<DESCRIPTION>7FaSSt is an IE toolbar which attaches to your browser. It further tracks your behavior through the use of cookies, and a unique user ID is assigned to you specifically to track your browsing</DESCRIPTION>
<DESCRIPTION>AdultChat dialer is a dialer program that dials a very expensive number to access pornography, many times without user's knowledge</DESCRIPTION>
<DESCRIPTION>Adult-Links is adware that modifies your search options, adds a browser toolbar, and monitors your browsing activity. Almost exclusively delivers adult themed popups and annoyances</DESCRIPTION>
<DESCRIPTION>ASpam is a trojan that allows a remote attacker user level access on your machine, allowing them to delete/access anything they wish</DESCRIPTION>
<DESCRIPTION>Aureate is installed completely without user permission. It causes your operating system to be unstable, delivers ads, and causes general system annoyances</DESCRIPTION>
<DESCRIPTION>BargainBuddy delivers ads, as well as silently updates itself. Causes general system instability as well as internet connectivity issues, as it is constantly connecting to its host PCs</DESCRIPTION>
<DESCRIPTION>CashToolbar delivers advertisements to the PC without permission, and adds a toolbar to your browser. It also silent updates itself with a running process in the background of the infected PC</DESCRIPTION>
<DESCRIPTION>ClickTheButton will detect if you visit a known shopping site, and instead provide links to other sites connected to Clickthebutton</DESCRIPTION>
</SW>
<SW NAME="CnsMin">
<DIRECTORIES>
</DIRECTORIES>
<FILES>
<FILE NAME="Bdhelper.dll" PATH="SysDir"></FILE>
<FILE NAME="Bdhelper.dll" PATH="Sys32Dir"></FILE>
<FILE NAME="CnsMin.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
<FILE NAME="CnsDel.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
<DESCRIPTION>CnsMin is aimed at stealing sponsored keyword listings, but is also focused on Chinese speakers using Chinese characters, which makes it that much more annoying to non Chinese speaking users</DESCRIPTION>
<DESCRIPTION>DownloadReceiver will install components without user permission. It also adds an advertising process at startup, which runs in the background of the PC</DESCRIPTION>
<DESCRIPTION>DownloadWare will cause general system instability, and install software that allows Downloadware to excecute arbitrary code on the PC</DESCRIPTION>
<DESCRIPTION>FavoriteMan will install programs without user permission, as well as add entries to browser favorites menu and add desktop icons</DESCRIPTION>
<DESCRIPTION>Gratisware will deliver popup advertisements to the PC, as well as track certain browsing habits and report them back to a central server</DESCRIPTION>
<DESCRIPTION>HotBar is a toolbar that attaches to the browser. Once installed, it delivers popup ads, and is known to significantly decrease both system and browser speed</DESCRIPTION>
<DESCRIPTION>HuntBar is known to attach a toolbar to the browser, as well as snoop on browsing activity, and silently update without user interaction</DESCRIPTION>
<DESCRIPTION>Mirar Toolbar is a toolbar addon for internet explorer. It has the ability to hide, and then re-emerge, making removal difficult and very annoying</DESCRIPTION>
<DESCRIPTION>Wazam is a browser addon that provides certain search features, but stays resident in the background and hides itself from the user</DESCRIPTION>
