home *** CD-ROM | disk | FTP | other *** search
/ CD-ROM Data 2003 March / CD Rom Data Mart 2003.iso / Freeware / Panda / QRV.KRN < prev    next >
Encoding:
INI File  |  2002-04-29  |  69.6 KB  |  1,445 lines
  1. [Version]
  2. MinVersion=2.6.2.26
  3. MaxVersion=2.7.0.0
  4. Version=01.09.04.02
  5.  
  6. [VirusInformation]
  7. W32/Stator=W32/Stator
  8. W32/Reeezak.A=W32/Reeezak.A@mm,Keyluc,W32/Zacker.C,W32/Maldal.C@mm
  9. W32/Updater=W32/Updater
  10. W32/Goner.A=W32/Goner.A
  11. I-Worm/Happy=I-Worm/Happy
  12. W32/Qaz=W32/Qaz
  13. W32/MSInit.A=W32/MSInit.A
  14. W32/Badtrans=W32/Badtrans.B,W32/Badtrans@MM
  15. W32/Klez=W32/Klez
  16. W32/Vote=Vote
  17. W32/Nimda=Nimda
  18. W32/SirCam=W32/SirCam@mm
  19. VBS/Help=VBS/HappyTime.A
  20. VBS/SST.A=VBS/SST.A,I-Worm/Lee.O
  21. W32/PrettyPark=W32/ExploreZip.Worm.Pack,Wrom.ExploreZip
  22. I-Worm/MTX=I-Worm/MTX
  23. JS/Kak.Worm=VBS.KakWorm, Kagou-Anti-Frosoft, Wsript.Kak.A
  24. JS/Kak.Worm.B=VBS.KakWorm.B, Wsript.Kak.B, Days
  25. VBS/ShellScrap.Worm=VBS/ShellScrap.Worm
  26. I-Worm/Verona.B=BleBla.B, I-Worm-Blebla.B, Troj/Blebla.B, W32/BleBla@mm
  27. W32/Navidad=W32/Navidad
  28. W32/Navidad.B=W32/Navidad.B
  29. VBS/CoolNotepad.Worm=VBS/CoolNotepad.Worm
  30. VBS/LoveLetter=VBS/LoveLetter
  31. VBS/LoveLetter.AS=VBS/LoveLetter.AS
  32. VBS/LoveLetter.C=VBS/LoveLetter.C
  33. VBS/LoveLetter.D=VBS/LoveLetter.D
  34. VBS/LoveLetter.E=VBS/LoveLetter.E
  35. VBS/LoveLetter.F=VBS/LoveLetter.F
  36. VBS/LoveLetter.G=VBS/LoveLetter.G
  37. VBS/LoveLetter.I=VBS/LoveLetter.I
  38. VBS/LoveLetter.J=VBS/LoveLetter.J
  39. VBS/LoveLetter.K=VBS/LoveLetter.K
  40. VBS/LoveLetter.L=VBS/LoveLetter.L
  41. VBS/LoveLetter.N=VBS/LoveLetter.N
  42. VBS/LoveLetter.P=VBS/LoveLetter.P
  43. VBS/LoveLetter.Q=VBS/LoveLetter.Q
  44. VBS/LoveLetter.S=VBS/LoveLetter.S
  45. VBS/LoveLetter.T=VBS/LoveLetter.T
  46. VBS/LoveLetter.U=VBS/LoveLetter.U
  47. VBS/LoveLetter.V=VBS/LoveLetter.V
  48. VBS/LoveLetter.W=VBS/LoveLetter.W
  49. W32/FunLove=Win32_FLC, Win32.FLC, FLCSS
  50.  
  51. [VirusFamilies]
  52. F23=STATOR
  53. F21=REEEZAK
  54. F20=UPDATER
  55. F19=GONER
  56. F18=HAPPY
  57. F17=QAZ
  58. F16=MSINIT
  59. F15=BADTRANS
  60. F14=KLEZ
  61. F13=VOTE
  62. F12=NIMDA
  63. F11=SIRCAM
  64. F07=FUNLOVE
  65. F09=ANNA KOURNIKOVA
  66. F03=COOL NOTEPAD
  67. F10=HELP
  68. F00=I LOVE YOU
  69. F01=KAK WORM
  70. F04=MATRIX
  71. F06=NAVIDAD
  72. F08=PRETTY PARK
  73. F02=SHELL SCRAP
  74. F05=VERONA
  75.  
  76. [F23.Family]
  77. Name=STATOR
  78. FileName=
  79.  
  80.  
  81. [F22.Family]
  82. Name=BADTRANS@MM
  83. FileName=
  84.  
  85. [F21.Family]
  86. Name=REEEZAK
  87. FileName=
  88.  
  89. [F20.Family]
  90. Name=UPDATER
  91. FileName=
  92.  
  93. [F19.Family]
  94. Name=GONER
  95. FileName=
  96.  
  97. [F18.Family]
  98. Name=HAPPY
  99. FileName=
  100.  
  101. [F17.Family]
  102. Name=QAZ
  103. FileName=
  104.  
  105. [F16.Family]
  106. Name=MSINIT
  107. FileName=
  108.  
  109. [F15.Family]
  110. Name=BADTRANS
  111. FileName=
  112.  
  113. [F14.Family]
  114. Name=KLEZ
  115. FileName=
  116.  
