE NAME="mspfgf.com" PATH="SysDir"></FILE>
  9802.         <FILE NAME="msqmqr.com" PATH="SysDir"></FILE>
  9803.         <FILE NAME="msujop.com" PATH="SysDir"></FILE>
  9804.         <FILE NAME="msyrmu.com" PATH="SysDir"></FILE>
  9805.         <FILE NAME="oksw.blf" PATH="SysDir"></FILE>
  9806.         <FILE NAME="shell32.com" PATH="SysDir"></FILE>
  9807.         <FILE NAME="ujop.blf" PATH="SysDir"></FILE>
  9808.         <FILE NAME="wb.com" PATH="SysDir\\wbem"></FILE>
  9809.         <FILE NAME="wsv.com" PATH="SysDir\\wbem"></FILE>
  9810.         <FILE NAME="beast191.exe" PATH=""></FILE>
  9811.         <FILE NAME="beast192.exe" PATH=""></FILE>
  9812.         <FILE NAME="beast2.00.exe" PATH=""></FILE>
  9813.         <FILE NAME="beast2.01.exe" PATH=""></FILE>
  9814.         <FILE NAME="beast2.01_french_tuto.chm" PATH=""></FILE>
  9815.         <FILE NAME="beast2.06.exe" PATH=""></FILE>
  9816.         <FILE NAME="frenchtuto.doc" PATH=""></FILE>
  9817.         <FILE NAME="server_compressed.exe" PATH=""></FILE>
  9818.     </FILES>
  9819.     <COOKIES>
  9820.     </COOKIES>
  9821.     <REGISTRY>
  9822.         <KEYS>
  9823.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE=".bad"></REGKEY> 
  9824.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="beastfile"></REGKEY> 
  9825.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="beastfile1"></REGKEY> 
  9826.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\active setup\\installed components\\{as096941-b967-10d8-9cbd-0000f87a369e}" VALUE="stubpath"></REGKEY> 
  9827.         </KEYS>
  9828.         <VALUES>
  9829.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="com service"></REGVALUE>
  9830.            </VALUES>
  9831.     </REGISTRY>
  9832. <DANGER_LEVEL>1</DANGER_LEVEL>
  9833. <DESCRIPTION>It is a Trojan that, provides an attacker with the capability of remotely controlling a machine.</DESCRIPTION>
  9834. </SW>
  9835. <SW NAME="CasinoOnNet">
  9836.      <DIRECTORIES>
  9837.         <DIR NAME="aceclub casino online download deluxe suite" PATH="ProfilePath\\start menu\\programs"></DIR>
  9838.         <DIR NAME="bingofun" PATH="ProfilePath\\start menu\\programs"></DIR>
  9839.         <DIR NAME="casino on net" PATH="ProfilePath\\start menu\\programs"></DIR>
  9840.         <DIR NAME="riviera gold" PATH="ProfilePath\\start menu\\programs"></DIR>
  9841.         <DIR NAME="aceclub casino" PATH="PFDir"></DIR>
  9842.         <DIR NAME="bingofun games" PATH="PFDir"></DIR>
  9843.         <DIR NAME="casinoonnet" PATH="PFDir"></DIR>
  9844.         <DIR NAME="ca shared" PATH="PFDir\\common files"></DIR>
  9845.      </DIRECTORIES>
  9846.      <FILES>
  9847.          <FILE NAME="aceclub casino online.lnk" PATH="desktopdir"></FILE>
  9848.          <FILE NAME="bingofun.lnk" PATH="desktopdir"></FILE>
  9849.          <FILE NAME="casino on net.lnk" PATH="desktopdir"></FILE>
  9850.          <FILE NAME="five roses casino.url" PATH="desktopdir"></FILE>
  9851.          <FILE NAME="mayan sportsbook.url" PATH="desktopdir"></FILE>
  9852.          <FILE NAME="onluck casion.url" PATH="desktopdir"></FILE>
  9853.          <FILE NAME="riviera gold.lnk" PATH="desktopdir"></FILE>
  9854.          <FILE NAME="riviera gold.ulr" PATH="desktopdir"></FILE>
  9855.          <FILE NAME="aceclub casino online.lnk" PATH="ProfilePath\\start menu"></FILE>
  9856.          <FILE NAME="dlhelperexe.exe" PATH="ProfilePath\\start menu\\programs\\startup"></FILE>
  9857.          <FILE NAME="bszip.dll" PATH="PFDir\\casinoonnet"></FILE>
  9858.          <FILE NAME="casino.exe" PATH="PFDir\\casinoonnet"></FILE>
  9859.          <FILE NAME="downloadinstaller.exe" PATH="PFDir\\casinoonnet"></FILE>
  9860.          <FILE NAME="biuninst.exe" PATH="PFDir\\common files\\ca shared"></FILE>
  9861.      </FILES>
  9862.      <COOKIES>
  9863.      </COOKIES>
  9864.      <REGISTRY>
  9865.          <KEYS>
  9866.         </KEYS>
  9867.          <VALUES>
  9868.          </VALUES>
  9869.      </REGISTRY>
  9870.  <DANGER_LEVEL>1</DANGER_LEVEL>
  9871.  <DESCRIPTION>It is an Adware that brings ads to your computer.</DESCRIPTION>
  9872.  </SW>
  9873. <SW NAME="W32.Blaster.B.Worm">
  9874.     <DIRECTORIES>
  9875.     </DIRECTORIES>
  9876.     <FILES>
  9877.         <FILE NAME="PENIS32.EXE" PATH="Sys32Dir"></FILE>
  9878.     </FILES>
  9879.     <COOKIES>
  9880.     </COOKIES>
  9881.     <REGISTRY>
  9882.        <KEYS>
  9883.        </KEYS>
  9884.        <VALUES>
  9885.        </VALUES>
  9886.     </REGISTRY>
  9887. <DANGER_LEVEL>1</DANGER_LEVEL>
  9888. <DESCRIPTION>MSblaster worm widely spread through networks on the internet</DESCRIPTION>
  9889. </SW>
  9890. <SW NAME="W32.Blaster.D.Worm">
  9891.     <DIRECTORIES>
  9892.     </DIRECTORIES>
  9893.     <FILES>
  9894.         <FILE NAME="mspatch.exe" PATH="Sys32Dir"></FILE>
  9895.     </FILES>
  9896.     <COOKIES>
  9897.     </COOKIES>
  9898.     <REGISTRY>
  9899.        <KEYS>
  9900.        </KEYS>
  9901.        <VALUES>
  9902.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Nonton Antivirus"></REGVALUE>
  9903.        </VALUES>
  9904.     </REGISTRY>
  9905. <DANGER_LEVEL>1</DANGER_LEVEL>
  9906. <DESCRIPTION>MSblaster worm widely spread through networks on the internet</DESCRIPTION>
  9907. </SW>
  9908. <SW NAME="W32.Blaster.F.Worm">
  9909.     <DIRECTORIES>
  9910.     </DIRECTORIES>
  9911.     <FILES>
  9912.         <FILE NAME="enbiei.exe" PATH="Sys32Dir"></FILE>
  9913.     </FILES>
  9914.     <COOKIES>
  9915.     </COOKIES>
  9916.     <REGISTRY>
  9917.        <KEYS>
  9918.        </KEYS>
  9919.        <VALUES>
  9920.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="www.hidro.4t.com"></REGVALUE>
  9921.        </VALUES>
  9922.     </REGISTRY>
  9923. <DANGER_LEVEL>1</DANGER_LEVEL>
  9924. <DESCRIPTION>MSblaster worm widely spread through networks on the internet</DESCRIPTION>
  9925. </SW>
  9926. <SW NAME="W32.Mimail.J@mm">
  9927.     <DIRECTORIES>
  9928.     </DIRECTORIES>
  9929.     <FILES>
  9930.         <FILE NAME="svchost32.exe" PATH="WinDir"></FILE>
  9931.     </FILES>
  9932.     <COOKIES>
  9933.     </COOKIES>
  9934.     <REGISTRY>
  9935.        <KEYS>
  9936.        </KEYS>
  9937.        <VALUES>
  9938.        </VALUES>
  9939.     </REGISTRY>
  9940. <DANGER_LEVEL>1</DANGER_LEVEL>
  9941. <DESCRIPTION>It is a  mass mailing worms that attempts to steal credit card information.</DESCRIPTION>
  9942. </SW>
  9943. <SW NAME="I-Worm.Netsky">
  9944.     <DIRECTORIES>
  9945.     </DIRECTORIES>
  9946.     <FILES>
  9947.         <FILE NAME=".xx.pif" PATH=""></FILE>
  9948.         <FILE NAME="i-worm.netsky.m.exe" PATH=""></FILE>
  9949.         <FILE NAME="injection.htm.exe" PATH=""></FILE>
  9950.         <FILE NAME="message.pif" PATH=""></FILE>
  9951.         <FILE NAME="netsky[1].d.exe_" PATH=""></FILE>
  9952.         <FILE NAME="netsky[1].e.exe_" PATH=""></FILE>
  9953.         <FILE NAME="new_document1.pif" PATH=""></FILE>
  9954.         <FILE NAME="your_archive.pif" PATH=""></FILE>
  9955.     </FILES>
  9956.     <COOKIES>
  9957.     </COOKIES>
  9958.     <REGISTRY>
  9959.        <KEYS>
  9960.        </KEYS>
  9961.        <VALUES>
  9962.        </VALUES>
  9963.     </REGISTRY>
  9964. <DANGER_LEVEL>1</DANGER_LEVEL>
  9965. <DESCRIPTION>It is a Worm that propagates by attacking other machines and copying itself to them.It may replace files, but do not insert themselves into files (as viruses do).</DESCRIPTION>
  9966. </SW>
  9967. <SW NAME="GlobalNetcom">
  9968.     <DIRECTORIES>
  9969.     </DIRECTORIES>
  9970.     <FILES>
  9971.         <FILE NAME="culakkma.dll" PATH=""></FILE>
  9972.         <FILE NAME="itstgblg.dll" PATH=""></FILE>
  9973.         <FILE NAME="ntmccdds.dll" PATH=""></FILE>
  9974.         <FILE NAME="qhgimxyy.dll" PATH=""></FILE>
  9975.     </FILES>
  9976.     <COOKIES>
  9977.     </COOKIES>
  9978.     <REGISTRY>
  9979.        <KEYS>
  9980.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\code store database\\distribution units" VALUE="{00000000-cddc-0704-0b53-2c8830e9faec}"></REGKEY>
  9981.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\moduleusage" VALUE="c:/windows/downloaded program files/ieloader.dll"></REGKEY>
  9982.        </KEYS>
  9983.        <VALUES>
  9984.        </VALUES>
  9985.     </REGISTRY>
  9986. <DANGER_LEVEL>1</DANGER_LEVEL>
  9987. <DESCRIPTION>An ActiveX installer for premium-rate phone diallers.Any web page can direct it to install arbitrary code downloaded from its home server.</DESCRIPTION>
  9988. </SW>
  9989. <SW NAME="Parasite">
  9990.     <DIRECTORIES>
  9991.     </DIRECTORIES>
  9992.     <FILES>
  9993.     </FILES>
  9994.     <COOKIES>
  9995.     </COOKIES>
  9996.     <REGISTRY>
  9997.        <KEYS>
  9998.        </KEYS>
  9999.        <VALUES>
  10000.            <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Windows Shell"></REGVALUE>
  10001.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Scandick"></REGVALUE>
  10002.            <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="Windows Shell"></REGVALUE>
  10003.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="Windows Shell"></REGVALUE>
  10004.        </VALUES>
  10005.     </REGISTRY>
  10006. <DANGER_LEVEL>1</DANGER_LEVEL>
  10007. <DESCRIPTION>It is a trojan that provides an attacker with the capability of remotely controlling a machine.</DESCRIPTION>
  10008. </SW>
  10009. <SW NAME="NetSlayer">
  10010.     <DIRECTORIES>
  10011.     </DIRECTORIES>
  10012.     <FILES>
  10013.         <FILE NAME="nspatch.exe" PATH=""></FILE>
  10014.         <FILE NAME="unpacked server.exe" PATH=""></FILE>
  10015.     </FILES>
  10016.     <COOKIES>
  10017.     </COOKIES>
  10018.     <REGISTRY>
  10019.        <KEYS>
  10020.        </KEYS>
  10021.        <VALUES>
  10022.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="nspatch"></REGVALUE>
  10023.        </VALUES>
  10024.     </REGISTRY>
  10025. <DANGER_LEVEL>1</DANGER_LEVEL>
  10026. <DESCRIPTION>It is a trojan that provides an attacker with the capability of remotely controlling a machine.</DESCRIPTION>
  10027. </SW>
  10028. <SW NAME="Zinx-A">
  10029.     <DIRECTORIES>
  10030.     </DIRECTORIES>
  10031.     <FILES>
  10032.         <FILE NAME="fghy.exe" PATH="WinDir"></FILE>
  10033.         <FILE NAME="msreg.exe" PATH="WinDir"></FILE>
  10034.         <FILE NAME="msto32.dll" PATH="WinDir"></FILE>
  10035.         <FILE NAME="surte.exe" PATH="WinDir"></FILE>
  10036.         <FILE NAME="svchostc.exe" PATH="SysDir"></FILE>
  10037.         <FILE NAME="svchostc.exe" PATH="Sys32Dir"></FILE>
  10038.     </FILES>
  10039.     <COOKIES>
  10040.     </COOKIES>
  10041.     <REGISTRY>
  10042.        <KEYS>
  10043.        </KEYS>
  10044.        <VALUES>
  10045.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="apimon"></REGVALUE>
  10046.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="systems"></REGVALUE>
  10047.        </VALUES>
  10048.     </REGISTRY>
  10049. <DANGER_LEVEL>1</DANGER_LEVEL>
  10050. <DESCRIPTION>It is a trojan that provides an attacker with the capability of remotely controlling a machine.</DESCRIPTION>
  10051. </SW>
  10052. <SW NAME="Artic">
  10053.     <DIRECTORIES>
  10054.     </DIRECTORIES>
  10055.     <FILES>
  10056.         <FILE NAME="arctic.exe" PATH=""></FILE>
  10057.     </FILES>
  10058.     <COOKIES>
  10059.     </COOKIES>
  10060.     <REGISTRY>
  10061.        <KEYS>
  10062.        </KEYS>
  10063.        <VALUES>
  10064.        </VALUES>
  10065.     </REGISTRY>
  10066. <DANGER_LEVEL>1</DANGER_LEVEL>
  10067. <DESCRIPTION>It is a trojan that provides an attacker with the capability of remotely controlling a machine.</DESCRIPTION>
  10068. </SW>
  10069. <SW NAME="Microspy 1.0">
  10070.     <DIRECTORIES>
  10071.     </DIRECTORIES>
  10072.     <FILES>
  10073.         <FILE NAME="win32.exemicrospy 1.0.exe" PATH="WinDir"></FILE>
  10074.         <FILE NAME="microspy server.exe" PATH=""></FILE>
  10075.     </FILES>
  10076.     <COOKIES>
  10077.     </COOKIES>
  10078.     <REGISTRY>
  10079.        <KEYS>
  10080.        </KEYS>
  10081.        <VALUES>
  10082.        </VALUES>
  10083.     </REGISTRY>
  10084. <DANGER_LEVEL>1</DANGER_LEVEL>
  10085. <DESCRIPTION>It is a trojan that provides an attacker with the capability of remotely controlling a machine.</DESCRIPTION>
  10086. </SW>
  10087. <SW NAME="Radlight">
  10088.      <DIRECTORIES>
  10089.          <DIR NAME="cnet" PATH="ProfilePath\\my documents\\my deliveries"></DIR>
  10090.         <DIR NAME="radlight" PATH="PFDir"></DIR>
  10091.      </DIRECTORIES>
  10092.      <FILES>
  10093.          <FILE NAME="radlight35se.exe" PATH="ProfilePath\\my documents\\my deliveries\\cnet"></FILE>
  10094.          <FILE NAME="radlight.lnk" PATH="desktopdir"></FILE>
  10095.          <FILE NAME="radlight.chm" PATH="PFDir\\radlight\\help"></FILE>
  10096.          <FILE NAME="subtitle1.dll" PATH="PFDir\\radlight\\modules"></FILE>
  10097.         <FILE NAME="subtitle2.dll" PATH="PFDir\\radlight\\modules"></FILE>
  10098.         <FILE NAME="radlight.exe" PATH="PFDir\\radlight"></FILE>
  10099.         <FILE NAME="rpk.exe" PATH="PFDir\\radlight\\rpki"></FILE>
  10100.         <FILE NAME="settings.ini" PATH="PFDir\\radlight"></FILE>
  10101.         <FILE NAME="rluninstall.exe" PATH="WinDir"></FILE>
  10102.         <FILE NAME="default.rls" PATH=""></FILE>
  10103.         <FILE NAME="default2.rls" PATH=""></FILE>
  10104.         <FILE NAME="playlist.pbm" PATH=""></FILE>
  10105.         <FILE NAME="radlight.htm" PATH=""></FILE>
  10106.         <FILE NAME="radlight.txt" PATH=""></FILE>
  10107.         <FILE NAME="radlight_336.exe" PATH=""></FILE>
  10108.         <FILE NAME="radlight_eula.txt" PATH=""></FILE>
  10109.         <FILE NAME="radlight_removal.htm" PATH=""></FILE>
  10110.         <FILE NAME="radlight_removal.txt" PATH=""></FILE>
  10111.         <FILE NAME="save_removal.htm" PATH=""></FILE>
  10112.         <FILE NAME="save_removal.txt" PATH=""></FILE>
  10113.         <FILE NAME="weathercast_removal.htm" PATH=""></FILE>
  10114.         <FILE NAME="weathercast_removal.txt" PATH=""></FILE>
  10115.      </FILES>
  10116.      <COOKIES>
  10117.      </COOKIES>
  10118.      <REGISTRY>
  10119.          <KEYS>
  10120.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE=".rpk"></REGKEY>
  10121.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="rpkfile"></REGKEY>
  10122.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes" VALUE=".rpk"></REGKEY>
  10123.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall" VALUE="radlight"></REGKEY>
  10124.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall" VALUE="radlight_is1"></REGKEY>
  10125.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software" VALUE="radlight team"></REGKEY>
  10126.         </KEYS>
  10127.          <VALUES>
  10128.          </VALUES>
  10129.      </REGISTRY>
  10130.  <DANGER_LEVEL>1</DANGER_LEVEL>
  10131.  <DESCRIPTION>It is a Trojan with a hidden, unwanted intent.</DESCRIPTION>
  10132.  </SW>
  10133. <SW NAME="Glacier">  
  10134.     <DIRECTORIES>
  10135.     </DIRECTORIES>
  10136.     <FILES>
  10137.         <FILE NAME="lfp.exe" PATH="SysDir"></FILE>
  10138.         <FILE NAME="rnudll32.exe" PATH="SysDir"></FILE>
  10139.         <FILE NAME="shellscrap.exe" PATH="SysDir"></FILE>
  10140.         <FILE NAME="sysdll32.exe" PATH="SysDir"></FILE>
  10141.         <FILE NAME="sysexecr.exe" PATH="SysDir"></FILE>
  10142.         <FILE NAME="sysexplr.exe" PATH="SysDir"></FILE>
  10143.         <FILE NAME="sysrun32.exe" PATH="SysDir"></FILE>
  10144.         <FILE NAME="tel.dll" PATH="SysDir"></FILE>
  10145.         <FILE NAME="winabc.exe" PATH="SysDir"></FILE>
  10146.         <FILE NAME="psw.tmp" PATH="SysDir"></FILE>
  10147.     </FILES>
  10148.     <COOKIES>
  10149.     </COOKIES>
  10150.     <REGISTRY>
  10151.         <KEYS>
  10152.         </KEYS>
  10153.         <VALUES>
  10154.            </VALUES>
  10155.     </REGISTRY>
  10156. <DANGER_LEVEL>1</DANGER_LEVEL>
  10157. <DESCRIPTION>It is Trojan that provides an attacker with the capability of remotely controlling a machine.</DESCRIPTION>
  10158. </SW>
  10159. <SW NAME="WebRebates/TopRebates">  
  10160.      <DIRECTORIES>
  10161.          <DIR NAME="webrebates" PATH="PFDir"></DIR>
  10162.       </DIRECTORIES>
  10163.      <FILES>
  10164.          <FILE NAME="webrebates1.exe" PATH="PFDir\\webrebates"></FILE>
  10165.       </FILES>
  10166.      <COOKIES>
  10167.      </COOKIES>
  10168.      <REGISTRY>
  10169.          <KEYS>
  10170.          </KEYS>
  10171.          <VALUES>
  10172.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="webrebates"></REGVALUE>
  10173.          </VALUES>
  10174.      </REGISTRY>
  10175.      <DANGER_LEVEL>1</DANGER_LEVEL>
  10176.  <DESCRIPTION>It is an Adware that brings ads to your computer.</DESCRIPTION>
  10177. </SW>
  10178. <SW NAME="CustomToolbar"> 
  10179.     <DIRECTORIES>
  10180.            <DIR NAME="ctb" PATH="WinDir"></DIR>
  10181.     </DIRECTORIES>
  10182.     <FILES>
  10183.           <FILE NAME="CustomToolbar.dll" PATH="WinDir\\ctb"></FILE>
  10184.           <FILE NAME="Actbar2.ocx" PATH="SysDir "></FILE>
  10185.           <FILE NAME="Actbar2.ocx" PATH="Sys32Dir"></FILE>
  10186.     </FILES>
  10187.     <COOKIES>
  10188.     </COOKIES>
  10189.     <REGISTRY>
  10190.     <KEYS>
  10191.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{21301D69-B8F1-46AA-B0B5-09EE2285914C}"></REGKEY>
  10192.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{21301D69-B8F1-46AA-B0B5-09EE2285914C}"></REGKEY>
  10193.     </KEYS>
  10194.     <VALUES>
  10195.         <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar\\WebBrowser" VALUE="{21301D69-B8F1-46AA-B0B5-09EE2285914C}"></REGVALUE>
  10196.         <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{21301D69-B8F1-46AA-B0B5-09EE2285914C}"></REGVALUE>
  10197.     </VALUES>
  10198.     </REGISTRY>
  10199. <DANGER_LEVEL>1</DANGER_LEVEL>
  10200. <DESCRIPTION>It is a browser helper object that open pop-up windows.</DESCRIPTION>
  10201. </SW>
  10202. <SW NAME="Seek99">  
  10203.      <DIRECTORIES>
  10204.      </DIRECTORIES>
  10205.      <FILES>
  10206.          <FILE NAME="seek99.dll" PATH="SysDir"></FILE>
  10207.          <FILE NAME="seek99.dll" PATH="Sys32Dir"></FILE>
  10208.      </FILES>
  10209.      <COOKIES>
  10210.      </COOKIES>
  10211.      <REGISTRY>
  10212.          <KEYS>
  10213.         </KEYS>
  10214.          <VALUES>
  10215.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{22998d24-b789-4ca2-a7fc-cd7ce7deb14c}"></REGVALUE>
  10216.          </VALUES>
  10217.      </REGISTRY>
  10218.      <DANGER_LEVEL>1</DANGER_LEVEL>
  10219.  <DESCRIPTION>It is likely to slow performance of Internet Explorer.</DESCRIPTION>
  10220. </SW>
  10221. <SW NAME="MyPageFinder">
  10222.     <DIRECTORIES>
  10223.     </DIRECTORIES>
  10224.     <FILES>
  10225.         <FILE NAME="ml_32.dll" PATH="SysDir"></FILE>
  10226.         <FILE NAME="ml_32.dll" PATH="Sys32Dir"></FILE>
  10227.         <FILE NAME="ml1_32.dll" PATH="SysDir"></FILE>
  10228.         <FILE NAME="ml1_32.dll" PATH="Sys32Dir"></FILE>
  10229.     </FILES>
  10230.     <COOKIES>
  10231.     </COOKIES>
  10232.     <REGISTRY>
  10233.        <KEYS>
  10234.               <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{27a5ff76-9919-492c-98e3-eda3502fc829}"></REGKEY>
  10235.        </KEYS>
  10236.        <VALUES>
  10237.        </VALUES>
  10238.     </REGISTRY>
  10239. <DANGER_LEVEL>1</DANGER_LEVEL>
  10240. <DESCRIPTION>It is an IE Browser Helper object that hijacks Internet Explorer homepage and searches. It resets your home page.</DESCRIPTION>
  10241. </SW>
  10242. <SW NAME="Commander Toolbar">  
  10243.      <DIRECTORIES>
  10244.       </DIRECTORIES>
  10245.      <FILES>
  10246.          <FILE NAME="ietb.dll" PATH="Sys32Dir"></FILE>
  10247.      </FILES>
  10248.      <COOKIES>
  10249.      </COOKIES>
  10250.      <REGISTRY>
  10251.          <KEYS>
  10252.         </KEYS>
  10253.          <VALUES>
  10254.           </VALUES>
  10255.      </REGISTRY>
  10256.      <DANGER_LEVEL>1</DANGER_LEVEL>
  10257.  <DESCRIPTION>It is likely to slow performance of Internet Explorer.</DESCRIPTION>
  10258. </SW>
  10259. <SW NAME="Dynamic Desktop Media/Sysu">
  10260.     <DIRECTORIES>
  10261.         <DIR NAME="ddm" PATH="PFDir"></DIR>
  10262.     </DIRECTORIES>
  10263.     <FILES>
  10264.         <FILE NAME="sysu.exe" PATH="PFDir\\ddm"></FILE>
  10265.         <FILE NAME="ddm_d.exe" PATH="PFDir\\ddm"></FILE>
  10266.         <FILE NAME="ddmp.dll" PATH="SysDir"></FILE>
  10267.         <FILE NAME="ddmp.dll" PATH="Sys32Dir"></FILE>
  10268.         <FILE NAME="redirect.dll" PATH="SysDir"></FILE>
  10269.         <FILE NAME="redirect.dll" PATH="Sys32Dir"></FILE>
  10270.     </FILES>
  10271.     <COOKIES>
  10272.     </COOKIES>
  10273.     <REGISTRY>
  10274.        <KEYS>
  10275.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{2bc43670-c0bd-4794-bb11-f60f3e001dc5}"></REGKEY> 
  10276.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{2bc43670-c0bd-4794-bb11-f60f3e001dc5}"></REGKEY> 
  10277.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{2bc43670-c0bd-4794-bb11-f60f3e001dc5}"></REGKEY> 
  10278.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{2bc43670-c0bd-4794-bb11-f60f3e001dc5}"></REGKEY> 
  10279.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{2bc43670-c0bd-4794-bb11-f60f3e001dc5}"></REGKEY> 
  10280.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software" VALUE="ddm"></REGKEY> 
  10281.        </KEYS>
  10282.        <VALUES>
  10283.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="sysu"></REGVALUE>
  10284.        </VALUES>
  10285.     </REGISTRY>
  10286. <DANGER_LEVEL>1</DANGER_LEVEL>
  10287. <DESCRIPTION>Known to cause popup advertisements.</DESCRIPTION>
  10288. </SW>
  10289. <SW NAME="iSpy">
  10290.     <DIRECTORIES>
  10291.     </DIRECTORIES>
  10292.     <FILES>
  10293.         <FILE NAME="ispy.exe" PATH="PFDir\\ISpy"></FILE>    
  10294.     </FILES>
  10295.     <COOKIES>
  10296.     </COOKIES>
  10297.     <REGISTRY>
  10298.         <KEYS>
  10299.         </KEYS>
  10300.         <VALUES>