<DESCRIPTION>Timesink will display pop up ads, including full screen flashing pop up ads. It might also record your web browser history, and other personal information</DESCRIPTION>
<DESCRIPTION>Benjamin Kazaa is a worm spread through the kazaa sharing service. Once infected, the worm does several very harmful things to the PC, including replicating itself up to 2000 times</DESCRIPTION>
</SW>
<SW NAME="Kazaa">
<DIRECTORIES>
<DIR NAME="kazaa media desktop" PATH=""></DIR>
<DIR NAME="kazaa" PATH="PFDir"></DIR>
</DIRECTORIES>
<FILES>
<FILE NAME="kazaa media desktop.lnk" PATH=""></FILE>
<DESCRIPTION>The Klez Trojan is a trojan spread by mostly email, that in some cases, has actually removed all files on the infected computer</DESCRIPTION>
<DESCRIPTION>I-Lookup provides a search box as well as custom buttons added to the browser. It also adds bookmarks and hijacks browser settings</DESCRIPTION>
<DESCRIPTION>PerMedia is started at windows startup, has an auto-update feature, and a browser helper object that tampers with browser settings</DESCRIPTION>
</SW>
<SW NAME="X-Diver/BillByCall">
<DIRECTORIES>
</DIRECTORIES>
<FILES>
<FILE NAME="cax.dll" PATH=""></FILE>
<FILE NAME="cuwin32.exe" PATH=""></FILE>
<FILE NAME="x-diver.dun" PATH=""></FILE>
</FILES>
<COOKIES>
<COOKIE NAME="EOPS"></COOKIE>
</COOKIES>
<REGISTRY>
<KEYS>
</KEYS>
<VALUES>
</VALUES>
</REGISTRY>
<DANGER_LEVEL>2</DANGER_LEVEL>
<DESCRIPTION>X-Diver is a premium rate dialer, based out of Germany. It allows the PC to be connected to a high rate phone number without user interaction</DESCRIPTION>
<DESCRIPTION>Xupiter modifies your browser settings to contain their buttons, as well as automatically updating itself, it hijacks browser settings</DESCRIPTION>
</SW>
<SW NAME="OnlineDialer">
<DIRECTORIES>
<DIR NAME="OnlineDialer" PATH="PFDir"></DIR>
</DIRECTORIES>
<FILES>
<FILE NAME="MaConnect.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
<FILE NAME="eConnect.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
<FILE NAME="IEDialer.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
<FILE NAME="SunInfoConnect.dll" PATH="WinDir\\Downloaded Program Files"></FILE>
<FILE NAME="BelCallConnect.dll" PATH=""></FILE>
<FILE NAME="Loader class.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
<FILE NAME="eConn class.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
<FILE NAME="IELoaderCtl class.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
<FILE NAME="Download class.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
<FILE NAME="snConnect class.ocx" PATH="WinDir\\Downloaded Program Files"></FILE>
<DESCRIPTION>The Gator Advertising and Information Network, this is the company behind gator and the ads associated with GAIN related applications, known to produce popups</DESCRIPTION>
<DESCRIPTION>It is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning the hard drives and mapped drives.</DESCRIPTION>
<DESCRIPTION>It is a Browser Helper Object. A component that Internet Explorer will load whenever it starts, shares IE's memory context, can perform any action on the available windows and modules.</DESCRIPTION>
<DESCRIPTION>It is an encrypted worm virus written in VBScript language that is capable of infecting Windows 95/98/2000. This destructive virus is capable of sending a copy of itself through MSOutlook, MIRC, PIRCH and mapped network directories.</DESCRIPTION>
</SW>
<SW NAME="CoolSavings">
<DIRECTORIES>
</DIRECTORIES>
<FILES>