  117. [F13.Family]
  118. Name=VOTE
  119. FileName=
  120.  
  121. [F12.Family]
  122. Name=NIMDA
  123. FileName=
  124.  
  125. [F11.Family]
  126. Name=SIRCAM
  127. FileName=
  128.  
  129. [F10.Family]
  130. Name=HELP
  131. FileName=
  132.  
  133. [F09.Family]
  134. Name=ANNA KOURNIKOVA
  135. FileName=
  136.  
  137. [F08.Family]
  138. Name=PRETTY PARK
  139. FileName=
  140.  
  141. [F00.Family]
  142. Name=I LOVE YOU
  143. FileName=
  144.  
  145. [F01.Family]
  146. Name=KAK WORM
  147. FileName=KAK
  148.  
  149. [F02.Family]
  150. Name=SHELL SCRAP
  151. FileName=SHELL
  152.  
  153. [F03.Family]
  154. Name=COOL NOTEPAD
  155. FileName=
  156.  
  157. [F04.Family]
  158. Name=MTX
  159. FileName=
  160.  
  161. [F05.Family]
  162. Name=VERONA
  163. FileName=
  164.  
  165. [F06.Family]
  166. Name=NAVIDAD
  167. FileName=
  168.  
  169. [F07.Family]
  170. Name=FUNLOVE
  171. FileName=
  172.  
  173. [W32/Stator.Info]
  174. Family=F23
  175. Detect=Stator
  176. Clear=Stator
  177. Aliases=Stator
  178. Ids=56530,59493,59627,61025,61120,59471
  179. LaunchPAV=1,/clv /aut /loc /nos /ext:exe;com
  180. LaunchPAV32=1,/clv /aut /loc /nos /ext:exe;com
  181.  
  182. [W32/Reeezak.A.Info]
  183. Family=F21
  184. Detect=W32/Reeezak.A
  185. Clear=W32/Reeezak.A
  186. Aliases=Keyluc,W32/Zacker.C,W32/Maldal.C@mm
  187. Ids=59897
  188. LaunchPAV=1,/clv /aut /nbr /loc /nos /ext:exe
  189. LaunchPAV32=1,/clv /aut /nbr /loc /nos /ext:exe
  190.  
  191. [W32/Updater.Info]
  192. Family=F20
  193. Detect=W32/Updater
  194. Clear=W32/Updater
  195. Aliases=W32/Updater
  196. Ids=60086
  197. LaunchPAV=1,/clv /aut /nbr /loc /nos /ext:exe;vbs
  198. LaunchPAV32=1,/clv /aut /nbr /loc /nos /ext:exe;vbs
  199.  
  200.  
  201. [W32/Goner.A.Info]
  202. Family=F19
  203. Detect=W32/Goner.A
  204. Clear=W32/Goner.A
  205. Aliases=W32/Goner.A@mm
  206. Ids=59868
  207. LaunchPAV=1,/clv /aut /nbr /loc /nos /ext:scr
  208. LaunchPAV32=1,/clv /aut /nbr /loc /nos /ext:scr
  209.  
  210. [I-Worm/Happy.Info]
  211. Family=F18
  212. Detect=I-Worm/Happy
  213. Clear=I-Worm/Happy
  214. Aliases=W32/Ska
  215. Ids=24129
  216. LaunchPAV=1,/clv /aut /nbr /loc /nos /ext:exe;ska;dll
  217. LaunchPAV32=1,/clv /aut /nbr /loc /nos /ext:exe;ska;dll
  218.  
  219. [W32/Qaz.Info]
  220. Family=F17
  221. Detect=W32/Qaz
  222. Clear=W32/Qaz
  223. Aliases=Trojan/Notepad
  224. Ids=55307
  225. LaunchPAV=1,/clv /aut /nbr /loc /nos /ext:exe
  226. LaunchPAV32=1,/clv /aut /nbr /loc /nos /ext:exe
  227.  
  228. [W32/MSInit.A.Info]
  229. Family=F16
  230. Detect=W32/MSInit.A
  231. Clear=W32/MSInit.A
  232. Aliases=Worm/Dnet_Winit
  233. Ids=55309,59719
  234. LaunchPAV=1,/clv /aut /nbr /loc /nos /ext:exe
  235. LaunchPAV32=1,/clv /aut /nbr /loc /nos /ext:exe
  236.  
  237.  
  238. [W32/Badtrans.Info]
  239. Family=F15
  240. Detect=W32/Badtrans
  241. Clear=W32/Badtrans
  242. Aliases=W32/Badtrans.B,W32/Badtrans@MM
  243. Ids=59851,57861,57862,59162,59412
  244. LaunchPAV=1,/clv /aut /nbr /loc /nos /ext:exe;pif;scr;dll
  245. LaunchPAV32=1,/clv /aut /nbr /loc /nos /ext:exe;pif;scr;dll
  246.  
  247.  
  248. [W32/Klez.Info]
  249. Family=F14
  250. Detect=W32/Klez
  251. Clear=W32/Klez
  252. Aliases=W32/Klez
  253. Ids=58972,60202,60355
  254. LaunchPAV=1,/clv /aut /nbr /loc /nos /aex /del /delp /cmp
  255. LaunchPAV32=1,/clv /aut /nbr /loc /nos /aex /del /delp /cmp
  256. LaunchAtRunOnce=1,/selfdel /auto:clear /nopav
  257.  