  10301.         </VALUES>
  10302.     </REGISTRY>
  10303. <DANGER_LEVEL>1</DANGER_LEVEL>
  10304. <DESCRIPTION>hacker tool used to descrypt encrypted password files.</DESCRIPTION>
  10305. </SW>
  10306. <SW NAME="AdShooter">
  10307.     <DIRECTORIES>
  10308.     </DIRECTORIES>
  10309.     <FILES>
  10310.         <FILE NAME="syssfitb.dll" PATH="SysDir"></FILE>
  10311.         <FILE NAME="syssfitb.dll" PATH="Sys32Dir"></FILE>
  10312.     </FILES>
  10313.     <COOKIES>
  10314.     </COOKIES>
  10315.     <REGISTRY>
  10316.        <KEYS>
  10317.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{c109664b-ceb1-420b-b353-d55a561536dd}"></REGKEY> 
  10318.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{c109664b-ceb1-420b-b353-d55a561536dd}"></REGKEY> 
  10319.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{c109664b-ceb1-420b-b353-d55a561536dd}"></REGKEY> 
  10320.        </KEYS>
  10321.        <VALUES>
  10322.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{c109664b-ceb1-420b-b353-d55a561536dd}"></REGVALUE> 
  10323.        </VALUES>
  10324.     </REGISTRY>
  10325. <DANGER_LEVEL>1</DANGER_LEVEL>
  10326. <DESCRIPTION>It is an adware component that downloads and displays advertisements.</DESCRIPTION>
  10327. </SW>
  10328. <SW NAME="ClickTillUWin">
  10329.      <DIRECTORIES>
  10330.      </DIRECTORIES>
  10331.      <FILES>
  10332.          <FILE NAME="dlder.exe" PATH="WinDir"></FILE>
  10333.      </FILES>
  10334.      <COOKIES>
  10335.      </COOKIES>
  10336.      <REGISTRY>
  10337.          <KEYS>
  10338.          </KEYS>
  10339.          <VALUES>
  10340.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="dilder"></REGVALUE>
  10341.          </VALUES>
  10342.      </REGISTRY>
  10343.  <DANGER_LEVEL>1</DANGER_LEVEL>
  10344.  <DESCRIPTION>It is a way of misusing or breaking into a system by taking advantage of a weakness in it.</DESCRIPTION>
  10345.  </SW>
  10346. <SW NAME="AdBlaster">
  10347.     <DIRECTORIES>
  10348.     </DIRECTORIES>
  10349.     <FILES>
  10350.         <FILE NAME="ngpw34.dll" PATH="SysDir"></FILE>
  10351.         <FILE NAME="ngpw34.dll" PATH="Sys32Dir"></FILE>
  10352.         <FILE NAME="ngsw31.dll" PATH="SysDir"></FILE>
  10353.         <FILE NAME="ngsw31.dll" PATH="Sys32Dir"></FILE>
  10354.     </FILES>
  10355.     <COOKIES>
  10356.     </COOKIES>
  10357.     <REGISTRY>
  10358.        <KEYS>
  10359.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{2D7CB618-CC1C-4126-A7E3-F5B12D3BCF71}"></REGKEY> 
  10360.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{2D7CB618-CC1C-4126-A7E3-F5B12D3BCF71}"></REGKEY> 
  10361.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{2D7CB618-CC1C-4126-A7E3-F5B12D3BCF71}"></REGKEY> 
  10362.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{2D7CB618-CC1C-4126-A7E3-F5B12D3BCF71}"></REGKEY> 
  10363.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{2D7CB618-CC1C-4126-A7E3-F5B12D3BCF71}"></REGKEY> 
  10364.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{e9147a0a-a866-4214-b47c-da821891240f}"></REGKEY> 
  10365.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{e9147a0a-a866-4214-b47c-da821891240f}"></REGKEY> 
  10366.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{e9147a0a-a866-4214-b47c-da821891240f}"></REGKEY> 
  10367.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{e9147a0a-a866-4214-b47c-da821891240f}"></REGKEY> 
  10368.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{e9147a0a-a866-4214-b47c-da821891240f}"></REGKEY> 
  10369.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="interface" VALUE="{0b60cef5-2431-4f92-82cf-03fee5bdc762}"></REGKEY>
  10370.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="interface" VALUE="{7fb04de1-4340-4002-9d9e-3b6913ae6953}"></REGKEY>
  10371.        </KEYS>
  10372.        <VALUES>
  10373.        </VALUES>
  10374.     </REGISTRY>
  10375. <DANGER_LEVEL>1</DANGER_LEVEL>
  10376. <DESCRIPTION>It is an Adware that brings ads to your computer.</DESCRIPTION>
  10377. </SW>
  10378. <SW NAME="EZSearching">
  10379.     <DIRECTORIES>
  10380.     </DIRECTORIES>
  10381.     <FILES>
  10382.         <FILE NAME="ctav3.dll" PATH="Sys32Dir"></FILE>
  10383.         <FILE NAME="ctavp3.dll" PATH="Sys32Dir"></FILE>
  10384.         <FILE NAME="ctavp5.dll" PATH="Sys32Dir"></FILE>
  10385.         <FILE NAME="ctsr2.dll" PATH="Sys32Dir"></FILE>
  10386.         <FILE NAME="testadit.dll" PATH="Sys32Dir"></FILE>
  10387.         <FILE NAME="testadit3.dll" PATH="Sys32Dir"></FILE>
  10388.         <FILE NAME="ctav3.dll" PATH="SysDir"></FILE>
  10389.         <FILE NAME="ctavp3.dll" PATH="SysDir"></FILE>
  10390.         <FILE NAME="ctavp5.dll" PATH="SysDir"></FILE>
  10391.         <FILE NAME="ctsr2.dll" PATH="SysDir"></FILE>
  10392.         <FILE NAME="testadit.dll" PATH="SysDir"></FILE>
  10393.         <FILE NAME="testadit3.dll" PATH="SysDir"></FILE>
  10394.     </FILES>
  10395.     <COOKIES>
  10396.     </COOKIES>
  10397.     <REGISTRY>
  10398.        <KEYS>
  10399.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{34d516ea-40e3-4e3b-8ba8-505112738ed5}"></REGKEY>
  10400.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\exploer\\browser helper objects" VALUE="{858126b0-3708-4051-ae8e-b48521401ca2}"></REGKEY>
  10401.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{2F24B54D-3A27-11D8-8169-00C02623048A}"></REGKEY> 
  10402.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{2F24B54D-3A27-11D8-8169-00C02623048A}"></REGKEY> 
  10403.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{2F24B54D-3A27-11D8-8169-00C02623048A}"></REGKEY> 
  10404.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{2F24B54D-3A27-11D8-8169-00C02623048A}"></REGKEY> 
  10405.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{2F24B54D-3A27-11D8-8169-00C02623048A}"></REGKEY> 
  10406.        </KEYS>
  10407.        <VALUES>
  10408.        </VALUES>
  10409.     </REGISTRY>
  10410. <DANGER_LEVEL>1</DANGER_LEVEL>
  10411. <DESCRIPTION>It is a Browser Helper Object. A component that Internet Explorer will load whenever it starts, shares IE's memory context, can perform any action on the available windows and modules. </DESCRIPTION>
  10412. </SW>
  10413. <SW NAME="YellowPages">  
  10414.     <DIRECTORIES>
  10415.     </DIRECTORIES>
  10416.     <FILES>
  10417.         <FILE NAME="Autosearch.dll" PATH=""></FILE>
  10418.     </FILES>
  10419.     <COOKIES>
  10420.     </COOKIES>
  10421.     <REGISTRY>
  10422.         <KEYS>
  10423.         </KEYS>
  10424.         <VALUES>
  10425.         </VALUES>
  10426.     </REGISTRY>
  10427. <DANGER_LEVEL>1</DANGER_LEVEL>
  10428. <DESCRIPTION>It is an Adware that brings ads to your computer.</DESCRIPTION>
  10429. </SW> 
  10430. <SW NAME="StartNow.HyperBar">  
  10431.     <DIRECTORIES>
  10432.     </DIRECTORIES>
  10433.     <FILES>
  10434.         <FILE NAME="Hyperbar.dll" PATH=""></FILE>
  10435.     </FILES>
  10436.     <COOKIES>
  10437.     </COOKIES>
  10438.     <REGISTRY>
  10439.         <KEYS>
  10440.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{4b2f5308-2cb0-40e2-8030-59936ed5d22c}"></REGKEY>
  10441.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{4b2f5308-2cb0-40e2-8030-59936ed5d22c}"></REGKEY>
  10442.         </KEYS>
  10443.         <VALUES>
  10444.         </VALUES>
  10445.     </REGISTRY>
  10446. <DANGER_LEVEL>1</DANGER_LEVEL>
  10447. <DESCRIPTION>Likely to slow performance of Internet Explorer.</DESCRIPTION>
  10448. </SW> 
  10449. <SW NAME="Fastseeker">  
  10450.     <DIRECTORIES>
  10451.     </DIRECTORIES>
  10452.     <FILES>
  10453.         <FILE NAME="fastseekertoolbar.dll" PATH="Sys32Dir"></FILE>
  10454.         <FILE NAME="fastseekertoolbar.dll" PATH="SysDir"></FILE>
  10455.         <FILE NAME="fastseekersetup.ocx" PATH=""></FILE>
  10456.         <FILE NAME="fastseekersetupv2.ocx" PATH=""></FILE>
  10457.     </FILES>
  10458.     <COOKIES>
  10459.     </COOKIES>
  10460.     <REGISTRY>
  10461.         <KEYS>
  10462.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{4cc0faf8-6048-421c-9fe2-261a9ece5f80}"></REGKEY>
  10463.         </KEYS>
  10464.         <VALUES>
  10465.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{4cc0faf8-6048-421c-9fe2-261a9ece5f80}"></REGVALUE>
  10466.         </VALUES>
  10467.     </REGISTRY>
  10468. <DANGER_LEVEL>1</DANGER_LEVEL>
  10469. <DESCRIPTION>Toolbar that attaches itself to internet explorer.</DESCRIPTION>
  10470. </SW>
  10471. <SW NAME="PowerSearch">
  10472.     <DIRECTORIES>
  10473.           <DIR NAME="PowerSearch" PATH="PFDir"></DIR>
  10474.     </DIRECTORIES>
  10475.     <FILES>
  10476.         <FILE NAME="pwrsc032.dll" PATH="SysDir"></FILE>
  10477.         <FILE NAME="pwrsc032.dll" PATH="Sys32Dir"></FILE>
  10478.         <FILE NAME="pwrs0108.dll" PATH="SysDir"></FILE>
  10479.         <FILE NAME="pwrs0108.dll" PATH="Sys32Dir"></FILE>
  10480.         <FILE NAME="pwrs0102.dll" PATH="Sys32Dir"></FILE>
  10481.         <FILE NAME="pwrs0102.dll" PATH="SysDir"></FILE>
  10482.         <FILE NAME="pwrswmda.dll" PATH="PFDir\\powersearch\\toolbar"></FILE>
  10483.         <FILE NAME="pwrswmda.dll" PATH="PFDir\\powersoft\\toolbar"></FILE>
  10484.         <FILE NAME="pwrswmda.dll" PATH="Sys32Dir"></FILE>
  10485.         <FILE NAME="pwrswmda.dll" PATH="SysDir"></FILE>
  10486.         <FILE NAME="pwrsbikd.dll" PATH="PFDir\\powersearch\\toolbar"></FILE>
  10487.         <FILE NAME="pwrs0rbi.dll" PATH="SysDir"></FILE>
  10488.         <FILE NAME="pwrs0rbi.dll" PATH="Sys32Dir"></FILE>
  10489.     </FILES>
  10490.     <COOKIES>
  10491.     </COOKIES>
  10492.     <REGISTRY>
  10493.         <KEYS>
  10494.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{4E7BD74F-2B8D-469E-A08E-8E1CA787AD2D}"></REGKEY>
  10495.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{4E7BD74F-2B8D-469E-D3FA-F27BA787AD2D}"></REGKEY>
  10496.         </KEYS>
  10497.         <VALUES>
  10498.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar\\WebBrowser" VALUE="{4E7BD74F-2B8D-469E-D3FA-F27BA787AD2D}"></REGVALUE>
  10499.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar\\WebBrowser" VALUE="{4E7BD74F-2B8D-469E-A08E-8E1CA787AD2D}"></REGVALUE>
  10500.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{4E7BD74F-2B8D-469E-A08E-8E1CA787AD2D}"></REGVALUE>
  10501.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{4E7BD74F-2B8D-469E-D3FA-F27BA787AD2D}"></REGVALUE>
  10502.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{4E7BD74F-2B8D-469E-A08D-8F6FA787AD2D}"></REGVALUE>
  10503.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{4E7BD74F-2B8D-469E-AA8E-8E1CA787AD2D}"></REGVALUE>
  10504.         </VALUES>
  10505.     </REGISTRY>
  10506. <DANGER_LEVEL>1</DANGER_LEVEL>
  10507. <DESCRIPTION>It is a Hijacker that resets your browser's settings to point to other sites. </DESCRIPTION>
  10508. </SW>
  10509. <SW NAME="Americlicks">  
  10510.     <DIRECTORIES>
  10511.     </DIRECTORIES>
  10512.     <FILES>
  10513.         <FILE NAME="acbarv2.dll" PATH="Sys32Dir"></FILE>
  10514.         <FILE NAME="acbarv2.dll" PATH="SysDir"></FILE>
  10515.     </FILES>
  10516.     <COOKIES>
  10517.     </COOKIES>
  10518.     <REGISTRY>
  10519.         <KEYS>
  10520.         </KEYS>
  10521.         <VALUES>
  10522.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{4E7BD74F-2B8D-469E-A0E8-ED6DB696BB7D}"></REGVALUE>
  10523.         </VALUES>
  10524.     </REGISTRY>
  10525. <DANGER_LEVEL>1</DANGER_LEVEL>
  10526. <DESCRIPTION>It is a Hijacker that resets your browser's settings to point to other sites. </DESCRIPTION>
  10527. </SW>
  10528. <SW NAME="Push toolbar">  
  10529.     <DIRECTORIES>
  10530.     </DIRECTORIES>
  10531.     <FILES>
  10532.         <FILE NAME="searchv2.dll" PATH="Sys32Dir"></FILE>
  10533.         <FILE NAME="searchv2.dll" PATH="SysDir"></FILE>
  10534.     </FILES>
  10535.     <COOKIES>
  10536.     </COOKIES>
  10537.     <REGISTRY>
  10538.         <KEYS>
  10539.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{4e7bd74f-2b8d-469e-a0e8-f76fa694bf2e}"></REGKEY>
  10540.         </KEYS>
  10541.         <VALUES>
  10542.         </VALUES>
  10543.     </REGISTRY>
  10544. <DANGER_LEVEL>1</DANGER_LEVEL>
  10545. <DESCRIPTION>Likely to slow performance of Internet Explorer.</DESCRIPTION>
  10546. </SW>
  10547. <SW NAME="DownloadPlus">  
  10548.     <DIRECTORIES>
  10549.     </DIRECTORIES>
  10550.     <FILES>
  10551.         <FILE NAME="downloadplus.exe" PATH="ProfilePath\\application data"></FILE>
  10552.         <FILE NAME="downloadplus.exe" PATH="WinDir\\application data"></FILE>
  10553.     </FILES>
  10554.     <COOKIES>
  10555.     </COOKIES>
  10556.     <REGISTRY>
  10557.         <KEYS>
  10558.             <REGKEY MAIN="HKEY_CURRENT_USER" SUB="software" VALUE="0x7a69"></REGKEY>
  10559.         </KEYS>
  10560.         <VALUES>
  10561.         </VALUES>
  10562.     </REGISTRY>
  10563. <DANGER_LEVEL>1</DANGER_LEVEL>
  10564. <DESCRIPTION>Known to cause popup advertisements.</DESCRIPTION>
  10565. </SW>
  10566. <SW NAME="123Messenger">
  10567.     <DIRECTORIES>
  10568.     </DIRECTORIES>
  10569.     <FILES>
  10570.         <FILE NAME="123messenger.per" PATH=""></FILE>
  10571.     </FILES>
  10572.     <COOKIES>
  10573.     </COOKIES>
  10574.     <REGISTRY>
  10575.         <KEYS>
  10576.         </KEYS>
  10577.         <VALUES>
  10578.         </VALUES>
  10579.     </REGISTRY>
  10580. <DANGER_LEVEL>2</DANGER_LEVEL>
  10581. <DESCRIPTION>Spanish dialer associated with high cost numbers.</DESCRIPTION>
  10582. </SW>
  10583. <SW NAME="Msudpb">
  10584.     <DIRECTORIES>
  10585.     </DIRECTORIES>
  10586.     <FILES>
  10587.         <FILE NAME="Msudpb.dll" PATH="Sys32Dir"></FILE>
  10588.     </FILES>
  10589.     <COOKIES>
  10590.     </COOKIES>
  10591.     <REGISTRY>
  10592.        <KEYS>
  10593.        </KEYS>
  10594.        <VALUES>
  10595.        </VALUES>
  10596.     </REGISTRY>
  10597. <DANGER_LEVEL>2</DANGER_LEVEL>
  10598. <DESCRIPTION>Browser helper object related to pornography.</DESCRIPTION>
  10599. </SW>
  10600. <SW NAME="TROJ_VANTA.A">  
  10601.      <DIRECTORIES>
  10602.      </DIRECTORIES>
  10603.      <FILES>
  10604.        </FILES>
  10605.      <COOKIES>
  10606.      </COOKIES>
  10607.      <REGISTRY>
  10608.          <KEYS>
  10609.          </KEYS>
  10610.          <VALUES>
  10611.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="MsSystem"></REGVALUE>
  10612.          </VALUES>
  10613.      </REGISTRY>
  10614.  <DANGER_LEVEL>2</DANGER_LEVEL>
  10615.  <DESCRIPTION>Worm that allows hackers unauthorized access to your PC.</DESCRIPTION>
  10616. </SW>
  10617. <SW NAME="MSIEBHO">  
  10618.      <DIRECTORIES>
  10619.      </DIRECTORIES>
  10620.      <FILES>
  10621.          <FILE NAME="msiebho.dll" PATH=""></FILE>
  10622.        </FILES>
  10623.      <COOKIES>
  10624.      </COOKIES>
  10625.      <REGISTRY>
  10626.          <KEYS>
  10627.          </KEYS>
  10628.          <VALUES>
  10629.          </VALUES>
  10630.      </REGISTRY>
  10631.  <DANGER_LEVEL>1</DANGER_LEVEL>
  10632.  <DESCRIPTION>Known to cause popup advertisements.</DESCRIPTION>
  10633. </SW>
  10634. <SW NAME="Mshta Dialer">  
  10635.      <DIRECTORIES>
  10636.      </DIRECTORIES>
  10637.      <FILES>
  10638.        </FILES>
  10639.      <COOKIES>
  10640.      </COOKIES>
  10641.      <REGISTRY>
  10642.          <KEYS>
  10643.          </KEYS>
  10644.          <VALUES>
  10645.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="SystemBoot"></REGVALUE>
  10646.          </VALUES>
  10647.      </REGISTRY>
  10648.  <DANGER_LEVEL>2</DANGER_LEVEL>
  10649.  <DESCRIPTION>Dialer program that dials a very expensive number to access pornography, many times without user's knowledge.</DESCRIPTION>
  10650. </SW>
  10651. <SW NAME="Mostrar Dialer">
  10652.     <DIRECTORIES>
  10653.     </DIRECTORIES>
  10654.     <FILES>
  10655.         <FILE NAME="msapasrc.dll" PATH="SysDir"></FILE>
  10656.         <FILE NAME="msapasrc.dll" PATH="Sys32Dir"></FILE>
  10657.         <FILE NAME="MSA64CHK.DLL" PATH="SysDir"></FILE>
  10658.         <FILE NAME="MSA64CHK.DLL" PATH="Sys32Dir"></FILE>
  10659.     </FILES>
  10660.     <COOKIES>
  10661.     </COOKIES>
  10662.     <REGISTRY>
  10663.        <KEYS>
  10664.        </KEYS>
  10665.        <VALUES>
  10666.        </VALUES>
  10667.     </REGISTRY>
  10668. <DANGER_LEVEL>2</DANGER_LEVEL>
  10669. <DESCRIPTION>Dialer program that dials a very expensive number to access pornography, many times without user's knowledge.</DESCRIPTION>
  10670. </SW>
  10671. <SW NAME="CoolBar/LookThru Cool Search Bar">  
  10672.     <DIRECTORIES>
  10673.     </DIRECTORIES>
  10674.     <FILES>
  10675.         <FILE NAME="coolbar.dll" PATH="SysDir"></FILE>
  10676.         <FILE NAME="coolbar.dll" PATH="Sys32Dir"></FILE>
  10677.     </FILES> 
  10678.     <COOKIES>
  10679.     </COOKIES>
  10680.     <REGISTRY>
  10681.         <KEYS>
  10682.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{2af8ced6-5bd8-4310-a90c-9664efb16b10}"></REGKEY>
  10683.         </KEYS>
  10684.         <VALUES>
  10685.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{a49aa76f-7215-4f80-97d6-9a7e16a5fee1}"></REGVALUE>
  10686.         </VALUES>
  10687.     </REGISTRY>
  10688. <DANGER_LEVEL>1</DANGER_LEVEL>
  10689. <DESCRIPTION>Will change your internet settings and display popup advertisements.</DESCRIPTION>
  10690. </SW>
  10691. <SW NAME="GlobalDialer">
  10692.     <DIRECTORIES>
  10693.     <DIR NAME="GlobalDialer" PATH="PFDir"></DIR>
  10694.     </DIRECTORIES>
  10695.     <FILES>
  10696.         <FILE NAME="svchost.exe" PATH="PFDir\\GlobalDialer\\tonex00201"></FILE>
  10697.         <FILE NAME="gd-dial.exe" PATH="PFDir\\GlobalDialer\\domer00084"></FILE>
  10698.     </FILES>
  10699.     <COOKIES>
  10700.     </COOKIES>
  10701.     <REGISTRY>
  10702.         <KEYS>
  10703.         </KEYS>
  10704.         <VALUES>
  10705.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="sws.exe"></REGVALUE>
  10706.         </VALUES>
  10707.     </REGISTRY>
  10708. <DANGER_LEVEL>2</DANGER_LEVEL>
  10709. <DESCRIPTION>Dialer program that dials a very expensive number , many times without user's knowledge.</DESCRIPTION>
  10710. </SW>
  10711. <SW NAME="W32/Bagle.n@MM/W32.Beagle.M@mm">  
  10712.      <DIRECTORIES>
  10713.      </DIRECTORIES>
  10714.      <FILES>
  10715.          <FILE NAME="winupd.exe" PATH="Sys32Dir"></FILE>
  10716.        </FILES>
  10717.      <COOKIES>
  10718.      </COOKIES>
  10719.      <REGISTRY>
  10720.          <KEYS>
  10721.          </KEYS>
  10722.          <VALUES>
  10723.              <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="winupd.exe"></REGVALUE>
  10724.          </VALUES>
  10725.      </REGISTRY>
  10726.  <DANGER_LEVEL>2</DANGER_LEVEL>
  10727.  <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  10728. </SW> 
  10729. <SW NAME="KeyloggerPro">
  10730.     <DIRECTORIES>
  10731.     </DIRECTORIES>
  10732.     <FILES>
  10733.         <FILE NAME="KeyloggerPro.exe" PATH="PFDir\\ExploreAnywhere\\KeyloggerPro"></FILE>
  10734.     </FILES>
  10735.     <COOKIES>
  10736.     </COOKIES>
  10737.     <REGISTRY>
  10738.         <KEYS>
  10739.         </KEYS>
  10740.         <VALUES>
  10741.         </VALUES>
  10742.     </REGISTRY>
  10743. <DANGER_LEVEL>2</DANGER_LEVEL>
  10744. <DESCRIPTION>Commercial keylogger program that will record all actions done on your PC.</DESCRIPTION>
  10745. </SW>
  10746. <SW NAME="CWS.XPlugin">
  10747.     <DIRECTORIES>
  10748.     </DIRECTORIES>
  10749.     <FILES>
  10750.         <FILE NAME="XPlugin.dll" PATH="SysDir"></FILE>
  10751.         <FILE NAME="XPlugin.dll" PATH="Sys32Dir"></FILE>
  10752.     </FILES>
  10753.     <COOKIES>
  10754.     </COOKIES>
  10755.     <REGISTRY>
  10756.         <KEYS>
  10757.         </KEYS>
  10758.         <VALUES>
  10759.         </VALUES>
  10760.     </REGISTRY>
  10761. <DANGER_LEVEL>1</DANGER_LEVEL>
  10762. <DESCRIPTION>Coolwebsearch variant, known to hijackthis your internet settings.</DESCRIPTION>
  10763. </SW>
  10764. <SW NAME="CWS.QTTasks">
  10765.     <DIRECTORIES>
  10766.     </DIRECTORIES>
  10767.     <FILES>
  10768.         <FILE NAME="qttasks.exe" PATH="WinDir"></FILE>
  10769.     </FILES>
  10770.     <COOKIES>
  10771.     </COOKIES>
  10772.     <REGISTRY>
  10773.         <KEYS>
  10774.         </KEYS>
  10775.         <VALUES>
  10776.         </VALUES>
  10777.     </REGISTRY>
  10778. <DANGER_LEVEL>1</DANGER_LEVEL>
  10779. <DESCRIPTION>Coolwebsearch variant, known to hijackthis your internet settings.</DESCRIPTION>
  10780. </SW>
  10781. <SW NAME="CWS.Excel10">
  10782.     <DIRECTORIES>
  10783.     </DIRECTORIES>
  10784.     <FILES>
  10785.         <FILE NAME="Excel10.dll" PATH="ProfilePath\\application data\\microsoft\\office"></FILE>
  10786.         <FILE NAME="Excel10.dll" PATH="SysDir"></FILE>
  10787.         <FILE NAME="Excel10.dll" PATH="Sys32Dir"></FILE>
  10788.     </FILES>
  10789.     <COOKIES>
  10790.     </COOKIES>
  10791.     <REGISTRY>
  10792.         <KEYS>
  10793.         </KEYS>
  10794.         <VALUES>
  10795.         </VALUES>
  10796.     </REGISTRY>
  10797. <DANGER_LEVEL>1</DANGER_LEVEL>
  10798. <DESCRIPTION>Coolwebsearch variant, known to hijackthis your internet settings.</DESCRIPTION>
  10799. </SW>
  10800. <SW NAME="EBlaster">
  10801.     <DIRECTORIES>
  10802.     </DIRECTORIES>
  10803.     <FILES>
  10804.         <FILE NAME="eblaster.exe" PATH=""></FILE>
  10805.         <FILE NAME="msrac32.exe" PATH=""></FILE>
  10806.         <FILE NAME="ebsetup.exe" PATH=""></FILE>
  10807.         <FILE NAME="MSWEBHLP.DLL" PATH="SysDir"></FILE>
  10808.         <FILE NAME="mstv9swin.dll" PATH="SysDir"></FILE>
  10809.         <FILE NAME="mstv9swin.ocx" PATH="SysDir"></FILE>
  10810.     </FILES>
  10811.     <COOKIES>
  10812.     </COOKIES>
  10813.     <REGISTRY>
  10814.         <KEYS>
  10815.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{6314e760-e667-11d2-ba98-0080c8e9491a}\\ole\\shell\\commands"></REGKEY>
  10816.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{deca39c1-f713-11d2-ba99-0080c8e9491a}\\inprocserver32"></REGKEY>
  10817.         </KEYS>
  10818.         <VALUES>
  10819.         </VALUES>
  10820.     </REGISTRY>
