home *** CD-ROM | disk | FTP | other *** search
/ Chip 2004 April / CMCD0404.ISO / Software / Demo / Panda / platinumisshuk.exe / QRV.KRN < prev    next >
Encoding:
INI File  |  2003-10-13  |  83.0 KB  |  1,797 lines
  1. [Version]
  2. MinVersion=2.6.3.0
  3. MaxVersion=2.8.0.0
  4. Version=01.14.4.0
  5.  
  6. [VirusInformation]
  7. W32/GIBE.C=W32/GIBE.C
  8. W32/SOBIG.F=W32/SOBIG.F
  9. W32/NACHI.A=W32/NACHI.A
  10. W32/BLASTER=W32/BLASTER
  11. W32/Sobig.B=W32/Sobig.B
  12. W32/Parite.B=W32/Parite.B
  13. W32/Fizzer=W32/Fizzer
  14. W32/Lovgate.F=W32/Lovgate.F
  15. W32/NiceHello=W32/NiceHello
  16. W32/Lovgate.C=W32/Lovgate.C
  17. VBS/Redlof=VBS/Redlof
  18. W32/Lirva=W32/Lirva
  19. W32/Datom=W32/Datom
  20. W32/Bride=W32/Bride
  21. W32/Opaserv=W32/Opaserv
  22. W32/Bugbear=W32/Bugbear
  23. W32/Frethem=W32/Frethem
  24. W32/Dadinu=W32/Dadinu,W32/Duni.worm
  25. W32/Lentin.E=W32/Lentin.E,W32/Yaha.E
  26. W32/Lentin=W32/Lentin,W32/Yaha
  27. W32/Stator=W32/Stator
  28. W32/Klez=W32/Klez
  29. W32/Reeezak.A=W32/Reeezak.A@mm,Keyluc,W32/Zacker.C,W32/Maldal.C@mm
  30. W32/Updater=W32/Updater
  31. W32/Goner.A=W32/Goner.A
  32. I-Worm/Happy=I-Worm/Happy
  33. W32/Qaz=W32/Qaz
  34. W32/MSInit.A=W32/MSInit.A
  35. W32/Badtrans=W32/Badtrans.B,W32/Badtrans@MM
  36. W32/Vote=Vote
  37. W32/Nimda=Nimda
  38. W32/SirCam=W32/SirCam@mm
  39. VBS/Help=VBS/HappyTime.A
  40. VBS/VBSWG.J=VBS/VBSWG.J,I-Worm/Lee.O
  41. W32/PrettyPark=I-Worm.PrettyPark
  42. I-Worm/MTX=I-Worm/MTX
  43. JS/Kak.Worm=VBS.KakWorm, Kagou-Anti-Frosoft, Wsript.Kak.A
  44. JS/Kak.Worm.B=VBS.KakWorm.B, Wsript.Kak.B, Days
  45. VBS/ShellScrap.Worm=VBS/ShellScrap.Worm
  46. I-Worm/Verona.B=BleBla.B, I-Worm-Blebla.B, Troj/Blebla.B, W32/BleBla@mm
  47. W32/Navidad=W32/Navidad
  48. W32/Navidad.B=W32/Navidad.B
  49. VBS/CoolNotepad.Worm=VBS/CoolNotepad.Worm
  50. VBS/LoveLetter=VBS/LoveLetter
  51. VBS/LoveLetter.AS=VBS/LoveLetter.AS
  52. VBS/LoveLetter.B=VBS/LoveLetter.B
  53. VBS/LoveLetter.C=VBS/LoveLetter.C
  54. VBS/LoveLetter.D=VBS/LoveLetter.D
  55. VBS/LoveLetter.E=VBS/LoveLetter.E
  56. VBS/LoveLetter.F=VBS/LoveLetter.F
  57. VBS/LoveLetter.G=VBS/LoveLetter.G
  58. VBS/LoveLetter.H=VBS/LoveLetter.H
  59. VBS/LoveLetter.I=VBS/LoveLetter.I
  60. VBS/LoveLetter.J=VBS/LoveLetter.J
  61. VBS/LoveLetter.K=VBS/LoveLetter.K
  62. VBS/LoveLetter.L=VBS/LoveLetter.L
  63. VBS/LoveLetter.M=VBS/LoveLetter.M
  64. VBS/LoveLetter.N=VBS/LoveLetter.N
  65. VBS/LoveLetter.O=VBS/LoveLetter.O
  66. VBS/LoveLetter.P=VBS/LoveLetter.P
  67. VBS/LoveLetter.Q=VBS/LoveLetter.Q
  68. VBS/LoveLetter.R=VBS/LoveLetter.R
  69. VBS/LoveLetter.S=VBS/LoveLetter.S
  70. VBS/LoveLetter.T=VBS/LoveLetter.T
  71. VBS/LoveLetter.U=VBS/LoveLetter.U
  72. VBS/LoveLetter.V=VBS/LoveLetter.V
  73. VBS/LoveLetter.W=VBS/LoveLetter.W
  74. VBS/LoveLetter.X=VBS/LoveLetter.X
  75. VBS/LoveLetter.Y=VBS/LoveLetter.Y
  76. VBS/LoveLetter.Z=VBS/LoveLetter.Z
  77. W32/FunLove=Win32_FLC, Win32.FLC, FLCSS
  78.  
  79. [VirusFamilies]
  80. F41=W32/GIBE.C
  81. F40=W32/SOBIG.F
  82. F39=W32/NACHI.A
  83. F38=BLASTER
  84. F37=Sobig.B
  85. F36=PARITE
  86. F35=FIZZER
  87. F34=NICEHELLO
  88. F33=LOVGATE
  89. F32=REDLOF
  90. F31=LIRVA
  91. F30=DATOM
  92. F29=BRIDE
  93. F28=BUGBEAR
  94. F27=OPASERV
  95. F26=FRETHEM
  96. F25=DADINU
  97. F24=LENTIN
  98. F23=STATOR
  99. F21=REEEZAK
  100. F20=UPDATER
  101. F19=GONER
  102. F18=HAPPY
  103. F17=QAZ
  104. F16=MSINIT
  105. F15=BADTRANS
  106. F14=KLEZ
  107. F13=VOTE
  108. F12=NIMDA
  109. F11=SIRCAM
  110. F07=FUNLOVE
  111. F09=ANNA KOURNIKOVA
  112. F03=COOL NOTEPAD
  113. F10=HELP
  114. F00=I LOVE YOU
  115. F01=KAK WORM
  116. F04=MATRIX
  117. F06=NAVIDAD
  118. F08=PRETTY PARK
  119. F02=SHELL SCRAP
  120. F05=VERONA
  121.  
  122.  
  123. [F41.Family]
  124. Name=W32/GIVE.C
  125.  
  126. [F40.Family]
  127. Name=W32/SOBIG.F
  128.  
  129. [F39.Family]
  130. Name=W32/NACHI.A
  131.  
  132. [F38.Family]
  133. Name=Blaster
  134.  
  135. [F37.Family]
  136. Name=Sobig.B
  137.  
  138. [F36.Family]
  139. Name=Parite
  140.  
  141. [F35.Family]
  142. Name=Fizzer
  143.  
  144. [F34.Family]
  145. Name=NiceHello
  146. Filename=
  147.  
  148. [F33.Family]
  149. Name=LOVGATE
  150. Filename=
  151.  
  152. [F32.Family]
  153. Name=REDLOF
  154. Filename=
  155.  
  156. [F31.Family]
  157. Name=LIRVA
  158. FileName=
  159.  
  160. [F30.Family]
  161. Name=DATOM
  162. FileName=
  163.  
  164.  
  165. [F29.Family]
  166. Name=BRIDE
  167. FileName=
  168.  
  169. [F28.Family]
  170. Name=BUGBEAR
  171. FileName=
  172.  
  173.  
  174. [F27.Family]
  175. Name=OPASERV
  176. FileName=
  177.  
  178.  
  179. [F26.Family]
  180. Name=FRETHEM
  181. FileName=
  182.  
  183.  
  184. [F25.Family]
  185. Name=DADINU
  186. FileName=
  187.  
  188.  
  189. [F24.Family]
  190. Name=LENTIN
  191. FileName=
  192.  
  193.  
  194. [F23.Family]
  195. Name=STATOR
  196. FileName=
  197.  
  198.  
  199. [F22.Family]
  200. Name=BADTRANS@MM
  201. FileName=
  202.  
  203. [F21.Family]
  204. Name=REEEZAK
  205. FileName=
  206.  
  207. [F20.Family]
  208. Name=UPDATER
  209. FileName=
  210.  
  211. [F19.Family]
  212. Name=GONER
  213. FileName=
  214.  
  215. [F18.Family]
  216. Name=HAPPY
  217. FileName=
  218.  
  219. [F17.Family]
  220. Name=QAZ
  221. FileName=
  222.  
  223. [F16.Family]
  224. Name=MSINIT
  225. FileName=
  226.  
  227. [F15.Family]
  228. Name=BADTRANS
  229. FileName=
  230.  
  231. [F14.Family]
  232. Name=KLEZ
  233. FileName=
  234.  
  235. [F13.Family]
  236. Name=VOTE
  237. FileName=
  238.  
  239. [F12.Family]
  240. Name=NIMDA
  241. FileName=
  242.  
  243. [F11.Family]
  244. Name=SIRCAM
  245. FileName=
  246.  
  247. [F10.Family]
  248. Name=HELP
  249. FileName=
  250.  
  251. [F09.Family]
  252. Name=ANNA KOURNIKOVA
  253. FileName=
  254.  
  255. [F08.Family]
  256. Name=PRETTY PARK
  257. FileName=
  258.  
  259. [F00.Family]
  260. Name=I LOVE YOU
  261. FileName=
  262.  
  263. [F01.Family]
  264. Name=KAK WORM
  265. FileName=KAK
  266.  
  267. [F02.Family]
  268. Name=SHELL SCRAP
  269. FileName=SHELL
  270.  
  271. [F03.Family]
  272. Name=COOL NOTEPAD
  273. FileName=
  274.  
  275. [F04.Family]
  276. Name=MTX
  277. FileName=
  278.  
  279. [F05.Family]
  280. Name=VERONA
  281. FileName=
  282.  
  283. [F06.Family]
  284. Name=NAVIDAD
  285. FileName=
  286.  
  287. [F07.Family]
  288. Name=FUNLOVE
  289. FileName=
  290.  
  291. [W32/GIBE.C.Info]
  292. Family=F41
  293. Detect=W32/GIBE.C
  294. Clear=W32/GIBE.C
  295. Aliases=W32/GIBE.C
  296. Ids=49563
  297.  
  298. [W32/SOBIG.F.Info]
  299. Family=F40
  300. Detect=W32/SOBIG.F
  301. Clear=W32/SOBIG.F
  302. Aliases=W32/SOBIG.F
  303. Ids=48968,55286
  304. LaunchPAV=1,/clv /aut /loc /nos /del /ext:exe;vir;scr;pif
  305. LaunchPAV32=1,/clv /aut /loc /nos /del /ext:exe;vir;scr;pif
  306.  
  307. [W32/NACHI.A.Info]
  308. Family=F39
  309. Detect=W32/NACHI.A
  310. Clear=W32/NACHI.A
  311. Aliases=W32/NACHI.A
  312. Ids=48971,48959
  313. LaunchPAV=1,/clv /aut /loc /nos /del /ext:exe;vir
  314. LaunchPAV32=1,/clv /aut /loc /nos /del /ext:exe;vir
  315.  
  316. [W32/BLASTER.Info]
  317. Family=F38
  318. Detect=W32/BLASTER
  319. Clear=W32/BLASTER
  320. Aliases=W32/BLASTER
  321. Ids=55284
  322.  
  323. [W32/Sobig.B.Info]
  324. Family=F37
  325. Detect=W32/Sobig.B
  326. Clear=W32/Sobig.B
  327. Aliases=W32/Sobig.B
  328. Ids=44683
  329. LaunchPAV=1,/clv /aut /all /nos /del /ext:vir;exe;pif;tmp
  330. LaunchPAV32=1,/clv /aut /all /nos /del /ext:vir;exe;pif;tmp
  331.  
  332. [W32/Parite.B.Info]
  333. Family=F36
  334. Detect=W32/Parite.B
  335. Clear=W32/Parite.B
  336. Aliases=W32/Parite.B
  337. Ids=20144,42730,55354
  338. LaunchPAV=1,/clv /aut /all /nos /del /ext:vir;exe;scr;tmp
  339. LaunchPAV32=1,/clv /aut /all /nos /del /ext:vir;exe;scr;tmp
  340.  