  258.  
  259. [W32/Vote.Info]
  260. Family=F13
  261. Detect=W32/Vote
  262. Clear=W32/Vote
  263. Aliases=W32/Vote,VOTE
  264. Ids=58507,59595,59596,59597
  265. LaunchPAV=1,/clv /aut /nbr /loc /nos /ext:vbs;exe
  266. LaunchPAV32=1,/clv /aut /nbr /loc /nos /ext:vbs;exe
  267.  
  268. [W32/Nimda.Info]
  269. Family=F12
  270. Detect=W32/Nimda
  271. Clear=W32/Nimda
  272. Aliases=W32/Nimda.A@mm,Nimda,W32/Nimda.D,W32/Nimda.E
  273. Ids=58707,58941
  274. LaunchPAV=1,/loc /nbr /clv /del /nos /aut /cmp /ext:dll;exe;tmp;doc;dot;eml;nws;asp;htm;html;vir;;
  275. LaunchPAV32=1,/loc /nbr /clv /del /nos /aut /cmp /ext:dll;exe;tmp;doc;dot;eml;nws;asp;htm;html;vir;;
  276.  
  277. [VBS/SST.A.Info]
  278. Family=F09
  279. Detect=VBS/SST.A
  280. Clear=VBS/SST.A
  281. Aliases=VBS/SST.A,I-Worm/Lee.O
  282. Ids=15400
  283. LaunchPAV=1,/clv /aut /nbr /loc /nos /ext:vbs;ini
  284. LaunchPAV32=1,/clv /aut /nbr /loc /nos /ext:vbs;ini
  285.  
  286. [W32/PrettyPark.Info]
  287. Family=F08
  288. Detect=W32/PrettyPark
  289. Clear=W32/PrettyPark
  290. Aliases=W32/ExploreZip.Worm.Pack,Wrom.ExploreZip
  291. Ids=55018,28008
  292. LaunchPAV=1,/clv /aut /nbr /loc /nos /ext:exe;vxd
  293. LaunchPAV32=1,/clv /aut /nbr /loc /nos /ext:exe;vxd
  294.  
  295. [I-Worm/MTX.Info]
  296. Family=F04
  297. Detect=I-Worm/MTX
  298. Clear=I-Worm/MTX
  299. Aliases=I-Worm/MTX
  300. Ids=28889,51714,55212
  301. LaunchPAV=1,/mtx /clv /aut /aex /nbr /loc /nos
  302. LaunchPAV32=1,/mtx /clv /aut /aex /nbr /loc /nos
  303.  
  304. [VBS/CoolNotepad.Worm.Info]
  305. Family=F03
  306. Detect=VBS/CoolNotepad.Worm
  307. Clear=VBS/CoolNotepad.Worm
  308. Aliases=VBS/CoolNotepad.Worm
  309. Ids=51328
  310. LaunchPAV=1,/clv /aut /nbr /loc /nos /ext:vbs;ini
  311. LaunchPAV32=1,/clv /aut /nbr /loc /nos /ext:vbs;ini
  312.  
  313. [VBS/LoveLetter.AS.Info]
  314. Family=F00
  315. Detect=VBS/LoveLetter.AS
  316. Clear=VBS/LoveLetter.AS
  317. Aliases=VBS/LoveLetter.AS
  318. Ids=55101
  319.  
  320. [JS/Kak.Worm.Info]
  321. Family=F01
  322. Detect=JS/Kak.Worm
  323. Clear=JS/Kak.Worm
  324. Aliases=VBS.KakWorm, Kagou-Anti-Frosoft, Wsript.Kak.A
  325. Ids=31932
  326. LaunchPAV=1,/clv /aut /nbr /loc /nos /ext:htm;html;hta;reg;bat;kak
  327. LaunchPAV32=1,/clv /aut /nbr /loc /nos /ext:htm;html;hta;reg;bat;kak
  328.  
  329. [JS/Kak.Worm.B.Info]
  330. Family=F01
  331. Detect=JS/Kak.Worm.B
  332. Clear=JS/Kak.Worm.B
  333. Aliases=VBS.KakWorm.B, Wsript.Kak.B, Days
  334. Ids=24215
  335. LaunchPAV=1,/clv /aut /nbr /loc /nos /ext:htm;html;hta;reg;bat;kak
  336. LaunchPAV32=1,/clv /aut /nbr /loc /nos /ext:htm;html;hta;reg;bat;kak
  337.  
  338. [VBS/ShellScrap.Worm.Info]
  339. Family=F02
  340. Detect=VBS/ShellScrap.Worm
  341. Clear=VBS/ShellScrap.Worm
  342. Aliases=VBS/ShellScrap.Worm, VBS/Live_Stages, VBS.Stages.Worm
  343. Ids=51542
  344. LaunchPAV=1,/clv /aut /nbr /loc /nos /ext:shs;ini;exe;vbs
  345. LaunchPAV32=1,/clv /aut /nbr /loc /nos /ext:shs;ini;exe;vbs
  346.  
  347. [VBS/LoveLetter.Info]
  348. Family=F00
  349. Detect=VBS/LoveLetter
  350. Clear=VBS/LoveLetter
  351. Aliases=I LOVE YOU, Worm/LoveLetter, Barok
  352. Ids=51220,51221,51224,51225,51241
  353. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  354. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  355.  