  10821. <DANGER_LEVEL>2</DANGER_LEVEL>
  10822. <DESCRIPTION>Commercial keylogger program that will record all actions done on your PC.</DESCRIPTION>
  10823. </SW>
  10824. <SW NAME="Fearless Key Spy">
  10825.     <DIRECTORIES>
  10826.     </DIRECTORIES>
  10827.     <FILES>
  10828.         <FILE NAME="fks2.0_server.exe" PATH="SysDir"></FILE>
  10829.     </FILES>
  10830.     <COOKIES>
  10831.     </COOKIES>
  10832.     <REGISTRY>
  10833.         <KEYS>
  10834.         </KEYS>
  10835.         <VALUES>
  10836.         </VALUES>
  10837.     </REGISTRY>
  10838. <DANGER_LEVEL>2</DANGER_LEVEL>
  10839. <DESCRIPTION>Commercial keylogger program that will record all actions done on your PC.</DESCRIPTION>
  10840. </SW>
  10841. <SW NAME="Ghost KeyLogger">
  10842.     <DIRECTORIES>
  10843.     <DIR NAME="sync manager" PATH="PFDir"></DIR>
  10844.     </DIRECTORIES>
  10845.     <FILES>
  10846.         <FILE NAME="syncagent.exe" PATH="PFDir\\sync manager\\agent"></FILE>
  10847.         <FILE NAME="syncconfig.exe" PATH="PFDir\\sync manager"></FILE>
  10848.         <FILE NAME="synconfig.exe" PATH="PFDir\\sync manager"></FILE>
  10849.         <FILE NAME="logfile.cip" PATH="PFDir\\sync manager"></FILE>
  10850.     </FILES>
  10851.     <COOKIES>
  10852.     </COOKIES>
  10853.     <REGISTRY>
  10854.         <KEYS>
  10855.         </KEYS>
  10856.         <VALUES>
  10857.         </VALUES>
  10858.     </REGISTRY>
  10859. <DANGER_LEVEL>2</DANGER_LEVEL>
  10860. <DESCRIPTION>Commercial keylogger program that will record all actions done on your PC.</DESCRIPTION>
  10861. </SW>
  10862. <SW NAME="keyhook">
  10863.     <DIRECTORIES>
  10864.     </DIRECTORIES>
  10865.     <FILES>
  10866.         <FILE NAME="keyhook.dll" PATH="WinDir"></FILE>
  10867.     </FILES>
  10868.     <COOKIES>
  10869.     </COOKIES>
  10870.     <REGISTRY>
  10871.         <KEYS>
  10872.         </KEYS>
  10873.         <VALUES>
  10874.         </VALUES>
  10875.     </REGISTRY>
  10876. <DANGER_LEVEL>1</DANGER_LEVEL>
  10877. <DESCRIPTION>Dll file associated with keylogger programs used to record actions done on your PC.</DESCRIPTION>
  10878. </SW>
  10879. <SW NAME="Home Keylogger">  
  10880.     <DIRECTORIES>
  10881.         <DIR NAME="homekeylogger" PATH="PFDir"></DIR>
  10882.     </DIRECTORIES>
  10883.     <FILES>
  10884.         <FILE NAME="Keylogger.dll" PATH="PFDir\\homekeylogger"></FILE>
  10885.         <FILE NAME="Keylogger.exe" PATH="PFDir\\homekeylogger"></FILE>
  10886.     </FILES>
  10887.     <COOKIES>
  10888.     </COOKIES>
  10889.     <REGISTRY>
  10890.         <KEYS>
  10891.         </KEYS>
  10892.         <VALUES>
  10893.         </VALUES>
  10894.     </REGISTRY>
  10895. <DANGER_LEVEL>2</DANGER_LEVEL>
  10896. <DESCRIPTION>Commercial keylogger program that will record all actions done on your PC.</DESCRIPTION>
  10897. </SW>
  10898. <SW NAME="Invisible Keylogger 97">
  10899.     <DIRECTORIES>
  10900.          <DIR NAME="ik" PATH="PFDir"></DIR>
  10901.     </DIRECTORIES>
  10902.     <FILES>
  10903.         <FILE NAME="ik.exe" PATH="PFDir\\ik"></FILE>
  10904.     </FILES>
  10905.     <COOKIES>
  10906.     </COOKIES>
  10907.     <REGISTRY>
  10908.         <KEYS>
  10909.         </KEYS>
  10910.         <VALUES>
  10911.         </VALUES>
  10912.     </REGISTRY>
  10913. <DANGER_LEVEL>2</DANGER_LEVEL>
  10914. <DESCRIPTION>Commercial keylogger program that will record all actions done on your PC.</DESCRIPTION>
  10915. </SW>
  10916. <SW NAME="W32/Lirva.a@MM">
  10917.     <DIRECTORIES>
  10918.     </DIRECTORIES>
  10919.     <FILES>
  10920.     </FILES>
  10921.     <COOKIES>
  10922.     </COOKIES>
  10923.     <REGISTRY>
  10924.         <KEYS>
  10925.         </KEYS>
  10926.         <VALUES>
  10927.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Avril Lavigne - Muse"></REGVALUE>
  10928.         </VALUES>
  10929.     </REGISTRY>
  10930. <DANGER_LEVEL>2</DANGER_LEVEL>
  10931. <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  10932. </SW>
  10933. <SW NAME="CoolWebSearch.image">
  10934.     <DIRECTORIES>
  10935.     </DIRECTORIES>
  10936.     <FILES>
  10937.          <FILE NAME="image.dll" PATH="WinDir"></FILE>
  10938.     </FILES>
  10939.     <COOKIES>
  10940.     </COOKIES>
  10941.     <REGISTRY>
  10942.         <KEYS>
  10943.         </KEYS>
  10944.         <VALUES>
  10945.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Image"></REGVALUE>
  10946.         </VALUES>
  10947.     </REGISTRY>
  10948. <DANGER_LEVEL>1</DANGER_LEVEL>
  10949. <DESCRIPTION>Coolwebsearch variant, known to hijackthis your internet settings.</DESCRIPTION>
  10950. </SW>
  10951. <SW NAME="IeMonit">
  10952.     <DIRECTORIES>
  10953.     </DIRECTORIES>
  10954.     <FILES>
  10955.         <FILE NAME="iemonit.dll" PATH="SysDir"></FILE>
  10956.         <FILE NAME="iemonit.dll" PATH="Sys32Dir"></FILE>
  10957.         <FILE NAME="ieupdates.exe" PATH="SysDir"></FILE>
  10958.         <FILE NAME="updaterie01.exe" PATH="SysDir"></FILE>
  10959.         <FILE NAME="fixieupdate.exe" PATH="SysDir"></FILE>
  10960.         <FILE NAME="ieupdates.exe" PATH="Sys32Dir"></FILE>
  10961.         <FILE NAME="updaterie01.exe" PATH="Sys32Dir"></FILE>
  10962.         <FILE NAME="fixieupdate.exe" PATH="Sys32Dir"></FILE>
  10963.     </FILES>
  10964.     <COOKIES>
  10965.     </COOKIES>
  10966.     <REGISTRY>
  10967.         <KEYS>
  10968.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{ce7c3cf0-4b15-11d1-abed-709549c10001}"></REGKEY>
  10969.         </KEYS>
  10970.         <VALUES>
  10971.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Internet Explorer Library"></REGVALUE>
  10972.         </VALUES>
  10973.     </REGISTRY>
  10974. <DANGER_LEVEL>1</DANGER_LEVEL>
  10975. <DESCRIPTION>Search result hijacker used to display sponsored results to your browser.</DESCRIPTION>
  10976. </SW>
  10977. <SW NAME="CWS.GonnaSearch">
  10978.     <DIRECTORIES>
  10979.         <DIR NAME="toolbar" PATH="PFDir\\internet explorer"></DIR>
  10980.     </DIRECTORIES>
  10981.     <FILES>
  10982.        <FILE NAME="SEARCH~1.DLL" PATH="PFDir\\internet explorer\\toolbar"></FILE>
  10983.        <FILE NAME="AUTOSE~1.DLL" PATH="PFDir\\internet explorer\\toolbar"></FILE>
  10984.        <FILE NAME="webinfo.dll" PATH="PFDir\\internet explorer\\toolbar"></FILE>
  10985.      </FILES> 
  10986.     <COOKIES>
  10987.     </COOKIES>
  10988.     <REGISTRY>
  10989.        <KEYS>
  10990.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{799A370D-5993-4887-9DF7-0A4756A77D00}"></REGKEY>
  10991.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{A55581DC-2CDB-4089-8878-71A080B22342}"></REGKEY>
  10992.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{E7AFFF2A-1B57-49C7-BF6B-E5123394C970}"></REGKEY>
  10993.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{799A370D-5993-4887-9DF7-0A4756A77D00}"></REGKEY>
  10994.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{A55581DC-2CDB-4089-8878-71A080B22342}"></REGKEY>
  10995.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{E7AFFF2A-1B57-49C7-BF6B-E5123394C970}"></REGKEY>
  10996.        </KEYS>
  10997.        <VALUES>
  10998.        </VALUES>
  10999.     </REGISTRY>
  11000. <DANGER_LEVEL>1</DANGER_LEVEL>
  11001. <DESCRIPTION>Coolwebsearch variant, known to hijackthis your internet settings.</DESCRIPTION>
  11002. </SW>
  11003. <SW NAME="Trojan.Gema">  
  11004.     <DIRECTORIES>
  11005.     </DIRECTORIES>
  11006.     <FILES>
  11007.         <FILE NAME="cpusave32.exe" PATH="Sys32Dir"></FILE>
  11008.         <FILE NAME="pwr32ctr.exe" PATH="SysDir"></FILE>
  11009.         <FILE NAME="pwr32ctr.exe" PATH="Sys32Dir"></FILE>
  11010.     </FILES>
  11011.     <COOKIES>
  11012.     </COOKIES>
  11013.     <REGISTRY>
  11014.         <KEYS>
  11015.         </KEYS>
  11016.         <VALUES>
  11017.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Cpusave32"></REGVALUE>
  11018.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Cpusave32"></REGVALUE>
  11019.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Pwr32ctr"></REGVALUE>
  11020.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Pwr32ctr"></REGVALUE>
  11021.         </VALUES>
  11022.     </REGISTRY>
  11023. <DANGER_LEVEL>2</DANGER_LEVEL>
  11024. <DESCRIPTION>Worm that attempts to perform unauthorized functions on your PC.</DESCRIPTION>
  11025. </SW>
  11026. <SW NAME="Family Keylogger">  
  11027.     <DIRECTORIES>
  11028.         <DIR NAME="FamilyKeylogger" PATH="PFDir"></DIR>
  11029.     </DIRECTORIES>
  11030.     <FILES>
  11031.         <FILE NAME="acl.exe" PATH="PFDir\\FamilyKeylogger"></FILE>
  11032.         <FILE NAME="cisvc.dll" PATH="PFDir\\FamilyKeylogger"></FILE>
  11033.         <FILE NAME="cisvc.exe" PATH="PFDir\\FamilyKeylogger"></FILE>
  11034.     </FILES>
  11035.     <COOKIES>
  11036.     </COOKIES>
  11037.     <REGISTRY>
  11038.         <KEYS>
  11039.         </KEYS>
  11040.         <VALUES>
  11041.         </VALUES>
  11042.     </REGISTRY>
  11043. <DANGER_LEVEL>2</DANGER_LEVEL>
  11044. <DESCRIPTION>Commercial keylogger program that will record all actions done on your PC.</DESCRIPTION>
  11045. </SW>
  11046. <SW NAME="ExPup">  
  11047.     <DIRECTORIES>
  11048.     </DIRECTORIES>
  11049.     <FILES>
  11050.         <FILE NAME="expup.exe" PATH="Sys32Dir"></FILE>
  11051.     </FILES>
  11052.     <COOKIES>
  11053.     </COOKIES>
  11054.     <REGISTRY>
  11055.         <KEYS>
  11056.         </KEYS>
  11057.         <VALUES>
  11058.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="Explkw"></REGVALUE>
  11059.         </VALUES>
  11060.     </REGISTRY>
  11061. <DANGER_LEVEL>1</DANGER_LEVEL>
  11062. <DESCRIPTION>Purposes not clearly known, but known to be packaged with malicious software.</DESCRIPTION>
  11063. </SW>
  11064. <SW NAME="Eros Dialer">  
  11065.     <DIRECTORIES>
  11066.     </DIRECTORIES>
  11067.     <FILES>
  11068.         <FILE NAME="eros.exe" PATH="SysDir"></FILE>
  11069.         <FILE NAME="eros.exe" PATH="Sys32Dir"></FILE>
  11070.     </FILES>
  11071.     <COOKIES>
  11072.     </COOKIES>
  11073.     <REGISTRY>
  11074.         <KEYS>
  11075.         </KEYS>
  11076.         <VALUES>
  11077.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="eros.exe"></REGVALUE>
  11078.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\RunServices" VALUE="eros.exe"></REGVALUE>
  11079.         </VALUES>
  11080.     </REGISTRY>
  11081. <DANGER_LEVEL>2</DANGER_LEVEL>
  11082. <DESCRIPTION>Dialer program that dials a very expensive number to access pornography, many times without user's knowledge.</DESCRIPTION>
  11083. </SW>
  11084. <SW NAME="Downloader.Dluca.C/Downloader.Dluca.D">  
  11085.       <DIRECTORIES>
  11086.       </DIRECTORIES>
  11087.       <FILES>
  11088.           <FILE NAME="dluca.exe" PATH=""></FILE>
  11089.         <FILE NAME="Dluxjp.exe" PATH="PFDir\\Dialers\\Dluxjp"></FILE>
  11090.     </FILES>
  11091.       <COOKIES>
  11092.       </COOKIES>
  11093.       <REGISTRY>
  11094.           <KEYS>
  11095.           </KEYS>
  11096.           <VALUES>
  11097.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="DLuxjp"></REGVALUE>
  11098.               <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="dluca"></REGVALUE>
  11099.           </VALUES>
  11100.       </REGISTRY>
  11101.   <DANGER_LEVEL>2</DANGER_LEVEL>
  11102.   <DESCRIPTION>Worm that allows hackers unauthorized access to your PC.</DESCRIPTION>
  11103.  </SW>
  11104.  <SW NAME="W32.HLLW.Respan/W32.HLLW.Astef">  
  11105.       <DIRECTORIES>
  11106.       </DIRECTORIES>
  11107.       <FILES>
  11108.           <FILE NAME="windows_critical_update.exe" PATH="SysDir"></FILE>
  11109.           <FILE NAME="windows_critical_update.exe" PATH="Sys32Dir"></FILE>
  11110.           <FILE NAME="windowsupdate.exe" PATH="SysDir"></FILE>
  11111.          <FILE NAME="windowsupdate.exe" PATH="Sys32Dir"></FILE>
  11112.          <FILE NAME="windll32.exe" PATH="WinDir"></FILE>
  11113.          <FILE NAME="ocx32.exe" PATH="WinDir"></FILE>
  11114.          <FILE NAME="svchost.exe" PATH="WinDir"></FILE>
  11115.      </FILES>
  11116.       <COOKIES>
  11117.       </COOKIES>
  11118.       <REGISTRY>
  11119.           <KEYS>
  11120.           </KEYS>
  11121.           <VALUES>
  11122.               <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="WindowsCriticalUpdate"></REGVALUE>
  11123.               <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="WindowsUpdate"></REGVALUE>
  11124.               <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="windll"></REGVALUE>
  11125.               <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="ocx32"></REGVALUE>
  11126.               <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="microsoft"></REGVALUE>
  11127.              <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="WindowsCriticalUpdate"></REGVALUE>
  11128.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="WindowsUpdate"></REGVALUE>
  11129.           </VALUES>
  11130.       </REGISTRY>
  11131.   <DANGER_LEVEL>1</DANGER_LEVEL>
  11132.   <DESCRIPTION>Worm that attempts to spread itself through file sharing networks.</DESCRIPTION>
  11133. </SW>
  11134. <SW NAME="WebSavings">  
  11135.     <DIRECTORIES>
  11136.         <DIR NAME="WebSavingsfromEbates" PATH="PFDir"></DIR>
  11137.     </DIRECTORIES>
  11138.     <FILES>
  11139.     </FILES>
  11140.     <COOKIES>
  11141.     </COOKIES>
  11142.     <REGISTRY>
  11143.         <KEYS>
  11144.         </KEYS>
  11145.         <VALUES>
  11146.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="WebSavingsfromEbates"></REGVALUE>
  11147.         </VALUES>
  11148.     </REGISTRY>
  11149. <DANGER_LEVEL>1</DANGER_LEVEL>
  11150. <DESCRIPTION>Shopping tool that will present pop up advertisements.</DESCRIPTION>
  11151. </SW>
  11152. <SW NAME="Downloader.Dluca">  
  11153.       <DIRECTORIES>
  11154.       </DIRECTORIES>
  11155.       <FILES>
  11156.           <FILE NAME="Winde.exe" PATH=""></FILE>
  11157.     </FILES>
  11158.       <COOKIES>
  11159.       </COOKIES>
  11160.       <REGISTRY>
  11161.           <KEYS>
  11162.           </KEYS>
  11163.           <VALUES>
  11164.               <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="winde"></REGVALUE>
  11165.           </VALUES>
  11166.       </REGISTRY>
  11167.   <DANGER_LEVEL>2</DANGER_LEVEL>
  11168.   <DESCRIPTION>Trojan horse that will send information about your computer back to a central server.</DESCRIPTION>
  11169.  </SW>
  11170. <SW NAME="DlDer">  
  11171.       <DIRECTORIES>
  11172.       </DIRECTORIES>
  11173.       <FILES>
  11174.           <FILE NAME="Explorer.exe" PATH="WinDir\\explorer"></FILE>
  11175.      </FILES>
  11176.       <COOKIES>
  11177.       </COOKIES>
  11178.       <REGISTRY>
  11179.           <KEYS>
  11180.           </KEYS>
  11181.           <VALUES>
  11182.               <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="dlder"></REGVALUE>
  11183.               <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Explorer"></REGVALUE>
  11184.           </VALUES>
  11185.       </REGISTRY>
  11186.   <DANGER_LEVEL>2</DANGER_LEVEL>
  11187.   <DESCRIPTION>Spyware that sends information about your PC to a central server.</DESCRIPTION>
  11188.  </SW>
  11189.  <SW NAME="Deltabar Deltaclick">
  11190.      <DIRECTORIES>
  11191.      </DIRECTORIES>
  11192.      <FILES>
  11193.         <FILE NAME="deltaclick.dll" PATH="SysDir"></FILE>
  11194.        <FILE NAME="deltaclick.dll" PATH="Sys32Dir"></FILE>
  11195.       </FILES> 
  11196.      <COOKIES>
  11197.      </COOKIES>
  11198.      <REGISTRY>
  11199.         <KEYS>
  11200.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{0fc817c2-3b45-11d4-8340-0050da825906}"></REGKEY>
  11201.         </KEYS>
  11202.         <VALUES>
  11203.         </VALUES>
  11204.      </REGISTRY>
  11205.  <DANGER_LEVEL>1</DANGER_LEVEL>
  11206.  <DESCRIPTION>Browser helper object that has been reported to cause errors in internet explorer.</DESCRIPTION>
  11207.  </SW>
  11208. <SW NAME="ClientMan.bho1">  
  11209.      <DIRECTORIES>
  11210.       </DIRECTORIES>
  11211.      <FILES>
  11212.          <FILE NAME="MSEFFM.DLL" PATH="SysDir"></FILE>
  11213.         <FILE NAME="MSEFFM.DLL" PATH="Sys32Dir"></FILE>
  11214.         <FILE NAME="MSCDKA.DLL" PATH="SysDir"></FILE>
  11215.         <FILE NAME="MSCDKA.DLL" PATH="Sys32Dir"></FILE>
  11216.         <FILE NAME="MSOBFL.DLL" PATH="SysDir"></FILE>
  11217.         <FILE NAME="MSOBFL.DLL" PATH="Sys32Dir"></FILE>
  11218.         <FILE NAME="MSECLK.DLL" PATH="Sys32Dir"></FILE>
  11219.         <FILE NAME="msncjk.dll" PATH="Sys32Dir"></FILE>
  11220.      </FILES>
  11221.      <COOKIES>
  11222.      </COOKIES>
  11223.      <REGISTRY>
  11224.          <KEYS>
  11225.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{94927A13-4AAA-476A-989D-392456427688}"></REGKEY>
  11226.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{94927A13-4AAA-476A-989D-392456427688}"></REGKEY>
  11227.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{96BE1D9A-9E54-4344-A27A-37C088D64FB4}"></REGKEY>
  11228.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{96BE1D9A-9E54-4344-A27A-37C088D64FB4}"></REGKEY>
  11229.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{CC916B4B-BE44-4026-A19D-8C74BBD23361}"></REGKEY>
  11230.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{CC916B4B-BE44-4026-A19D-8C74BBD23361}"></REGKEY>
  11231.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}"></REGKEY>
  11232.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}"></REGKEY>
  11233.          </KEYS>
  11234.          <VALUES>
  11235.          </VALUES>
  11236.      </REGISTRY>
  11237.      <DANGER_LEVEL>2</DANGER_LEVEL>
  11238.  <DESCRIPTION>Clientman is a widespread advertising parasite used to deliver advertisements to your PC.</DESCRIPTION>
  11239. </SW>
  11240. <SW NAME="ClientMan.bho2">  
  11241.      <DIRECTORIES>
  11242.       </DIRECTORIES>
  11243.      <FILES>
  11244.      </FILES>
  11245.      <COOKIES>
  11246.      </COOKIES>
  11247.      <REGISTRY>
  11248.          <KEYS>
  11249.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{00A0A40C-F432-4C59-BA11-B25D142C7AB7}"></REGKEY>
  11250.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{00A0A40C-F432-4C59-BA11-B25D142C7AB7}"></REGKEY>
  11251.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{166348F1-2C41-4C9F-86BB-EB2B8ADE030C}"></REGKEY>
  11252.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{166348F1-2C41-4C9F-86BB-EB2B8ADE030C}"></REGKEY>
  11253.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{25F7FA20-3FC3-11D7-B487-00D05990014C}"></REGKEY>
  11254.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{25F7FA20-3FC3-11D7-B487-00D05990014C}"></REGKEY>
  11255.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{5ED50735-B0D9-47C6-9774-02DD8E6FE053}"></REGKEY>
  11256.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{5ED50735-B0D9-47C6-9774-02DD8E6FE053}"></REGKEY>
  11257.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{A097840A-61F8-4B89-8693-F68F641CC838}"></REGKEY>
  11258.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{A097840A-61F8-4B89-8693-F68F641CC838}"></REGKEY>
  11259.               <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{A096A159-4E58-45A9-8EE6-B11466851181}"></REGKEY>
  11260.                 <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{A096A159-4E58-45A9-8EE6-B11466851181}"></REGKEY>
  11261.          </KEYS>
  11262.          <VALUES>
  11263.          </VALUES>
  11264.      </REGISTRY>
  11265.  <DANGER_LEVEL>2</DANGER_LEVEL>
  11266.  <DESCRIPTION>Clientman is a widespread advertising parasite used to deliver advertisements to your PC.</DESCRIPTION>
  11267. </SW>
  11268. <SW NAME="BlowSearch">  
  11269.      <DIRECTORIES>
  11270.         <DIR NAME="blowsearchtoolbar" PATH="PFDir"></DIR>
  11271.       </DIRECTORIES>
  11272.      <FILES>
  11273.          <FILE NAME="ultrabar.dll" PATH="SysDir"></FILE>
  11274.          <FILE NAME="ultrabar.dll" PATH="Sys32Dir"></FILE>
  11275.       </FILES>
  11276.      <COOKIES>
  11277.      </COOKIES>
  11278.      <REGISTRY>
  11279.          <KEYS>
  11280.          </KEYS>
  11281.          <VALUES>
  11282.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{6F8ADBE2-8C92-4362-B0E6-7321AA49EE46}"></REGVALUE>
  11283.          </VALUES>
  11284.      </REGISTRY>
  11285.      <DANGER_LEVEL>1</DANGER_LEVEL>
  11286.  <DESCRIPTION>Internet Explorer toolbar that displays search results.</DESCRIPTION>
  11287. </SW>
  11288. <SW NAME="BKDR_SDBOT.OJ">  
  11289.      <DIRECTORIES>
  11290.      </DIRECTORIES>
  11291.      <FILES>
  11292.          <FILE NAME="MSConfig45.exe" PATH=""></FILE>
  11293.       </FILES>
  11294.      <COOKIES>
  11295.      </COOKIES>
  11296.      <REGISTRY>
  11297.          <KEYS>
  11298.          </KEYS>
  11299.          <VALUES>
  11300.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="MSConfig45"></REGVALUE>
  11301.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="MSConfig45"></REGVALUE>
  11302.          </VALUES>
  11303.      </REGISTRY>
  11304.      <DANGER_LEVEL>2</DANGER_LEVEL>
  11305.  <DESCRIPTION>Worm that allows hackers unauthorized access to your PC.</DESCRIPTION>
  11306. </SW>
  11307. <SW NAME="ABCKeylogger">  
  11308.      <DIRECTORIES>
  11309.          <DIR NAME="jthabckeylogger" PATH="PFDir"></DIR>
  11310.     </DIRECTORIES>
  11311.      <FILES>
  11312.          <FILE NAME="abckey.dll" PATH="PFDir\\jthabckeylogger"></FILE>
  11313.          <FILE NAME="forgotpass.exe" PATH="PFDir\\jthabckeylogger"></FILE>
  11314.          <FILE NAME="keylogger.exe" PATH="PFDir\\jthabckeylogger"></FILE>
  11315.       </FILES>
  11316.      <COOKIES>
  11317.      </COOKIES>
  11318.      <REGISTRY>
  11319.          <KEYS>
  11320.          </KEYS>
  11321.          <VALUES>
  11322.          </VALUES>
  11323.      </REGISTRY>
  11324.  <DANGER_LEVEL>2</DANGER_LEVEL>
  11325.  <DESCRIPTION>Keylogger program that will record all actions done on your PC.</DESCRIPTION>
  11326. </SW>
  11327. <SW NAME="Web P2P Installer">
  11328.     <DIRECTORIES>
  11329.     </DIRECTORIES>
  11330.     <FILES>