  341. [W32/Fizzer.Info]
  342. Family=F35
  343. Detect=W32/Fizzer
  344. Clear=W32/Fizzer
  345. Aliases=W32/Fizzer
  346. Ids=44614,44615,44620
  347. LaunchPAV=1,/clv /aut /all /nos /del /ext:dll;vir;exe;pif;com;scr
  348. LaunchPAV32=1,/clv /aut /all /nos /del /ext:dll;vir;exe;pif;com;scr
  349.  
  350. [W32/Lovgate.F.Info]
  351. Family=F33
  352. Detect=W32/Lovgate.F
  353. Clear=W32/Lovgate.F
  354. Aliases=W32/Lovgate.F
  355. Ids=43908,44083,44469,55165,55166
  356. LaunchPAV=1,/clv /aut /all /nos /del /ext:dll;vir;exe;pif
  357. LaunchPAV32=1,/clv /aut /all /nos /del /ext:dll;vir;exe;pif
  358. LaunchAtRunOnce=1,/selfdel /auto:clear
  359.  
  360. [W32/NiceHello.Info]
  361. Family=F34
  362. Detect=W32/NiceHello
  363. Clear=W32/NiceHello
  364. Aliases=W32/NiceHello
  365. Ids=43490
  366.  
  367. [W32/Lovgate.C.Info]
  368. Family=F33
  369. Detect=W32/Lovgate.C
  370. Clear=W32/Lovgate.C
  371. Aliases=W32/Lovgate.C
  372. Ids=42822,50948,55168
  373. LaunchPAV=1,/clv /aut /all /nos /del /ext:dll;vir;exe
  374. LaunchPAV32=1,/clv /aut /all /nos /del /ext:dll;vir;exe
  375.  
  376. [VBS/Redlof.Info]
  377. Family=F32
  378. Detect=VBS/Redlof
  379. Clear=VBS/Redlof
  380. Aliases=VBS/Redlof
  381. Ids=55362,60658,44602,55122,55125,55123
  382. LaunchPAV=1,/clv /aut /loc /nos /del /ext:dll;vir;vbs;html;htm;asp;php;jsp;htt;gif
  383. LaunchPAV32=1,/clv /aut /loc /nos /del /ext:dll;vir;vbs;html;htm;asp;php;jsp;htt;gif
  384.  
  385. [W32/Lirva.Info]
  386. Family=F31
  387. Detect=W32/Lirva
  388. Clear=W32/Lirva
  389. Aliases=W32/Lirva
  390. Ids=34171,34204,34201,34205
  391. LaunchPAV=1,/clv /aut /loc /nos /del /ext:exe;ini;vir
  392. LaunchPAV32=1,/clv /aut /loc /nos /del /ext:exe;ini;vir
  393.  
  394. [W32/Datom.Info]
  395. Family=F30
  396. Detect=W32/Datom
  397. Clear=W32/Datom
  398. Aliases=W32/Datom
  399. Ids=60813,60814,60815
  400.  
  401. [W32/Bride.Info]
  402. Family=F29
  403. Detect=W32/Bride
  404. Clear=W32/Bride
  405. Aliases=W32/Bride
  406. Ids=61831
  407. LaunchPAV=1,/clv /aut /cmp /loc /nos /del /ext:exe;eml;vir
  408. LaunchPAV32=1,/clv /aut /cmp /loc /nos /del /ext:exe;eml;vir
  409.  
  410. [W32/Bugbear.Info]
  411. Family=F28
  412. Detect=W32/Bugbear
  413. Clear=W32/Bugbear
  414. Aliases=W32/Bugbear
  415. Ids=53751,58234,58507,61581,61590,61635,44994,44997,55197,45069,55233
  416. LaunchPAV=1,/clv /aut /loc /nos /del /ext:exe;vir
  417. LaunchPAV32=1,/clv /aut /loc /nos /del /ext:exe;vir
  418.  
  419. [W32/Opaserv.Info]
  420. Family=F27
  421. Detect=W32/Opaserv
  422. Clear=W32/Opaserv
  423. Aliases=W32/Opaserv
  424. Ids=55103,61613,61752,43998,55104,61614,61757,34752,34753,34780,55109,61574,55110,61363,41074,47159,55108,61580,55106,61586,61754,41195,41211,41212,41213,41214,41215,41216,41217,41218,41219,41220,41221,41697,41698,41699,42561,44070,44071,44072,44073,44074,44075,44076,44077,44078,44079,44332,44333,44334,49021,55107,61587,62265,34871,61775,61792,61794,61832,61842,61844,43639,61819,61830,61868,61876,44452,62230,39963,42673,42729,42993,43630,62635,43604,62773,34309,34310,34859,40953,43906,44832,48889,34376,34377
  425.  
  426. [W32/Frethem.Info]
  427. Family=F26
  428. Detect=W32/Frethem
  429. Clear=W32/Frethem
  430. Aliases=W32/Frethem
  431. Ids=60840,60853,60859
  432. LaunchPAV=1,/clv /aut /loc /nos /del /ext:exe;vir
  433. LaunchPAV32=1,/clv /aut /loc /nos /del /ext:exe;vir
  434.  
  435. [W32/Dadinu.Info]
  436. Family=F25
  437. Detect=W32/Dadinu
  438. Clear=W32/Dadinu
  439. Aliases=W32/Dadinu,W32/Duni.worm
  440. Ids=60710,60711,60877
  441. LaunchPAV=1,/clv /aut /loc /nos /del /ext:exe;cpl;vir
  442. LaunchPAV32=1,/clv /aut /loc /nos /del /ext:exe;cpl;vir
  443.  
  444. [W32/Lentin.E.Info]
  445. Family=F24
  446. Detect=W32/Lentin.E
  447. Clear=W32/Lentin.E
  448. Aliases=W32/Lentin.E,W32/Yaha.E
  449. Ids=60568
  450. LaunchPAV=1,/clv /aut /loc /nos /del /ext:exe;vir;dll;scr
  451. LaunchPAV32=1,/clv /aut /loc /nos /del /ext:exe;vir;dll;scr
  452. LaunchAtRunOnce=1,/selfdel /auto:clear /nopav
  453.  
  454. [W32/Lentin.Info]
  455. Family=F24
  456. Detect=W32/Lentin
  457. Clear=W32/Lentin
  458. Aliases=W32/Lentin,W32/Yaha
  459. Ids=51720,60336,34681,60379,60383,60544,61289,60655,60657,62395,62670,63551,34166
  460. LaunchPAV=1,/clv /aut /loc /nos /del /ext:exe;vir;dll;scr
  461. LaunchPAV32=1,/clv /aut /loc /nos /del /ext:exe;vir;dll;scr
  462.  
  463. [W32/Stator.Info]
  464. Family=F23
  465. Detect=Stator
  466. Clear=Stator
  467. Aliases=Stator
  468. Ids=55250,56530,59493,59627,60344,61025,61120,57653
  469. LaunchPAV=1,/clv /aut /loc /nos /del /ext:exe;com;sys;vir
  470. LaunchPAV32=1,/clv /aut /loc /nos /del /ext:exe;com;sys;vir
  471.  
  472. [W32/Reeezak.A.Info]
  473. Family=F21
  474. Detect=W32/Reeezak.A
  475. Clear=W32/Reeezak.A
  476. Aliases=Keyluc,W32/Zacker.C,W32/Maldal.C@mm
  477. Ids=59897
  478. LaunchPAV=1,/clv /aut /nbr /loc /nos /del /ext:exe;vir
  479. LaunchPAV32=1,/clv /aut /nbr /loc /nos /del /ext:exe;vir
  480.  
  481. [W32/Updater.Info]
  482. Family=F20
  483. Detect=W32/Updater
  484. Clear=W32/Updater
  485. Aliases=W32/Updater
  486. Ids=59877,59878,60086
  487. LaunchPAV=1,/clv /aut /nbr /loc /del /nos /ext:exe;vbs;vir
  488. LaunchPAV32=1,/clv /aut /nbr /loc /del /nos /ext:exe;vbs;vir
  489.  
  490. [W32/Goner.A.Info]
  491. Family=F19
  492. Detect=W32/Goner.A
  493. Clear=W32/Goner.A
  494. Aliases=W32/Goner.A@mm
  495. Ids=44453,51850,59868,59872,59965
  496. LaunchPAV=1,/clv /aut /nbr /del /loc /nos /ext:scr;vir
  497. LaunchPAV32=1,/clv /aut /nbr /del /loc /nos /ext:scr;vir
  498.  
  499. [I-Worm/Happy.Info]
  500. Family=F18
  501. Detect=I-Worm/Happy
  502. Clear=I-Worm/Happy
  503. Aliases=W32/Ska
  504. Ids=24129,53243
  505. LaunchPAV=1,/clv /aut /nbr /loc /nos /del /ext:exe;ska;dll;vir
  506. LaunchPAV32=1,/clv /aut /nbr /loc /nos /del /ext:exe;ska;dll;vir
  507.  
  508. [W32/Qaz.Info]
  509. Family=F17
  510. Detect=W32/Qaz
  511. Clear=W32/Qaz
  512. Aliases=Trojan/Notepad
  513. Ids=55307,61257
  514. LaunchPAV=1,/clv /aut /nbr /del /loc /nos /ext:exe;vir
  515. LaunchPAV32=1,/clv /aut /nbr /del /loc /nos /ext:exe;vir
  516.  
  517. [W32/MSInit.A.Info]
  518. Family=F16
  519. Detect=W32/MSInit.A
  520. Clear=W32/MSInit.A
  521. Aliases=Worm/Dnet_Winit
  522. Ids=55306,59290,59881,59927,59982,60422,60607,55309,59719,60606
  523. LaunchPAV=1,/clv /aut /nbr /loc /nos /del /ext:exe;vir
  524. LaunchPAV32=1,/clv /aut /nbr /loc /nos /del /ext:exe;vir
  525.  
  526. [W32/Badtrans.Info]
  527. Family=F15
  528. Detect=W32/Badtrans
  529. Clear=W32/Badtrans
  530. Aliases=W32/Badtrans.B,W32/Badtrans@MM
  531. Ids=57861,57862,59162,59412,60664,59420,59851,59886,59892,59852
  532. LaunchPAV=1,/clv /aut /nbr /loc /nos /del /ext:exe;pif;scr;dll;vir
  533. LaunchPAV32=1,/clv /aut /nbr /loc /nos /del /ext:exe;pif;scr;dll;vir
  534.  
  535. [W32/Klez.Info]
  536. Family=F14
  537. Detect=W32/Klez
  538. Clear=W32/Klez
  539. Aliases=W32/Klez
  540. Ids=55243,61364,58936,58945,60202,60212,60284,57631,61532,55252,62355,43062
  541. LaunchPAV=1,/clv /aut /loc /nos /aex /nbr /del /delp
  542. LaunchPAV32=1,/clv /aut /loc /nos /aex /nbr /del /delp
  543. LaunchAtRunOnce=1,/auto:clear /nopav /selfdel
  544.  
  545. [W32/Vote.Info]
  546. Family=F13
  547. Detect=W32/Vote
  548. Clear=W32/Vote
  549. Aliases=W32/Vote,VOTE
  550. Ids=59595,59596,59597
  551. LaunchPAV=1,/clv /aut /nbr /loc /nos /del /ext:vbs;exe;vir
  552. LaunchPAV32=1,/clv /aut /nbr /loc /nos /del /ext:vbs;exe;vir
  553.  
  554. [W32/Nimda.Info]
  555. Family=F12
  556. Detect=W32/Nimda
  557. Clear=W32/Nimda
  558. Aliases=W32/Nimda.A@mm,Nimda,W32/Nimda.D,W32/Nimda.E
  559. Ids=55341,62241,58707,58941,42277,42278,42279
  560. LaunchPAV=1,/loc /nbr /clv /del /nos /aut /cmp  /delp /ext:dll;exe;tmp;doc;dot;eml;nws;asp;htm;html;vir
  561. LaunchPAV32=1,/loc /nbr /clv /del /nos /aut /cmp  /delp /ext:dll;exe;tmp;doc;dot;eml;nws;asp;htm;html;vir
  562.  
  563. [VBS/VBSWG.J.Info]
  564. Family=F09
  565. Detect=VBS/VBSWG.J
  566. Clear=VBS/VBSWG.J
  567. Aliases=VBS/VBSWG.J,I-Worm/Lee.O
  568. Ids=15400,34976,59961
  569. LaunchPAV=1,/clv /aut /nbr /loc /nos /del /ext:vbs;ini;vir
  570. LaunchPAV32=1,/clv /aut /nbr /loc /nos /del /ext:vbs;ini;vir
  571.  