  356. [VBS/LoveLetter.B.Info]
  357. Family=F00
  358. Detect=VBS/LoveLetter
  359. Clear=VBS/LoveLetter
  360. Aliases=VBS/LoveLetter.B
  361. Ids=51238
  362. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  363. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  364.  
  365. [VBS/LoveLetter.C.Info]
  366. Family=F00
  367. Detect=VBS/LoveLetter.C
  368. Clear=VBS/LoveLetter.C
  369. Aliases=Very Funny
  370. Ids=51239
  371. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  372. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  373.  
  374. [VBS/LoveLetter.D.Info]
  375. Family=F00
  376. Detect=VBS/LoveLetter.D
  377. Clear=VBS/LoveLetter.D
  378. Aliases=VBS/Mothersday, WORM/LoveLetter.D
  379. Ids=51240
  380. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  381. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  382.  
  383. [VBS/LoveLetter.E.Info]
  384. Family=F00
  385. Detect=VBS/LoveLetter.E
  386. Clear=VBS/LoveLetter.E
  387. Aliases=WORM/LoveLetter.E
  388. Ids=51236
  389. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  390. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  391.  
  392. [VBS/LoveLetter.F.Info]
  393. Family=F00
  394. Detect=VBS/LoveLetter.F
  395. Clear=VBS/LoveLetter.F
  396. Aliases=WORM/LoveLetter.F
  397. Ids=51248
  398. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  399. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  400.  
  401. [VBS/LoveLetter.G.Info]
  402. Family=F00
  403. Detect=VBS/LoveLetter.G
  404. Clear=VBS/LoveLetter.G
  405. Aliases=WORM/LoveLetter.G
  406. Ids=51246
  407. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  408. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  409.  
  410. [VBS/LoveLetter.H.Info]
  411. Family=F00
  412. Detect=VBS/LoveLetter
  413. Clear=VBS/LoveLetter
  414. Aliases=WORM/LoveLetter.H
  415. Ids=51253
  416. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  417. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  418.  
  419. [VBS/LoveLetter.I.Info]
  420. Family=F00
  421. Detect=VBS/LoveLetter.I
  422. Clear=VBS/LoveLetter.I
  423. Aliases=WORM/LoveLetter.I
  424. Ids=51254,51256
  425. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  426. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  427.  
  428. [VBS/LoveLetter.J.Info]
  429. Family=F00
  430. Detect=VBS/LoveLetter.J
  431. Clear=VBS/LoveLetter.J
  432. Aliases=WORM/LoveLetter.J
  433. Ids=51260
  434. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  435. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  436.  
  437. [VBS/LoveLetter.K.Info]
  438. Family=F00
  439. Detect=VBS/LoveLetter.K
  440. Clear=VBS/LoveLetter.K
  441. Aliases=WORM/LoveLetter.K
  442. Ids=51262
  443. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  444. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  445.  
  446. [VBS/LoveLetter.L.Info]
  447. Family=F00
  448. Detect=VBS/LoveLetter.L
  449. Clear=VBS/LoveLetter.L
  450. Aliases=WORM/LoveLetter.L
  451. Ids=51257
  452. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  453. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  454.  
  455. [VBS/LoveLetter.M.Info]
  456. Family=F00
  457. Detect=VBS/LoveLetter
  458. Clear=VBS/LoveLetter
  459. Aliases=WORM/LoveLetter.M
  460. Ids=51220
  461. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  462. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  463.  
  464. [VBS/LoveLetter.N.Info]
  465. Family=F00
  466. Detect=VBS/LoveLetter.N
  467. Clear=VBS/LoveLetter.N
  468. Aliases=WORM/LoveLetter.N
  469. Ids=51267
  470. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  471. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  472.  
  473. [VBS/LoveLetter.O.Info]
  474. Family=F00
  475. Detect=VBS/LoveLetter
  476. Clear=VBS/LoveLetter
  477. Aliases=WORM/LoveLetter.O
  478. Ids=51269
  479. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  480. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  481.  
  482. [VBS/LoveLetter.P.Info]
  483. Family=F00
  484. Detect=VBS/LoveLetter.P
  485. Clear=VBS/LoveLetter.P
  486. Aliases=WORM/LoveLetter.P
  487. Ids=51272
  488. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  489. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  490.  
  491. [VBS/LoveLetter.Q.Info]
  492. Family=F00
  493. Detect=VBS/LoveLetter.Q
  494. Clear=VBS/LoveLetter.Q
  495. Aliases=WORM/LoveLetter.Q
  496. Ids=51273
  497. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  498. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  499.  
  500. [VBS/LoveLetter.R.Info]
  501. Family=F00
  502. Detect=VBS/LoveLetter.G
  503. Clear=VBS/LoveLetter.G
  504. Aliases=WORM/LoveLetter.R
  505. Ids=51275
  506. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  507. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  508.  
  509. [VBS/LoveLetter.S.Info]
  510. Family=F00
  511. Detect=VBS/LoveLetter.S
  512. Clear=VBS/LoveLetter.S
  513. Aliases=WORM/LoveLetter.S
  514. Ids=51276
  515. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  516. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  517.  
  518. [VBS/LoveLetter.T.Info]
  519. Family=F00
  520. Detect=VBS/LoveLetter.T
  521. Clear=VBS/LoveLetter.T
  522. Aliases=WORM/LoveLetter.T
  523. Ids=51278
  524. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  525. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  526.  