  11331.     </FILES>
  11332.     <COOKIES>
  11333.     </COOKIES>
  11334.     <REGISTRY>
  11335.        <KEYS>
  11336.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{1d6711c8-7154-40bb-8380-3dea45b69cbf}"></REGKEY>
  11337.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\code store database\\distribution units" VALUE="{1d6711c8-7154-40bb-8380-3dea45b69cbf}"></REGKEY>
  11338.        </KEYS>
  11339.        <VALUES>
  11340.        </VALUES>
  11341.     </REGISTRY>
  11342. <DANGER_LEVEL>1</DANGER_LEVEL>
  11343. <DESCRIPTION>Installer used to download and install other applications.</DESCRIPTION>
  11344. </SW>
  11345. <SW NAME="SafeSearch">  
  11346.     <DIRECTORIES>
  11347.         <DIR NAME="Safesearch" PATH="PFDir\\Primesoft"></DIR>
  11348.     </DIRECTORIES>
  11349.     <FILES>
  11350.         <FILE NAME="safesearch.exe" PATH="PFDir\\Primesoft\\Safesearch"></FILE>
  11351.     </FILES>
  11352.     <COOKIES>
  11353.     </COOKIES>
  11354.     <REGISTRY>
  11355.         <KEYS>
  11356.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="interface" VALUE="{28e6cce2-3f2c-4b3d-9cb4-2fc8715a3ece}"></REGKEY>
  11357.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{cb5006ee-f57d-4116-b7b6-48eb564fe0f0}"></REGKEY>
  11358.          </KEYS>
  11359.         <VALUES>
  11360.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="safesearch"></REGVALUE>
  11361.         </VALUES>
  11362.     </REGISTRY>
  11363. <DANGER_LEVEL>1</DANGER_LEVEL>
  11364. <DESCRIPTION>Browser Hijacker that will redirect some website visits to a secondary site.</DESCRIPTION>
  11365. </SW>
  11366. <SW NAME="Seach Assistant">
  11367.     <DIRECTORIES>
  11368.     </DIRECTORIES>
  11369.     <FILES>
  11370.         <FILE NAME="SrchAsst.exe" PATH="PFDir\\iWon\\Search Assistant"></FILE>
  11371.     </FILES>
  11372.     <COOKIES>
  11373.     </COOKIES>
  11374.     <REGISTRY>
  11375.         <KEYS>
  11376.         </KEYS>
  11377.         <VALUES>
  11378.         </VALUES>
  11379.     </REGISTRY>
  11380. <DANGER_LEVEL>1</DANGER_LEVEL>
  11381. <DESCRIPTION>SeekSeek variant that will hijack your browser.</DESCRIPTION>
  11382. </SW>
  11383. <SW NAME="SecondPower Multimedia Speedbar">
  11384.     <DIRECTORIES>
  11385.     </DIRECTORIES>
  11386.     <FILES>
  11387.         <FILE NAME="2ndpower.dll" PATH="SysDir"></FILE>
  11388.         <FILE NAME="2ndpower.dll" PATH="Sys32Dir"></FILE>
  11389.         </FILES>
  11390.     <COOKIES>
  11391.     </COOKIES>
  11392.     <REGISTRY>
  11393.         <KEYS>
  11394.         </KEYS>
  11395.         <VALUES>
  11396.         </VALUES>
  11397.     </REGISTRY>
  11398. <DANGER_LEVEL>1</DANGER_LEVEL>
  11399. <DESCRIPTION>Shows ads for gambling and other related industries.</DESCRIPTION>
  11400. </SW>
  11401. <SW NAME="SpyAnywhere">
  11402.     <DIRECTORIES>
  11403.     </DIRECTORIES>
  11404.     <FILES>
  11405.         <FILE NAME="spyanywhere.exe" PATH="PFDir\\spytech software\\spyanywhere"></FILE>
  11406.     </FILES>
  11407.     <COOKIES>
  11408.     </COOKIES>
  11409.     <REGISTRY>
  11410.         <KEYS>
  11411.         </KEYS>
  11412.         <VALUES>
  11413.         </VALUES>
  11414.     </REGISTRY>
  11415. <DANGER_LEVEL>2</DANGER_LEVEL>
  11416. <DESCRIPTION>Commercial keylogger program that will record all actions done on your PC.</DESCRIPTION>
  11417. </SW>
  11418. <SW NAME="SpyBuddy">
  11419.     <DIRECTORIES>
  11420.     </DIRECTORIES>
  11421.     <FILES>
  11422.         <FILE NAME="spybuddy.exe" PATH=""></FILE>
  11423.         <FILE NAME="spybuddy.exe" PATH="PFDir\\ExploreAnywhere\\SpyBuddy"></FILE>
  11424.      </FILES>
  11425.     <COOKIES>
  11426.     </COOKIES>
  11427.     <REGISTRY>
  11428.         <KEYS>
  11429.         </KEYS>
  11430.         <VALUES>
  11431.         </VALUES>
  11432.     </REGISTRY>
  11433. <DANGER_LEVEL>2</DANGER_LEVEL>
  11434. <DESCRIPTION>Commercial keylogger program that will record all actions done on your PC.</DESCRIPTION>
  11435. </SW>
  11436. <SW NAME="SpyCapture">
  11437.     <DIRECTORIES>
  11438.     </DIRECTORIES>
  11439.     <FILES>
  11440.         <FILE NAME="msscdll.exe" PATH=""></FILE>
  11441.         <FILE NAME="234001.tps" PATH=""></FILE>
  11442.         <FILE NAME="234301.tps" PATH=""></FILE>
  11443.         <FILE NAME="spycapture.txt" PATH=""></FILE>
  11444.     </FILES>
  11445.     <COOKIES>
  11446.     </COOKIES>
  11447.     <REGISTRY>
  11448.         <KEYS>
  11449.         </KEYS>
  11450.         <VALUES>
  11451.         </VALUES>
  11452.     </REGISTRY>
  11453. <DANGER_LEVEL>2</DANGER_LEVEL>
  11454. <DESCRIPTION>Commercial keylogger program that will record all actions done on your PC.</DESCRIPTION>
  11455. </SW>
  11456. <SW NAME="Iopus Starr Pro Key Logger">
  11457.     <DIRECTORIES>
  11458.     </DIRECTORIES>
  11459.     <FILES>
  11460.         <FILE NAME="see32.dll" PATH="SysDir"></FILE>
  11461.         <FILE NAME="see32u.dll" PATH="SysDir"></FILE>
  11462.         <FILE NAME="see32z.dll" PATH="SysDir"></FILE>
  11463.         <FILE NAME="slog.sys" PATH="SysDir"></FILE>
  11464.         <FILE NAME="slog.sysz" PATH="SysDir"></FILE>
  11465.         <FILE NAME="starrcmd.exe" PATH="SysDir"></FILE>
  11466.         <FILE NAME="wsys.dll" PATH="SysDir"></FILE>
  11467.     </FILES>
  11468.     <COOKIES>
  11469.     </COOKIES>
  11470.     <REGISTRY>
  11471.         <KEYS>
  11472.         </KEYS>
  11473.         <VALUES>
  11474.         </VALUES>
  11475.     </REGISTRY>
  11476. <DANGER_LEVEL>2</DANGER_LEVEL>
  11477. <DESCRIPTION>Commercial keylogger program that will record all actions done on your PC</DESCRIPTION>
  11478. </SW>
  11479. <SW NAME="Advanced Stealth Email Redirector">
  11480.     <DIRECTORIES>
  11481.     </DIRECTORIES>
  11482.     <FILES>
  11483.         <FILE NAME="vmaser.exe" PATH="SysDir"></FILE>
  11484.         <FILE NAME="vmaser.vxd" PATH="SysDir"></FILE>
  11485.     </FILES>
  11486.     <COOKIES>
  11487.     </COOKIES>
  11488.     <REGISTRY>
  11489.         <KEYS>
  11490.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="system\\currentcontrolset\\services\\vxd" VALUE="vmaser"></REGKEY>
  11491.         </KEYS>
  11492.         <VALUES>
  11493.         </VALUES>
  11494.     </REGISTRY>
  11495. <DANGER_LEVEL>2</DANGER_LEVEL>
  11496. <DESCRIPTION>Program used to intercept all email communications sent and reports them to another email address.</DESCRIPTION>
  11497. </SW>
  11498. <SW NAME="Assasin Backdoor">  
  11499.      <DIRECTORIES>
  11500.      </DIRECTORIES>
  11501.      <FILES>
  11502.          <FILE NAME="Ms Spool32.exe" PATH="WinDir"></FILE>
  11503.       </FILES>
  11504.      <COOKIES>
  11505.      </COOKIES>
  11506.      <REGISTRY>
  11507.          <KEYS>
  11508.          </KEYS>
  11509.          <VALUES>
  11510.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Ms Spool32"></REGVALUE>
  11511.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="Ms Spool32"></REGVALUE>
  11512.          </VALUES>
  11513.      </REGISTRY>
  11514.      <DANGER_LEVEL>2</DANGER_LEVEL>
  11515.  <DESCRIPTION>Component that allows a remote user to control your PC.</DESCRIPTION>
  11516. </SW>
  11517. <SW NAME="Backdoor.Pestdoor.31">
  11518.     <DIRECTORIES>
  11519.     </DIRECTORIES>
  11520.     <FILES>
  11521.         <FILE NAME="msHtml.exe" PATH="WinDir"></FILE>
  11522.     </FILES>
  11523.     <COOKIES> 
  11524.     </COOKIES>
  11525.     <REGISTRY>
  11526.        <KEYS>
  11527.        </KEYS> 
  11528.        <VALUES>
  11529.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="ms html"></REGVALUE>
  11530.        </VALUES>
  11531.     </REGISTRY>
  11532. <DANGER_LEVEL>2</DANGER_LEVEL>
  11533. <DESCRIPTION>Worm that allows hackers unauthorized access to your PC.</DESCRIPTION>
  11534. </SW>
  11535. <SW NAME="Backdoor.Winet">
  11536.     <DIRECTORIES>
  11537.     </DIRECTORIES>
  11538.     <FILES>
  11539.         <FILE NAME="Wininetd.exe" PATH="SysDir"></FILE>
  11540.     </FILES>
  11541.     <COOKIES>
  11542.     </COOKIES>
  11543.     <REGISTRY>
  11544.         <KEYS>
  11545.         </KEYS>
  11546.         <VALUES>
  11547.                  <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="wininetd"></REGVALUE>
  11548.         </VALUES>
  11549.     </REGISTRY>
  11550. <DANGER_LEVEL>2</DANGER_LEVEL>
  11551. <DESCRIPTION>Worm that allows hackers unauthorized access to your PC.</DESCRIPTION>
  11552. </SW>
  11553. <SW NAME="Backdoor.FTP_Bmail">  
  11554.      <DIRECTORIES>
  11555.      </DIRECTORIES>
  11556.      <FILES>
  11557.          <FILE NAME="createsw.exe" PATH="SysDir"></FILE>
  11558.          <FILE NAME="createsw.exe" PATH="Sys32Dir"></FILE>
  11559.         </FILES>
  11560.      <COOKIES>
  11561.      </COOKIES>
  11562.      <REGISTRY>
  11563.          <KEYS>
  11564.          </KEYS>
  11565.          <VALUES>
  11566.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="setFTPBack"></REGVALUE>
  11567.          </VALUES>
  11568.      </REGISTRY>
  11569.  <DANGER_LEVEL>2</DANGER_LEVEL>
  11570.  <DESCRIPTION>Worm that allows hackers unauthorized access to your PC.</DESCRIPTION>
  11571. </SW>
  11572. <SW NAME="Sub Seven">
  11573.     <DIRECTORIES>
  11574.     </DIRECTORIES>
  11575.     <FILES>
  11576.         <FILE NAME="NODLL.EXE" PATH="WinDir"></FILE>
  11577.         <FILE NAME="SERVER.EXE" PATH="WinDir"></FILE>
  11578.         <FILE NAME="KERNEL16.DL" PATH="WinDir"></FILE>
  11579.         <FILE NAME="WINDOW.EXE" PATH="WinDir"></FILE>
  11580.         <FILE NAME="WATCHING.DLL" PATH="SysDir"></FILE>
  11581.         <FILE NAME="LMDRK_33.DLL" PATH="SysDir"></FILE>
  11582.     </FILES>
  11583.     <COOKIES>
  11584.     </COOKIES>
  11585.     <REGISTRY>
  11586.         <KEYS>
  11587.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="Kernel16"></REGKEY>
  11588.         </KEYS>
  11589.         <VALUES>
  11590.         </VALUES>
  11591.     </REGISTRY>
  11592. <DANGER_LEVEL>2</DANGER_LEVEL>
  11593. <DESCRIPTION>Program that allows hackers unauthorized access to your PC.</DESCRIPTION>
  11594. </SW>
  11595. <SW NAME="SurferBar">
  11596.     <DIRECTORIES>
  11597.     </DIRECTORIES>
  11598.     <FILES>
  11599.         <FILE NAME="win32.dll" PATH="PFDir"></FILE>
  11600.         <FILE NAME="winsrv32.exe" PATH="PFDir"></FILE>
  11601.     </FILES>
  11602.     <COOKIES>
  11603.     </COOKIES>
  11604.     <REGISTRY>
  11605.         <KEYS>
  11606.         </KEYS>
  11607.         <VALUES>
  11608.         </VALUES>
  11609.     </REGISTRY>
  11610. <DANGER_LEVEL>2</DANGER_LEVEL>
  11611. <DESCRIPTION>Internet Explorer toolbar that hijacks your settings and displays pop up advertisements.</DESCRIPTION>
  11612. </SW>
  11613. <SW NAME="SysMon">
  11614.     <DIRECTORIES>
  11615.     </DIRECTORIES>
  11616.     <FILES>
  11617.         <FILE NAME="sysmon.exe" PATH="SysDir"></FILE>
  11618.     </FILES>
  11619.     <COOKIES>
  11620.     </COOKIES>
  11621.     <REGISTRY>
  11622.         <KEYS>
  11623.         </KEYS>
  11624.         <VALUES>
  11625.         </VALUES>
  11626.     </REGISTRY>
  11627. <DANGER_LEVEL>2</DANGER_LEVEL>
  11628. <DESCRIPTION>Worm that allows hackers unauthorized access to your PC.</DESCRIPTION>
  11629. </SW>
  11630. <SW NAME="W32.Netsky.P@mm">  
  11631.     <DIRECTORIES>
  11632.     </DIRECTORIES>
  11633.     <FILES>
  11634.         <FILE NAME="FVProtect.exe" PATH="WinDir"></FILE>
  11635.     </FILES>
  11636.     <COOKIES>
  11637.     </COOKIES>
  11638.     <REGISTRY>
  11639.         <KEYS>
  11640.         </KEYS>
  11641.         <VALUES>
  11642.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Norton Antivirus AV"></REGVALUE>
  11643.         </VALUES>
  11644.     </REGISTRY>
  11645. <DANGER_LEVEL>2</DANGER_LEVEL>
  11646. <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  11647. </SW>
  11648. <SW NAME="TSCash">
  11649.     <DIRECTORIES>
  11650.     </DIRECTORIES>
  11651.     <FILES>
  11652.         <FILE NAME="sysupd.exe" PATH="SysDir"></FILE>
  11653.         <FILE NAME="sysupd.exe" PATH="Sys32Dir"></FILE>
  11654.     </FILES>
  11655.     <COOKIES>
  11656.     </COOKIES>
  11657.     <REGISTRY>
  11658.        <KEYS>
  11659.        </KEYS>
  11660.        <VALUES>
  11661.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="sysupd"></REGVALUE>
  11662.        </VALUES>
  11663.     </REGISTRY>
  11664. <DANGER_LEVEL>2</DANGER_LEVEL>
  11665. <DESCRIPTION>German dialer program used to dial expensive phone numbers.</DESCRIPTION>
  11666. </SW>
  11667. <SW NAME="MSConnect Dialer">  
  11668.      <DIRECTORIES>
  11669.       </DIRECTORIES>
  11670.      <FILES>
  11671.      </FILES>
  11672.      <COOKIES>
  11673.      </COOKIES>
  11674.      <REGISTRY>
  11675.          <KEYS>
  11676.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{8b22270a-71d9-4ab9-b11a-2ea1e5292f42}"></REGKEY>
  11677.          </KEYS>
  11678.          <VALUES>
  11679.          </VALUES>
  11680.      </REGISTRY>
  11681.  <DANGER_LEVEL>2</DANGER_LEVEL>
  11682.  <DESCRIPTION>Dialer program used to dial expensive phone numbers.</DESCRIPTION>
  11683. </SW>
  11684. <SW NAME="Online Trojan/W32.Hostidel.Trojan.B">
  11685.     <DIRECTORIES>
  11686.     </DIRECTORIES>
  11687.     <FILES>
  11688.     </FILES>
  11689.     <COOKIES>
  11690.     </COOKIES>
  11691.     <REGISTRY>
  11692.        <KEYS>
  11693.        </KEYS>
  11694.        <VALUES>
  11695.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Online Service"></REGVALUE>
  11696.        </VALUES>
  11697.     </REGISTRY>
  11698. <DANGER_LEVEL>2</DANGER_LEVEL>
  11699. <DESCRIPTION>Overwrites your HOSTS file and resets your internet settings</DESCRIPTION>
  11700. </SW>
  11701. <SW NAME="W32.Dumaru.Y@mm">
  11702.     <DIRECTORIES>
  11703.     </DIRECTORIES>
  11704.     <FILES>
  11705.         <FILE NAME="l32x.exe" PATH="SysDir"></FILE>
  11706.         <FILE NAME="l32x.exe" PATH="Sys32Dir"></FILE>
  11707.         <FILE NAME="vxd32v.exe" PATH="SysDir"></FILE>
  11708.         <FILE NAME="vxd32v.exe" PATH="Sys32Dir"></FILE>
  11709.         <FILE NAME="dllxw.exe" PATH=""></FILE>
  11710.     </FILES>
  11711.     <COOKIES>
  11712.     </COOKIES>
  11713.     <REGISTRY>
  11714.        <KEYS>
  11715.        </KEYS>
  11716.        <VALUES>
  11717.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="load32"></REGVALUE>
  11718.        </VALUES>
  11719.     </REGISTRY>
  11720. <DANGER_LEVEL>2</DANGER_LEVEL>
  11721. <DESCRIPTION>Worm that trys to spread itself and allows unauthorized access to your PC</DESCRIPTION>
  11722. </SW>
  11723. <SW NAME="W32.HLLW.Bodiru">  
  11724.     <DIRECTORIES>
  11725.     </DIRECTORIES>
  11726.     <FILES>
  11727.     </FILES>
  11728.     <COOKIES>
  11729.     </COOKIES>
  11730.     <REGISTRY>
  11731.         <KEYS>
  11732.         </KEYS>
  11733.         <VALUES>
  11734.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="App.EXEName"></REGVALUE>
  11735.         </VALUES>
  11736.     </REGISTRY>
  11737. <DANGER_LEVEL>2</DANGER_LEVEL>
  11738. <DESCRIPTION>Worm that will spread itself using networks and launch denial of service attacks against two particular websites.</DESCRIPTION>
  11739. </SW>
  11740. <SW NAME="W32.Beagle.B"> 
  11741.     <DIRECTORIES>
  11742.     </DIRECTORIES>
  11743.     <FILES>
  11744.         <FILE NAME="au.exe" PATH="SysDir"></FILE>
  11745.         <FILE NAME="au.exe" PATH="Sys32Dir"></FILE>
  11746.     </FILES>
  11747.     <COOKIES>
  11748.     </COOKIES>
  11749.     <REGISTRY>
  11750.         <KEYS>
  11751.         </KEYS>
  11752.         <VALUES>
  11753.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="au.exe"></REGVALUE>
  11754.         </VALUES>
  11755.     </REGISTRY>
  11756. <DANGER_LEVEL>2</DANGER_LEVEL>
  11757. <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  11758. </SW>
  11759. <SW NAME="W32.Netsky.M@mm"> 
  11760.     <DIRECTORIES>
  11761.     </DIRECTORIES>
  11762.     <FILES>
  11763.     </FILES>
  11764.     <COOKIES>
  11765.     </COOKIES>
  11766.     <REGISTRY>
  11767.         <KEYS>
  11768.         </KEYS>
  11769.         <VALUES>
  11770.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="9xHtProtect"></REGVALUE>
  11771.         </VALUES>
  11772.     </REGISTRY>
  11773. <DANGER_LEVEL>2</DANGER_LEVEL>
  11774. <DESCRIPTION>It is a Worm that propagates by attacking other machines and copying itself to them.</DESCRIPTION>
  11775. </SW>
  11776. <SW NAME="W32.Beagle.A@mm"> 
  11777.     <DIRECTORIES>
  11778.     </DIRECTORIES>
  11779.     <FILES>
  11780.         <FILE NAME="bbeagle.exe" PATH="SysDir"></FILE>
  11781.     </FILES>
  11782.     <COOKIES>
  11783.     </COOKIES>
  11784.     <REGISTRY>
  11785.         <KEYS>
  11786.         </KEYS>
  11787.         <VALUES>
  11788.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="d3dupdate.exe"></REGVALUE>
  11789.         </VALUES>
  11790.     </REGISTRY>
  11791. <DANGER_LEVEL>2</DANGER_LEVEL>
  11792. <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  11793. </SW>
  11794. <SW NAME="W32.Gluber@mm"> 
  11795.     <DIRECTORIES>
  11796.     </DIRECTORIES>
  11797.     <FILES>
  11798.         <FILE NAME="Bglr32.exe" PATH=""></FILE>
  11799.     </FILES>
  11800.     <COOKIES>
  11801.     </COOKIES>
  11802.     <REGISTRY>
  11803.         <KEYS>
  11804.         </KEYS>
  11805.         <VALUES>
  11806.         </VALUES>
  11807.     </REGISTRY>
  11808. <DANGER_LEVEL>2</DANGER_LEVEL>
  11809. <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  11810. </SW>
  11811. <SW NAME="W32.HLLW.Caspid">  
  11812.     <DIRECTORIES>
  11813.     </DIRECTORIES>
  11814.     <FILES>
  11815.         <FILE NAME="Capside.exe" PATH="WinDir"></FILE>
  11816.     </FILES>
  11817.     <COOKIES>
  11818.     </COOKIES>
  11819.     <REGISTRY>
  11820.         <KEYS>
  11821.         </KEYS>
  11822.         <VALUES>
  11823.         </VALUES>
  11824.     </REGISTRY>
  11825. <DANGER_LEVEL>2</DANGER_LEVEL>
  11826. <DESCRIPTION>Worm spread through networks that will infect HTML files.</DESCRIPTION>
  11827. </SW>
  11828. <SW NAME="Find4u.net/Find4u/CoolWebSearch.olehelp">  
  11829.      <DIRECTORIES>
  11830.      </DIRECTORIES>
  11831.      <FILES>
  11832.          <FILE NAME="olehelp.exe" PATH="WinDir"></FILE>
  11833.          <FILE NAME="olehelp.exe" PATH="Sys32Dir"></FILE>
  11834.             <FILE NAME="winlogon.exe" PATH="WinDir\\downloaded program files"></FILE>
  11835.        </FILES>
  11836.      <COOKIES>
  11837.      </COOKIES>
  11838.      <REGISTRY>
  11839.          <KEYS>
  11840.          </KEYS>
  11841.          <VALUES>
  11842.              <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="olehelp"></REGVALUE>
  11843.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="olehelp"></REGVALUE>
  11844.          </VALUES>
  11845.      </REGISTRY>
  11846.  <DANGER_LEVEL>1</DANGER_LEVEL>
  11847.  <DESCRIPTION>Hijacker that will reset your browser settings.</DESCRIPTION>
  11848. </SW>
  11849. <SW NAME="Wotch">
  11850.     <DIRECTORIES>
  11851.     </DIRECTORIES>
  11852.     <FILES>
  11853.          <FILE NAME="stub.exe" PATH="PFDir\\ebkrdr"></FILE>
  11854.     </FILES>
  11855.     <COOKIES>
  11856.     </COOKIES>
  11857.     <REGISTRY>
  11858.        <KEYS>
  11859.        </KEYS>
  11860.        <VALUES>
  11861.                <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="media_stub"></REGVALUE>
  11862.        </VALUES>
  11863.     </REGISTRY>
  11864. <DANGER_LEVEL>1</DANGER_LEVEL>
  11865. <DESCRIPTION>Known to cause pop up advertisements.</DESCRIPTION>
  11866. </SW>
  11867. <SW NAME="OnWebMedia/OnSrvr">
  11868.     <DIRECTORIES>
  11869.     </DIRECTORIES>
  11870.     <FILES>
  11871.         <FILE NAME="OnSrvr.exe" PATH="SysDir"></FILE>
  11872.         <FILE NAME="OnSrvr.exe" PATH="Sys32Dir"></FILE>
  11873.     </FILES> 
  11874.     <COOKIES> 
  11875.     </COOKIES>
  11876.     <REGISTRY>
  11877.        <KEYS>
  11878.        </KEYS> 
  11879.        <VALUES>
  11880.              <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="onsrvr"></REGVALUE>
  11881.        </VALUES>
  11882.     </REGISTRY>
  11883. <DANGER_LEVEL>1</DANGER_LEVEL>
  11884. <DESCRIPTION>Adware process that launches at startup and causes pop up advertisements</DESCRIPTION>
  11885. </SW>
  11886. <SW NAME="Tdak Searchbar">  
  11887.      <DIRECTORIES>
  11888.      </DIRECTORIES>
  11889.      <FILES>
  11890.          <FILE NAME="brdrsstl.exe" PATH=""></FILE>
  11891.          <FILE NAME="sex_show.reg" PATH=""></FILE>
  11892.          <FILE NAME="tchstlmmdrm.htm" PATH=""></FILE>
  11893.      </FILES>
  11894.      <COOKIES>
  11895.      </COOKIES>
  11896.      <REGISTRY>
  11897.          <KEYS>
  11898.          </KEYS>
  11899.          <VALUES>
  11900.          </VALUES>
  11901.      </REGISTRY>
  11902.  <DANGER_LEVEL>2</DANGER_LEVEL>
  11903.  <DESCRIPTION>Toolbar known to display pornographic ads, as well as monitor urls visited</DESCRIPTION>
  11904. </SW>
  11905. <SW NAME="Trojan.JS.Snake">  
  11906.      <DIRECTORIES>                      
  11907.      </DIRECTORIES>
  11908.      <FILES>
  11909.          <FILE NAME="trojan.js.snake.exe" PATH=""></FILE>
  11910.       </FILES>
  11911.      <COOKIES>
  11912.      </COOKIES>
  11913.      <REGISTRY>
  11914.          <KEYS>
  11915.          </KEYS>
  11916.          <VALUES>
  11917.          </VALUES>
  11918.      </REGISTRY>
  11919.  <DANGER_LEVEL>2</DANGER_LEVEL>
  11920.  <DESCRIPTION>Worm that allows hackers unauthorized access to your PC.</DESCRIPTION>
  11921. </SW>
  11922. <SW NAME="Tiny Keylogger">  
  11923.      <DIRECTORIES>                      
  11924.      </DIRECTORIES>
  11925.      <FILES>
  11926.          <FILE NAME="tikl.exe" PATH="SysDir"></FILE>
  11927.          <FILE NAME="tikl.log" PATH="SysDir"></FILE>
  11928.          <FILE NAME="tikl32.dll" PATH="SysDir"></FILE>
  11929.       </FILES>
  11930.      <COOKIES>
  11931.      </COOKIES>
  11932.      <REGISTRY>
  11933.          <KEYS>
  11934.          </KEYS>
  11935.          <VALUES>
  11936.          </VALUES>
  11937.      </REGISTRY>
  11938.  <DANGER_LEVEL>2</DANGER_LEVEL>