  572. [W32/PrettyPark.Info]
  573. Family=F08
  574. Detect=W32/PrettyPark
  575. Clear=W32/PrettyPark
  576. Aliases=I-Worm.PrettyPark
  577. Ids=28008,55018,59472
  578. LaunchPAV=1,/clv /aut /nbr /loc /nos /del /ext:exe;vxd;vir
  579. LaunchPAV32=1,/clv /aut /nbr /loc /nos /del /ext:exe;vxd;vir
  580.  
  581. [I-Worm/MTX.Info]
  582. Family=F04
  583. Detect=I-Worm/MTX
  584. Clear=I-Worm/MTX
  585. Aliases=I-Worm/MTX
  586. Ids=28889,55212,54751,62448
  587. LaunchPAV=1,/mtx /clv /aut /aex /nbr /loc /nos /del
  588. LaunchPAV32=1,/mtx /clv /aut /aex /nbr /loc /nos /del
  589.  
  590. [VBS/CoolNotepad.Worm.Info]
  591. Family=F03
  592. Detect=VBS/CoolNotepad.Worm
  593. Clear=VBS/CoolNotepad.Worm
  594. Aliases=VBS/CoolNotepad.Worm
  595. Ids=51328
  596. LaunchPAV=1,/clv /aut /nbr /loc /nos /del /ext:vbs;ini;vir
  597. LaunchPAV32=1,/clv /aut /nbr /loc /nos /del /ext:vbs;ini;vir
  598.  
  599. [VBS/LoveLetter.AS.Info]
  600. Family=F00
  601. Detect=VBS/LoveLetter.AS
  602. Clear=VBS/LoveLetter.AS
  603. Aliases=VBS/LoveLetter.AS
  604. Ids=55101,57686,61350
  605.  
  606. [JS/Kak.Worm.Info]
  607. Family=F01
  608. Detect=JS/Kak.Worm
  609. Clear=JS/Kak.Worm
  610. Aliases=VBS.KakWorm, Kagou-Anti-Frosoft, Wsript.Kak.A
  611. Ids=31932,32378
  612. LaunchPAV=1,/clv /aut /nbr /loc /nos /del /ext:htm;html;hta;reg;bat;kak;vir
  613. LaunchPAV32=1,/clv /aut /nbr /loc /nos /del /ext:htm;html;hta;reg;bat;kak;vir
  614.  
  615. [JS/Kak.Worm.B.Info]
  616. Family=F01
  617. Detect=JS/Kak.Worm.B
  618. Clear=JS/Kak.Worm.B
  619. Aliases=VBS.KakWorm.B, Wsript.Kak.B, Days
  620. Ids=24215,28858,51623
  621. LaunchPAV=1,/clv /aut /nbr /loc /nos /del /ext:htm;html;hta;reg;bat;kak;vir
  622. LaunchPAV32=1,/clv /aut /nbr /loc /nos /del /ext:htm;html;hta;reg;bat;kak;vir
  623.  
  624. [VBS/ShellScrap.Worm.Info]
  625. Family=F02
  626. Detect=VBS/ShellScrap.Worm
  627. Clear=VBS/ShellScrap.Worm
  628. Aliases=VBS/ShellScrap.Worm, VBS/Live_Stages, VBS.Stages.Worm
  629. Ids=24746,51343,51344,51542,24747,24748
  630. LaunchPAV=1,/clv /aut /nbr /loc /nos /del /ext:shs;ini;exe;vbs;vir
  631. LaunchPAV32=1,/clv /aut /nbr /loc /nos /del /ext:shs;ini;exe;vbs;vir
  632.  
  633. [VBS/LoveLetter.Info]
  634. Family=F00
  635. Detect=VBS/LoveLetter
  636. Clear=VBS/LoveLetter
  637. Aliases=I LOVE YOU, Worm/LoveLetter, Barok
  638. Ids=42206,48186,48945,51220,51221,51224,51225,51241,54995,61021,61356
  639. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  640. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  641.  
  642. [VBS/LoveLetter.B.Info]
  643. Family=F00
  644. Detect=VBS/LoveLetter
  645. Clear=VBS/LoveLetter
  646. Aliases=VBS/LoveLetter.B
  647. Ids=51238,51242
  648. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  649. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  650.  
  651. [VBS/LoveLetter.C.Info]
  652. Family=F00
  653. Detect=VBS/LoveLetter.C
  654. Clear=VBS/LoveLetter.C
  655. Aliases=Very Funny
  656. Ids=51239,60315
  657. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  658. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  659.  
  660. [VBS/LoveLetter.D.Info]
  661. Family=F00
  662. Detect=VBS/LoveLetter.D
  663. Clear=VBS/LoveLetter.D
  664. Aliases=VBS/Mothersday, WORM/LoveLetter.D
  665. Ids=51240
  666. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  667. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  668.  
  669. [VBS/LoveLetter.E.Info]
  670. Family=F00
  671. Detect=VBS/LoveLetter.E
  672. Clear=VBS/LoveLetter.E
  673. Aliases=WORM/LoveLetter.E
  674. Ids=51236,51243
  675. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  676. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  677.  
  678. [VBS/LoveLetter.F.Info]
  679. Family=F00
  680. Detect=VBS/LoveLetter.F
  681. Clear=VBS/LoveLetter.F
  682. Aliases=WORM/LoveLetter.F
  683. Ids=51244,51248
  684. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  685. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  686.  
  687. [VBS/LoveLetter.G.Info]
  688. Family=F00
  689. Detect=VBS/LoveLetter.G
  690. Clear=VBS/LoveLetter.G
  691. Aliases=WORM/LoveLetter.G
  692. Ids=51245,51246
  693. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  694. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  695.  
  696. [VBS/LoveLetter.H.Info]
  697. Family=F00
  698. Detect=VBS/LoveLetter
  699. Clear=VBS/LoveLetter
  700. Aliases=WORM/LoveLetter.H
  701. Ids=51253
  702. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  703. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  704.  
  705. [VBS/LoveLetter.I.Info]
  706. Family=F00
  707. Detect=VBS/LoveLetter.I
  708. Clear=VBS/LoveLetter.I
  709. Aliases=WORM/LoveLetter.I
  710. Ids=51254,51256
  711. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  712. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  713.  
  714. [VBS/LoveLetter.J.Info]
  715. Family=F00
  716. Detect=VBS/LoveLetter.J
  717. Clear=VBS/LoveLetter.J
  718. Aliases=WORM/LoveLetter.J
  719. Ids=51260
  720. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  721. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  722.  
  723. [VBS/LoveLetter.K.Info]
  724. Family=F00
  725. Detect=VBS/LoveLetter.K
  726. Clear=VBS/LoveLetter.K
  727. Aliases=WORM/LoveLetter.K
  728. Ids=51262
  729. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  730. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  731.  
  732. [VBS/LoveLetter.L.Info]
  733. Family=F00
  734. Detect=VBS/LoveLetter.L
  735. Clear=VBS/LoveLetter.L
  736. Aliases=WORM/LoveLetter.L
  737. Ids=51257
  738. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  739. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  740.  
  741. [VBS/LoveLetter.M.Info]
  742. Family=F00
  743. Detect=VBS/LoveLetter
  744. Clear=VBS/LoveLetter
  745. Aliases=WORM/LoveLetter.M
  746. Ids=51220
  747. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  748. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  749.  
  750. [VBS/LoveLetter.N.Info]
  751. Family=F00
  752. Detect=VBS/LoveLetter.N
  753. Clear=VBS/LoveLetter.N
  754. Aliases=WORM/LoveLetter.N
  755. Ids=51267
  756. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  757. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  758.  
  759. [VBS/LoveLetter.O.Info]
  760. Family=F00
  761. Detect=VBS/LoveLetter
  762. Clear=VBS/LoveLetter
  763. Aliases=WORM/LoveLetter.O
  764. Ids=51269,51270
  765. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  766. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  767.  
  768. [VBS/LoveLetter.P.Info]
  769. Family=F00
  770. Detect=VBS/LoveLetter.P
  771. Clear=VBS/LoveLetter.P
  772. Aliases=WORM/LoveLetter.P
  773. Ids=51272
  774. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  775. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  776.  
  777. [VBS/LoveLetter.Q.Info]
  778. Family=F00
  779. Detect=VBS/LoveLetter.Q
  780. Clear=VBS/LoveLetter.Q
  781. Aliases=WORM/LoveLetter.Q
  782. Ids=51273
  783. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  784. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  785.  
  786. [VBS/LoveLetter.R.Info]
  787. Family=F00
  788. Detect=VBS/LoveLetter.G
  789. Clear=VBS/LoveLetter.G
  790. Aliases=WORM/LoveLetter.R
  791. Ids=51275
  792. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  793. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  794.  
  795. [VBS/LoveLetter.S.Info]
  796. Family=F00
  797. Detect=VBS/LoveLetter.S
  798. Clear=VBS/LoveLetter.S
  799. Aliases=WORM/LoveLetter.S
  800. Ids=51276,56848
  801. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  802. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  803.  
  804. [VBS/LoveLetter.T.Info]
  805. Family=F00
  806. Detect=VBS/LoveLetter.T
  807. Clear=VBS/LoveLetter.T
  808. Aliases=WORM/LoveLetter.T
  809. Ids=51278
  810. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  811. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  812.  
  813. [VBS/LoveLetter.U.Info]
  814. Family=F00
  815. Detect=VBS/LoveLetter.U
  816. Clear=VBS/LoveLetter.U
  817. Aliases=WORM/LoveLetter.U
  818. Ids=51279
  819. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  820. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  821.  
  822. [VBS/LoveLetter.V.Info]
  823. Family=F00
  824. Detect=VBS/LoveLetter.V
  825. Clear=VBS/LoveLetter.V
  826. Aliases=WORM/LoveLetter.V
  827. Ids=51281
  828. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  829. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  830.  
  831. [VBS/LoveLetter.W.Info]
  832. Family=F00
  833. Detect=VBS/LoveLetter.W
  834. Clear=VBS/LoveLetter.W
  835. Aliases=WORM/LoveLetter.W
  836. Ids=51284,51290
  837. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  838. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  839.  
  840. [VBS/LoveLetter.X.Info]
  841. Family=F00
  842. Detect=VBS/LoveLetter
  843. Clear=VBS/LoveLetter
  844. Aliases=WORM/LoveLetter.X
  845. Ids=51291,56849
  846. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  847. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  848.  
  849. [VBS/LoveLetter.Y.Info]
  850. Family=F00
  851. Detect=VBS/LoveLetter
  852. Clear=VBS/LoveLetter
  853. Aliases=WORM/LoveLetter.Y
  854. Ids=51292
  855. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  856. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  857.  
  858. [VBS/LoveLetter.Z.Info]
  859. Family=F00
  860. Detect=VBS/LoveLetter
  861. Clear=VBS/LoveLetter
  862. Aliases=WORM/LoveLetter.Z
  863. Ids=51303
  864. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos /del
  865. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos /del
  866.  
  867. [I-Worm/Verona.B.Info]
  868. Family=F05
  869. Detect=I-Worm/Verona.B
  870. Clear=I-Worm/Verona.B
  871. Aliases=I-Worm/Verona.B
  872. Ids=15352,15353,43804,53486,54857,57237,57256,58034,60977,61075,24845,24846,53361,54763
  873. LaunchPAV=1,/clv /aut /nbr /loc /nos /del /ext:exe;chm;vir
  874. LaunchPAV32=1,/clv /aut /nbr /loc /nos /del /ext:exe;chm;vir
  875.  
  876. [W32/Navidad.Info]
  877. Family=F06
  878. Detect=W32/Navidad
  879. Clear=W32/Navidad
  880. Aliases=W32/Navidad
  881. Ids=55221,61266
  882. LaunchPAV=1,/clv /aut /nbr /loc /nos /del /ext:exe;vir
  883. LaunchPAV32=1,/clv /aut /nbr /loc /nos /del /ext:exe;vir
  884.  
  885. [W32/Navidad.B.Info]
  886. Family=F06
  887. Detect=W32/Navidad.B
  888. Clear=W32/Navidad.B
  889. Aliases=W32/Navidad.B
  890. Ids=54974,57545,58445,60566
  891. LaunchPAV=1,/clv /aut /nbr /loc /nos /del /ext:exe;vir
  892. LaunchPAV32=1,/clv /aut /nbr /loc /nos /del /ext:exe;vir
  893.  
  894. [W32/FunLove.Info]
  895. Family=F07
  896. Detect=W32/FunLove
  897. Clear=W32/FunLove
  898. Aliases=W32/FunLove
  899. Ids=30807,55051,52029,61837,61930
  900. LaunchPAV=1,/clv /aut /nbr /loc /nos /aex /del
  901. LaunchPAV32=1,/clv /aut /nbr /loc /nos /aex /del
  902.  