  527. [VBS/LoveLetter.U.Info]
  528. Family=F00
  529. Detect=VBS/LoveLetter.U
  530. Clear=VBS/LoveLetter.U
  531. Aliases=WORM/LoveLetter.U
  532. Ids=51279
  533. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  534. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  535.  
  536. [VBS/LoveLetter.V.Info]
  537. Family=F00
  538. Detect=VBS/LoveLetter.V
  539. Clear=VBS/LoveLetter.V
  540. Aliases=WORM/LoveLetter.V
  541. Ids=51281
  542. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  543. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  544.  
  545. [VBS/LoveLetter.W.Info]
  546. Family=F00
  547. Detect=VBS/LoveLetter.W
  548. Clear=VBS/LoveLetter.W
  549. Aliases=WORM/LoveLetter.W
  550. Ids=51284
  551. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  552. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  553.  
  554. [VBS/LoveLetter.X.Info]
  555. Family=F00
  556. Detect=VBS/LoveLetter
  557. Clear=VBS/LoveLetter
  558. Aliases=WORM/LoveLetter.X
  559. Ids=51291
  560. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  561. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  562.  
  563. [VBS/LoveLetter.Y.Info]
  564. Family=F00
  565. Detect=VBS/LoveLetter
  566. Clear=VBS/LoveLetter
  567. Aliases=WORM/LoveLetter.Y
  568. Ids=51292
  569. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  570. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  571.  
  572. [VBS/LoveLetter.Z.Info]
  573. Family=F00
  574. Detect=VBS/LoveLetter
  575. Clear=VBS/LoveLetter
  576. Aliases=WORM/LoveLetter.Z
  577. Ids=51303
  578. LaunchPAV=1,/clv /aut /aex /nbr /loc /nos
  579. LaunchPAV32=1,/clv /aut /aex /nbr /loc /nos
  580.  
  581. [I-Worm/Verona.B.Info]
  582. Family=F05
  583. Detect=I-Worm/Verona.B
  584. Clear=I-Worm/Verona.B
  585. Aliases=I-Worm/Verona.B
  586. Ids=53486,54857,15353,15352
  587. LaunchPAV=1,/clv /aut /nbr /loc /nos /ext:exe;chm
  588. LaunchPAV32=1,/clv /aut /nbr /loc /nos /ext:exe;chm
  589.  
  590. [W32/Navidad.Info]
  591. Family=F06
  592. Detect=W32/Navidad
  593. Clear=W32/Navidad
  594. Aliases=W32/Navidad
  595. Ids=55221
  596. LaunchPAV=1,/clv /aut /nbr /loc /nos /ext:exe
  597. LaunchPAV32=1,/clv /aut /nbr /loc /nos /ext:exe
  598.  
  599. [W32/Navidad.B.Info]
  600. Family=F06
  601. Detect=W32/Navidad.B
  602. Clear=W32/Navidad.B
  603. Aliases=W32/Navidad.B
  604. Ids=54974
  605. LaunchPAV=1,/clv /aut /nbr /loc /nos /ext:exe
  606. LaunchPAV32=1,/clv /aut /nbr /loc /nos /ext:exe
  607.  
  608. [W32/FunLove.Info]
  609. Family=F07
  610. Detect=W32/FunLove
  611. Clear=W32/FunLove
  612. Aliases=W32/FunLove
  613. Ids=55051,30807,52029,54554
  614. LaunchPAV=1,/clv /aut /nbr /loc /nos /aex
  615. LaunchPAV32=1,/clv /aut /nbr /loc /nos /aex
  616.  
  617. [W32/SirCam.Info]
  618. Family=F11
  619. Detect=W32/SirCam
  620. Clear=W32/SirCam
  621. Aliases=W32/SirCam@mm
  622. Ids=56752
  623. LaunchPAV=1,/clv /aut /nbr /loc /nos /ext:bat;com;lnk;pif;exe
  624. LaunchPAV32=1,/clv /aut /nbr /loc /nos /ext:bat;com;lnk;pif;exe
  625.  
  626. [VBS/Help.Info]
  627. Family=F10
  628. Detect=VBS/Help
  629. Clear=VBS/Help
  630. Aliases=VBS/HappyTime.A
  631. Ids=55405,24266
  632. LaunchPAV=1,/clv /aut /nbr /loc /nos /ext:htm;html;vbs;asp;htt;hta
  633. LaunchPAV32=1,/clv /aut /nbr /loc /nos /ext:htm;html;vbs;asp;htt;hta
  634.  
  635. [Stator.Detect]
  636. REGISTRY_FIND_TEXT_IN_VALUE=HKEY_CLASSES_ROOT,exefile\shell\open\command,"",loadpe.com,FALSE
  637. REGISTRY_EXISTS_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,ScanRegistry
  638. FILE_EXISTS_BY_PATH0=%SystemRoot%\LOADPE.COM
  639. FILE_EXISTS_BY_PATH1=%SystemRoot%\SCANREGW.EXE
  640.  
  641.  
  642. [W32/Reeezak.A.Detect]
  643. FILE_EXISTS_BY_PATH0=%WindowsRoot%\Christmas.exe
  644. PROC_EXISTS_BY_NAME0=Christmas.exe
  645. REGISTRY_EXISTS_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,ZaCker
  646. REGISTRY_EXISTS_KEY_VALUE1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main\Start page,http://geocities.com/jobreee/ZaCker.htm
  647.  