  11939.  <DESCRIPTION>Keylogger program that will record all actions done on your PC. Known to resist removal.</DESCRIPTION>
  11940. </SW>
  11941. <SW NAME="TradeExit">  
  11942.      <DIRECTORIES>                      
  11943.      </DIRECTORIES>
  11944.      <FILES>
  11945.          <FILE NAME="winupie.exe" PATH="WinDir"></FILE>
  11946.          <FILE NAME="AxConfig.dll" PATH="SysDir"></FILE>
  11947.          <FILE NAME="AxConfig.dll" PATH="Sys32Dir"></FILE>
  11948.       </FILES>
  11949.      <COOKIES>
  11950.      </COOKIES>
  11951.      <REGISTRY>
  11952.          <KEYS>
  11953.          </KEYS>
  11954.          <VALUES>
  11955.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="winpopup"></REGVALUE>
  11956.          </VALUES>
  11957.      </REGISTRY>
  11958.  <DANGER_LEVEL>2</DANGER_LEVEL>
  11959.  <DESCRIPTION>Reported to create pornography related pop up advertisements.</DESCRIPTION>
  11960. </SW>
  11961. <SW NAME="TV Media Display"> 
  11962.     <DIRECTORIES>
  11963.     </DIRECTORIES>
  11964.     <FILES>
  11965.           <FILE NAME="TVTMD.EXE" PATH="WinDir"></FILE>
  11966.           <FILE NAME="TVMD.EXE" PATH="WinDir"></FILE>
  11967.     </FILES>
  11968.     <COOKIES>
  11969.     </COOKIES>
  11970.     <REGISTRY>
  11971.     <KEYS>
  11972.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" VALUE="TVTMD"></REGKEY>
  11973.           <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" VALUE="TVMD"></REGKEY>
  11974.     </KEYS>
  11975.     <VALUES>
  11976.         <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="TVTMD"></REGVALUE>
  11977.         <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="TVMD"></REGVALUE>
  11978.     </VALUES>
  11979.     </REGISTRY>
  11980. <DANGER_LEVEL>1</DANGER_LEVEL>
  11981. <DESCRIPTION>Known to cause pop up advertisements and install stealthily.</DESCRIPTION>
  11982. </SW>
  11983. <SW NAME="WinSpy 5.6.1"> 
  11984.     <DIRECTORIES>
  11985.     </DIRECTORIES>
  11986.     <FILES>
  11987.         <FILE NAME="Out.exe" PATH="WinDir"></FILE>
  11988.         <FILE NAME="ccctr.exe" PATH="WinDir"></FILE>
  11989.         <FILE NAME="ij12.exe" PATH="WinDir"></FILE>
  11990.         <FILE NAME="ijl11.dll" PATH="WinDir"></FILE>
  11991.         <FILE NAME="ijl15.dll" PATH="WinDir"></FILE>
  11992.         <FILE NAME="rf.exe" PATH="WinDir"></FILE>
  11993.         <FILE NAME="sm.exe" PATH="WinDir"></FILE>
  11994.         <FILE NAME="syst.exe" PATH="WinDir"></FILE>
  11995.         <FILE NAME="ezVidC60.ocx" PATH="WinDir"></FILE>
  11996.         <FILE NAME="unin.exe" PATH="WinDir"></FILE>
  11997.         <FILE NAME="uninse.exe" PATH="WinDir"></FILE>
  11998.         <FILE NAME="winsyst.exe" PATH="WinDir"></FILE>
  11999.         <FILE NAME="zapro.exe" PATH="WinDir"></FILE>
  12000.         <FILE NAME="smt.exe" PATH="WinDir"></FILE>
  12001.         </FILES>
  12002.     <COOKIES>
  12003.     </COOKIES>
  12004.     <REGISTRY>
  12005.         <KEYS>
  12006.         </KEYS>
  12007.         <VALUES>
  12008.         </VALUES>
  12009.     </REGISTRY>
  12010. <DANGER_LEVEL>2</DANGER_LEVEL>
  12011. <DESCRIPTION>Commercial keylogger program that will record all actions done on your PC.</DESCRIPTION>
  12012. </SW>
  12013. <SW NAME="WinWhatWhere">  
  12014.      <DIRECTORIES>                      
  12015.      </DIRECTORIES>
  12016.      <FILES>
  12017.          <FILE NAME="MSdfCng.exe" PATH=""></FILE>
  12018.         <FILE NAME="msegcng.exe" PATH=""></FILE>
  12019.         <FILE NAME="windoc.sys" PATH=""></FILE>
  12020.     </FILES>
  12021.      <COOKIES>
  12022.      </COOKIES>
  12023.      <REGISTRY>
  12024.          <KEYS>
  12025.          </KEYS>
  12026.          <VALUES>
  12027.          </VALUES>
  12028.      </REGISTRY>
  12029.  <DANGER_LEVEL>2</DANGER_LEVEL>
  12030.  <DESCRIPTION>Commercial keylogger program that will record all actions done on your PC.</DESCRIPTION>
  12031. </SW>
  12032. <SW NAME="ipsysdrv32.dll">
  12033.     <DIRECTORIES>
  12034.     </DIRECTORIES>
  12035.     <FILES>
  12036.         <FILE NAME="ipsysdrv32.dll" PATH="SysDir"></FILE>
  12037.         <FILE NAME="ipsysdrv32.dll" PATH="Sys32Dir"></FILE>
  12038.         </FILES>
  12039.     <COOKIES>
  12040.     </COOKIES>
  12041.     <REGISTRY>
  12042.         <KEYS>
  12043.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{13f90341-ad79-4a9f-9b57-0234675670d6}"></REGKEY>
  12044.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{13f90341-ad79-4a9f-9b57-0234675670d6}"></REGKEY>
  12045.         </KEYS>
  12046.         <VALUES>
  12047.         </VALUES>
  12048.     </REGISTRY>
  12049. <DANGER_LEVEL>1</DANGER_LEVEL>
  12050. <DESCRIPTION>Related to malware.</DESCRIPTION>
  12051. </SW>
  12052. <SW NAME="Desire">
  12053.     <DIRECTORIES>
  12054.     </DIRECTORIES>
  12055.     <FILES>
  12056.         <FILE NAME="desire.exe" PATH="PFDir\\dialers\\desire"></FILE>
  12057.     </FILES>
  12058.     <COOKIES>
  12059.     </COOKIES>
  12060.     <REGISTRY>
  12061.         <KEYS>
  12062.              <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software" VALUE="SiteIcons"></REGKEY>
  12063.              <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software\\SiteIcons" VALUE="Dialers"></REGKEY>
  12064.              <REGKEY MAIN="HKEY_CURRENT_USER" SUB="Software\\SiteIcons\\Dialers" VALUE="Desire"></REGKEY>
  12065.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" VALUE="Desire"></REGKEY>
  12066.         </KEYS>
  12067.         <VALUES>
  12068.         </VALUES>
  12069.     </REGISTRY>
  12070. <DANGER_LEVEL>2</DANGER_LEVEL>
  12071. <DESCRIPTION>Dialer that will use your computer to dial out, usually associated with high cost pornographic related phone numbers.</DESCRIPTION>
  12072. </SW>
  12073. <SW NAME="InternetDelivery">
  12074.     <DIRECTORIES>
  12075.            <DIR NAME="inet delivery" PATH="PFDir"></DIR>
  12076.     </DIRECTORIES>
  12077.     <FILES>
  12078.         <FILE NAME="intdel.exe" PATH="PFDir\\inet delivery"></FILE>
  12079.     </FILES>
  12080.     <COOKIES>
  12081.     </COOKIES>
  12082.     <REGISTRY>
  12083.         <KEYS>
  12084.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall" VALUE="inet delivery"></REGKEY>
  12085.         </KEYS>
  12086.         <VALUES>
  12087.         </VALUES>
  12088.     </REGISTRY>
  12089. <DANGER_LEVEL>1</DANGER_LEVEL>
  12090. <DESCRIPTION>Adware that will deliver advertisements to your PC.</DESCRIPTION>
  12091. </SW>
  12092. <SW NAME="GnucDNA">
  12093.     <DIRECTORIES>
  12094.     </DIRECTORIES>
  12095.     <FILES>
  12096.         <FILE NAME="gnucdna.dll" PATH="Sys32Dir"></FILE>
  12097.     </FILES>
  12098.     <COOKIES>
  12099.     </COOKIES>
  12100.     <REGISTRY>
  12101.         <KEYS>
  12102.         </KEYS>
  12103.         <VALUES>
  12104.         </VALUES>
  12105.     </REGISTRY>
  12106. <DANGER_LEVEL>1</DANGER_LEVEL>
  12107. <DESCRIPTION>Component used to interact with peer to peer filesharing networks.</DESCRIPTION>
  12108. </SW>
  12109. <SW NAME="ClientMan.DNSRep">
  12110.     <DIRECTORIES>
  12111.     </DIRECTORIES>
  12112.     <FILES>
  12113.         <FILE NAME="dnsrep.dll" PATH="PFDir\\ClientMan\\run"></FILE>
  12114.     </FILES>
  12115.     <COOKIES>
  12116.     </COOKIES>
  12117.     <REGISTRY>
  12118.         <KEYS>
  12119.         </KEYS>
  12120.         <VALUES>
  12121.         </VALUES>
  12122.     </REGISTRY>
  12123. <DANGER_LEVEL>2</DANGER_LEVEL>
  12124. <DESCRIPTION>Clientman is a widespread advertising parasite used to deliver advertisements to your PC</DESCRIPTION>
  12125. </SW>
  12126. <SW NAME="I-Worm.BadTrans.b">
  12127.     <DIRECTORIES>
  12128.     </DIRECTORIES>
  12129.     <FILES>
  12130.         <FILE NAME="kernel32.exe" PATH="Sys32Dir"></FILE>
  12131.         <FILE NAME="kdll.dll" PATH="Sys32Dir"></FILE>
  12132.     </FILES>
  12133.     <COOKIES>
  12134.     </COOKIES>
  12135.     <REGISTRY>
  12136.         <KEYS>
  12137.         </KEYS>
  12138.         <VALUES>
  12139.         </VALUES>
  12140.     </REGISTRY>
  12141. <DANGER_LEVEL>2</DANGER_LEVEL>
  12142. <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  12143. </SW>
  12144. <SW NAME="Dsi">
  12145.     <DIRECTORIES>
  12146.     </DIRECTORIES>
  12147.     <FILES>
  12148.         <FILE NAME="dp-k13w13.exe" PATH="Sys32Dir"></FILE>
  12149.     </FILES>
  12150.     <COOKIES>
  12151.     </COOKIES>
  12152.     <REGISTRY>
  12153.         <KEYS>
  12154.         </KEYS>
  12155.         <VALUES>
  12156.                  <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Dsi"></REGVALUE>
  12157.         </VALUES>
  12158.     </REGISTRY>
  12159. <DANGER_LEVEL>1</DANGER_LEVEL>
  12160. <DESCRIPTION>Related to malware.</DESCRIPTION>
  12161. </SW>
  12162. <SW NAME="ViewPornKey">
  12163.     <DIRECTORIES>
  12164.     </DIRECTORIES>
  12165.     <FILES>
  12166.         <FILE NAME="rundll32.vbe" PATH="Sys32Dir"></FILE>
  12167.     </FILES>
  12168.     <COOKIES>
  12169.     </COOKIES>
  12170.     <REGISTRY>
  12171.        <KEYS>
  12172.        </KEYS> 
  12173.        <VALUES>
  12174.            <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="windows security assistant"></REGVALUE>
  12175.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="windows security assistant"></REGVALUE>
  12176.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\runservices" VALUE="windows security assistant"></REGVALUE>
  12177.        </VALUES>
  12178.     </REGISTRY>
  12179. <DANGER_LEVEL>1</DANGER_LEVEL>
  12180. <DESCRIPTION>Known to reset your browser's settings.</DESCRIPTION>
  12181. </SW>
  12182. <SW NAME="WORM_BAGLE.W/Trojan.Mitglieder.F/W32.Beagle.J@mm">
  12183.     <DIRECTORIES>
  12184.     </DIRECTORIES>
  12185.     <FILES>
  12186.         <FILE NAME="irun4.exe" PATH="Sys32Dir"></FILE>
  12187.     </FILES>
  12188.     <COOKIES>
  12189.     </COOKIES>
  12190.     <REGISTRY>
  12191.        <KEYS>
  12192.        </KEYS> 
  12193.        <VALUES>
  12194.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="ssgrate.exe"></REGVALUE>
  12195.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="ssate.exe"></REGVALUE>
  12196.        </VALUES>
  12197.     </REGISTRY>
  12198. <DANGER_LEVEL>2</DANGER_LEVEL>
  12199. <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  12200. </SW>> 
  12201. <SW NAME="IpDill">  
  12202.      <DIRECTORIES>
  12203.      </DIRECTORIES>
  12204.      <FILES>
  12205.         <FILE NAME="IP.DLL" PATH="WinDir"></FILE>
  12206.      </FILES> 
  12207.      <COOKIES>
  12208.      </COOKIES>
  12209.      <REGISTRY>
  12210.          <KEYS>
  12211.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{8D91ECD1-2A29-41B8-9988-FD892F07F859}"></REGKEY>
  12212.         </KEYS>
  12213.          <VALUES>
  12214.          </VALUES>
  12215.      </REGISTRY>
  12216.  <DANGER_LEVEL>1</DANGER_LEVEL>
  12217.  <DESCRIPTION>Related to malware.</DESCRIPTION>
  12218.  </SW>
  12219. <SW NAME="MSN SmartTags">
  12220.     <DIRECTORIES>
  12221.     </DIRECTORIES>
  12222.     <FILES>
  12223.         <FILE NAME="msnbho.dll" PATH="Sys32Dir"></FILE>
  12224.         <FILE NAME="msnbho.dll" PATH="SysDir"></FILE>
  12225.     </FILES>
  12226.     <COOKIES>
  12227.     </COOKIES>
  12228.     <REGISTRY>
  12229.         <KEYS>
  12230.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{9dd4258a-7138-49c4-8d34-587879a5c7a4}"></REGKEY>
  12231.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{9dd4258a-7138-49c4-8d34-587879a5c7a4}"></REGKEY>
  12232.            <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{9dd4258a-7138-49c4-8d34-587879a5c7a4}"></REGKEY>
  12233.         </KEYS>
  12234.         <VALUES>
  12235.         </VALUES>
  12236.     </REGISTRY>
  12237. <DANGER_LEVEL>1</DANGER_LEVEL>
  12238. <DESCRIPTION>Used to highlight certain terms and redirect you to affiliated websites when you click</DESCRIPTION>
  12239. </SW>
  12240. <SW NAME="IRC-Hack">
  12241.     <DIRECTORIES>
  12242.     </DIRECTORIES>
  12243.     <FILES>
  12244.        <FILE NAME="irchack.exe" PATH="WinDir"></FILE>
  12245.        <FILE NAME="rundlls.exe" PATH="WinDir"></FILE>
  12246.        <FILE NAME="ajout.ini" PATH="WinDir"></FILE>
  12247.        <FILE NAME="closew.bat" PATH="WinDir"></FILE>
  12248.        <FILE NAME="instll.bat" PATH="WinDir"></FILE>
  12249.        <FILE NAME="serv-u.ini" PATH="WinDir"></FILE>
  12250.     </FILES>
  12251.     <COOKIES>
  12252.     </COOKIES>
  12253.     <REGISTRY>
  12254.         <KEYS>
  12255.         </KEYS>
  12256.         <VALUES>
  12257.         </VALUES>
  12258.     </REGISTRY>
  12259. <DANGER_LEVEL>2</DANGER_LEVEL>
  12260. <DESCRIPTION>Used to allow PC access to unauthorized people.</DESCRIPTION>
  12261. </SW>
  12262. <SW NAME="Dua ti choi">
  12263.     <DIRECTORIES>
  12264.     </DIRECTORIES>
  12265.     <FILES>
  12266.         <FILE NAME="twain1.dll" PATH="WinDir"></FILE>
  12267.         <FILE NAME="twain1.exe" PATH="WinDir"></FILE>
  12268.         </FILES>
  12269.     <COOKIES>
  12270.     </COOKIES>
  12271.     <REGISTRY>
  12272.         <KEYS>
  12273.         </KEYS>
  12274.         <VALUES>
  12275.         </VALUES>
  12276.     </REGISTRY>
  12277. <DANGER_LEVEL>2</DANGER_LEVEL>
  12278. <DESCRIPTION>Worm that allows hackers unauthorized access to your PC.</DESCRIPTION>
  12279. </SW>
  12280. <SW NAME="ICQ Hacker">
  12281.     <DIRECTORIES>
  12282.     </DIRECTORIES>
  12283.     <FILES>
  12284.         <FILE NAME="icqhacker.exe" PATH=""></FILE>
  12285.     </FILES>
  12286.     <COOKIES>
  12287.     </COOKIES>
  12288.     <REGISTRY>
  12289.         <KEYS>
  12290.         </KEYS>
  12291.         <VALUES>
  12292.         </VALUES>
  12293.     </REGISTRY>
  12294. <DANGER_LEVEL>2</DANGER_LEVEL>
  12295. <DESCRIPTION>Pest used against AOL users and used for malicious purposes.</DESCRIPTION>
  12296. </SW>
  12297. <SW NAME="Wonderland">  
  12298.      <DIRECTORIES>                      
  12299.      </DIRECTORIES>
  12300.      <FILES>
  12301.          <FILE NAME="WonderPlus.Wonder_Plus" PATH="WinDir\\Downloaded Program Files"></FILE>
  12302.         <FILE NAME="WonderWeb.Wonder_Web" PATH="WinDir\\Downloaded Program Files"></FILE>
  12303.         <FILE NAME="Cab33107.Cab_33107" PATH="WinDir\\Downloaded Program Files"></FILE>
  12304.     </FILES>
  12305.      <COOKIES>
  12306.      </COOKIES>
  12307.      <REGISTRY>
  12308.          <KEYS>
  12309.          </KEYS>
  12310.          <VALUES>
  12311.          </VALUES>
  12312.      </REGISTRY>
  12313.  <DANGER_LEVEL>2</DANGER_LEVEL>
  12314.  <DESCRIPTION>Dialer program used to dial expensive phone numbers.</DESCRIPTION>
  12315. </SW>
  12316. <SW NAME="XLoader">  
  12317.      <DIRECTORIES>                      
  12318.      </DIRECTORIES>
  12319.      <FILES>
  12320.          <FILE NAME="xloader.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
  12321.     </FILES>
  12322.      <COOKIES>
  12323.      </COOKIES>
  12324.      <REGISTRY>
  12325.          <KEYS>
  12326.              <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{8c6c6922-6258-44ac-9912-53964ac55272}"></REGKEY>
  12327.          </KEYS>
  12328.          <VALUES>
  12329.          </VALUES>
  12330.      </REGISTRY>
  12331.  <DANGER_LEVEL>2</DANGER_LEVEL>
  12332.  <DESCRIPTION>A German dialer that dials high rate phone numbers, usually related to pornography.</DESCRIPTION>
  12333. </SW>
  12334. <SW NAME="XPCSpy">  
  12335.      <DIRECTORIES>
  12336.         <DIR NAME="XPCSpy" PATH="PFDir"></DIR>
  12337.      </DIRECTORIES>
  12338.      <FILES>
  12339.          <FILE NAME="XPCSpy.exe" PATH="PFDir\\XPCSpy"></FILE>
  12340.          <FILE NAME="AppSpy.dll" PATH="PFDir\\XPCSpy"></FILE>
  12341.          <FILE NAME="Protector.dll" PATH="PFDir\\XPCSpy"></FILE>
  12342.          <FILE NAME="KeySpy.dll" PATH="PFDir\\XPCSpy"></FILE>
  12343.     </FILES>
  12344.      <COOKIES>
  12345.      </COOKIES>
  12346.      <REGISTRY>
  12347.          <KEYS>
  12348.          </KEYS>
  12349.          <VALUES>
  12350.          </VALUES>
  12351.      </REGISTRY>
  12352.  <DANGER_LEVEL>2</DANGER_LEVEL>
  12353.  <DESCRIPTION>Commercial keylogger program that will record all actions done on your PC.</DESCRIPTION>
  12354. </SW>
  12355. <SW NAME="eBates MoneyMaker">  
  12356.      <DIRECTORIES>
  12357.         <DIR NAME="ebatesmoemoneymaker" PATH="PFDir"></DIR>           
  12358.      </DIRECTORIES>
  12359.      <FILES>
  12360.          <FILE NAME="ebatesmoemoneymaker.exe" PATH="PFDir\\ebatesmoemoneymaker"></FILE>
  12361.          <FILE NAME="popup.exe" PATH="PFDir\\care2gtu"></FILE>
  12362.     </FILES>
  12363.      <COOKIES>
  12364.      </COOKIES>
  12365.      <REGISTRY>
  12366.          <KEYS>
  12367.               <REGKEY MAIN="HKEY_LOCAL_MACHINE " SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" VALUE="ebatesver2.xml"></REGKEY>
  12368.            </KEYS>
  12369.          <VALUES>
  12370.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="EbatesMoeMoneyMaker"></REGVALUE>
  12371.          </VALUES>
  12372.      </REGISTRY>
  12373.  <DANGER_LEVEL>1</DANGER_LEVEL>
  12374.  <DESCRIPTION>Software with privacy policy concerns.  Related to pop up advertisements</DESCRIPTION>
  12375. </SW>
  12376. <SW NAME="WhenUSearch">
  12377.      <DIRECTORIES>
  12378.       </DIRECTORIES>
  12379.      <FILES>
  12380.          <FILE NAME="Search.exe" PATH="PFDir\\WhenUSearch"></FILE>
  12381.      </FILES>
  12382.      <COOKIES>
  12383.      </COOKIES>
  12384.      <REGISTRY>
  12385.          <KEYS>
  12386.          </KEYS>
  12387.          <VALUES>
  12388.           </VALUES>
  12389.      </REGISTRY>
  12390.  <DANGER_LEVEL>1</DANGER_LEVEL>
  12391.  <DESCRIPTION>Distributed by WhenU, a leading adware company.  Related to pop up advertising.</DESCRIPTION>
  12392. </SW>
  12393. <SW NAME="MyDoom.B Worm">  
  12394.      <DIRECTORIES>
  12395.       </DIRECTORIES>
  12396.      <FILES>
  12397.          <FILE NAME="CTFMON.DLL" PATH="SysDir"></FILE>
  12398.         <FILE NAME="explorer.exe" PATH="SysDir"></FILE>
  12399.      </FILES>
  12400.      <COOKIES>
  12401.      </COOKIES>
  12402.      <REGISTRY>
  12403.          <KEYS>
  12404.          </KEYS>
  12405.          <VALUES>
  12406.           </VALUES>
  12407.      </REGISTRY>
  12408.  <DANGER_LEVEL>2</DANGER_LEVEL>
  12409.  <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  12410. </SW>
  12411. <SW NAME="MyDoom.A Worm">  
  12412.      <DIRECTORIES>
  12413.       </DIRECTORIES>
  12414.      <FILES>
  12415.          <FILE NAME="shimgapi.dll" PATH="SysDir"></FILE>
  12416.         <FILE NAME="taskmon.exe" PATH="SysDir"></FILE>
  12417.      </FILES>
  12418.      <COOKIES>
  12419.      </COOKIES>
  12420.      <REGISTRY>
  12421.          <KEYS>
  12422.          </KEYS>
  12423.          <VALUES>
  12424.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Taskmon"></REGVALUE>
  12425.         </VALUES>
  12426.      </REGISTRY>
  12427.  <DANGER_LEVEL>2</DANGER_LEVEL>
  12428.  <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  12429. </SW>
  12430. <SW NAME="DotCom Toolbar">  
  12431.      <DIRECTORIES>
  12432.       </DIRECTORIES>
  12433.      <FILES>
  12434.          <FILE NAME="redirect2.exe" PATH="WinDir"></FILE>
  12435.         <FILE NAME="redirect4.exe" PATH="WinDir"></FILE>
  12436.      </FILES>
  12437.      <COOKIES>
  12438.      </COOKIES>
  12439.      <REGISTRY>
  12440.          <KEYS>
  12441.          </KEYS>
  12442.          <VALUES>
  12443.          </VALUES>
  12444.      </REGISTRY>
  12445.  <DANGER_LEVEL>2</DANGER_LEVEL>
  12446.  <DESCRIPTION>Spyware software that can monitor and report all websites visited.</DESCRIPTION>
  12447. </SW>
  12448. <SW NAME="Hugesearch.net">  
  12449.      <DIRECTORIES>
  12450.       </DIRECTORIES>
  12451.      <FILES>
  12452.          <FILE NAME="fonts.hta" PATH="WinDir\\fonts"></FILE>
  12453.      </FILES>
  12454.      <COOKIES>
  12455.      </COOKIES>
  12456.      <REGISTRY>
  12457.          <KEYS>
  12458.          </KEYS>
  12459.          <VALUES>
  12460.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Truefonts"></REGVALUE>
  12461.          </VALUES>
  12462.      </REGISTRY>
  12463.  <DANGER_LEVEL>1</DANGER_LEVEL>
  12464.  <DESCRIPTION>Known to hijack internet settings and not allow them to be reset.</DESCRIPTION>
  12465. </SW>
  12466. <SW NAME="Trojan.Noupdate.B">
  12467.     <DIRECTORIES>
  12468.     </DIRECTORIES>
  12469.     <FILES>
  12470.         <FILE NAME="reg32.exe" PATH="WinDir"></FILE>
  12471.     </FILES>
  12472.     <COOKIES>
  12473.     </COOKIES>
  12474.     <REGISTRY>
  12475.        <KEYS>
  12476.        </KEYS> 
  12477.        <VALUES>
  12478.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="reg32"></REGVALUE>
  12479.        </VALUES>
  12480.     </REGISTRY>
  12481. <DANGER_LEVEL>2</DANGER_LEVEL>
  12482. <DESCRIPTION>Trojan horse that prevents you from obtaining updates for your operating system</DESCRIPTION>
  12483. </SW> 
  12484. <SW NAME="Trojan.Linst">
  12485.     <DIRECTORIES>
  12486.     </DIRECTORIES>
  12487.     <FILES>
  12488.         <FILE NAME="cihost.exe" PATH="WinDir"></FILE>
  12489.     </FILES>
  12490.     <COOKIES>
  12491.     </COOKIES>
  12492.     <REGISTRY>
  12493.        <KEYS>
  12494.        </KEYS> 
  12495.        <VALUES>
  12496.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="cihost.exe"></REGVALUE>
  12497.        </VALUES>
  12498.     </REGISTRY>
  12499. <DANGER_LEVEL>2</DANGER_LEVEL>
  12500. <DESCRIPTION>Attaches itself to Internet Explorer and reports to another server about your activity</DESCRIPTION>
  12501. </SW>
  12502. <SW NAME="Win32.Dluca.F">
  12503.     <DIRECTORIES>
  12504.     </DIRECTORIES>
  12505.     <FILES>
  12506.         <FILE NAME="sncntr.exe" PATH="SysDir"></FILE>
  12507.     </FILES>
  12508.     <COOKIES>
  12509.     </COOKIES>
  12510.     <REGISTRY>
  12511.        <KEYS>
  12512.        </KEYS> 
  12513.        <VALUES>
  12514.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="sncntr"></REGVALUE>
  12515.        </VALUES>
  12516.     </REGISTRY>
  12517. <DANGER_LEVEL>2</DANGER_LEVEL>
  12518. <DESCRIPTION>Trojan horse that will send information about your computer back to a central server</DESCRIPTION>