  903. [W32/SirCam.Info]
  904. Family=F11
  905. Detect=W32/SirCam
  906. Clear=W32/SirCam
  907. Aliases=W32/SirCam@mm
  908. Ids=56752,58846,59406,59423,59459
  909. LaunchPAV=1,/clv /aut /nbr /loc /nos /del /ext:bat;com;lnk;pif;exe;vir
  910. LaunchPAV32=1,/clv /aut /nbr /loc /nos /del /ext:bat;com;lnk;pif;exe;vir
  911.  
  912. [VBS/Help.Info]
  913. Family=F10
  914. Detect=VBS/Help
  915. Clear=VBS/Help
  916. Aliases=VBS/HappyTime.A
  917. Ids=24266,55094,55405,62240,62384,24273,55406
  918. LaunchPAV=1,/clv /aut /nbr /loc /nos /del /ext:htm;html;vbs;asp;htt;hta;vir
  919. LaunchPAV32=1,/clv /aut /nbr /loc /nos /del /ext:htm;html;vbs;asp;htt;hta;vir
  920.  
  921. [W32/GIBE.C.Clear]
  922. REGISTRY_DELETE_KEY_VALUE0=HKEY_CURRENT_USER,Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableRegistryTools
  923. REGISTRY_SET_KEY_VALUE0=HKEY_CLASSES_ROOT,exefile\shell\open\command,"",""%1" %*"
  924. REGISTRY_SET_KEY_VALUE1=HKEY_CLASSES_ROOT,comfile\shell\open\command,"",""%1" %*"
  925. REGISTRY_SET_KEY_VALUE2=HKEY_CLASSES_ROOT,piffile\shell\open\command,"",""%1" %*"
  926. REGISTRY_SET_KEY_VALUE3=HKEY_CLASSES_ROOT,scrfile\shell\open\command,"",""%1" %*"
  927. REGISTRY_SET_KEY_VALUE4=HKEY_CLASSES_ROOT,batfile\shell\open\command,"",""%1" %*"
  928. REGISTRY_SET_KEY_VALUE5=HKEY_CLASSES_ROOT,regfile\shell\open\command,"","regedit.exe "%1""
  929.  
  930. [W32/SOBIG.F.Clear]
  931. PROC_TERMINATE_BY_NAME0=WINPPR32.EXE
  932. FILE_DELETE_BY_PATH0=%WindowsRoot%\WINPPR32.EXE
  933. FILE_DELETE_BY_PATH1=%WindowsRoot%\WINFSTF32.DLL
  934. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,TrayX
  935. REGISTRY_DELETE_KEY_VALUE1=HKEY_CURRENT_USER,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,TrayX
  936.  
  937. [W32/NACHI.A.Clear]
  938. PROC_TERMINATE_BY_NAME0=DLLHOST.EXE
  939. FILE_DELETE_BY_PATH0=%SystemRoot%\Wins\DLLHOST.EXE
  940. FILE_DELETE_BY_PATH1=%SystemRoot%\Wins\SVCHOST.EXE
  941. REGISTRY_DELETE_KEY0=HKEY_LOCAL_MACHINE,SYSTEM\CurrentControlSet\Services\RPCPatch
  942. REGISTRY_DELETE_KEY1=HKEY_LOCAL_MACHINE,SYSTEM\CurrentControlSet\Services\RPCTftpd
  943.  
  944. [W32/BLASTER.Clear]
  945. PROC_TERMINATE_BY_NAME0=MSBLAST.EXE
  946. PROC_TERMINATE_BY_NAME1=PENIS32.EXE
  947. PROC_TERMINATE_BY_NAME2=TEEKIDS.EXE
  948. PROC_TERMINATE_BY_NAME3=MSLAUGH.EXE
  949. FILE_DELETE_BY_PATH0=%SystemRoot%\MSBLAST.EXE
  950. FILE_DELETE_BY_PATH1=%SystemRoot%\PENIS32.EXE
  951. FILE_DELETE_BY_PATH2=%SystemRoot%\TEEKIDS.EXE
  952. FILE_DELETE_BY_PATH3=%SystemRoot%\MSLAUGH.EXE
  953. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,windows auto update
  954. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Microsoft Inet Xp..
  955. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Windows Automation
  956. PATH_MAKE_BY_PATH0=%SystemRoot%\MSBLAST.EXE,1,HSR
  957. PATH_MAKE_BY_PATH1=%SystemRoot%\PENIS32.EXE,1,HSR
  958. PATH_MAKE_BY_PATH2=%SystemRoot%\TEEKIDS.EXE,1,HSR
  959. PATH_MAKE_BY_PATH3=%SystemRoot%\MSLAUGH.EXE,1,HSR
  960.  
  961. [W32/Sobig.B.Clear]
  962. PROC_TERMINATE_BY_NAME0=msccn32.exe
  963. FILE_DELETE_BY_PATH0=%WindowsRoot%\msccn32.exe
  964. FILE_DELETE_BY_PATH1=%WindowsRoot%\All Users\Start Menu\Programs\StartUp\msccn32.exe
  965. FILE_DELETE_BY_PATH2=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\msccn32.exe
  966. FILE_DELETE_BY_PATH3=%WindowsRoot%\hnks.ini
  967. FILE_DELETE_BY_PATH4=%WindowsRoot%\mdbrr.ini
  968. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,System Tray
  969. REGISTRY_DELETE_KEY_VALUE1=HKEY_CURRENT_USER,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,System Tray
  970.  
  971. [W32/Parite.B.Clear]
  972. REGISTRY_DELETE_KEY_VALUE0=HKEY_CURRENT_USER,Software\Microsoft\Windows\CurrentVersion\Explorer,PINF
  973.  
  974. [W32/Fizzer.Clear]
  975. PROC_TERMINATE_BY_NAME0=iservc.exe
  976. PROC_TERMINATE_BY_NAME1=progop.exe
  977. FILE_DELETE_BY_PATH0=%WindowsRoot%\initbak.dat
  978. FILE_DELETE_BY_PATH1=%WindowsRoot%\iservc.exe
  979. FILE_DELETE_BY_PATH2=%WindowsRoot%\progop.exe
  980. FILE_DELETE_BY_PATH3=%WindowsRoot%\iservc.dll
  981. FILE_DELETE_BY_PATH4=%WindowsRoot%\iservc.klg
  982. SERVICE_DELETE_BY_NAME0=S1TRACE
  983. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,SystemInit
  984. REGISTRY_SET_KEY_VALUE0=HKEY_CLASSES_ROOT,txtfile\shell\open\command,"","NOTEPAD.EXE %1"
  985. REGISTRY_DELETE_KEY0=HKEY_CLASSES_ROOT,Applications\ProgOp.exe
  986.  
  987.  
  988. [W32/Lovgate.F.Clear]
  989. PROC_TERMINATE_BY_NAME0=WinGate.EXE
  990. PROC_TERMINATE_BY_NAME1=winrpc.EXE
  991. PROC_TERMINATE_BY_NAME2=WinDriver.exe
  992. PROC_TERMINATE_BY_NAME3=RAVMOND.exe
  993. PROC_TERMINATE_BY_NAME4=IEXPLORE.EXE
  994. PROC_TERMINATE_BY_NAME5=WinHelp.exe
  995. PROC_TERMINATE_BY_NAME6=stg.exe
  996. PROC_TERMINATE_BY_NAME7=NetServices.exe
  997. SERVICE_DELETE_BY_NAME0=ll_reg
  998. SERVICE_DELETE_BY_NAME1=NetMeeting Remote Desktop (RPC) Sharing
  999. SERVICE_DELETE_BY_NAME2=Windows Management Instrumentation Driver Extension
  1000. SERVICE_DELETE_BY_NAME3=Microsoft NetWork FireWall Services
  1001. FILE_DELETE_BY_PATH0=%SystemRoot%\WINGATE.EXE
  1002. FILE_DELETE_BY_PATH1=%SystemRoot%\WINRPC.EXE
  1003. FILE_DELETE_BY_PATH2=%SystemRoot%\WinDriver.exe
  1004. FILE_DELETE_BY_PATH3=%SystemRoot%\RAVMOND.exe
  1005. FILE_DELETE_BY_PATH4=%SystemRoot%\IEXPLORE.EXE
  1006. FILE_DELETE_BY_PATH5=%SystemRoot%\WinHelp.exe
  1007. FILE_DELETE_BY_PATH6=%SystemRoot%\stg.exe 
  1008. FILE_DELETE_BY_PATH7=%SystemRoot%\kernel66.dll
  1009. FILE_DELETE_BY_PATH8=%SystemRoot%\111.dll
  1010. FILE_DELETE_BY_PATH9=%SystemRoot%\ily668.dll
  1011. FILE_DELETE_BY_PATH10=%SystemRoot%\reg678.dll
  1012. FILE_DELETE_BY_PATH11=%SystemRoot%\Task688.dll
  1013. FILE_DELETE_BY_PATH12=%SystemRoot%\NetServices.exe
  1014. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Remote Procedure Call Locator
  1015. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,WinHelp
  1016. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,WinGate initialize
  1017. REGISTRY_DELETE_KEY_VALUE3=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Program In Windows
  1018. REGISTRY_SET_KEY_VALUE0=HKEY_CLASSES_ROOT,txtfile\shell\open\command,"","NOTEPAD.EXE %1"
  1019. REGISTRY_DELETE_KEY0=HKEY_LOCAL_MACHINE,SYSTEM\CurrentControlSet\Services\ll_reg
  1020. REGISTRY_DELETE_KEY1=HKEY_LOCAL_MACHINE,SYSTEM\CurrentControlSet\Services\NetMeeting Remote Desktop (RPC) Sharing
  1021. REGISTRY_DELETE_KEY2=HKEY_LOCAL_MACHINE,SYSTEM\CurrentControlSet\Services\Windows Management Instrumentation Driver Extension
  1022. REGISTRY_DELETE_KEY3=HKEY_LOCAL_MACHINE,SYSTEM\CurrentControlSet\Services\Microsoft NetWork FireWall Services
  1023. INI_SET_KEY_VALUE0=%WindowsRoot%\WIN.INI,windows,run,""
  1024.  
  1025. [W32/NiceHello.Clear]
  1026. PROC_TERMINATE_BY_NAME0=Sys64dvr.exe
  1027. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,System 64 Driver for Games
  1028. FILE_DELETE_BY_PATH0=%SystemRoot%\Sys64dvr.exe
  1029. FILE_DELETE_BY_PATH1=%WindowsRoot%\system32sys64dvr.exe
  1030. FILE_DELETE_BY_PATH2=%WindowsRoot%\systemsys64dvr.exe
  1031.  
  1032. [W32/Lovgate.C.Clear]
  1033. REGISTRY_DELETE_KEY0=HKEY_LOCAL_MACHINE,SOFTWARE\KittyXP.sql
  1034. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Module Call initialize
  1035. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,syshelp
  1036. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Wingate initialize
  1037. REGISTRY_DELETE_KEY_VALUE3=HKEY_CURRENT_USER,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows,Run 
  1038. REGISTRY_SET_KEY_VALUE0=HKEY_CLASSES_ROOT,txtfile\shell\open\command,"","NOTEPAD.EXE %1"
  1039. PROC_TERMINATE_BY_NAME0=SYSHELP.EXE
  1040. PROC_TERMINATE_BY_NAME1=WINGATE.EXE
  1041. PROC_TERMINATE_BY_NAME2=RPCSRV.EXE
  1042. PROC_TERMINATE_BY_NAME3=SSRV.EXE
  1043. SERVICE_DELETE_BY_NAME0=Window Remote Service
  1044. SERVICE_DELETE_BY_NAME1=Windows Management Extension
  1045. SERVICE_DELETE_BY_NAME2=dll_reg
  1046. INI_SET_KEY_VALUE0=%WindowsRoot%\WIN.INI,windows,run,""
  1047. FILE_DELETE_BY_PATH0=%SystemRoot%\ILY.DLL
  1048. FILE_DELETE_BY_PATH1=%SystemRoot%\TASK.DLL
  1049. FILE_DELETE_BY_PATH2=%SystemRoot%\REG.DLL
  1050. FILE_DELETE_BY_PATH3=%SystemRoot%\1.dll
  1051.  
  1052. [VBS/Redlof.Clear]
  1053. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Kernel32
  1054. REGISTRY_DELETE_KEY0=HKEY_CLASSES_ROOT,dllfile\shell\Open\Command
  1055. REGISTRY_DELETE_KEY1=HKEY_CLASSES_ROOT,dllfile\ScriptEngine
  1056. REGISTRY_DELETE_KEY2=HKEY_CLASSES_ROOT,dllfile\ScriptHostEncode
  1057. REGISTRY_DELETE_KEY3=HKEY_CLASSES_ROOT,dllfile\ShellEx\PropertySheetHandlers
  1058.  