  648. [W32/Updater.Detect]
  649. FILE_EXISTS_BY_PATH0=%WindowsRoot%\Update.exe
  650. FILE_EXISTS_BY_PATH1=%StartUpRoot%\Update.vbs
  651. REGISTRY_EXISTS_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Update
  652.  
  653. [W32/Goner.A.Detect]
  654. FILE_EXISTS_BY_PATH0=%SystemRoot%\Gone.scr
  655. REGISTRY_EXISTS_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,%SystemRoot%\gone.scr
  656.  
  657. [I-Worm/Happy.Detect]
  658. FILE_EXISTS_BY_PATH0=%SystemRoot%\Ska.exe
  659. FILE_EXISTS_BY_PATH1=%SystemRoot%\Ska.dll
  660. REGISTRY_EXISTS_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunOnce,SKA.EXE
  661.  
  662. [W32/Qaz.Detect]
  663. FILE_EXISTS_BY_PATH0=%WindowsRoot%\Note.com
  664. REGISTRY_EXISTS_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,startIE
  665.  
  666. [W32/MSInit.A.Detect]
  667. FILE_EXISTS_BY_PATH0=%SystemRoot%\WININIT.EXE
  668. REGISTRY_EXISTS_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,bymer.scanner 
  669. REGISTRY_EXISTS_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,distributed.net.client
  670.  
  671. [W32/Badtrans.Detect]
  672. PROC_EXISTS_BY_NAME0=KERNEL32.EXE
  673. FILE_EXISTS_BY_PATH0=%SystemRoot%\Kernel32.exe
  674. FILE_EXISTS_BY_PATH1=%SystemRoot%\Kdll.dll
  675. FILE_EXISTS_BY_PATH2=%SystemRoot%\KERN32.EXE
  676. FILE_EXISTS_BY_PATH3=%WindowsRoot%\INETD.EXE
  677. REGISTRY_EXISTS_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,Kernel32
  678.  
  679. [W32/Klez.Detect]
  680. SERVICE_EXISTS_BY_NAME0=WINSVC
  681. PROC_EXISTS_BY_NAME0=WINSVC.EXE
  682. FILE_EXISTS_BY_PATH0=%SystemRoot%\Winsvc.exe
  683. FILE_EXISTS_BY_PATH1=%SystemRoot%\Wqk.exe
  684. FILE_EXISTS_BY_PATH2=%SystemRoot%\Wqk.dll
  685. FILE_EXISTS_BY_PATH3=%SystemRoot%\Wink*.exe
  686. REGISTRY_EXISTS_KEY0=HKEY_LOCAL_MACHINE,SYSTEM\CurrentControlSet\Services\Wink*
  687. REGISTRY_EXISTS_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,WinSvc
  688. REGISTRY_EXISTS_KEY_VALUE1=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,WQK
  689. REGISTRY_FIND_TEXT_IN_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows,AppInit_DLLs,Wqk.dll,FALSE
  690.  
  691.  
  692.  
  693.  
  694. [W32/Vote.Detect]
  695. FILE_EXISTS_BY_PATH0=%SystemRoot%\Zacker.vbs
  696. FILE_EXISTS_BY_PATH1=%WindowsRoot%\MixDaLaL.vbs
  697. FILE_EXISTS_BY_PATH2=%WindowsRoot%\WTC.exe
  698. REGISTRY_EXISTS_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,Norton.Thar
  699. REGISTRY_COMPARE_KEY_VALUE0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,start Page,http://us.f1.yahoofs.com/users/da36d538/bc/TimeUpdate.exe?bcaVq97ATaW0yAxk
  700. FILE_FIND_TEXT0=%Root%\AUTOEXEC.BAT,"echo y | format C:",FALSE
  701.  
  702. [W32/Nimda.Detect]
  703. FILE_FIND_TEXT0=%WindowsRoot%\SYSTEM.INI,"load.exe -dontrunold",FALSE
  704. FILE_EXISTS_BY_PATH0=%SystemRoot%\LOAD.EXE
  705. PROC_EXISTS_BY_NAME0=LOAD.EXE
  706. FILE_EXISTS_BY_PATH1=C:\ADMIN.DLL
  707. FILE_EXISTS_BY_PATH2=D:\ADMIN.DLL
  708. FILE_EXISTS_BY_PATH3=E:\ADMIN.DLL
  709. FILE_EXISTS_BY_PATH4=%WindowsRoot%\MMC.EXE
  710. FILE_EXISTS_BY_PATH5=C:\HTTPODBC.DLL
  711. FILE_EXISTS_BY_PATH6=D:\HTTPODBC.DLL
  712. FILE_EXISTS_BY_PATH7=E:\HTTPODBC.DLL
  713. FILE_EXISTS_BY_PATH8=%WindowsRoot%\CSRSS.EXE
  714.  
  715.  
  716. [W32/Navidad.Detect]
  717. FILE_EXISTS_BY_PATH1=%SystemRoot%\WINSVRC.VXD
  718.  
  719. [W32/Navidad.B.Detect]
  720. FILE_EXISTS_BY_PATH0=%SystemRoot%\wintask.exe
  721.  