<FILE NAME="cpnmgr.dll" PATH="WinDir\\downloaded program files"></FILE>
<DESCRIPTION>It is a Hijacker that resets your browser's settings to point to other sites.</DESCRIPTION>
</SW>
<SW NAME="W32.Netsky.H@mm">
<DIRECTORIES>
</DIRECTORIES>
<FILES>
<FILE NAME="maja.exe" PATH="WinDir"></FILE>
</FILES>
<COOKIES>
</COOKIES>
<REGISTRY>
<KEYS>
</KEYS>
<VALUES>
</VALUES>
</REGISTRY>
<DANGER_LEVEL>1</DANGER_LEVEL>
<DESCRIPTION>It is a mass-mailing worm that uses its own SMTP engine to send itself to the email addresses it finds when scanning hard drives and mapped drives. </DESCRIPTION>
<DESCRIPTION>It employs a user's Internet connection in the background without their knowledge or explicit permission, and gathers/transmits info on the user, their machine, or their behavior.</DESCRIPTION>
</SW>
<SW NAME="I Love You">
<DIRECTORIES>
</DIRECTORIES>
<FILES>
<FILE NAME="iloveyou.txt" PATH=""></FILE>
<FILE NAME="iloveyou.vbs" PATH=""></FILE>
<FILE NAME="lovele~1.vbs" PATH=""></FILE>
<FILE NAME="vbs-mail.vbs" PATH=""></FILE>
<FILE NAME="_ilove~1.txt" PATH=""></FILE>
</FILES>
<COOKIES>
</COOKIES>
<REGISTRY>
<KEYS>
</KEYS>
<VALUES>
</VALUES>
</REGISTRY>
<DANGER_LEVEL>1</DANGER_LEVEL>
<DESCRIPTION>It is a Worm that propagates by attacking other machines and copying itself to them.It may replace files, but do not insert themselves into files (as viruses do).</DESCRIPTION>
</SW>
<SW NAME="MSBlast.b">
<DIRECTORIES>
</DIRECTORIES>
<FILES>
<FILE NAME="msblast.exe" PATH=""></FILE>
<FILE NAME="msblast_unpacked.exe" PATH=""></FILE>
</FILES>
<COOKIES>
</COOKIES>
<REGISTRY>
<KEYS>
</KEYS>
<VALUES>
<REGVALUE MAIN="HKEY_LOCAL_MACHINE" SUB="Software\\Microsoft\\Windows\\CurrentVersion\\Run" VALUE="windows auto update"></REGVALUE>
</VALUES>
</REGISTRY>
<DANGER_LEVEL>1</DANGER_LEVEL>
<DESCRIPTION>It is a Worm that propagates by attacking other machines and copying itself to them.It may replace files, but do not insert themselves into files (as viruses do).</DESCRIPTION>
</SW>
<SW NAME="W32.Spybot Worm">
<DIRECTORIES>
</DIRECTORIES>
<FILES>
</FILES>
<COOKIES>
</COOKIES>
<REGISTRY>
<KEYS>
</KEYS>
<VALUES>
</VALUES>
</REGISTRY>
<DANGER_LEVEL>1</DANGER_LEVEL>
<DESCRIPTION>It is a Worm that propagates by attacking other machines and copying itself to them.It may replace files, but do not insert themselves into files (as viruses do).</DESCRIPTION>
<DESCRIPTION>It is a Worm that propagates by attacking other machines and copying itself to them.It may replace files, but do not insert themselves into files (as viruses do).</DESCRIPTION>
<REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\code store database\\distribution units" VALUE="{26e8361f-bce7-4f75-a347-98c88b418322}"></REGKEY>
</KEYS>
<VALUES>
</VALUES>
</REGISTRY>
<DANGER_LEVEL>1</DANGER_LEVEL>
<DESCRIPTION>It is a Browser Helper Object. A component that Internet Explorer will load whenever it starts, shares IE's memory context, can perform any action on the available windows and modules.</DESCRIPTION>
<DESCRIPTION>This worm exploits the Windows LSASS vulnerability, which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of affected systems.</DESCRIPTION>
<DESCRIPTION>This worm exploits the Windows LSASS vulnerability, which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of affected systems.</DESCRIPTION>
<DESCRIPTION>This worm exploits the Windows LSASS vulnerability, which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of affected systems.</DESCRIPTION>