  1059. [W32/Lirva.Clear]
  1060. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Avril Lavigne - Muse
  1061.  
  1062. [W32/Datom.Clear]
  1063. PROC_TERMINATE_BY_NAME0=msvxd.exe
  1064. FILE_DELETE_BY_PATH0=%WindowsRoot%\MSVXD.EXE
  1065. FILE_DELETE_BY_PATH1=%WindowsRoot%\MSVXD16.DLL
  1066. FILE_DELETE_BY_PATH2=%WindowsRoot%\MSVXD32.DLL
  1067. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSVXD
  1068. INI_SET_KEY_VALUE0=%WindowsRoot%\WIN.INI,windows,run,""
  1069. PATH_MAKE_BY_PATH0=%WindowsRoot%\MSVXD.EXE,1,HSR
  1070. PATH_MAKE_BY_PATH1=%WindowsRoot%\MSVXD16.DLL,1,HSR
  1071. PATH_MAKE_BY_PATH2=%WindowsRoot%\MSVXD32.DLL,1,HSR
  1072.  
  1073. [W32/Bride.Clear]
  1074. PROC_TERMINATE_BY_NAME0=REGEDIT.EXE
  1075. PROC_TERMINATE_BY_NAME1=BRIDE.EXE
  1076. FILE_DELETE_BY_PATH0=%SystemRoot%\REGEDIT.EXE
  1077. FILE_DELETE_BY_PATH1=%SystemRoot%\BRIDE.EXE
  1078. PATH_MAKE_BY_PATH0=%SystemRoot%\BRIDE.EXE,1,HSR
  1079. REGISTRY_DELETE_KEY_VALUE0=HKEY_CURRENT_USER,Software\Microsoft\Windows\CurrentVersion\Run,Regedit
  1080. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,Regedit
  1081.  
  1082. [W32/Bugbear.Clear]
  1083. FILE_DELETE_BY_PATH0=%TempRoot%\~PHQGHUM.TMP
  1084.  
  1085.  
  1086. [W32/Opaserv.Clear]
  1087. PROC_TERMINATE_BY_NAME0=SCRSVR.EXE
  1088. PROC_TERMINATE_BY_NAME1=BRASIL.EXE
  1089. PROC_TERMINATE_BY_NAME2=BRASIL.PIF
  1090. PROC_TERMINATE_BY_NAME3=ALEVIR.EXE
  1091. PROC_TERMINATE_BY_NAME4=PUTA!!.EXE
  1092. PROC_TERMINATE_BY_NAME5=HACKE!.EXE
  1093. PROC_TERMINATE_BY_NAME6=MARCO!.SCR
  1094. PROC_TERMINATE_BY_NAME7=SRV32.EXE
  1095. PROC_TERMINATE_BY_NAME8=INSTIT.BAT
  1096. PROC_TERMINATE_BY_NAME9=MQBKUP.EXE
  1097. PROC_TERMINATE_BY_NAME10=MSTASK.EXE
  1098. FILE_DELETE_BY_PATH0=%WindowsRoot%\SCRSVR.EXE
  1099. FILE_DELETE_BY_PATH1=C:\SCRSIN.DAT
  1100. FILE_DELETE_BY_PATH2=C:\SCRSOUT.DAT
  1101. FILE_DELETE_BY_PATH3=C:\TMP.INI
  1102. FILE_DELETE_BY_PATH4=%WindowsRoot%\SCRLOG
  1103. FILE_DELETE_BY_PATH5=%WindowsRoot%\SCRLOG2
  1104. FILE_DELETE_BY_PATH6=%WindowsRoot%\BRASIL.EXE
  1105. FILE_DELETE_BY_PATH7=%WindowsRoot%\BRASIL.PIF
  1106. FILE_DELETE_BY_PATH8=C:\PUT.INI
  1107. FILE_DELETE_BY_PATH9=%WindowsRoot%\ALEVIR.EXE
  1108. FILE_DELETE_BY_PATH10=%WindowsRoot%\PUTA!!.EXE
  1109. FILE_DELETE_BY_PATH11=%WindowsRoot%\HACKE!.EXE
  1110. FILE_DELETE_BY_PATH12=%WindowsRoot%\MARCO!.SCR
  1111. FILE_DELETE_BY_PATH13=%WindowsRoot%\SRV32.EXE
  1112. FILE_DELETE_BY_PATH14=C:\TEMP.INI
  1113. FILE_DELETE_BY_PATH15=C:\SRVTSK
  1114. FILE_DELETE_BY_PATH16=C:\SRVRES
  1115. FILE_DELETE_BY_PATH17=%WindowsRoot%\INSTIT.BAT
  1116. FILE_DELETE_BY_PATH18=C:\INSTITU
  1117. FILE_DELETE_BY_PATH19=C:\GUSTAV.SAV
  1118. FILE_DELETE_BY_PATH20=C:\INSTITU.VAT
  1119. FILE_DELETE_BY_PATH21=%WindowsRoot%\MQBKUP.EXE
  1120. FILE_DELETE_BY_PATH22=%WindowsRoot%\MSTASK.EXE
  1121. FILE_DELETE_BY_PATH23=%WindowsRoot%\MSBIND.DLL
  1122. FILE_DELETE_BY_PATH24=%WindowsRoot%\MSCAT32.DLL
  1123. PATH_MAKE_BY_PATH0=%WindowsRoot%\SCRSVR.EXE,1,HSR
  1124. PATH_MAKE_BY_PATH1=%WindowsRoot%\BRASIL.PIF,1,HSR
  1125. PATH_MAKE_BY_PATH2=%WindowsRoot%\BRASIL.EXE,1,HSR
  1126. PATH_MAKE_BY_PATH3=%WindowsRoot%\ALEVIR.EXE,1,HSR
  1127. PATH_MAKE_BY_PATH4=%WindowsRoot%\PUTA!!.EXE,1,HSR
  1128. PATH_MAKE_BY_PATH5=%WindowsRoot%\HACKE!.EXE,1,HSR
  1129. PATH_MAKE_BY_PATH6=%WindowsRoot%\MARCO!.SCR,1,HSR
  1130. PATH_MAKE_BY_PATH7=%WindowsRoot%\SRV32.EXE,1,HSR
  1131. PATH_MAKE_BY_PATH8=%WindowsRoot%\INSTIT.BAT,1,HSR
  1132. PATH_MAKE_BY_PATH9=%WindowsRoot%\MSTASK.EXE,1,HSR
  1133. PATH_MAKE_BY_PATH10=%WindowsRoot%\MQBKUP.EXE,1,HSR
  1134. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,ScrSvr
  1135. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,Brasil
  1136. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,Alevir
  1137. REGISTRY_DELETE_KEY_VALUE3=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,Puta!!
  1138. REGISTRY_DELETE_KEY_VALUE4=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,Hacke!
  1139. REGISTRY_DELETE_KEY_VALUE5=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,Cronos
  1140. REGISTRY_DELETE_KEY_VALUE6=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,Srv32
  1141. REGISTRY_DELETE_KEY_VALUE7=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,Instit
  1142. REGISTRY_DELETE_KEY_VALUE8=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,Mstask
  1143. REGISTRY_DELETE_KEY_VALUE9=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,Mqbkup
  1144. INI_SET_KEY_VALUE0=%WindowsRoot%\WIN.INI,windows,run,""
  1145.  
  1146.  
  1147. [W32/Frethem.Clear]
  1148. PROC_TERMINATE_BY_NAME0=taskbar.exe
  1149. PROC_TERMINATE_BY_NAME1=decrypt-password.exe
  1150. FILE_DELETE_BY_PATH0=%WindowsRoot%\taskbar.exe
  1151. REGISTRY_DELETE_KEY_VALUE0=HKEY_CURRENT_USER,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Task Bar
  1152.  
  1153.  
  1154. [W32/Dadinu.Clear]
  1155. PROC_TERMINATE_BY_NAME3=RUNDLL32.EXE
  1156. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,PAV.EXE
  1157.  
  1158. [W32/Lentin.E.Clear]
  1159. FILE_DELETE_BY_PATH4=%TempRoot%\KITKAT
  1160. REGISTRY_SET_KEY_VALUE0=HKEY_CLASSES_ROOT,exefile\shell\open\command,"",""%1" %*"
  1161.  
  1162. [W32/Lentin.Clear]
  1163. PROC_TERMINATE_BY_NAME0=NAV32_LOADER.EXE
  1164. FILE_DELETE_BY_PATH0=%Systemroot%\NAV32_LOADER.EXE
  1165. PATH_MAKE_BY_PATH0=%SystemRoot%\NAV32_LOADER.EXE,1,HSR
  1166. PROC_TERMINATE_BY_NAME1=TCPSVS32.EXE
  1167. FILE_DELETE_BY_PATH1=%Systemroot%\TCPSVS32.EXE
  1168. PATH_MAKE_BY_PATH1=%Systemroot%\TCPSVS32.EXE,1,HSR
  1169. PROC_TERMINATE_BY_NAME2=WINSERVICES.EXE
  1170. FILE_DELETE_BY_PATH2=%Systemroot%\WINSERVICES.EXE
  1171. PATH_MAKE_BY_PATH2=%Systemroot%\WINSERVICES.EXE,1,HSR
  1172. FILE_DELETE_BY_PATH3=%Systemroot%\WINLOADER32.DLL
  1173. PATH_MAKE_BY_PATH3=%Systemroot%\WINLOADER32.DLL,1,HSR
  1174. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WinServices
  1175. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,WinServices
  1176. REGISTRY_SET_KEY_VALUE0=HKEY_CLASSES_ROOT,exefile\shell\open\command,"",""%1" %*"
  1177. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.hrvg.tk,http://www.pandasoftware.com
  1178. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.hirosh.tk,http://www.pandasoftware.com
  1179. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.hackers.com\html\neohaven.html,http://www.pandasoftware.com
  1180. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.unixhideout.com,http://www.pandasoftware.com
  1181. REGISTRY_SET_KEY_VALUE_IF_EQUAL4=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.neworder.box.sk,http://www.pandasoftware.com
  1182. REGISTRY_SET_KEY_VALUE_IF_EQUAL5=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.blacksun.box.sk,http://www.pandasoftware.com
  1183. REGISTRY_SET_KEY_VALUE_IF_EQUAL6=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://geocities.com/snak33y3s,http://www.pandasoftware.com
  1184. REGISTRY_SET_KEY_VALUE_IF_EQUAL7=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.hackersclub.up.to,http://www.pandasoftware.com
  1185. REGISTRY_SET_KEY_VALUE_IF_EQUAL8=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.ankitfadia.com,http://www.pandasoftware.com
  1186. REGISTRY_SET_KEY_VALUE_IF_EQUAL9=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.coderz.net,http://www.pandasoftware.com
  1187.  
  1188. [Stator.Clear]
  1189. REGISTRY_SET_KEY_VALUE0=HKEY_CLASSES_ROOT,exefile\shell\open\command,"",""%1" %*"
  1190. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,ScanRegistry
  1191. FILE_DELETE_BY_PATH0=%SystemRoot%\LOADPE.COM
  1192. FILE_DELETE_BY_PATH1=%SystemRoot%\SCANREGW.EXE
  1193. DLL_EXEC_FUNCTION_VOID0=QRVKRN.DLL,QRVAUX_ClearW32Stator
  1194.  
  1195. [W32/Reeezak.A.Clear]
  1196. PROC_TERMINATE_BY_NAME0=Christmas.exe
  1197. FILE_DELETE_BY_PATH0=%WindowsRoot%\Christmas.exe
  1198. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,ZaCker
  1199. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start page,http://geocities.com/jobreee/ZaCker.htm,http://www.pandasoftware.com
  1200.  
  1201.  
  1202. [W32/Updater.Clear]
  1203. FILE_DELETE_BY_PATH0=%WindowsRoot%\Update.exe
  1204. FILE_DELETE_BY_PATH1=%StartUpRoot%\Update.vbs
  1205. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Update
  1206.  
  1207. [W32/Goner.A.Clear]
  1208. FILE_DELETE_BY_PATH0=%SystemRoot%\Gone.scr
  1209. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,%SystemRoot%\gone.scr
  1210.  
  1211. [I-Worm/Happy.Clear]
  1212. FILE_DELETE_BY_PATH0=%SystemRoot%\Ska.exe
  1213. FILE_DELETE_BY_PATH1=%SystemRoot%\Ska.dll
  1214. FILE_DELETE_BY_PATH2=%SystemRoot%\Liste.ska
  1215. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunOnce,SKA.EXE
  1216. FILE_MOVE_BY_PATH_TO_PATH0=%SystemRoot%\WSOCK32.SKA,%SystemRoot%\Wsock32.dll
  1217.  