  12519. </SW>
  12520. <SW NAME="W32.SirCam.Worm@mm">
  12521.     <DIRECTORIES>
  12522.     </DIRECTORIES>
  12523.     <FILES>
  12524.         <FILE NAME="Scam32.exe" PATH="SysDir"></FILE>
  12525.         <FILE NAME="Scam32.exe" PATH="Sys32Dir"></FILE>
  12526.     </FILES>
  12527.     <COOKIES>
  12528.     </COOKIES>
  12529.     <REGISTRY>
  12530.        <KEYS>
  12531.        </KEYS> 
  12532.        <VALUES>
  12533.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="Driver32"></REGVALUE>
  12534.        </VALUES>
  12535.     </REGISTRY>
  12536. <DANGER_LEVEL>2</DANGER_LEVEL>
  12537. <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  12538. </SW>
  12539. <SW NAME="CouponsandOffers/TopMoxie">
  12540.     <DIRECTORIES>
  12541.         <DIR NAME="couponsandoffers" PATH="PFDir"></DIR>
  12542.         <DIR NAME="topmoxie" PATH="PFDir"></DIR>
  12543.     </DIRECTORIES>
  12544.     <FILES>
  12545.         <FILE NAME="Couponsandoffers.exe" PATH="PFDir\\couponsandoffers"></FILE>
  12546.         <FILE NAME="JavaRun.exe" PATH=""></FILE>
  12547.     </FILES>
  12548.     <COOKIES>
  12549.         <COOKIE NAME="etraffic"></COOKIE>
  12550.     </COOKIES>
  12551.     <REGISTRY>
  12552.        <KEYS>
  12553.          <REGKEY MAIN="HKEY_CURRENT_USER" SUB="software" VALUE="etraffic"></REGKEY>                     
  12554.        </KEYS> 
  12555.        <VALUES>
  12556.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="couponsandoffers"></REGVALUE>
  12557.        </VALUES>
  12558.     </REGISTRY>
  12559. <DANGER_LEVEL>1</DANGER_LEVEL>
  12560. <DESCRIPTION>TopMoxie is responsible for pop up ads and coupons when visiting certain sites.</DESCRIPTION>
  12561. </SW>
  12562. <SW NAME="W32.HLLW.Lacon@mm">  
  12563.      <DIRECTORIES>
  12564.      </DIRECTORIES>
  12565.      <FILES>
  12566.          <FILE NAME="Bndt32.exe" PATH="SysDir"></FILE>
  12567.            <FILE NAME="Bndt32.exe" PATH="Sys32Dir"></FILE>
  12568.        </FILES>
  12569.      <COOKIES>
  12570.      </COOKIES>
  12571.      <REGISTRY>
  12572.          <KEYS>
  12573.          </KEYS>
  12574.          <VALUES>
  12575.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Bndt32"></REGVALUE>
  12576.          </VALUES>
  12577.      </REGISTRY>
  12578.  <DANGER_LEVEL>2</DANGER_LEVEL>
  12579.  <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  12580. </SW>
  12581. <SW NAME="VBS.Waterworks.Worm/VBS.Evion.IWorm">  
  12582.      <DIRECTORIES>
  12583.      </DIRECTORIES>
  12584.      <FILES>
  12585.          <FILE NAME="Bootloader.exe.vbs " PATH="SysDir"></FILE>
  12586.        </FILES>
  12587.      <COOKIES>
  12588.      </COOKIES>
  12589.      <REGISTRY>
  12590.          <KEYS>
  12591.          </KEYS>
  12592.          <VALUES>
  12593.              <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="BootLoader"></REGVALUE>
  12594.          </VALUES>
  12595.      </REGISTRY>
  12596.  <DANGER_LEVEL>2</DANGER_LEVEL>
  12597.  <DESCRIPTION>Virus that will attempt to spread itself and overwrite vbs and html files.</DESCRIPTION>
  12598. </SW>
  12599.  <SW NAME="Troj/Crypter-C">  
  12600.       <DIRECTORIES>
  12601.       </DIRECTORIES>
  12602.       <FILES>
  12603.           <FILE NAME="mswavedll.exe" PATH="Sys32Dir"></FILE>
  12604.        </FILES>
  12605.       <COOKIES>
  12606.       </COOKIES>
  12607.       <REGISTRY>
  12608.           <KEYS>
  12609.           </KEYS>
  12610.           <VALUES>
  12611.               <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="mswavedll"></REGVALUE>
  12612.           </VALUES>
  12613.       </REGISTRY>
  12614.   <DANGER_LEVEL>2</DANGER_LEVEL>
  12615.   <DESCRIPTION>Trojan that runs in the background and attempts to download malicious components to your PC.</DESCRIPTION>
  12616.  </SW>
  12617.  <SW NAME="Trojan.Simcss.B">  
  12618.       <DIRECTORIES>
  12619.       </DIRECTORIES>
  12620.       <FILES>
  12621.           <FILE NAME="MSLAGENT.EXE" PATH="WinDir\\mslagent"></FILE>
  12622.        </FILES>
  12623.       <COOKIES>
  12624.       </COOKIES>
  12625.       <REGISTRY>
  12626.           <KEYS>
  12627.           </KEYS>
  12628.           <VALUES>
  12629.               <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="mslagent"></REGVALUE>
  12630.           </VALUES>
  12631.       </REGISTRY>
  12632.   <DANGER_LEVEL>2</DANGER_LEVEL>
  12633.   <DESCRIPTION>Runs without user intervention and can download and execute malicious programs</DESCRIPTION>
  12634.  </SW>
  12635.  <SW NAME="OpenSite">
  12636.      <DIRECTORIES>
  12637.          <DIR NAME="Open Site" PATH="PFDir"></DIR>
  12638.      </DIRECTORIES>
  12639.      <FILES>
  12640.          <FILE NAME="opnste.exe" PATH="PFDir\\Open Site"></FILE>
  12641.         <FILE NAME="opnste.exe" PATH="SysDir"></FILE>
  12642.         <FILE NAME="opnste.exe" PATH="Sys32Dir"></FILE>
  12643.         <FILE NAME="dateclen.dll" PATH="PFDir\\Open Site"></FILE>
  12644.         <FILE NAME="rbsman.dll" PATH="PFDir\\Open Site"></FILE>
  12645.         <FILE NAME="uninstall.exe" PATH="PFDir\\Open Site"></FILE>
  12646.      </FILES> 
  12647.      <COOKIES> 
  12648.      </COOKIES>
  12649.      <REGISTRY>
  12650.         <KEYS>
  12651.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{30a56549-9d5b-4d34-afa7-440a7f0538a9}"></REGKEY>
  12652.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{30a56549-9d5b-4d34-afa7-440a7f0538a9}"></REGKEY>
  12653.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{30a56549-9d5b-4d34-afa7-440a7f0538a9}"></REGKEY>
  12654.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{30a56549-9d5b-4d34-afa7-440a7f0538a9}"></REGKEY>
  12655.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{30a56549-9d5b-4d34-afa7-440a7f0538a9}"></REGKEY>
  12656.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall" VALUE="open site"></REGKEY>
  12657.         </KEYS> 
  12658.         <VALUES>
  12659.               <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Open Site"></REGVALUE>
  12660.         </VALUES>
  12661.      </REGISTRY>
  12662.  <DANGER_LEVEL>1</DANGER_LEVEL>
  12663.  <DESCRIPTION>Hijacks your internet settings and spawns pop up advertisements.</DESCRIPTION>
  12664.  </SW>
  12665.  <SW NAME="W32.HLLW.Gaobot.RS">  
  12666.       <DIRECTORIES>
  12667.       </DIRECTORIES>
  12668.       <FILES>
  12669.           <FILE NAME="hallowelt.exe" PATH=""></FILE>
  12670.       </FILES>
  12671.       <COOKIES>
  12672.       </COOKIES>
  12673.       <REGISTRY>
  12674.           <KEYS>
  12675.           </KEYS>
  12676.           <VALUES>
  12677.               <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="yeahdude.exe"></REGVALUE>
  12678.               <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="yeahdude.exe"></REGVALUE>
  12679.           </VALUES>
  12680.       </REGISTRY>
  12681.   <DANGER_LEVEL>2</DANGER_LEVEL>
  12682.   <DESCRIPTION>Attempts to spread through networks and allows hackers unauthorized access to your PC.</DESCRIPTION>
  12683.  </SW>
  12684. <SW NAME="TROJ_MOSCENT.A">
  12685.     <DIRECTORIES>
  12686.     </DIRECTORIES>
  12687.     <FILES>
  12688.         <FILE NAME="mscnt.exe" PATH="SysDir"></FILE>
  12689.     </FILES>
  12690.     <COOKIES>
  12691.     </COOKIES>
  12692.     <REGISTRY>
  12693.        <KEYS>
  12694.        </KEYS> 
  12695.        <VALUES>
  12696.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Mscnt"></REGVALUE>
  12697.        </VALUES>
  12698.     </REGISTRY>
  12699. <DANGER_LEVEL>2</DANGER_LEVEL>
  12700. <DESCRIPTION>Runs without user intervention and can download and execute malicious programs.</DESCRIPTION>
  12701. </SW>
  12702. <SW NAME="MGS_32">
  12703.     <DIRECTORIES>
  12704.     </DIRECTORIES>
  12705.     <FILES>
  12706.         <FILE NAME="mgs_32.dll" PATH="PFDir\\internet explorer\\toolbar"></FILE>
  12707.     </FILES>
  12708.     <COOKIES>
  12709.     </COOKIES>
  12710.     <REGISTRY>
  12711.         <KEYS>
  12712.         </KEYS>
  12713.         <VALUES>
  12714.         </VALUES>
  12715.     </REGISTRY>
  12716. <DANGER_LEVEL>1</DANGER_LEVEL>
  12717. <DESCRIPTION>Malware component related to hijackings and pop up advertisements.</DESCRIPTION>
  12718. </SW> 
  12719. <SW NAME="Zyncos">  
  12720.      <DIRECTORIES>
  12721.         <DIR NAME="zyncosspace" PATH="PFDir"></DIR>
  12722.       </DIRECTORIES>
  12723.      <FILES>
  12724.          <FILE NAME="cmctl.dll" PATH="SysDir"></FILE>
  12725.         <FILE NAME="cmctl.dll" PATH="Sys32Dir"></FILE>
  12726.         <FILE NAME="cmctl.dll" PATH="PFDir\\zyncosspace"></FILE>
  12727.         <FILE NAME="qwysh.exe" PATH=""></FILE>
  12728.         <FILE NAME="ACCESS.AccessCtrl.1" PATH="WinDir\\Downloaded Program Files"></FILE>
  12729.      </FILES>
  12730.      <COOKIES>
  12731.      </COOKIES>
  12732.      <REGISTRY>
  12733.          <KEYS>
  12734.          </KEYS>
  12735.          <VALUES>
  12736.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="ZyncosMark"></REGVALUE>
  12737.          </VALUES>
  12738.      </REGISTRY>
  12739.      <DANGER_LEVEL>2</DANGER_LEVEL>
  12740.  <DESCRIPTION>Pornography related homepage hijacker and browser helper object.</DESCRIPTION>
  12741. </SW>
  12742. <SW NAME="GoInDirect/All-In-One Telcom">
  12743.     <DIRECTORIES>
  12744.       <DIR NAME="dialer" PATH="PFDir"></DIR>
  12745.     </DIRECTORIES>
  12746.     <FILES>
  12747.        <FILE NAME="dialer_activex.ocx" PATH="SysDir"></FILE>
  12748.        <FILE NAME="dialer_activex.ocx" PATH="Sys32Dir"></FILE>
  12749.      </FILES>
  12750.     <COOKIES>
  12751.     </COOKIES>
  12752.     <REGISTRY>
  12753.        <KEYS>
  12754.        </KEYS>
  12755.        <VALUES>
  12756.        </VALUES>
  12757.     </REGISTRY>
  12758. <DANGER_LEVEL>2</DANGER_LEVEL>
  12759. <DESCRIPTION>Used to download and help execute high cost dialer programs.</DESCRIPTION>
  12760. </SW>
  12761. <SW NAME="eStart">
  12762.     <DIRECTORIES>
  12763.     </DIRECTORIES>
  12764.     <FILES>
  12765.        <FILE NAME="GoUpdate.exe" PATH="WinDir"></FILE>
  12766.        <FILE NAME="EStartTemp.ini" PATH="SysDir"></FILE>
  12767.        <FILE NAME="EStartTemp.ini" PATH="Sys32Dir"></FILE>
  12768.        <FILE NAME="BandObjs1,0,0,3.dll" PATH="SysDir"></FILE>
  12769.        <FILE NAME="BandObjs1,0,0,3.dll" PATH="Sys32Dir"></FILE>
  12770.        <FILE NAME="Links.dll" PATH="SysDir"></FILE>
  12771.        <FILE NAME="Links.dll" PATH="Sys32Dir"></FILE>
  12772.        <FILE NAME="Install.ini" PATH="SysDir"></FILE>
  12773.        <FILE NAME="Install.ini" PATH="Sys32Dir"></FILE>
  12774.        <FILE NAME="Register.vbs" PATH="SysDir"></FILE>
  12775.        <FILE NAME="Register.vbs" PATH="Sys32Dir"></FILE>
  12776.        <FILE NAME="Uninst.exe" PATH="SysDir"></FILE>
  12777.        <FILE NAME="Uninst.exe" PATH="Sys32Dir"></FILE>
  12778.        <FILE NAME="GoUpdate.exe" PATH=""></FILE>
  12779.     </FILES>
  12780.     <COOKIES>
  12781.     </COOKIES>
  12782.     <REGISTRY>
  12783.        <KEYS>
  12784.        </KEYS>
  12785.        <VALUES>
  12786.        </VALUES>
  12787.     </REGISTRY>
  12788. <DANGER_LEVEL>1</DANGER_LEVEL>
  12789. <DESCRIPTION>Internet Explorer toolbar that will replace normal bookmarks and links.</DESCRIPTION>
  12790. </SW>
  12791. <SW NAME="MagicControl">
  12792.     <DIRECTORIES>
  12793.         <DIR NAME="iexplore" PATH="PFDir"></DIR>
  12794.         <DIR NAME="winmgts" PATH="WinDir"></DIR>
  12795.         <DIR NAME="wincomp" PATH="WinDir"></DIR>
  12796.         <DIR NAME="wintrim" PATH="WinDir"></DIR>
  12797.         <DIR NAME="mc" PATH="WinDir"></DIR>
  12798.     </DIRECTORIES>
  12799.     <FILES>
  12800.         <FILE NAME="msegcompid.dll" PATH="SysDir"></FILE>
  12801.         <FILE NAME="msegcompid.dll" PATH="Sys32Dir"></FILE>
  12802.         <FILE NAME="wincomp.exe" PATH="WinDir\\wincomp"></FILE>
  12803.         <FILE NAME="wintrim.exe" PATH="WinDir\\wintrim"></FILE>
  12804.         <FILE NAME="winmgts.exe" PATH="WinDir\\winmgts"></FILE>
  12805.         <FILE NAME="MagicControl.dll" PATH=""></FILE>
  12806.         <FILE NAME="EGPing.dll" PATH=""></FILE>
  12807.         <FILE NAME="2_wincomp.dll" PATH=""></FILE>
  12808.         <FILE NAME="3_1,0,0,5_wincomp.dll" PATH=""></FILE>
  12809.         <FILE NAME="2_1,0,2,9_winmgts.dll" PATH=""></FILE>
  12810.         <FILE NAME="3_1,0,0,6_winmgts.dll" PATH=""></FILE>
  12811.     </FILES>
  12812.     <COOKIES>
  12813.     </COOKIES>
  12814.     <REGISTRY>
  12815.        <KEYS>
  12816.        </KEYS>
  12817.        <VALUES>
  12818.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="cpntmgc"></REGVALUE>
  12819.        </VALUES>
  12820.     </REGISTRY>
  12821. <DANGER_LEVEL>2</DANGER_LEVEL>
  12822. <DESCRIPTION>trojan that is associated with dialer manufacturer eGroup.</DESCRIPTION>
  12823. </SW>
  12824. <SW NAME="BrowserPal">
  12825.     <DIRECTORIES>
  12826.        <DIR NAME="BrowserPal" PATH="PFDir"></DIR>
  12827.     </DIRECTORIES>
  12828.     <FILES>
  12829.            <FILE NAME="blckbho.dll" PATH="PFDir\\BrowserPal"></FILE>
  12830.            <FILE NAME="bptlb.dll" PATH="PFDir\\BrowserPal"></FILE>
  12831.     </FILES>
  12832.     <COOKIES>
  12833.     </COOKIES>
  12834.     <REGISTRY>
  12835.        <KEYS>
  12836.        </KEYS>
  12837.        <VALUES>
  12838.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Browser Pal"></REGVALUE>
  12839.        </VALUES>
  12840.     </REGISTRY>
  12841. <DANGER_LEVEL>1</DANGER_LEVEL>
  12842. <DESCRIPTION>Internet Explorer toolbar.</DESCRIPTION>
  12843. </SW>
  12844. <SW NAME="LolaWeb.winhost">
  12845.     <DIRECTORIES>
  12846.     </DIRECTORIES>
  12847.     <FILES>
  12848.         <FILE NAME="WINTT.EXE" PATH="WinDir"></FILE>
  12849.         <FILE NAME="WINH.EXE" PATH="WinDir"></FILE>
  12850.     </FILES>
  12851.     <COOKIES> 
  12852.     </COOKIES>
  12853.     <REGISTRY>
  12854.        <KEYS>
  12855.        </KEYS> 
  12856.        <VALUES>
  12857.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Winhost"></REGVALUE>
  12858.        </VALUES>
  12859.     </REGISTRY>
  12860. <DANGER_LEVEL>2</DANGER_LEVEL>
  12861. <DESCRIPTION>Trojan that copies itself to ensure it is run continuously.</DESCRIPTION>
  12862. </SW>
  12863. <SW NAME="PraizeToolbar">
  12864.     <DIRECTORIES>
  12865.     </DIRECTORIES>
  12866.     <FILES>
  12867.         <FILE NAME="praizetoolbar.dll" PATH="SysDir"></FILE>
  12868.         <FILE NAME="praizetoolbar.dll" PATH="Sys32Dir"></FILE>
  12869.     </FILES>
  12870.     <COOKIES>
  12871.     </COOKIES>
  12872.     <REGISTRY>
  12873.         <KEYS>
  12874.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{c6335b00-e8d9-423e-a691-48d17cbb6c5a}"></REGKEY>
  12875.         </KEYS>
  12876.         <VALUES>
  12877.         </VALUES>
  12878.     </REGISTRY>
  12879. <DANGER_LEVEL>1</DANGER_LEVEL>
  12880. <DESCRIPTION>Internet Explorer toolbar.</DESCRIPTION>
  12881. </SW>
  12882. <SW NAME="PCWeasel">
  12883.     <DIRECTORIES>
  12884.         <DIR NAME="PC Weasel" PATH="PFDir"></DIR>
  12885.     </DIRECTORIES>
  12886.     <FILES>
  12887.         <FILE NAME="CleanReg.exe" PATH="PFDir\\pc weasel"></FILE>
  12888.         <FILE NAME="PCWeasel.exe" PATH="PFDir\\pc weasel"></FILE>
  12889.         <FILE NAME="Keying.txt" PATH=""></FILE>
  12890.     </FILES> 
  12891.     <COOKIES> 
  12892.     </COOKIES>
  12893.     <REGISTRY>
  12894.        <KEYS>
  12895.        </KEYS> 
  12896.        <VALUES>
  12897.        </VALUES>
  12898.     </REGISTRY>
  12899. <DANGER_LEVEL>2</DANGER_LEVEL>
  12900. <DESCRIPTION>Commercial keylogger program that will record all actions done on your PC</DESCRIPTION>
  12901. </SW>
  12902. <SW NAME="Optix Pro">
  12903.     <DIRECTORIES>
  12904.     </DIRECTORIES>
  12905.     <FILES>
  12906.         <FILE NAME="msiexec16.exe" PATH="SysDir"></FILE>
  12907.         <FILE NAME="msiexec16.exe" PATH="Sys32Dir"></FILE>
  12908.         <FILE NAME="isass.exe" PATH="SysDir"></FILE>
  12909.         <FILE NAME="isass.exe" PATH="Sys32Dir"></FILE>
  12910.     </FILES>
  12911.     <COOKIES> 
  12912.     </COOKIES>
  12913.     <REGISTRY>
  12914.        <KEYS>
  12915.        </KEYS> 
  12916.        <VALUES>
  12917.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="GLSetIT32"></REGVALUE>
  12918.        </VALUES>
  12919.     </REGISTRY>
  12920. <DANGER_LEVEL>2</DANGER_LEVEL>
  12921. <DESCRIPTION>Worm that allows hackers unauthorized access to your PC.</DESCRIPTION>
  12922. </SW>
  12923. <SW NAME="NSUpdate Dialer">
  12924.     <DIRECTORIES>
  12925.     </DIRECTORIES>
  12926.     <FILES>
  12927.         <FILE NAME="NsUpdate.exe" PATH="WinDir"></FILE>
  12928.     </FILES> 
  12929.     <COOKIES> 
  12930.     </COOKIES>
  12931.     <REGISTRY>
  12932.        <KEYS>
  12933.        </KEYS> 
  12934.        <VALUES>
  12935.              <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="NsUpdate"></REGVALUE>
  12936.        </VALUES>
  12937.     </REGISTRY>
  12938. <DANGER_LEVEL>2</DANGER_LEVEL>
  12939. <DESCRIPTION>Pornography related dialer that dials high cost numbers usually without user intervention.</DESCRIPTION>
  12940. </SW>
  12941. <SW NAME="SVAPlayer">  
  12942.     <DIRECTORIES>
  12943.         <DIR NAME="SVA Player" PATH="PFDir"></DIR>
  12944.     </DIRECTORIES>
  12945.     <FILES>
  12946.         <FILE NAME="SVAPLAYER.EXE" PATH="PFDir\\SVA Player"></FILE>
  12947.     </FILES>
  12948.     <COOKIES>
  12949.     </COOKIES>
  12950.     <REGISTRY>
  12951.         <KEYS>
  12952.         </KEYS>
  12953.         <VALUES>
  12954.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="SVAPlayer"></REGVALUE>
  12955.         </VALUES>
  12956.     </REGISTRY>
  12957. <DANGER_LEVEL>1</DANGER_LEVEL>
  12958. <DESCRIPTION>System tray icon and browser helper object that displays pop up advertising.</DESCRIPTION>
  12959. </SW>
  12960. <SW NAME="SmartBrowser">  
  12961.     <DIRECTORIES>
  12962.     </DIRECTORIES>
  12963.     <FILES>
  12964.         <FILE NAME="BHO.0.1.0.135.dll" PATH="WinDir\\Temp"></FILE>
  12965.         <FILE NAME="ybd.dll" PATH="WinDir\\Temp"></FILE>
  12966.         <FILE NAME="regme.exe" PATH="WinDir\\Temp"></FILE>
  12967.         <FILE NAME="logo.ico" PATH="WinDir\\Temp"></FILE>
  12968.         <FILE NAME="IYBD.5.exe" PATH="WinDir\\Temp"></FILE>
  12969.         <FILE NAME="thingies.lish.enctext" PATH="WinDir\\Temp"></FILE>
  12970.         <FILE NAME="YBDversion.5" PATH="WinDir\\Temp"></FILE>
  12971.         <FILE NAME="system.htm" PATH="WinDir\\Temp"></FILE>
  12972.     </FILES>
  12973.     <COOKIES>
  12974.     </COOKIES>
  12975.     <REGISTRY>
  12976.         <KEYS>
  12977.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{00000185-B716-11D3-92F3-00D0B709A7D8}"></REGKEY>
  12978.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="Interface" VALUE="{00000183-B716-11D3-92F3-00D0B709A7D8}"></REGKEY>
  12979.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="CLSID" VALUE="{00000186-B716-11D3-92F3-00D0B709A7D8}"></REGKEY>
  12980.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="TypeLib" VALUE="{00000182-B716-11D3-92F3-00D0B709A7D8}"></REGKEY>
  12981.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{00000185-B716-11D3-92F3-00D0B709A7D8}"></REGKEY>
  12982.         </KEYS>
  12983.         <VALUES>
  12984.         </VALUES>
  12985.     </REGISTRY>
  12986. <DANGER_LEVEL>2</DANGER_LEVEL>
  12987. <DESCRIPTION>Hijacker that will change Internet settings as well as display pop up advertising, sends spam as well.</DESCRIPTION>
  12988. </SW>
  12989. <SW NAME="WinMuschi Dialer">  
  12990.     <DIRECTORIES>
  12991.     </DIRECTORIES>
  12992.     <FILES>
  12993.         <FILE NAME="WinMuschi.exe" PATH="WinDir"></FILE>
  12994.     </FILES>
  12995.     <COOKIES>
  12996.     </COOKIES>
  12997.     <REGISTRY>
  12998.         <KEYS>
  12999.         </KEYS>
  13000.         <VALUES>
  13001.             <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="CFDStart"></REGVALUE>
  13002.         </VALUES>
  13003.     </REGISTRY>
  13004. <DANGER_LEVEL>2</DANGER_LEVEL>
  13005. <DESCRIPTION>Pornography related dialer that dials high cost numbers usually without user intervention.</DESCRIPTION>
  13006. </SW>
  13007. <SW NAME="W32.Wintoo.Worm">  
  13008.     <DIRECTORIES>
  13009.     </DIRECTORIES>
  13010.     <FILES>
  13011.     </FILES>
  13012.     <COOKIES>
  13013.     </COOKIES>
  13014.     <REGISTRY>
  13015.         <KEYS>
  13016.         </KEYS>
  13017.         <VALUES>
  13018.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Win2Drv"></REGVALUE>
  13019.         </VALUES>
  13020.     </REGISTRY>
  13021. <DANGER_LEVEL>2</DANGER_LEVEL>
  13022. <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  13023. </SW>
  13024. <SW NAME="NetVizor">
  13025.     <DIRECTORIES>
  13026.         <DIR NAME="NVClient" PATH="PFDir"></DIR>
  13027.     </DIRECTORIES>
  13028.     <FILES>
  13029.         <FILE NAME="sysdiag.exe" PATH="PFDir\\nvclient"></FILE>
  13030.         <FILE NAME="NetVizorViewer.exe" PATH="PFDir\\nvclient"></FILE>
  13031.         <FILE NAME="NetVizorViewer.exe" PATH="WinDir"></FILE>
  13032.         <FILE NAME="nvopts.dat" PATH="WinDir"></FILE>
  13033.         <FILE NAME="nvfa.dat" PATH="WinDir"></FILE>
  13034.         <FILE NAME="nvfw.dat" PATH="WinDir"></FILE>
  13035.     </FILES> 
  13036.     <COOKIES> 
  13037.     </COOKIES>
  13038.     <REGISTRY>
  13039.        <KEYS>
  13040.        </KEYS> 
  13041.        <VALUES>
  13042.        </VALUES>
  13043.     </REGISTRY>
  13044. <DANGER_LEVEL>2</DANGER_LEVEL>
  13045. <DESCRIPTION>Commercial keylogger program that will record all actions done on your PC.</DESCRIPTION>
  13046. </SW>
  13047. <SW NAME="host.vbs">
  13048.     <DIRECTORIES>
  13049.     </DIRECTORIES>
  13050.     <FILES>
  13051.         <FILE NAME="hosts.vbs" PATH="Sys32Dir"></FILE>
  13052.     </FILES>
  13053.     <COOKIES>
  13054.     </COOKIES>
  13055.     <REGISTRY>
  13056.         <KEYS>
  13057.         </KEYS>
  13058.         <VALUES>
  13059.                  <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="host"></REGVALUE>
  13060.         </VALUES>
  13061.     </REGISTRY>
  13062. <DANGER_LEVEL>1</DANGER_LEVEL>