<DESCRIPTION>This worm exploits the Windows LSASS vulnerability, which is a buffer overrun that allows remote code execution and enables an attacker to gain full control of affected systems.</DESCRIPTION>
<DESCRIPTION>MSblaster worm widely spread through networks on the internet</DESCRIPTION>
</SW>
<SW NAME="W32.Mimail.J@mm">
<DIRECTORIES>
</DIRECTORIES>
<FILES>
<FILE NAME="svchost32.exe" PATH="WinDir"></FILE>
</FILES>
<COOKIES>
</COOKIES>
<REGISTRY>
<KEYS>
</KEYS>
<VALUES>
</VALUES>
</REGISTRY>
<DANGER_LEVEL>1</DANGER_LEVEL>
<DESCRIPTION>It is a mass mailing worms that attempts to steal credit card information.</DESCRIPTION>
</SW>
<SW NAME="I-Worm.Netsky">
<DIRECTORIES>
</DIRECTORIES>
<FILES>
<FILE NAME=".xx.pif" PATH=""></FILE>
<FILE NAME="i-worm.netsky.m.exe" PATH=""></FILE>
<FILE NAME="injection.htm.exe" PATH=""></FILE>
<FILE NAME="message.pif" PATH=""></FILE>
<FILE NAME="netsky[1].d.exe_" PATH=""></FILE>
<FILE NAME="netsky[1].e.exe_" PATH=""></FILE>
<FILE NAME="new_document1.pif" PATH=""></FILE>
<FILE NAME="your_archive.pif" PATH=""></FILE>
</FILES>
<COOKIES>
</COOKIES>
<REGISTRY>
<KEYS>
</KEYS>
<VALUES>
</VALUES>
</REGISTRY>
<DANGER_LEVEL>1</DANGER_LEVEL>
<DESCRIPTION>It is a Worm that propagates by attacking other machines and copying itself to them.It may replace files, but do not insert themselves into files (as viruses do).</DESCRIPTION>
</SW>
<SW NAME="GlobalNetcom">
<DIRECTORIES>
</DIRECTORIES>
<FILES>
<FILE NAME="culakkma.dll" PATH=""></FILE>
<FILE NAME="itstgblg.dll" PATH=""></FILE>
<FILE NAME="ntmccdds.dll" PATH=""></FILE>
<FILE NAME="qhgimxyy.dll" PATH=""></FILE>
</FILES>
<COOKIES>
</COOKIES>
<REGISTRY>
<KEYS>
<REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\code store database\\distribution units" VALUE="{00000000-cddc-0704-0b53-2c8830e9faec}"></REGKEY>
<REGKEY MAIN="HKEY_LOCAL_MACHINE" SUB="software\\microsoft\\windows\\currentversion\\moduleusage" VALUE="c:/windows/downloaded program files/ieloader.dll"></REGKEY>
</KEYS>
<VALUES>
</VALUES>
</REGISTRY>
<DANGER_LEVEL>1</DANGER_LEVEL>
<DESCRIPTION>An ActiveX installer for premium-rate phone diallers.Any web page can direct it to install arbitrary code downloaded from its home server.</DESCRIPTION>
<DESCRIPTION>It is a Browser Helper Object. A component that Internet Explorer will load whenever it starts, shares IE's memory context, can perform any action on the available windows and modules. </DESCRIPTION>
</SW>
<SW NAME="YellowPages">
<DIRECTORIES>
</DIRECTORIES>
<FILES>
<FILE NAME="Autosearch.dll" PATH=""></FILE>
</FILES>
<COOKIES>
</COOKIES>
<REGISTRY>
<KEYS>
</KEYS>
<VALUES>
</VALUES>
</REGISTRY>
<DANGER_LEVEL>1</DANGER_LEVEL>
<DESCRIPTION>It is an Adware that brings ads to your computer.</DESCRIPTION>
<DESCRIPTION>Mirar Toolbar is a toolbar addon for internet explorer. It has the ability to hide, and then re-emerge, making removal difficult and very annoying</DESCRIPTION>
<DESCRIPTION>Mirar Toolbar is a toolbar addon for internet explorer. It has the ability to hide, and then re-emerge, making removal difficult and very annoying</DESCRIPTION>
<DESCRIPTION>Mirar Toolbar is a toolbar addon for internet explorer. It has the ability to hide, and then re-emerge, making removal difficult and very annoying</DESCRIPTION>
<DESCRIPTION>Mirar Toolbar is a toolbar addon for internet explorer. It has the ability to hide, and then re-emerge, making removal difficult and very annoying</DESCRIPTION>