  722. [W32/FunLove.Detect]
  723. PROC_EXISTS_BY_NAME0=FLCSS.EXE
  724. SERVICE_EXISTS_BY_NAME0=FLC
  725. FILE_EXISTS_BY_PATH0=%SystemRoot%\FLCSS.EXE
  726. REGISTRY_EXISTS_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,FLC
  727.  
  728. [W32/PrettyPark.Detect]
  729. FILE_EXISTS_BY_PATH0=%SystemRoot%\FILES32.VXD
  730.  
  731. [W32/SirCam.Detect]
  732. PROC_EXISTS_BY_NAME0=SIRC32.EXE
  733. PROC_EXISTS_BY_NAME1=SCAM32.EXE
  734. REGISTRY_EXISTS_KEY0=HKEY_LOCAL_MACHINE,SOFTWARE\SirCam
  735. REGISTRY_EXISTS_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices,Driver32
  736. FILE_FIND_TEXT0=%Root%\AUTOEXEC.BAT,"@win \recycled\sirc32.exe",FALSE
  737. FILE_FIND_TEXT1=%WindowsRoot%\WIN.INI,"SirC32.exe="C:\SirC32.exe"",FALSE
  738. REGISTRY_FIND_TEXT_IN_VALUE0=HKEY_CLASSES_ROOT,"inffile\shell\Install\command","","RUN32.EXE",FALSE
  739. REGISTRY_FIND_TEXT_IN_VALUE1=HKEY_CLASSES_ROOT,"Unknown\shell\openas\command","","RUN32.EXE",FALSE
  740.  
  741. [VBS/Help.Detect]
  742. REGISTRY_EXISTS_KEY0=HKEY_CURRENT_USER,SOFTWARE\Help
  743.  
  744. [VBS/SST.A.Detect]
  745. REGISTRY_EXISTS_KEY0=HKEY_CURRENT_USER,Software\OnTheFly
  746.  
  747. [I-Worm/MTX.Detect]
  748. REGISTRY_EXISTS_KEY0=HKEY_LOCAL_MACHINE,Software\[MATRIX]
  749. REGISTRY_EXISTS_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,SystemBackup
  750. PROC_EXISTS_BY_NAME0=MTX_.EXE
  751.  
  752. [JS/Kak.Worm.Detect]
  753. REGISTRY_EXISTS_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,cAg0u
  754. FILE_EXISTS_BY_PATH0=%StartUpRoot%\KAK.HTA
  755. FILE_EXISTS_BY_PATH1=%Root%\AE.KAK
  756.  
  757. [JS/Kak.Worm.B.Detect]
  758. REGISTRY_EXISTS_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,cDays
  759. FILE_EXISTS_BY_PATH0=%StartUpRoot%\DAY.HTA
  760. FILE_EXISTS_BY_PATH1=%WindowsRoot%\Help\DAYS.HTA
  761. FILE_EXISTS_BY_PATH2=%Root%\DAYS.DAY
  762.  
  763. [VBS/ShellScrap.Worm.Detect]
  764. REGISTRY_EXISTS_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices,ScanReg
  765. FILE_EXISTS_BY_PATH0=%StartUpRoot%\LIFE_STAGES.TXT.SHS
  766.  
  767. [VBS/CoolNotepad.Worm.Detect]
  768. REGISTRY_EXISTS_KEY_VALUE00=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,COOL_NOTEPAD_DEMO
  769. FILE_EXISTS_BY_PATH00=%SystemRoot%\COOL_NOTEPAD_DEMO.TXT.VBS
  770.  
  771. [VBS/LoveLetter.AS.Detect]
  772. REGISTRY_EXISTS_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,LINUX32
  773. REGISTRY_EXISTS_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,reload
  774.  
  775. [VBS/LoveLetter.Detect]
  776. FILE_EXISTS_BY_PATH1=%SystemRoot%\LOVE-LETTER-FOR-YOU.HTM
  777.  
  778. [VBS/LoveLetter.C.Detect]
  779. FILE_EXISTS_BY_PATH1=%SystemRoot%\VERY FUNNY.VBS
  780.  
  781. [VBS/LoveLetter.D.Detect]
  782. FILE_EXISTS_BY_PATH1=%SystemRoot%\MOTHERSDAY.HTM
  783.  
  784. [VBS/LoveLetter.E.Detect]
  785. REGISTRY_COMPARE_KEY_VALUE0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.hackers.com
  786. REGISTRY_COMPARE_KEY_VALUE1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.2600.com
  787.  
  788. [VBS/LoveLetter.F.Detect]
  789. REGISTRY_COMPARE_KEY_VALUE0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skycable.tucows.com/files2/setup24.exe
  790. FILE_EXISTS_BY_PATH0=%SystemRoot%\SETUP24.EXE
  791. FILE_EXISTS_BY_PATH1=%SystemRoot%\URGENT_VIRUS_WARNING.HTM
  792.  
  793. [VBS/LoveLetter.G.Detect]
  794. REGISTRY_COMPARE_KEY_VALUE0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://3doc.dailypussy.com/gallery/bunny.html
  795. REGISTRY_COMPARE_KEY_VALUE1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Search Page,http://astalavista.box.sk
  796. REGISTRY_COMPARE_KEY_VALUE2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Defaul_Page_URL,http://www.persiankitty.com
  797. REGISTRY_COMPARE_KEY_VALUE3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Default_Search_URL,http://www.thecrack.net
  798. REGISTRY_COMPARE_KEY_VALUE4=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Local Page,system\protect.htm
  799. REGISTRY_COMPARE_KEY_VALUE5=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Window Title,Mocro$oft Internet Exploder by Ommen⌐
  800. FILE_EXISTS_BY_PATH0=%SystemRoot%\SETUP24.EXE
  801. FILE_EXISTS_BY_PATH1=%SystemRoot%\PROTECT.HTM
  802. FILE_EXISTS_BY_PATH2=%SystemRoot%\PROTECT.VBS
  803.  