  13063. <DESCRIPTION>Known to modify the HOSTS file.  Malware.</DESCRIPTION>
  13064. </SW>
  13065. <SW NAME="ClearStream Accelerator">  
  13066.     <DIRECTORIES>
  13067.     </DIRECTORIES>
  13068.     <FILES>
  13069.     </FILES> 
  13070.     <COOKIES>
  13071.     </COOKIES>
  13072.     <REGISTRY>
  13073.         <KEYS>
  13074.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{d319662b-d5bf-4538-adf3-8d3e36362608}"></REGKEY>
  13075.         </KEYS>
  13076.         <VALUES>
  13077.         </VALUES>
  13078.     </REGISTRY>
  13079. <DANGER_LEVEL>1</DANGER_LEVEL>
  13080. <DESCRIPTION>known to display pop up advertisements.</DESCRIPTION>
  13081. </SW>
  13082. <SW NAME="TROJ_TOMADI.A">  
  13083.     <DIRECTORIES>
  13084.     </DIRECTORIES>
  13085.     <FILES>
  13086.         <FILE NAME="BrowserHelper.DLL" PATH="WinDir"></FILE>
  13087.     </FILES> 
  13088.     <COOKIES>
  13089.     </COOKIES>
  13090.     <REGISTRY>
  13091.         <KEYS>
  13092.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{B549456D-F5D0-4641-BCED-8648A0C13D83}"></REGKEY>
  13093.         </KEYS>
  13094.         <VALUES>
  13095.         </VALUES>
  13096.     </REGISTRY>
  13097. <DANGER_LEVEL>2</DANGER_LEVEL>
  13098. <DESCRIPTION>Performs malicious tasks in the background, known to cause pop up advertisements.</DESCRIPTION>
  13099. </SW>
  13100. <SW NAME="W32Sup">
  13101.     <DIRECTORIES>
  13102.     </DIRECTORIES>
  13103.     <FILES>
  13104.         <FILE NAME="w32sup.exe" PATH="Sys32Dir"></FILE>
  13105.     </FILES>
  13106.     <COOKIES>
  13107.     </COOKIES>
  13108.     <REGISTRY>
  13109.         <KEYS>
  13110.         </KEYS>
  13111.         <VALUES>
  13112.                  <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="w32sup"></REGVALUE>
  13113.         </VALUES>
  13114.     </REGISTRY>
  13115. <DANGER_LEVEL>1</DANGER_LEVEL>
  13116. <DESCRIPTION>Known to cause pop up advertisements.</DESCRIPTION>
  13117. </SW>
  13118. <SW NAME="W32.Blaster.C.Worm">
  13119.     <DIRECTORIES>
  13120.     </DIRECTORIES>
  13121.     <FILES>
  13122.         <FILE NAME="teekids.exe" PATH="SysDir"></FILE>
  13123.         <FILE NAME="teekids.exe" PATH="Sys32Dir"></FILE>
  13124.     </FILES>
  13125.     <COOKIES>
  13126.     </COOKIES>
  13127.     <REGISTRY>
  13128.         <KEYS>
  13129.         </KEYS>
  13130.         <VALUES>
  13131.                  <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Microsoft Inet Xp.."></REGVALUE>
  13132.         </VALUES>
  13133.     </REGISTRY>
  13134. <DANGER_LEVEL>2</DANGER_LEVEL>
  13135. <DESCRIPTION>MSblaster worm widely spread through networks on the internet</DESCRIPTION>
  13136. </SW>
  13137. <SW NAME="W32.Blaster.E.Worm">
  13138.     <DIRECTORIES>
  13139.     </DIRECTORIES>
  13140.     <FILES>
  13141.         <FILE NAME="mslaugh.exe" PATH="SysDir"></FILE>
  13142.         <FILE NAME="mslaugh.exe" PATH="Sys32Dir"></FILE>
  13143.     </FILES>
  13144.     <COOKIES>
  13145.     </COOKIES>
  13146.     <REGISTRY>
  13147.         <KEYS>
  13148.         </KEYS>
  13149.         <VALUES>
  13150.                  <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Windows Automation"></REGVALUE>
  13151.         </VALUES>
  13152.     </REGISTRY>
  13153. <DANGER_LEVEL>2</DANGER_LEVEL>
  13154. <DESCRIPTION>MSblaster worm widely spread through networks on the internet</DESCRIPTION>
  13155. </SW>
  13156. <SW NAME="WhistleSoftware">  
  13157.     <DIRECTORIES>
  13158.     </DIRECTORIES>
  13159.     <FILES>
  13160.         <FILE NAME="whistlehelper.dll" PATH=""></FILE>
  13161.     </FILES> 
  13162.     <COOKIES>
  13163.     </COOKIES>
  13164.     <REGISTRY>
  13165.         <KEYS>
  13166.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{27557cf1-a237-496d-8c8f-08f3844c6a8b}"></REGKEY>
  13167.         </KEYS>
  13168.         <VALUES>
  13169.         </VALUES>
  13170.     </REGISTRY>
  13171. <DANGER_LEVEL>1</DANGER_LEVEL>
  13172. <DESCRIPTION>Software known to cause pop up advertising.</DESCRIPTION>
  13173. </SW>
  13174. <SW NAME="Winpage Blocker">  
  13175.     <DIRECTORIES>
  13176.     </DIRECTORIES>
  13177.     <FILES>
  13178.         <FILE NAME="winpage.dll" PATH=""></FILE>
  13179.     </FILES> 
  13180.     <COOKIES>
  13181.     </COOKIES>
  13182.     <REGISTRY>
  13183.         <KEYS>
  13184.                <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{12DF6E3E-6272-4AE8-880B-2158D60791C0}"></REGKEY>
  13185.         </KEYS>
  13186.         <VALUES>
  13187.         </VALUES>
  13188.     </REGISTRY>
  13189. <DANGER_LEVEL>1</DANGER_LEVEL>
  13190. <DESCRIPTION>Hijacker that will change your Internet Settings.</DESCRIPTION>
  13191. </SW>
  13192. <SW NAME="BlazeFind">
  13193.    <DIRECTORIES>
  13194.    </DIRECTORIES>
  13195.    <FILES>
  13196.       <FILE NAME="2_0_1browserhelper2.dll" PATH="WinDir"></FILE>
  13197.       <FILE NAME="2_0_1browserhelper2.dll" PATH="SysDir"></FILE>
  13198.       <FILE NAME="2_0_1browserhelper2.dll" PATH="Sys32Dir"></FILE>
  13199.       <FILE NAME="3_0_1browserhelper3.dll" PATH="SysDir"></FILE>
  13200.       <FILE NAME="3_0_1browserhelper3.dll" PATH="Sys32Dir"></FILE>
  13201.       <FILE NAME="5_0_1browserhelper5.dll" PATH="SysDir"></FILE>
  13202.       <FILE NAME="5_0_1browserhelper5.dll" PATH="Sys32Dir"></FILE>
  13203.       <FILE NAME="iesearchbar.dll" PATH="SysDir"></FILE>
  13204.    </FILES>
  13205.    <COOKIES>
  13206.    </COOKIES>
  13207.    <REGISTRY>
  13208.     <KEYS>
  13209.       <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{71ed4fba-4024-4bbe-91dc-9704c93f453e}"></REGKEY>
  13210.       <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{83de62e0-5805-11d8-9b25-00e04c60faf2}"></REGKEY>
  13211.       <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{c5941ee5-6dfa-11d8-86b0-0002441a9695}"></REGKEY>
  13212.       <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{fbed6a02-71fb-11d8-86b0-0002441a9695}"></REGKEY>
  13213.       <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{71ed4fba-4024-4bbe-91dc-9704c93f453e}"></REGKEY>
  13214.       <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{83de62e0-5805-11d8-9b25-00e04c60faf2}"></REGKEY>
  13215.       <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{c5941ee5-6dfa-11d8-86b0-0002441a9695}"></REGKEY>
  13216.       <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{fbed6a02-71fb-11d8-86b0-0002441a9695}"></REGKEY>
  13217.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{71ed4fba-4024-4bbe-91dc-9704c93f453e}"></REGKEY>
  13218.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{83de62e0-5805-11d8-9b25-00e04c60faf2}"></REGKEY>
  13219.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{c5941ee5-6dfa-11d8-86b0-0002441a9695}"></REGKEY>
  13220.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="clsid" VALUE="{fbed6a02-71fb-11d8-86b0-0002441a9695}"></REGKEY>
  13221.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{71ed4fba-4024-4bbe-91dc-9704c93f453e}"></REGKEY>
  13222.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{83de62e0-5805-11d8-9b25-00e04c60faf2}"></REGKEY>
  13223.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{c5941ee5-6dfa-11d8-86b0-0002441a9695}"></REGKEY>
  13224.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{fbed6a02-71fb-11d8-86b0-0002441a9695}"></REGKEY>
  13225.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{71ed4fba-4024-4bbe-91dc-9704c93f453e}"></REGKEY>
  13226.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{83de62e0-5805-11d8-9b25-00e04c60faf2}"></REGKEY>
  13227.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{c5941ee5-6dfa-11d8-86b0-0002441a9695}"></REGKEY>
  13228.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{fbed6a02-71fb-11d8-86b0-0002441a9695}"></REGKEY>
  13229.     </KEYS>
  13230.     <VALUES>
  13231.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{71ed4fba-4024-4bbe-91dc-9704c93f453e}"></REGVALUE>
  13232.     </VALUES>
  13233. </REGISTRY>
  13234.    <DANGER_LEVEL>1</DANGER_LEVEL>
  13235.    <DESCRIPTION>Browser Helper Object that will redirect searches you make.</DESCRIPTION>
  13236. </SW>
  13237. <SW NAME="ToonComics">
  13238.     <DIRECTORIES>
  13239.     </DIRECTORIES>
  13240.     <FILES>
  13241.        <FILE NAME="dnserr.dll" PATH="WinDir"></FILE>
  13242.     </FILES>
  13243.     <COOKIES>
  13244.     </COOKIES>
  13245.     <REGISTRY>
  13246.     <KEYS>
  13247.     </KEYS>
  13248.     <VALUES>
  13249.     </VALUES>
  13250.     </REGISTRY>
  13251. <DANGER_LEVEL>1</DANGER_LEVEL>
  13252. <DESCRIPTION>Related to pop up advertising.</DESCRIPTION>
  13253. </SW>
  13254. <SW NAME="P2P Networking">
  13255.     <DIRECTORIES>
  13256.         <DIR NAME="p2p networking" PATH="Sys32Dir"></DIR>
  13257.     </DIRECTORIES>
  13258.     <FILES>
  13259.         <FILE NAME="p2p networking.exe" PATH="Sys32Dir\\p2p networking"></FILE>
  13260.     </FILES>
  13261.     <COOKIES>
  13262.     </COOKIES>
  13263.     <REGISTRY>
  13264.        <KEYS>
  13265.        </KEYS>
  13266.        <VALUES>
  13267.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="p2p networking"></REGVALUE>
  13268.        </VALUES>
  13269.     </REGISTRY>
  13270. <DANGER_LEVEL>1</DANGER_LEVEL>
  13271. <DESCRIPTION>Enables peer to peer functionality for certain applications.</DESCRIPTION>
  13272. </SW>
  13273. <SW NAME="DyFuCA"> 
  13274.     <DIRECTORIES>
  13275.        <DIR NAME="dialers" PATH="PFDir"></DIR>
  13276.        <DIR NAME="internet optimizer" PATH="PFDir"></DIR>
  13277.     </DIRECTORIES>
  13278.     <FILES>
  13279.          <FILE NAME="wsem216.dll" PATH="WinDir"></FILE>
  13280.          <FILE NAME="wsem217.dll" PATH="WinDir"></FILE>
  13281.         <FILE NAME="wsem210.dll" PATH="SysDir"></FILE>
  13282.         <FILE NAME="wsem210.dll" PATH="Sys32Dir"></FILE>
  13283.         <FILE NAME="stmtdlr.exe" PATH=""></FILE>
  13284.         <FILE NAME="nem218.dll" PATH=""></FILE>
  13285.         <FILE NAME="preinstt.exe" PATH=""></FILE>
  13286.         <FILE NAME="install.exe" PATH="PFDir\\internet optimizer"></FILE>
  13287.         <FILE NAME="optimize.exe" PATH="PFDir\\internet optimizer"></FILE>
  13288.         <FILE NAME="actalert.exe" PATH="PFDir\\internet optimizer\\update"></FILE>
  13289.         <FILE NAME="actalert.exe" PATH="PFDir\\internet optimizer"></FILE>
  13290.         <FILE NAME="install.exe" PATH="PFDir\\internet optimizer\\update"></FILE>
  13291.         <FILE NAME="optimize.exe" PATH="PFDir\\internet optimizer\\update"></FILE>
  13292.         <FILE NAME="nem214.dll" PATH="WinDir"></FILE>
  13293.         <FILE NAME="wsem218.dll" PATH=""></FILE>
  13294.            <FILE NAME="ssupdate.exe" PATH="Sys32Dir"></FILE>
  13295.            <FILE NAME="ssupdate.exe" PATH="SysDir"></FILE>
  13296.            <FILE NAME="preinstt.exe" PATH="WinDir\\Temp\\thi6026.tmp"></FILE>
  13297.     </FILES>
  13298.     <COOKIES>
  13299.     </COOKIES>
  13300.     <REGISTRY>
  13301.        <KEYS>
  13302.                <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="dyfuca_bh.bhobj"></REGKEY>
  13303.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="dyfuca_bh.bhobj.1"></REGKEY>
  13304.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="dyfuca_bh.sinkobj"></REGKEY>
  13305.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="dyfuca_bh.sinkobj.1"></REGKEY>
  13306.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="safesurfinghelper.iebho"></REGKEY>
  13307.             <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="safesurfinghelper.iebho.1"></REGKEY>
  13308.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{cea206e8-8057-4a04-ace9-ff0d69a92297}"></REGKEY>
  13309.          <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{f7f808f0-6f7d-442c-93e3-4a4827c2e4c8}"></REGKEY>
  13310.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{d8e25c53-9508-4f5c-9249-d98d438891d5}"></REGKEY>
  13311.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="interface" VALUE="{1c01d150-91a4-4de0-9bf8-a35d1bdf1001}"></REGKEY>
  13312.            <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="typelib" VALUE="{00211813-6223-4c6a-be8d-4d2676cd1361}"></REGKEY>
  13313.              <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{F7F808F0-6F7D-442C-93E3-4A4827C2E4C8}"></REGKEY>
  13314.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\explorer\\browser helper objects" VALUE="{8F4E5661-F99E-4B3E-8D85-0EA71C0748E4}"></REGKEY>
  13315.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\classes\\clsid" VALUE="{f7f808f0-6f7d-442c-93e3-4a4827c2e4c8}"></REGKEY>
  13316.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{8F4E5661-F99E-4B3E-8D85-0EA71C0748E4}"></REGKEY>
  13317.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall" VALUE="dyfuca"></REGKEY> 
  13318.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall" VALUE="internet optimizer"></REGKEY>
  13319.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall" VALUE="internet optimizer active alert"></REGKEY>
  13320.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\uninstall" VALUE="internet optimizer software installer"></REGKEY>
  13321.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\safesurfing" VALUE="update"></REGKEY>
  13322.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software" VALUE="avenue media"></REGKEY>
  13323.          <REGKEY MAIN="HKEY_CURRENT_USER" SUB="software" VALUE="avenue media"></REGKEY>
  13324.          <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software" VALUE="fci"></REGKEY>
  13325.        </KEYS>
  13326.        <VALUES>
  13327.                    <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\safesurfing" VALUE="update"></REGVALUE>
  13328.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="safesurfingupdate"></REGVALUE>
  13329.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="DyFuCA"></REGVALUE>
  13330.                 <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="DyFuCA Active Alerts"></REGVALUE>
  13331.                <REGVALUE MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="dyfuca_bh.bhobj"></REGVALUE>
  13332.                <REGVALUE MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="dyfuca_bh.bhobj.1"></REGVALUE>
  13333.                <REGVALUE MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="dyfuca_bh.sinkobj"></REGVALUE>
  13334.                <REGVALUE MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="dyfuca_bh.sinkobj.1"></REGVALUE>
  13335.                <REGVALUE MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="safesurfinghelper.iebho"></REGVALUE>
  13336.                <REGVALUE MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="safesurfinghelper.iebho.1"></REGVALUE>
  13337.                <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\run" VALUE="internet optimizer"></REGVALUE>
  13338.        </VALUES>
  13339.     </REGISTRY>
  13340. <DANGER_LEVEL>2</DANGER_LEVEL>
  13341. <DESCRIPTION>Porn dialer known to dial high cost numbers without user consent and Hijacks your internet explorer settings.</DESCRIPTION>
  13342. </SW>
  13343. <SW NAME="Search Toolbar">
  13344.     <DIRECTORIES>
  13345.     </DIRECTORIES>
  13346.     <FILES>
  13347.        <FILE NAME="searchtoolbar.dll" PATH="Sys32Dir"></FILE>
  13348.        <FILE NAME="searchtoolbar.dll" PATH="SysDir"></FILE>
  13349.     </FILES>
  13350.     <COOKIES>
  13351.     </COOKIES>
  13352.     <REGISTRY>
  13353.     <KEYS>
  13354.     </KEYS>
  13355.     <VALUES>
  13356.         <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\internet explorer\\toolbar" VALUE="{6a85d97d-665d-4825-8341-9501ad9f56a3}"></REGVALUE>
  13357.     </VALUES>
  13358.     </REGISTRY>
  13359. <DANGER_LEVEL>1</DANGER_LEVEL>
  13360. <DESCRIPTION>Browser Helper Object known to cause pop up advertisements.</DESCRIPTION>
  13361. </SW>
  13362. <SW NAME="Backdoor.Zinx">
  13363.     <DIRECTORIES>
  13364.     </DIRECTORIES>
  13365.     <FILES>
  13366.         <FILE NAME="msrege.exe" PATH="WinDir"></FILE>
  13367.     </FILES>
  13368.     <COOKIES>
  13369.     </COOKIES>
  13370.     <REGISTRY>
  13371.        <KEYS>
  13372.        </KEYS>
  13373.        <VALUES>
  13374.            <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="msreg.exe"></REGVALUE>
  13375.        </VALUES>
  13376.     </REGISTRY>
  13377. <DANGER_LEVEL>2</DANGER_LEVEL>
  13378. <DESCRIPTION>Worm that allows hackers unauthorized access to your PC.</DESCRIPTION>
  13379. </SW>
  13380. <SW NAME="CoolWebSearch.sys">
  13381.     <DIRECTORIES>
  13382.     </DIRECTORIES>
  13383.     <FILES>
  13384.         <FILE NAME="sys.reg" PATH="WinDir"></FILE>
  13385.         <FILE NAME="mupdate.exe" PATH="WinDir"></FILE>
  13386.     </FILES>
  13387.     <REGISTRY>
  13388.         <KEYS>
  13389.         </KEYS>
  13390.         <VALUES>
  13391.         </VALUES>
  13392.     </REGISTRY>
  13393. <DANGER_LEVEL>2</DANGER_LEVEL>
  13394. <DESCRIPTION>Wide range of different browser hijackers</DESCRIPTION>
  13395. </SW>
  13396. <SW NAME="Downloader.Psyme"> 
  13397.    <DIRECTORIES>
  13398.    </DIRECTORIES>
  13399.    <FILES>
  13400.       <FILE NAME="m.exe" PATH="WinDir"></FILE>
  13401.       <FILE NAME="mp.exe" PATH="WinDir"></FILE>
  13402.       <FILE NAME="dp.exe" PATH="WinDir"></FILE>
  13403.    </FILES>
  13404.    <COOKIES>
  13405.    </COOKIES>
  13406.    <REGISTRY>
  13407.         <KEYS>
  13408.         </KEYS>
  13409.         <VALUES>
  13410.         </VALUES>
  13411.     </REGISTRY>
  13412.    <DANGER_LEVEL>2</DANGER_LEVEL>
  13413.    <DESCRIPTION>Trojan horse that is known to download and execute a file.</DESCRIPTION>
  13414. </SW>
  13415. <SW NAME="Dubolom.com">
  13416.    <DIRECTORIES>
  13417.    </DIRECTORIES>
  13418.    <FILES>
  13419.    </FILES>
  13420.    <COOKIES>
  13421.    </COOKIES>
  13422.    <REGISTRY>
  13423.     <KEYS>
  13424.     </KEYS>
  13425.     <VALUES>
  13426.       <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="svchost.exe"></REGVALUE>
  13427.       <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="olehelp.exe"></REGVALUE>
  13428.     </VALUES>
  13429. </REGISTRY>
  13430.    <DANGER_LEVEL>1</DANGER_LEVEL>
  13431.    <DESCRIPTION>This HiJack's the Home page to Dubolom.com or My-Find.com.</DESCRIPTION>
  13432. </SW>
  13433. <SW NAME="Gigex SpeedDelivery">
  13434.    <DIRECTORIES>
  13435.    </DIRECTORIES>
  13436.    <FILES>
  13437.       <FILE NAME="gigexagent.dl" PATH="WinDir\\downloaded program files"></FILE>
  13438.    </FILES>
  13439.    <COOKIES>
  13440.    </COOKIES>
  13441.    <REGISTRY>
  13442.     <KEYS>
  13443.       <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{6d5fcfcb-fa6c-4cfb-9918-5f0a9f7365f2}"></REGKEY>
  13444.       <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="clsid" VALUE="{a7798d6c-c6b5-4f26-9363-f7cdbbffa607}"></REGKEY>
  13445.       <REGKEY MAIN="HKEY_CLASSES_ROOT" SUB="interface" VALUE="{c3b2b2af-e11c-4ec5-a9ac-6189992758d8}"></REGKEY>
  13446.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\moduleusage" VALUE="c:/windows/downloaded program files/gigexagent.dll"></REGKEY>
  13447.     </KEYS>
  13448.     <VALUES>
  13449.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\shareddlls" VALUE="c:\\windows\\downloaded program files\\gigexagent.dll"></REGVALUE>
  13450.       <REGVALUE MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="gigexagent.gigexctrl"></REGVALUE>
  13451.       <REGVALUE MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="gigexagent.gigexctrl.1"></REGVALUE>
  13452.       <REGVALUE MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="vxpspeeddelivery.download.1"></REGVALUE>
  13453.       <REGVALUE MAIN="HKEY_CLASSES_ROOT" SUB="" VALUE="vxpspeeddelivery.download"></REGVALUE>
  13454.     </VALUES>
  13455.     </REGISTRY>
  13456.    <DANGER_LEVEL>1</DANGER_LEVEL>
  13457.    <DESCRIPTION>Download manager known to report activity to a central server</DESCRIPTION>
  13458. </SW>
  13459. <SW NAME="IEFEATS.A"> 
  13460.    <DIRECTORIES>
  13461.    </DIRECTORIES>
  13462.    <FILES>
  13463.       <FILE NAME="IEFEATSL.DLL" PATH="WinDir"></FILE>
  13464.       <FILE NAME="MSIESH.DLL" PATH="WinDir"></FILE>
  13465.       <FILE NAME="SUBMITHOOK.DLL" PATH="WinDir"></FILE>
  13466.       <FILE NAME="UNINSTALL.EXE" PATH="WinDir"></FILE>
  13467.       <FILE NAME="UNINSTALL.INI" PATH="WinDir"></FILE>
  13468.       <FILE NAME="MSHP.DLL" PATH="WinDir"></FILE>
  13469.    </FILES>
  13470.    <COOKIES>
  13471.    </COOKIES>
  13472.    <REGISTRY>
  13473.     <KEYS>
  13474.     </KEYS>
  13475.     <VALUES>
  13476.       <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="Software\\Microsoft\\Windows\\Current Version\\Runonce" VALUE="iefeats1Update"></REGVALUE>
  13477.     </VALUES>
  13478. </REGISTRY>
  13479.    <DANGER_LEVEL>1</DANGER_LEVEL>
  13480.    <DESCRIPTION>It's a Hijacker that will reset your internet explorer settings</DESCRIPTION>
  13481. </SW>
  13482. <SW NAME="MSBLAST.D"> 
  13483.    <DIRECTORIES>
  13484.    </DIRECTORIES>
  13485.    <FILES>
  13486.       <FILE NAME="Dllhost.exe" PATH="Sys32Dir\\Wins"></FILE>
  13487.       <FILE NAME="svchost.exe" PATH="Sys32Dir\\Wins"></FILE>
  13488.    </FILES>
  13489.    <COOKIES>
  13490.    </COOKIES>
  13491.    <REGISTRY>
  13492.     <KEYS>
  13493.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SYSTEM\\CurrentControlSet\\Services" VALUE="RpcPatch"></REGKEY>
  13494.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SYSTEM\\CurrentControlSet\\Services" VALUE="RpcTftpd"></REGKEY>
  13495.     </KEYS>
  13496.     <VALUES>
  13497.     </VALUES>
  13498. </REGISTRY>
  13499. <DANGER_LEVEL>2</DANGER_LEVEL>
  13500. <DESCRIPTION>MSblaster worm widely spread through networks on the internet</DESCRIPTION>
  13501. </SW>
  13502. <SW NAME="Trojan.Adclicker/W32.Adclicker.E.Trojan/TrojanClicker.Win32.Qupdate">
  13503.    <DIRECTORIES>
  13504.    </DIRECTORIES>
  13505.    <FILES>
  13506.       <FILE NAME="QUpdate.exe" PATH="SysDir"></FILE>
  13507.       <FILE NAME="QUpdate.exe" PATH="Sys32Dir"></FILE>
  13508.    </FILES>
  13509.    <COOKIES>
  13510.    </COOKIES>
  13511.    <REGISTRY>
  13512.     <KEYS>
  13513.     </KEYS>
  13514.     <VALUES>