  1218. [W32/Qaz.Clear]
  1219. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,startIE
  1220. FILE_MOVE_BY_PATH_TO_PATH0=%WindowsRoot%\Note.com,%WindowsRoot%\Notepad.exe
  1221.  
  1222. [W32/MSInit.A.Clear]
  1223. FILE_DELETE_BY_PATH0=%SystemRoot%\WININIT.EXE
  1224. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,bymer.scanner
  1225. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,distributed.net.client
  1226. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,msinit
  1227. INI_SET_KEY_VALUE0=%WindowsRoot%\WIN.INI,windows,load,""
  1228.  
  1229. [W32/Badtrans.Clear]
  1230. PROC_TERMINATE_BY_NAME0=Kernel32.EXE
  1231. PROC_TERMINATE_BY_NAME1=Kern.EXE
  1232. FILE_DELETE_BY_PATH0=%SystemRoot%\Kernel32.exe
  1233. FILE_DELETE_BY_PATH1=%SystemRoot%\Kdll.dll
  1234. FILE_DELETE_BY_PATH2=%SystemRoot%\KERN32.EXE
  1235. FILE_DELETE_BY_PATH3=%WindowsRoot%\INETD.EXE
  1236. FILE_REPLACE_TEXT1=%WindowsRoot%\WIN.INI,"%WindowsRoot%\INETD.EXE","",FALSE
  1237. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,Kernel32
  1238. REGISTRY_NULL_KEY_VALUE0=HKEY_CURRENT_USER,Software\Microsoft\Windows NT\CurrentVersion\Windows,Run
  1239.  
  1240.  
  1241.  
  1242. [VBS/VBSWG.J.Clear]
  1243. REGISTRY_DELETE_KEY0=HKEY_CURRENT_USER,Software\OnTheFly
  1244. PROC_TERMINATE_BY_NAME0=WSCRIPT.EXE
  1245. FILE_DELETE_BY_PATH0=%WindowsRoot%\AnnaKournikova.jpg.vbs
  1246.  
  1247. [I-Worm/MTX.Clear]
  1248. PROC_TERMINATE_BY_NAME0=MTX_.EXE
  1249. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,SystemBackup
  1250. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,SystemBackup
  1251. REGISTRY_DELETE_KEY0=HKEY_LOCAL_MACHINE,Software\[MATRIX]
  1252. FILE_DELETE_BY_PATH0=%WindowsRoot%\WIN32.DLL
  1253. FILE_DELETE_BY_PATH1=%WindowsRoot%\IE_PACK.EXE
  1254. FILE_DELETE_BY_PATH2=%WindowsRoot%\MTX_.EXE
  1255. FILE_DELETE_BY_PATH3=%SystemRoot%\WSOCK32.MTX
  1256. FILE_COPY_BY_PATH_TO_PATH0=%SystemRoot%\WSOCK32.DLL,%SystemRoot%\WSOCK32.MTX
  1257.  
  1258. [JS/Kak.Worm.Clear]
  1259. OUTLOOKEXPRESS_DELETE_SIGNATURES_IF_CONTAIN_TEXT_BY_VAR0=KAK_A
  1260. FILE_DELETE_BY_PATH0=%StartUpRoot%\KAK.HTA
  1261. FILE_DELETE_BY_PATH1=%WindowsRoot%\KAK.HTM
  1262. FILE_DELETE_BY_PATH2=%WindowsRoot%\KAK.REG
  1263. FILE_MOVE_BY_PATH_TO_PATH0=%Root%\AE.KAK,%Root%\AUTOEXEC.BAT
  1264. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,cAg0u
  1265. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,cAg0u
  1266.  
  1267. [JS/Kak.Worm.B.Clear]
  1268. OUTLOOKEXPRESS_DELETE_SIGNATURES_IF_CONTAIN_TEXT_BY_VAR0=KAK_B
  1269. FILE_DELETE_BY_PATH0=%StartUpRoot%\DAY.HTA
  1270. FILE_DELETE_BY_PATH1=%WindowsRoot%\COMMAND\DEFAULT.HTM
  1271. FILE_DELETE_BY_PATH2=%WindowsRoot%\DAY.REG
  1272. FILE_DELETE_BY_PATH3=%WindowsRoot%\Help\DAYS.HTA
  1273. FILE_MOVE_BY_PATH_TO_PATH0=%Root%\DAYS.DAY,%Root%\AUTOEXEC.BAT
  1274. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,cDays
  1275. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,cDays
  1276.  
  1277. [VBS/ShellScrap.Worm.Clear]
  1278. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_USERS,.DEFAULT\SOFTWARE\Mirabilis\ICQ\Agent\Apps\ICQ,Parameters
  1279. REGISTRY_SET_KEY_VALUE_WITH_FORMAT_STRING_PATH_PARAMETER0=HKEY_LOCAL_MACHINE,Software\CLASSES\regfile\DefaultIcon,"","%s,1",%WindowsRoot%\REGEDIT.EXE
  1280. REGISTRY_SET_KEY_VALUE_WITH_FORMAT_STRING_PATH_PARAMETER1=HKEY_LOCAL_MACHINE,Software\CLASSES\regfile\shell\open\command,"","%s "%1"",%WindowsRoot%\REGEDIT.EXE
  1281. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices,ScanReg
  1282. REGISTRY_DELETE_KEY_VALUE1=HKEY_USERS,.DEFAULT\SOFTWARE\Mirabilis\ICQ\Agent\Apps\ICQ,Parameters
  1283. REGISTRY_DELETE_KEY_VALUE2=HKEY_CLASSES_ROOT,ShellScrap,AlwaysShowExt
  1284. REGISTRY_SET_KEY_VALUE0=HKEY_CLASSES_ROOT,ShellScrap,NeverShowExt,
  1285. FILE_MOVE_BY_PATH_TO_PATH0=%RecycledRoot%\RECYCLED.VXD,%WindowsRoot%\REGEDIT.EXE
  1286. FILE_DELETE_BY_PATH0=%SystemRoot%\MSINFO16.TLB
  1287. FILE_DELETE_BY_PATH1=%WindowsRoot%\MSINFO16.TLB
  1288. FILE_DELETE_BY_PATH2=%SystemRoot%\SCANREG.VBS
  1289. FILE_DELETE_BY_PATH3=%SystemRoot%\VBASET.OLB
  1290. FILE_DELETE_BY_PATH4=%RecycledRoot%\DBINDEX.VBS
  1291. FILE_DELETE_BY_PATH5=%RecycledRoot%\MSRCYCLD.DAT
  1292. FILE_DELETE_BY_PATH6=%RecycledRoot%\RCYCLDBN.DAT
  1293. FILE_DELETE_BY_PATH7=%WindowsRoot%\LIFE_STAGES.TXT.SHS
  1294. FILE_DELETE_BY_PATH8=%StartUpRoot%\LIFE_STAGES.TXT.SHS
  1295. FILE_DELETE_BY_PATH9=%MyDocumentsRoot%\IMPORTANT*.SHS
  1296. FILE_DELETE_BY_PATH10=%MyDocumentsRoot%\SECRET*.SHS
  1297. FILE_DELETE_BY_PATH11=%MyDocumentsRoot%\UNKNOWN*.SHS
  1298. FILE_DELETE_BY_PATH12=%MyDocumentsRoot%\REPORT*.SHS
  1299. FILE_DELETE_BY_PATH18=%MyDocumentsRoot%\INFO*.SHS
  1300. FILE_DELETE_BY_PATH13=%Root%\IMPORTANT*.SHS
  1301. FILE_DELETE_BY_PATH14=%Root%\SECRET*.SHS
  1302. FILE_DELETE_BY_PATH15=%Root%\UNKNOWN*.SHS
  1303. FILE_DELETE_BY_PATH16=%Root%\REPORT*.SHS
  1304. FILE_DELETE_BY_PATH17=%Root%\INFO*.SHS
  1305. FILE_DELETE_BY_PATH19=%ProgramsRoot%\IMPORTANT*.SHS
  1306. FILE_DELETE_BY_PATH20=%ProgramsRoot%\SECRET*.SHS
  1307. FILE_DELETE_BY_PATH21=%ProgramsRoot%\UNKNOWN*.SHS
  1308. FILE_DELETE_BY_PATH22=%ProgramsRoot%\REPORT*.SHS
  1309. FILE_DELETE_BY_PATH23=%ProgramsRoot%\INFO*.SHS
  1310. FILE_DELETE_BY_PATH24=%StartUpRoot%\LIFE_STAGES.TXT.SHS
  1311.  
  1312. [VBS/CoolNotepad.Worm.Clear]
  1313. FILE_DELETE_BY_REGISTRY_KEY_VALUE00=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,COOL_NOTEPAD_DEMO
  1314. REGISTRY_DELETE_KEY_VALUE00=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,COOL_NOTEPAD_DEMO
  1315. REGISTRY_SET_KEY_VALUE_WITH_TYPE00=DWORD,HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDesktop,0,0
  1316. FILE_DELETE_BY_PATH0=%SystemRoot%\COOL_NOTEPAD_DEMO.TXT.VBS
  1317.  
  1318. [VBS/LoveLetter.AS.Clear]
  1319. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,LINUX32
  1320. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,reload
  1321. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,LINUX32
  1322. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,reload
  1323. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://members.fortunecity.com/plancolombia/macromedia32.zip,http://www.pandasoftware.com
  1324. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://members.fortunecity.com/plancolombia/linux321.zip,http://www.pandasoftware.com
  1325. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://members.fortunecity.com/plancolombia/linux322.zip,http://www.pandasoftware.com
  1326. FILE_DELETE_BY_PATH0=%SystemRoot%\US-PRESIDENT-AND-FBI-SECRETS.HTM
  1327.  
  1328. [VBS/LoveLetter.Clear]
  1329. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1330. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1331. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1332. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1333. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1334. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1335. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1336. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1337. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1338. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1339. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1340. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1341. FILE_DELETE_BY_PATH1=%SystemRoot%\LOVE-LETTER-FOR-YOU.HTM
  1342. FILE_DELETE_BY_PATH2=%SystemRoot%\LOVE-LETTER-FOR-YOU.TXT.VBS
  1343.  
  1344. [VBS/LoveLetter.C.Clear]
  1345. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1346. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1347. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1348. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1349. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1350. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1351. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1352. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1353. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1354. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1355. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1356. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1357. FILE_DELETE_BY_PATH1=%SystemRoot%\VERY FUNNY.VBS
  1358. FILE_DELETE_BY_PATH2=%SystemRoot%\VERY FUNNY.HTM
  1359.  
  1360. [VBS/LoveLetter.D.Clear]
  1361. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1362. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1363. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1364. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1365. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1366. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1367. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1368. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1369. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1370. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1371. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1372. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1373. FILE_DELETE_BY_PATH1=%SystemRoot%\MOTHERSDAY.VBS
  1374. FILE_DELETE_BY_PATH2=%SystemRoot%\MOTHERSDAY.HTM
  1375.  
  1376. [VBS/LoveLetter.E.Clear]
  1377. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1378. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1379. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1380. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WinFAT32
  1381. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1382. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1383. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WinFAT32
  1384. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.hackers.com,http://www.pandasoftware.com
  1385. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.2600.com,http://www.pandasoftware.com
  1386. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1387. FILE_DELETE_BY_PATH1=%SystemRoot%\MOTHERSDAY.VBS
  1388. FILE_DELETE_BY_PATH2=%SystemRoot%\MOTHERSDAY.HTM
  1389.  
  1390. [VBS/LoveLetter.F.Clear]
  1391. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1392. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1393. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1394. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1395. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skycable.tucows.com/files2/setup24.exe,http://www.pandasoftware.com
  1396. FILE_DELETE_BY_PATH2=%SystemRoot%\URGENT_VIRUS_WARNING.HTM
  1397.  
  1398. [VBS/LoveLetter.G.Clear]
  1399. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1400. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1401. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1402. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1403. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1404. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://3doc.dailypussy.com/gallery/bunny.html,http://www.pandasoftware.com
  1405. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Search Page,http://astalavista.box.sk,http://www.pandasoftware.com
  1406. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Defaul_Page_URL,http://www.persiankitty.com,http://www.pandasoftware.com
  1407. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Default_Search_URL,http://www.thecrack.net,http://www.pandasoftware.com
  1408. REGISTRY_SET_KEY_VALUE_IF_EQUAL4=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Local Page,system\protect.htm,http://www.pandasoftware.com
  1409. REGISTRY_SET_KEY_VALUE_IF_EQUAL5=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Window Title,Mocro$oft Internet Exploder by Ommen⌐,Microsoft Internet Explorer
  1410. FILE_DELETE_BY_PATH0=%SystemRoot%\SETUP24.EXE
  1411. FILE_DELETE_BY_PATH1=%SystemRoot%\PROTECT.HTM
  1412. FILE_DELETE_BY_PATH2=%SystemRoot%\PROTECT.VBS
  1413.  
  1414. [VBS/LoveLetter.I.Clear]
  1415. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1416. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,ESKernel32
  1417. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,ES32DLL
  1418. ILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1419. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,ESKernel32
  1420. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,ES32DLL
  1421. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1422. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1423. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1424. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1425. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1426. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1427. FILE_DELETE_BY_PATH1=%SystemRoot%\IMPORTANT.HTM
  1428. FILE_DELETE_BY_PATH2=%SystemRoot%\IMPORTANT.TXT.VBS
  1429.  
  1430. [VBS/LoveLetter.J.Clear]
  1431. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1432. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1433. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1434. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1435. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1436. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1437. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1438. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1439. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1440. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1441. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1442. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1443. FILE_DELETE_BY_PATH1=%SystemRoot%\VIRUS-PROTECTION-INSTRUCTIONS.HTM
  1444. FILE_DELETE_BY_PATH2=%SystemRoot%\VIRUS-PROTECTION-INSTRUCTIONS.VBS
  1445.  
  1446. [VBS/LoveLetter.K.Clear]
  1447. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1448. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1449. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1450. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1451. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1452. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1453. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1454. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1455. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1456. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1457. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1458. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1459. FILE_DELETE_BY_PATH1=%SystemRoot%\NO-HATE-FOR-YOU.HTM
  1460.  
  1461. [VBS/LoveLetter.L.Clear]
  1462. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1463. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1464. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1465. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1466. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1467. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1468. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1469. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1470. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1471. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1472. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1473. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1474. FILE_DELETE_BY_PATH1=%SystemRoot%\BEWERBUNG.HTM
  1475. FILE_DELETE_BY_PATH2=%SystemRoot%\BEWERBUNG.TXT.VBS
  1476.  
  1477. [VBS/LoveLetter.N.Clear]
  1478. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1479. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,SNDVOL32
  1480. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,IEAKDLL
  1481. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1482. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,SNDVOL32
  1483. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,IEAKDLL
  1484. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1485. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.astalavista.box.sk,http://www.pandasoftware.com
  1486. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1487. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1488. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1489. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1490. FILE_DELETE_BY_PATH1=%SystemRoot%\IMPORTANT.HTM
  1491. FILE_DELETE_BY_PATH2=%SystemRoot%\IMPORTANT.TXT.VBS
  1492.  
  1493. [VBS/LoveLetter.P.Clear]
  1494. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1495. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1496. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1497. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1498. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1499. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1500. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.yahoo.com/Vir-Killer.exe,http://www.pandasoftware.com
  1501. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.msn.com/Vir-Killer.exe,http://www.pandasoftware.com
  1502. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.Hotmail.com/Vir-Killer.exe,http://www.pandasoftware.com
  1503. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.Aol.com/Vir-Killer.exe,http://www.pandasoftware.com
  1504. FILE_DELETE_BY_PATH0=%SystemRoot%\SETUP24.EXE
  1505. FILE_DELETE_BY_PATH1=%SystemRoot%\VIR-KILLER.HTM
  1506. FILE_DELETE_BY_PATH2=%SystemRoot%\VIR-KILLER.VBS
  1507.  
  1508. [VBS/LoveLetter.Q.Clear]
  1509. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1510. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MUSERS32.VBS
  1511. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,USER32DLL
  1512. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1513. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MUSERS32.VBS
  1514. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,USER32DLL
  1515. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1516. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1517. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1518. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1519. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1520. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1521. FILE_DELETE_BY_PATH1=%SystemRoot%\LOOK.HTM
  1522. FILE_DELETE_BY_PATH2=%SystemRoot%\LOOK.VBS
  1523.  
  1524. [VBS/LoveLetter.S.Clear]
  1525. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1526. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1527. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1528. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1529. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1530. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1531. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1532. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1533. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1534. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1535. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1536. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1537. FILE_DELETE_BY_PATH1=%SystemRoot%\KILLER.HTM
  1538. FILE_DELETE_BY_PATH2=%SystemRoot%\KILLEMALL.TXT.VBS
  1539.  
  1540. [VBS/LoveLetter.T.Clear]
  1541. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1542. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1543. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1544. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1545. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1546. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1547. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1548. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.2600.com,http://www.pandasoftware.com
  1549. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1550. FILE_DELETE_BY_PATH1=%SystemRoot%\BAND-AID.DOC.VBS
  1551.  
  1552. [VBS/LoveLetter.U.Clear]
  1553. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1554. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1555. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1556. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1557. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1558. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1559. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1560. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1561. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1562. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1563. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1564. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1565. FILE_DELETE_BY_PATH1=%SystemRoot%\MAJOR BUG & VIRUS FIX.HTM
  1566.  
  1567. [VBS/LoveLetter.V.Clear]
  1568. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1569. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1570. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1571. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1572. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1573. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1574. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1575. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.uol.com.br/,http://www.pandasoftware.com
  1576. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1577. FILE_DELETE_BY_PATH1=%SystemRoot%\UOL.HTM
  1578. FILE_DELETE_BY_PATH2=%SystemRoot%\UOL.TXT.VBS
  1579.  
  1580. [VBS/LoveLetter.W.Clear]
  1581. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1582. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1583. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1584. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1585. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1586. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1587. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.2600.com,http://www.pandasoftware.com
  1588. FILE_DELETE_BY_PATH1=%SystemRoot%\BUG AND VIRUS FIX.HTM
  1589. FILE_DELETE_BY_PATH2=%SystemRoot%\BUG AND VIRUS FIX.TXT.VBS
  1590.  
  1591. [I-Worm/Verona.B.Clear]
  1592. FILE_DELETE_BY_PATH0=%WindowsRoot%\Sysrnj.exe
  1593. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CLASSES_ROOT,.arj,,rnjfile,WinRAR
  1594. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CLASSES_ROOT,.avi,,rnjfile,avifile
  1595. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CLASSES_ROOT,.bmp,,rnjfile,Paint.Picture
  1596. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CLASSES_ROOT,.doc,,rnjfile,Word.Document.8
  1597. REGISTRY_SET_KEY_VALUE_IF_EQUAL4=HKEY_CLASSES_ROOT,.exe,,rnjfile,exefile
  1598. REGISTRY_SET_KEY_VALUE_IF_EQUAL5=HKEY_CLASSES_ROOT,.gif,,rnjfile,giffile
  1599. REGISTRY_SET_KEY_VALUE_IF_EQUAL6=HKEY_CLASSES_ROOT,.jpe,,rnjfile,jpegfile
  1600. REGISTRY_SET_KEY_VALUE_IF_EQUAL7=HKEY_CLASSES_ROOT,.jpeg,,rnjfile,jpegfile
  1601. REGISTRY_SET_KEY_VALUE_IF_EQUAL8=HKEY_CLASSES_ROOT,.jpg,,rnjfile,jpegfile
  1602. REGISTRY_SET_KEY_VALUE_IF_EQUAL9=HKEY_CLASSES_ROOT,.lha,,rnjfile,WinRAR
  1603. REGISTRY_SET_KEY_VALUE_IF_EQUAL10=HKEY_CLASSES_ROOT,.mp2,,rnjfile,mpegfile
  1604. REGISTRY_SET_KEY_VALUE_IF_EQUAL11=HKEY_CLASSES_ROOT,.mp3,,rnjfile,mp3file
  1605. REGISTRY_SET_KEY_VALUE_IF_EQUAL12=HKEY_CLASSES_ROOT,.mpeg,,rnjfile,mpegfile
  1606. REGISTRY_SET_KEY_VALUE_IF_EQUAL13=HKEY_CLASSES_ROOT,.mpg,,rnjfile,mpegfile
  1607. REGISTRY_SET_KEY_VALUE_IF_EQUAL14=HKEY_CLASSES_ROOT,.rar,,rnjfile,WinRAR
  1608. REGISTRY_SET_KEY_VALUE_IF_EQUAL15=HKEY_CLASSES_ROOT,.reg,,rnjfile,regfile
  1609. REGISTRY_SET_KEY_VALUE_IF_EQUAL16=HKEY_CLASSES_ROOT,.vqf,,rnjfile,
  1610. REGISTRY_SET_KEY_VALUE_IF_EQUAL17=HKEY_CLASSES_ROOT,.wma,,rnjfile,WMAfile
  1611. REGISTRY_SET_KEY_VALUE_IF_EQUAL18=HKEY_CLASSES_ROOT,.wmf,,rnjfile,WMF_auto_file
  1612. REGISTRY_SET_KEY_VALUE_IF_EQUAL19=HKEY_CLASSES_ROOT,.wmv,,rnjfile,WMVFile
  1613. REGISTRY_SET_KEY_VALUE_IF_EQUAL20=HKEY_CLASSES_ROOT,.xls,,rnjfile,Excel.Sheet.8
  1614. REGISTRY_SET_KEY_VALUE_IF_EQUAL21=HKEY_CLASSES_ROOT,.zip,,rnjfile,WinZip
  1615. REGISTRY_DELETE_KEY0=HKEY_CLASSES_ROOT,rnjfile\DefaultIcon
  1616. REGISTRY_DELETE_KEY1=HKEY_CLASSES_ROOT,rnjfile\shell\open\command
  1617. REGISTRY_DELETE_KEY2=HKEY_CLASSES_ROOT,rnjfile\shell\open
  1618. REGISTRY_DELETE_KEY3=HKEY_CLASSES_ROOT,rnjfile\shell\
  1619. REGISTRY_DELETE_KEY4=HKEY_CLASSES_ROOT,rnjfile
  1620.  
  1621.  
  1622. [W32/Navidad.Clear]
  1623. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Win32BaseServiceMOD
  1624. REGISTRY_SET_KEY_VALUE0=HKEY_CLASSES_ROOT,exefile\shell\open\command,"",""%1" %*"
  1625. FILE_DELETE_BY_PATH1=%SystemRoot%\WINSVRC.VXD
  1626. PROC_TERMINATE_BY_NAME0=NAVIDAD.EXE
  1627.  
  1628. [W32/Navidad.B.Clear]
  1629. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Win32BaseServiceMOD
  1630. REGISTRY_SET_KEY_VALUE0=HKEY_CLASSES_ROOT,exefile\shell\open\command,"",""%1" %*"
  1631. PROC_TERMINATE_BY_NAME0=WINTASK.EXE
  1632. PROC_TERMINATE_BY_NAME1=EMANUEL.EXE
  1633. FILE_DELETE_BY_PATH0=%SystemRoot%\wintask.exe
  1634.  
  1635. [W32/FunLove.Clear]
  1636. PROC_TERMINATE_BY_NAME0=FLCSS.EXE
  1637. PROC_TERMINATE_BY_NAME1=BRIDE.EXE
  1638. FILE_DELETE_BY_PATH0=%SystemRoot%\FLCSS.EXE
  1639. FILE_DELETE_BY_PATH1=%SystemRoot%\BRIDE.EXE
  1640. PATH_MAKE_BY_PATH0=%SystemRoot%\FLCSS.EXE,1,HSR
  1641. SERVICE_DELETE_BY_NAME0=FLC
  1642. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,FLC
  1643.  
  1644. [W32/PrettyPark.Clear]
  1645. REGISTRY_SET_KEY_VALUE0=HKEY_CLASSES_ROOT,exefile\shell\open\command,"",""%1" %*"
  1646. PROC_TERMINATE_BY_NAME0=FILES32.VXD
  1647. FILE_DELETE_BY_PATH0=%SystemRoot%\FILES32.VXD
  1648.  
  1649. [VBS/Help.Clear]
  1650. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_CURRENT_USER,SOFTWARE\Help,wallPaper
  1651. FILE_DELETE_BY_PATH0=%WindowsRoot%\UNTITLED.HTM
  1652. REGISTRY_DELETE_KEY0=HKEY_CURRENT_USER,SOFTWARE\Help
  1653. REGISTRY_SET_KEY_VALUE0=HKEY_CURRENT_USER,Control Panel\Desktop,Wallpaper,""
  1654.  