  13515.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Load"></REGVALUE>
  13516.     </VALUES>
  13517.    </REGISTRY>
  13518.    <DANGER_LEVEL>2</DANGER_LEVEL>
  13519.    <DESCRIPTION>Trojan horse that uses your system resources to send traffic to a predetermined web address</DESCRIPTION>
  13520. </SW>
  13521. <SW NAME="W32.HLLW.Gaobot.AA">
  13522.     <DIRECTORIES>
  13523.     </DIRECTORIES>
  13524.     <FILES>
  13525.         <FILE NAME="Svchosl.exe" PATH="SysDir"></FILE>
  13526.         <FILE NAME="Svchosl.exe" PATH="Sys32Dir"></FILE>
  13527.         <FILE NAME="Winhl32.exe" PATH="SysDir"></FILE>
  13528.         <FILE NAME="Winhl32.exe" PATH="Sys32Dir"></FILE>
  13529.     </FILES>
  13530.     <REGISTRY>
  13531.         <VALUES>
  13532.         <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Config Loader"></REGVALUE> 
  13533.         <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="Config Loader"></REGVALUE> 
  13534.         </VALUES>
  13535.     </REGISTRY>
  13536.   <DANGER_LEVEL>2</DANGER_LEVEL>
  13537.   <DESCRIPTION>Attempts to spread through networks and allows hackers unauthorized access to your PC.</DESCRIPTION>
  13538. </SW>
  13539. <SW NAME="W32.HLLW.Gaobot.gen"> 
  13540.     <DIRECTORIES>
  13541.     </DIRECTORIES>
  13542.     <FILES>
  13543.         <FILE NAME="Csrrs.exe" PATH="SysDir"></FILE>
  13544.         <FILE NAME="Csrrs.exe" PATH="Sys32Dir"></FILE>
  13545.         <FILE NAME="Scvhost.exe" PATH="SysDir"></FILE>
  13546.         <FILE NAME="Scvhost.exe" PATH="Sys32Dir"></FILE>
  13547.         <FILE NAME="System.exe" PATH="SysDir"></FILE>
  13548.         <FILE NAME="System.exe" PATH="Sys32Dir"></FILE>
  13549.         <FILE NAME="explored.exe" PATH="SysDir"></FILE>
  13550.         <FILE NAME="explored.exe" PATH="Sys32Dir"></FILE>
  13551.         <FILE NAME="lms.exe" PATH="SysDir"></FILE>
  13552.         <FILE NAME="lms.exe" PATH="Sys32Dir"></FILE>
  13553.     </FILES>
  13554.     <REGISTRY>
  13555.         <KEYS>
  13556.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SYSTEM\\CurrentControlSet\\Services" VALUE="x4"></REGKEY>
  13557.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SYSTEM\\CurrentControlSet\\Services" VALUE="a3"></REGKEY>
  13558.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SYSTEM\\CurrentControlSet\\Services" VALUE="MpR"></REGKEY>
  13559.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SYSTEM\\ControlSet001\\Enum\\Root" VALUE="LEGACY_SOUNDMAN"></REGKEY>
  13560.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SYSTEM\\ControlSet001\\Services" VALUE="SoundMan"></REGKEY>
  13561.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SYSTEM\\CurrentControlSet\\Enum\\Root" VALUE="LEGACY_SOUNDMAN"></REGKEY>
  13562.         <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SYSTEM\\CurrentControlSet\\Services" VALUE="SoundMan"></REGKEY>
  13563.         </KEYS>    
  13564.         <VALUES>
  13565.         <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Configuration Loader"></REGVALUE> 
  13566.         <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Windows Login"></REGVALUE>
  13567.         <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="Configuration Loader"></REGVALUE> 
  13568.         <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="Windows Login"></REGVALUE>
  13569.         <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="^`d}qZxu"></REGVALUE>
  13570.         <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="^`d}qZxu"></REGVALUE> 
  13571.         </VALUES>
  13572.     </REGISTRY>
  13573.   <DANGER_LEVEL>2</DANGER_LEVEL>
  13574.   <DESCRIPTION>Attempts to spread through networks and allows hackers unauthorized access to your PC.</DESCRIPTION>
  13575. </SW>
  13576. <SW NAME="w32.Randex.gen"> 
  13577.     <DIRECTORIES>
  13578.     </DIRECTORIES>
  13579.     <FILES>
  13580.         <FILE NAME="msnv32.exe" PATH="Sys32Dir"></FILE>
  13581.         <FILE NAME="msnv32.exe" PATH="SysDir"></FILE>
  13582.         <FILE NAME="IRBMe.exe" PATH="SysDir"></FILE>
  13583.         <FILE NAME="IRBMe.exe" PATH="Sys32Dir"></FILE>
  13584.         <FILE NAME="remove.bat" PATH="WinDir\\temp"></FILE>
  13585.     </FILES>
  13586.     <REGISTRY>
  13587.         <KEYS>
  13588.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="IRBMe Sucks!!"></REGKEY>
  13589.         </KEYS>
  13590.         <VALUES>
  13591.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="IRBMe Sucks!!"></REGVALUE> 
  13592.         </VALUES>
  13593.     </REGISTRY>
  13594.    <DANGER_LEVEL>2</DANGER_LEVEL>
  13595.    <DESCRIPTION>Worm that is spread using networks</DESCRIPTION>
  13596. </SW>
  13597. <SW NAME="Win32.Jeefo.A"> 
  13598.    <DIRECTORIES>
  13599.    </DIRECTORIES>
  13600.    <FILES>
  13601.    </FILES>
  13602.    <COOKIES>
  13603.    </COOKIES>
  13604.    <REGISTRY>
  13605.     <KEYS>
  13606.     </KEYS>
  13607.     <VALUES>
  13608.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\\PowerManager" VALUE="C:\\Windows\\SVCHOST.EXE"></REGVALUE>
  13609.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\\PowerManager" VALUE="C:\\Winnt\\\\SVCHOST.EXE"></REGVALUE>
  13610.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\\Power Manager" VALUE="C:\\Winnt\\\\SVCHOST.EXE"></REGVALUE>
  13611.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="System\\CurrentControlSet\\Services\\PowerManager\\ImagePath" VALUE="C:\\Windows\\svchost.exe"></REGVALUE>
  13612.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="System\\CurrentControlSet\\Services\\PowerManager\\ImagePath" VALUE="C:\\Winnt\\svchost.exe"></REGVALUE>
  13613.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="System\\CurrentControlSet\\Services\\Power Manager\\ImagePath" VALUE="C:\\Winnt\\svchost.exe"></REGVALUE>
  13614.     </VALUES>
  13615. </REGISTRY>
  13616.    <DANGER_LEVEL>2</DANGER_LEVEL>
  13617.    <DESCRIPTION>Worm that is spread using networks</DESCRIPTION>
  13618. </SW>
  13619. <SW NAME="WORM_OPASERV.T">
  13620.     <DIRECTORIES>
  13621.     </DIRECTORIES>
  13622.     <FILES>
  13623.         <FILE NAME="IASHLPR.EXE" PATH="WinDir"></FILE>
  13624.         <FILE NAME="MPREXE.EXE" PATH="WinDir"></FILE>
  13625.         <FILE NAME="scr.scr" PATH="SysDir"></FILE>
  13626.         <FILE NAME="scr.scr" PATH="Sys32Dir"></FILE>
  13627.         <FILE NAME="BIOS1.EXE" PATH="WinDir"></FILE>
  13628.         <FILE NAME="Winsrv.EXE" PATH="WinDir"></FILE>
  13629.         <FILE NAME="CLICONFG.EXE" PATH="WinDir"></FILE>
  13630.         <FILE NAME="ACTIVEDS.EXE" PATH="WinDir"></FILE>
  13631.     </FILES>
  13632.     <REGISTRY>
  13633.         <VALUES>
  13634.         <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="IASHLPR"></REGVALUE> 
  13635.         <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="FONTVIEW"></REGVALUE>
  13636.         <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="MPREXE"></REGVALUE>
  13637.         <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Scr"></REGVALUE>
  13638.         <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="BIOS1"></REGVALUE>
  13639.         <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Winsrv"></REGVALUE>
  13640.         <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="CLICONFG"></REGVALUE>
  13641.         <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="LoadManager"></REGVALUE>
  13642.         <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="ACTIVEDS"></REGVALUE>
  13643.         </VALUES>
  13644.     </REGISTRY>
  13645.     <DANGER_LEVEL>1</DANGER_LEVEL>
  13646.     <DESCRIPTION>Worm spread using networks</DESCRIPTION>
  13647. </SW>
  13648. <SW NAME="Mirar Toolbar.winnb40">
  13649.    <DIRECTORIES>
  13650.    </DIRECTORIES>
  13651.    <FILES>
  13652.    </FILES>
  13653.    <COOKIES>
  13654.    </COOKIES>
  13655.    <REGISTRY>
  13656.     <KEYS>
  13657.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{159471E5-F30C-434F-A0AB-73BD7D4487BF}"></REGKEY>
  13658.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{159471E5-F30C-434F-A0AB-73BD7D4487BF}"></REGKEY>
  13659.     </KEYS>
  13660.     <VALUES>
  13661.         <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{159471E5-F30C-434F-A0AB-73BD7D4487BF}"></REGVALUE>
  13662.         <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{159471E5-F30C-434F-A0AB-73BD7D4487BF}"></REGVALUE>
  13663.       <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar\\WebBrowser" VALUE="{159471E5-F30C-434F-A0AB-73BD7D4487BF}"></REGVALUE>
  13664.     </VALUES>
  13665.     </REGISTRY>
  13666.     <DANGER_LEVEL>2</DANGER_LEVEL>
  13667.     <DESCRIPTION>Mirar Toolbar is a toolbar addon for internet explorer.  It has the ability to hide, and then re-emerge, making removal difficult and very annoying</DESCRIPTION>
  13668. </SW>
  13669. <SW NAME="Mirar Toolbar.winnb41">
  13670.    <DIRECTORIES>
  13671.    </DIRECTORIES>
  13672.    <FILES>
  13673.    </FILES>
  13674.    <COOKIES>
  13675.    </COOKIES>
  13676.    <REGISTRY>
  13677.     <KEYS>
  13678.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{5FE0B6C9-F5C1-458E-91B3-0E5358B2F02F}"></REGKEY>
  13679.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{5FE0B6C8-F5C1-458E-91B3-0E5358B2F02F}"></REGKEY>
  13680.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="5FE0B6C9-F5C1-458E-91B3-0E5358B2F02F}"></REGKEY>
  13681.     </KEYS>
  13682.     <VALUES>
  13683.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{5FE0B6C8-F5C1-458E-91B3-0E5358B2F02F}"></REGVALUE>
  13684.     </VALUES>
  13685. </REGISTRY>
  13686.     <DANGER_LEVEL>2</DANGER_LEVEL>
  13687.     <DESCRIPTION>Mirar Toolbar is a toolbar addon for internet explorer.  It has the ability to hide, and then re-emerge, making removal difficult and very annoying</DESCRIPTION>
  13688. </SW>
  13689. <SW NAME="Mirar Toolbar.winnb42">
  13690.    <DIRECTORIES>
  13691.    </DIRECTORIES>
  13692.    <FILES>
  13693.    </FILES>
  13694.    <COOKIES>
  13695.    </COOKIES>
  13696.    <REGISTRY>
  13697.     <KEYS>
  13698.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{97852E81-5BE4-4F90-B24F-0947E44761A2}"></REGKEY>
  13699.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{97852E80-5BE4-4F90-B24F-0947E44761A2}"></REGKEY>
  13700.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{97852E81-5BE4-4F90-B24F-0947E44761A2}"></REGKEY>
  13701.     </KEYS>
  13702.     <VALUES>
  13703.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{97852E80-5BE4-4F90-B24F-0947E44761A2}"></REGVALUE>
  13704.     </VALUES>
  13705. </REGISTRY>
  13706.     <DANGER_LEVEL>2</DANGER_LEVEL>
  13707.     <DESCRIPTION>Mirar Toolbar is a toolbar addon for internet explorer.  It has the ability to hide, and then re-emerge, making removal difficult and very annoying</DESCRIPTION>
  13708. </SW>
  13709. <SW NAME="Mirar Toolbar.winnb51">
  13710.    <DIRECTORIES>
  13711.    </DIRECTORIES>
  13712.    <FILES>
  13713.       <FILE NAME="WinDmy.dll" PATH="SysDir"></FILE>
  13714.       <FILE NAME="WinDmy.dll" PATH="Sys32Dir"></FILE>
  13715.    </FILES>
  13716.    <COOKIES>
  13717.    </COOKIES>
  13718.    <REGISTRY>
  13719.     <KEYS>
  13720.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{9A9C9B69-F908-4AAB-8D0C-10EA8997F37E}"></REGKEY>
  13721.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}"></REGKEY>
  13722.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{9A9C9B69-F908-4AAB-8D0C-10EA8997F37E}"></REGKEY>
  13723.     </KEYS>
  13724.     <VALUES>
  13725.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Internet Explorer\\Toolbar" VALUE="{9A9C9B68-F908-4AAB-8D0C-10EA8997F37E}"></REGVALUE>
  13726.     </VALUES>
  13727. </REGISTRY>
  13728.     <DANGER_LEVEL>2</DANGER_LEVEL>
  13729.     <DESCRIPTION>Mirar Toolbar is a toolbar addon for internet explorer.  It has the ability to hide, and then re-emerge, making removal difficult and very annoying</DESCRIPTION>
  13730. </SW>
  13731. <SW NAME="Backdoor.Autoupder"> 
  13732.    <DIRECTORIES>
  13733.    </DIRECTORIES>
  13734.    <FILES>
  13735.       <FILE NAME="Ausvc.exe" PATH="WinDir"></FILE>
  13736.       <FILE NAME="Bvt.exe" PATH="WinDir"></FILE>
  13737.       <FILE NAME="Mnsvc.exe" PATH="WinDir"></FILE>
  13738.       <FILE NAME="Absr.exe" PATH="WinDir"></FILE>
  13739.    </FILES>
  13740.    <COOKIES>
  13741.    </COOKIES>
  13742.    <REGISTRY>
  13743.     <KEYS>
  13744.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\CLSID" VALUE="{6541B981-2E27-46B1-A2CC-8264A75B74FE}"></REGKEY>
  13745.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\CLSID" VALUE="{868B015F-3515-44DB-B0AD-182CD058985E}"></REGKEY>
  13746.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\CLSID" VALUE="{9A05FE9B-5B52-4D13-A77D-FA7C38557A8E}"></REGKEY>
  13747.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\CLSID" VALUE="{BAE85C97-2CD4-45C3-A1ED-E4CEF7C6AA52}"></REGKEY>
  13748.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\CLSID" VALUE="{C76BE992-2BC3-41A4-8B87-A8C01FE419A7}"></REGKEY>
  13749.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\CLSID" VALUE="{FBE091E5-DF43-4FFB-AECC-7E3A3BC7B0D9}"></REGKEY>
  13750.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\CLSID" VALUE="{F53C844A-D9C8-4E92-B923-C05B46C4A7E3}"></REGKEY>
  13751.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\AppID" VALUE="{8B034058-08B0-4CB3-B2E8-60238B4967F2}"></REGKEY>
  13752.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\CLASSES\\TypeLib" VALUE="{6D8B1B74-4AB8-473B-B479-253FA1936802}"></REGKEY>
  13753.     </KEYS>
  13754.     <VALUES>
  13755.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="SysScan"></REGVALUE>
  13756.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="ausvc"></REGVALUE>
  13757.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="ABsr"></REGVALUE>
  13758.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="mnsvc"></REGVALUE>
  13759.     </VALUES>
  13760. </REGISTRY>
  13761.    <DANGER_LEVEL>1</DANGER_LEVEL>
  13762.    <DESCRIPTION>Backdoor program that could be used to download additional malicious programs</DESCRIPTION>
  13763. </SW>
  13764. <SW NAME="W32.Backdoor.Nibu">
  13765.    <DIRECTORIES>
  13766.    </DIRECTORIES>
  13767.    <FILES>
  13768.       <FILE NAME="swchost.exe" PATH="SysDir"></FILE>
  13769.       <FILE NAME="netda.exe" PATH="SysDir"></FILE>
  13770.       <FILE NAME="load32.exe" PATH="SysDir"></FILE>
  13771.       <FILE NAME="Vxdmgr32.exe" PATH="SysDir"></FILE>
  13772.       <FILE NAME="swchost.exe" PATH="Sys32Dir"></FILE>
  13773.       <FILE NAME="netda.exe" PATH="Sys32Dir"></FILE>
  13774.       <FILE NAME="load32.exe" PATH="Sys32Dir"></FILE>
  13775.       <FILE NAME="Vxdmgr32.exe" PATH="Sys32Dir"></FILE>
  13776.       <FILE NAME="Rundllw.exe" PATH="SysStartup"></FILE>
  13777.       <FILE NAME="Dllreg.exe" PATH="WinDir"></FILE>
  13778.       <FILE NAME="Windrive.exe" PATH="WinDir"></FILE>
  13779.       <FILE NAME="Guid32.dll" PATH="WinDir"></FILE>
  13780.    </FILES>
  13781.    <COOKIES>
  13782.    </COOKIES>
  13783.    <REGISTRY>
  13784.     <KEYS>
  13785.     </KEYS>
  13786.     <VALUES>
  13787.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="load32"></REGVALUE>
  13788.     </VALUES>
  13789. </REGISTRY>
  13790.    <DANGER_LEVEL>2</DANGER_LEVEL>
  13791.    <DESCRIPTION>Trojan horse that allows unauthorized persons access to your PC</DESCRIPTION>
  13792. </SW>
  13793. <SW NAME="W32.Naco.C@mm/ W32/Naco.d@MM">
  13794.    <DIRECTORIES>
  13795.    </DIRECTORIES>
  13796.    <FILES>
  13797.       <FILE NAME="ANACON32.EXE" PATH="SysDir"></FILE>
  13798.       <FILE NAME="ANACON32.EXE" PATH="Sys32Dir"></FILE>
  13799.    </FILES>
  13800.    <COOKIES>
  13801.    </COOKIES>
  13802.    <REGISTRY>
  13803.     <KEYS>
  13804.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SYSTEM\\CurrentControlSet\\Services\\lanmanserver\\Shares" VALUE="HACKERz"></REGKEY>
  13805.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SYSTEM\\ControlSet001\\Services\\lanmanserver\\Shares" VALUE="HACKERz"></REGKEY>
  13806.       <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SYSTEM\\ControlSet002\\Services\\lanmanserver\\Shares" VALUE="HACKERz"></REGKEY>
  13807.     </KEYS>
  13808.     <VALUES>
  13809.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="ALM"></REGVALUE>
  13810.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="SysAnacon32"></REGVALUE>
  13811.       <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="Services"></REGVALUE>
  13812.       <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="Under20"></REGVALUE>
  13813.       <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Mirabilis\\ICQ\\Agent\\Apps\\Administrator" VALUE="Enable"></REGVALUE>
  13814.       <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Mirabilis\\ICQ\\Agent\\Apps\\Administrator" VALUE="Parameters"></REGVALUE>
  13815.       <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Mirabilis\\ICQ\\Agent\\Apps\\Administrator" VALUE="Path"></REGVALUE>
  13816.       <REGVALUE MAIN="HKEY_CURRENT_USER" SUB="SOFTWARE\\Mirabilis\\ICQ\\Agent\\Apps\\Administrator" VALUE="Startup"></REGVALUE>
  13817.     </VALUES>
  13818. </REGISTRY>
  13819.    <DANGER_LEVEL>2</DANGER_LEVEL>
  13820.    <DESCRIPTION>Mass mailing worm that will spread itself using your email addresses and slow down your PC.</DESCRIPTION>
  13821. </SW>
  13822. <SW NAME="Bubba.wintools or Adware-WinTools"> 
  13823.      <DIRECTORIES>
  13824.         <DIR NAME="WinTools" PATH="PFDir\\Common files"></DIR>
  13825.      </DIRECTORIES>
  13826.      <FILES>
  13827.          <FILE NAME="WToolsA.exe" PATH="PFDir\\Common files\\WinTools"></FILE>
  13828.         <FILE NAME="WSup.exe" PATH="PFDir\\Common files\\WinTools"></FILE>
  13829.         <FILE NAME="WToolsS.exe" PATH="PFDir\\Common files\\WinTools"></FILE>
  13830.         <FILE NAME="WToolsB.dll" PATH="PFDir\\Common files\\WinTools"></FILE>
  13831.         </FILES>
  13832.      <COOKIES>
  13833.      </COOKIES>
  13834.      <REGISTRY>
  13835.         <KEYS>
  13836.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Classes\\CLSID" VALUE="{87766247-311C-43B4-8499-3D5FEC94A183}"></REGKEY>
  13837.             <REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects" VALUE="{87766247-311C-43B4-8499-3D5FEC94A183}"></REGKEY>
  13838.         </KEYS>
  13839.         <VALUES>
  13840.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="WinTools"></REGVALUE>
  13841.             <REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunServices" VALUE="WinTools"></REGVALUE>
  13842.         </VALUES>
  13843.      </REGISTRY>
  13844.    <DANGER_LEVEL>1</DANGER_LEVEL>
  13845.    <DESCRIPTION>Believed to be associated with adware and spyware installation mechanisms.</DESCRIPTION>
  13846. </SW>
  13847. <SW NAME="Worm.P2P.SpyBot.gen/webtoolmaster/zymola 1">
  13848.    <DIRECTORIES>
  13849.    </DIRECTORIES>
  13850.    <FILES>
  13851.       <FILE NAME="19f80cf346d09aecf6c6b7c3aeaf2d52.exe" PATH=""></FILE>
  13852.       <FILE NAME="35db5fddecf94e788b413de0c6c0d711.exe" PATH=""></FILE>
  13853.       <FILE NAME="4e1fd18f867070053583a46fa448d698.exe" PATH=""></FILE>
  13854.       <FILE NAME="892f7e4df6639c1b68efe0aef02fa5cc.exe" PATH=""></FILE>
  13855.       <FILE NAME="e4785b269ae24f3ccc5991c18a345672.exe" PATH=""></FILE>
  13856.       <FILE NAME="fa40b88c3ef5a84c54faf8871b9e419f.exe" PATH=""></FILE>
  13857.       <FILE NAME="worm.p2p.spybot.gen.exe" PATH=""></FILE>
  13858.       <FILE NAME="worm.p2p.spybot.gen[2].exe" PATH=""></FILE>
  13859.       <FILE NAME="worm.p2p.spybot.gen[3].exe" PATH=""></FILE>
  13860.       <FILE NAME="worm.p2p.spybot.gen[5].exe" PATH=""></FILE>
  13861.       <FILE NAME="worm.p2p.spybot.gen_(56).exe" PATH=""></FILE>
  13862.       <FILE NAME="worm.p2p.spybot.gen_(92).exe" PATH=""></FILE>
  13863.    </FILES>
  13864.    <COOKIES>
  13865.    </COOKIES>
  13866.    <REGISTRY>
  13867.         <KEYS>
  13868.         </KEYS>
  13869.         <VALUES>
  13870.         </VALUES>
  13871.     </REGISTRY>    
  13872.    <DANGER_LEVEL>2</DANGER_LEVEL>
  13873.    <DESCRIPTION>Trojan horse that allows unauthorized persons access to your PC</DESCRIPTION>
  13874. </SW>
  13875. <SW NAME="Worm.P2P.Spybot">
  13876.    <DIRECTORIES>
  13877.    </DIRECTORIES>
  13878.    <FILES>
  13879.       <FILE NAME="c5f33afa0c8e4f1d55584fb2c69dbe44.exe" PATH=""></FILE>
  13880.       <FILE NAME="e389043030e9c8ef75b5885911cb6518.exe" PATH=""></FILE>
  13881.       <FILE NAME="worm.p2p.spybot.a.exe" PATH=""></FILE>
  13882.       <FILE NAME="worm.p2p.spybot.aa.exe" PATH=""></FILE>
  13883.       <FILE NAME="worm.p2p.spybot.ab.exe" PATH=""></FILE>
  13884.       <FILE NAME="worm.p2p.spybot.ag.exe" PATH=""></FILE>
  13885.       <FILE NAME="worm.p2p.spybot.am.exe" PATH=""></FILE>
  13886.       <FILE NAME="worm.p2p.spybot.ao.exe" PATH=""></FILE>
  13887.       <FILE NAME="worm.p2p.spybot.au.exe" PATH=""></FILE>
  13888.       <FILE NAME="worm.p2p.spybot.ax.exe" PATH=""></FILE>
  13889.       <FILE NAME="worm.p2p.spybot.bm.exe" PATH=""></FILE>
  13890.       <FILE NAME="worm.p2p.spybot.bn.exe" PATH=""></FILE>
  13891.       <FILE NAME="worm.p2p.spybot.ce.exe" PATH=""></FILE>
  13892.       <FILE NAME="worm.p2p.spybot.ch.exe" PATH=""></FILE>
  13893.       <FILE NAME="worm.p2p.spybot.cj.exe" PATH=""></FILE>
  13894.       <FILE NAME="worm.p2p.spybot.cy.exe" PATH=""></FILE>
  13895.       <FILE NAME="worm.p2p.spybot.d.exe" PATH=""></FILE>
  13896.       <FILE NAME="worm.p2p.spybot.dl.exe" PATH=""></FILE>
  13897.       <FILE NAME="worm.p2p.spybot.f.exe" PATH=""></FILE>
  13898.       <FILE NAME="worm.p2p.spybot.j.exe" PATH=""></FILE>
  13899.       <FILE NAME="worm.p2p.spybot.k.exe" PATH=""></FILE>
  13900.       <FILE NAME="worm.p2p.spybot.m.exe" PATH=""></FILE>
  13901.       <FILE NAME="worm.p2p.spybot.n.exe" PATH=""></FILE>
  13902.       <FILE NAME="worm.p2p.spybot.s.exe" PATH=""></FILE>
  13903.    </FILES>
  13904.    <COOKIES>
  13905.    </COOKIES>
  13906.    <REGISTRY>
  13907.         <KEYS>
  13908.         </KEYS>
  13909.         <VALUES>
  13910.         </VALUES>
  13911.     </REGISTRY>
  13912.    <DANGER_LEVEL>2</DANGER_LEVEL>
  13913.    <DESCRIPTION>Trojan horse that allows unauthorized persons access to your PC</DESCRIPTION>
  13914. </SW>
  13915. </NA>