  1655. [W32/SirCam.Clear.NT]
  1656. PROC_TERMINATE_BY_NAME0=SIRC32.EXE
  1657. PROC_TERMINATE_BY_NAME1=SCAM32.EXE
  1658. PROC_TERMINATE_BY_NAME2=RUN32.EXE
  1659. PROC_TERMINATE_BY_NAME3=RUNDLL32.EXE
  1660. REGISTRY_SET_KEY_VALUE0=HKEY_CLASSES_ROOT,exefile\shell\open\command,"",""%1" %*"
  1661. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices,Driver32
  1662. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices,Driver32
  1663. REGISTRY_DELETE_KEY0=HKEY_LOCAL_MACHINE,SOFTWARE\SirCam
  1664. FILE_DELETE_BY_PATH00=%RecycledRoot%\SIRC32.EXE
  1665. FILE_DELETE_BY_PATH01=%SystemRoot%\SCD.DLL
  1666. FILE_DELETE_BY_PATH02=%SystemRoot%\SCW1.DLL
  1667. FILE_DELETE_BY_PATH03=%SystemRoot%\SCI1.DLL
  1668. FILE_DELETE_BY_PATH04=%SystemRoot%\SCY1.DLL
  1669. FILE_DELETE_BY_PATH05=%SystemRoot%\SCH1.DLL
  1670. FILE_DELETE_BY_PATH06=%SystemRoot%\SCT1.DLL
  1671. FILE_DELETE_BY_PATH07=%WindowsRoot%\ScMx32.exe
  1672. FILE_DELETE_BY_PATH08=%StartUpRoot%\Microsoft Internet Office.exe
  1673. FILE_DELETE_BY_PATH09=%RecycledRoot%\SIRCAM.SYS
  1674. FILE_DELETE_BY_PATH10=%Root%\SIRC32.EXE
  1675. FILE_REPLACE_TEXT0=%Root%\AUTOEXEC.BAT,"@win \recycled\sirc32.exe","",FALSE
  1676. FILE_REPLACE_TEXT1=%WindowsRoot%\WIN.INI,"SirC32.exe="C:\SirC32.exe"","",FALSE
  1677. REGISTRY_REPLACE_TEXT_IN_VALUE0=HKEY_CLASSES_ROOT,"inffile\shell\Install\command","","RUN32.EXE","RUNDLL32.EXE",FALSE
  1678. REGISTRY_REPLACE_TEXT_IN_VALUE1=HKEY_CLASSES_ROOT,"Unknown\shell\openas\command","","RUN32.EXE","RUNDLL32.EXE",FALSE
  1679. FILE_MOVE_BY_PATH_TO_PATH0=%SystemRoot%\RUN32.EXE,%SystemRoot%\RUNDLL32.EXE
  1680.  
  1681. [W32/SirCam.Clear.9X]
  1682. PROC_TERMINATE_BY_NAME0=SIRC32.EXE
  1683. PROC_TERMINATE_BY_NAME1=SCAM32.EXE
  1684. PROC_TERMINATE_BY_NAME2=RUN32.EXE
  1685. PROC_TERMINATE_BY_NAME3=RUNDLL32.EXE
  1686. REGISTRY_SET_KEY_VALUE0=HKEY_CLASSES_ROOT,exefile\shell\open\command,"",""%1" %*"
  1687. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices,Driver32
  1688. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices,Driver32
  1689. REGISTRY_DELETE_KEY0=HKEY_LOCAL_MACHINE,SOFTWARE\SirCam
  1690. FILE_DELETE_BY_PATH00=%RecycledRoot%\SIRC32.EXE
  1691. FILE_DELETE_BY_PATH01=%SystemRoot%\SCD.DLL
  1692. FILE_DELETE_BY_PATH02=%SystemRoot%\SCW1.DLL
  1693. FILE_DELETE_BY_PATH03=%SystemRoot%\SCI1.DLL
  1694. FILE_DELETE_BY_PATH04=%SystemRoot%\SCY1.DLL
  1695. FILE_DELETE_BY_PATH05=%SystemRoot%\SCH1.DLL
  1696. FILE_DELETE_BY_PATH06=%SystemRoot%\SCT1.DLL
  1697. FILE_DELETE_BY_PATH07=%WindowsRoot%\ScMx32.exe
  1698. FILE_DELETE_BY_PATH08=%StartUpRoot%\Microsoft Internet Office.exe
  1699. FILE_DELETE_BY_PATH09=%RecycledRoot%\SIRCAM.SYS
  1700. FILE_DELETE_BY_PATH10=%Root%\SIRC32.EXE
  1701. FILE_REPLACE_TEXT0=%Root%\AUTOEXEC.BAT,"@win \recycled\sirc32.exe","",FALSE
  1702. FILE_REPLACE_TEXT1=%WindowsRoot%\WIN.INI,"SirC32.exe="C:\SirC32.exe"","",FALSE
  1703. REGISTRY_REPLACE_TEXT_IN_VALUE0=HKEY_CLASSES_ROOT,"inffile\shell\Install\command","","RUN32.EXE","RUNDLL.EXE",FALSE
  1704. REGISTRY_REPLACE_TEXT_IN_VALUE1=HKEY_CLASSES_ROOT,"Unknown\shell\openas\command","","RUN32.EXE","RUNDLL32.EXE",FALSE
  1705. FILE_MOVE_BY_PATH_TO_PATH0=%WindowsRoot%\RUN32.EXE,%WindowsRoot%\RUNDLL32.EXE
  1706.  
  1707. [W32/Nimda.Clear]
  1708. PROC_TERMINATE_BY_NAME0=LOAD.EXE
  1709. FILE_DELETE_BY_PATH00=%WindowsRoot%\MMC.EXE
  1710. FILE_DELETE_BY_PATH01=%WindowsRoot%\CSRSS.EXE
  1711. FILE_DELETE_BY_PATH02=%TempRoot%\MEP*.EXE
  1712. FILE_DELETE_BY_PATH03=%WindowsRoot%\WININIT.INI
  1713. FILE_REPLACE_TEXT1=%WindowsRoot%\SYSTEM.INI," load.exe -dontrunold","",FALSE
  1714. FILE_DELETE_BY_PATH04=%TempRoot%\MEP*.*
  1715. FILE_DELETE_BY_PATH05=%WindowsRoot%\MEP*.*
  1716. FILE_DELETE_BY_PATH06=%SystemRoot%\LOAD.EXE
  1717. USER_DISABLE_BY_NAME0=guest
  1718. FILE_DELETE_BY_PATH07=C:\ADMIN.DLL
  1719. FILE_DELETE_BY_PATH08=D:\ADMIN.DLL
  1720. FILE_DELETE_BY_PATH09=E:\ADMIN.DLL
  1721. FILE_DELETE_BY_PATH10=C:\HTTPODBC.DLL
  1722. FILE_DELETE_BY_PATH11=D:\HTTPODBC.DLL
  1723. FILE_DELETE_BY_PATH12=E:\HTTPODBC.DLL
  1724. FILE_DELETE_BY_PATH13=C:\INETPUB\WWWROOT\TFTP*
  1725. FILE_DELETE_BY_PATH14=C:\INETPUB\SCRIPTS\TFTP*
  1726. FILE_DELETE_BY_PATH15=D:\INETPUB\WWWROOT\TFTP*
  1727. FILE_DELETE_BY_PATH16=D:\INETPUB\SCRIPTS\TFTP*
  1728. FILE_DELETE_BY_PATH17=E:\INETPUB\WWWROOT\TFTP*
  1729. FILE_DELETE_BY_PATH18=E:\INETPUB\SCRIPTS\TFTP*
  1730. FILE_DELETE_BY_PATH19=F:\INETPUB\WWWROOT\TFTP*
  1731. FILE_DELETE_BY_PATH20=F:\INETPUB\SCRIPTS\TFTP*
  1732. FILE_DELETE_BY_PATH21=G:\INETPUB\WWWROOT\TFTP*
  1733. FILE_DELETE_BY_PATH22=G:\INETPUB\SCRIPTS\TFTP*
  1734.  
  1735. [W32/Klez.Clear]
  1736. PROC_TERMINATE_BY_NAME0=Wink*.exe
  1737. PROC_TERMINATE_BY_NAME1=Wqk.exe
  1738. PROC_TERMINATE_BY_NAME2=Winsvc.exe
  1739. PROC_TERMINATE_BY_NAME3=Krn132.exe
  1740. PROC_TERMINATE_BY_LINKED_DLL0=Wqk.dll
  1741. FILE_DELETE_BY_PATH0=%SystemRoot%\Wink*.exe
  1742. FILE_DELETE_BY_PATH1=%SystemRoot%\Wqk.exe
  1743. FILE_DELETE_BY_PATH2=%TempRoot%\k*.exe
  1744. FILE_DELETE_BY_PATH3=%SystemRoot%\Winsvc.exe
  1745. FILE_DELETE_BY_PATH4=%SystemRoot%\Krn132.exe
  1746. FILE_DELETE_ON_NATIVE_REBOOT0=%SystemRoot%\Wqk.dll
  1747. SERVICE_DELETE_BY_NAME0=Winsvc
  1748. PATH_MAKE_BY_PATH0=%SystemRoot%\WQK.EXE,1,HSR
  1749. PATH_MAKE_BY_PATH1=%SystemRoot%\WQK.DLL,1,HSR
  1750. PATH_MAKE_BY_PATH2=%SystemRoot%\Winsvc.exe,1,HSR
  1751. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,WQK
  1752. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Wink*
  1753. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Winsvc
  1754. REGISTRY_DELETE_KEY_VALUE3=HKEY_LOCAL_MACHINE,SYSTEM\CurrentControlSet\Services,WQK
  1755. REGISTRY_DELETE_KEY_VALUE4=HKEY_LOCAL_MACHINE,SYSTEM\CurrentControlSet\Services,Wink*
  1756. REGISTRY_DELETE_KEY_VALUE5=HKEY_LOCAL_MACHINE,SYSTEM\CurrentControlSet\Services,Winsvc
  1757. REGISTRY_DELETE_KEY_VALUE6=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Krn132
  1758. REGISTRY_REPLACE_TEXT_IN_VALUE0=HKEY_LOCAL_MACHINE,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows","AppInit_DLLs","Wqk.dll","",FALSE
  1759.  
  1760. [W32/Vote.Clear]
  1761. FILE_DELETE_BY_PATH00=%SystemRoot%\Zacker.vbs
  1762. FILE_DELETE_BY_PATH01=%WindowsRoot%\MixDaLaL.vbs
  1763. FILE_DELETE_BY_PATH02=%WindowsRoot%\WTC.exe
  1764. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,Norton.Thar
  1765. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://us.f1.yahoofs.com/users/da36d538/bc/TimeUpdate.exe?bcaVq97ATaW0yAxk,http://www.pandasoftware.com
  1766. FILE_REPLACE_TEXT0=%Root%\AUTOEXEC.BAT,"echo y | format C:","",FALSE
  1767.  
  1768.  
  1769. [ByteStrings]
  1770. KAK_A=4B414B2E48544D
  1771. KAK_B=44454641554C542E48544D
  1772.  
  1773.  
  1774. [GenericRegistryClean]
  1775. REG_SCAN_KEY_DATA_VALUES=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run
  1776. REG_SCAN_KEY_DATA_VALUES=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunOnce
  1777. REG_SCAN_KEY_DATA_VALUES=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices
  1778. REG_SCAN_KEY_DATA_VALUES=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
  1779. REG_SCAN_KEY_DATA_VALUES=HKEY_CURRENT_USER,Software\Microsoft\Windows\CurrentVersion\Run
  1780. REG_SCAN_KEY_DATA_VALUES=HKEY_CURRENT_USER,Software\Microsoft\Windows\CurrentVersion\RunOnce
  1781. REG_SCAN_EXTENSION_COMMAND=exefile,open,""%1" %*"
  1782. REG_SCAN_EXTENSION_COMMAND=comfile,open,""%1" %*"
  1783. REG_SCAN_EXTENSION_COMMAND=piffile,open,""%1" %*"
  1784. REG_SCAN_EXTENSION_COMMAND=scrfile,open,""%1" /S"
  1785. REG_SCAN_EXTENSION_COMMAND=scrfile,config,"%1"
  1786. REG_SCAN_EXTENSION_COMMAND=batfile,open,""%1" /S"
  1787. REG_SCAN_EXTENSION_COMMAND=regfile,open,"regedit.exe "%1""
  1788. INI_SCAN_DATA_VALUE=win.ini,windows,run
  1789. INI_SCAN_DATA_VALUE=win.ini,windows,load
  1790. STARTUP_FOLDER_SCAN=
  1791.  
  1792. [GenericRegistryClean.NT]
  1793. REG_SCAN_EXTENSION_COMMAND=txtfile,open,"%windowsroot%\system32\notepad.exe "%1""
  1794.  
  1795. [GenericRegistryClean.9x]
  1796. REG_SCAN_EXTENSION_COMMAND=txtfile,open,"%windowsroot%\notepad.exe "%1""
  1797.