  804. [VBS/LoveLetter.I.Detect]
  805. REGISTRY_EXISTS_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,ESKernel32
  806. REGISTRY_EXISTS_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,ES32DLL
  807.  
  808. [VBS/LoveLetter.J.Detect]
  809. FILE_EXISTS_BY_PATH1=%SystemRoot%\VIRUS-PROTECTION-INSTRUCTIONS.HTM
  810. FILE_EXISTS_BY_PATH2=%SystemRoot%\VIRUS-PROTECTION-INSTRUCTIONS.VBS
  811.  
  812. [VBS/LoveLetter.K.Detect]
  813. FILE_EXISTS_BY_PATH1=%SystemRoot%\NO-HATE-FOR-YOU.HTM
  814.  
  815. [VBS/LoveLetter.L.Detect]
  816. FILE_EXISTS_BY_PATH1=%SystemRoot%\BEWERBUNG.HTM
  817.  
  818. [VBS/LoveLetter.N.Detect]
  819. REGISTRY_EXISTS_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,SNDVOL32
  820. REGISTRY_EXISTS_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,IEAKDLL
  821.  
  822. [VBS/LoveLetter.P.Detect]
  823. FILE_EXISTS_BY_PATH0=%SystemRoot%\SETUP24.EXE
  824. FILE_EXISTS_BY_PATH1=%SystemRoot%\VIR-KILLER.HTM
  825.  
  826. [VBS/LoveLetter.Q.Detect]
  827. REGISTRY_EXISTS_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MUSERS32.VBS
  828. REGISTRY_EXISTS_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,USER32DLL
  829.  
  830. [VBS/LoveLetter.S.Detect]
  831. FILE_EXISTS_BY_PATH1=%SystemRoot%\KILLER.HTM
  832.  
  833. [VBS/LoveLetter.T.Detect]
  834. FILE_EXISTS_BY_PATH1=%SystemRoot%\BAND-AID.DOC.VBS
  835.  
  836. [VBS/LoveLetter.U.Detect]
  837. FILE_EXISTS_BY_PATH1=%SystemRoot%\MAJOR BUG & VIRUS FIX.HTM
  838.  
  839. [VBS/LoveLetter.V.Detect]
  840. FILE_EXISTS_BY_PATH1=%SystemRoot%\UOL.HTM
  841.  
  842. [VBS/LoveLetter.W.Detect]
  843. FILE_EXISTS_BY_PATH1=%SystemRoot%\BUG AND VIRUS FIX.HTM
  844.  
  845. [I-Worm/Verona.B.Detect]
  846. FILE_EXISTS_BY_PATH0=%WindowsRoot%\Sysrnj.exe
  847. REGISTRY_COMPARE_KEY_VALUE0=HKEY_CLASSES_ROOT,rnjfile\shell\open\command,,sysrnj.exe "%1" %*
  848. REGISTRY_COMPARE_KEY_VALUE1=HKEY_CLASSES_ROOT,.arj,,rnjfile
  849. REGISTRY_COMPARE_KEY_VALUE2=HKEY_CLASSES_ROOT,.avi,,rnjfile
  850. REGISTRY_COMPARE_KEY_VALUE3=HKEY_CLASSES_ROOT,.bmp,,rnjfile
  851. REGISTRY_COMPARE_KEY_VALUE4=HKEY_CLASSES_ROOT,.doc,,rnjfile
  852. REGISTRY_COMPARE_KEY_VALUE5=HKEY_CLASSES_ROOT,.exe,,rnjfile
  853. REGISTRY_COMPARE_KEY_VALUE6=HKEY_CLASSES_ROOT,.gif,,rnjfile
  854. REGISTRY_COMPARE_KEY_VALUE7=HKEY_CLASSES_ROOT,.jpe,,rnjfile
  855. REGISTRY_COMPARE_KEY_VALUE8=HKEY_CLASSES_ROOT,.jpeg,,rnjfile
  856. REGISTRY_COMPARE_KEY_VALUE9=HKEY_CLASSES_ROOT,.jpg,,rnjfile
  857. REGISTRY_COMPARE_KEY_VALUE10=HKEY_CLASSES_ROOT,.lha,,rnjfile
  858. REGISTRY_COMPARE_KEY_VALUE11=HKEY_CLASSES_ROOT,.mp2,,rnjfile
  859. REGISTRY_COMPARE_KEY_VALUE12=HKEY_CLASSES_ROOT,.mp3,,rnjfile
  860. REGISTRY_COMPARE_KEY_VALUE13=HKEY_CLASSES_ROOT,.mpeg,,rnjfile
  861. REGISTRY_COMPARE_KEY_VALUE14=HKEY_CLASSES_ROOT,.mpg,,rnjfile
  862. REGISTRY_COMPARE_KEY_VALUE15=HKEY_CLASSES_ROOT,.rar,,rnjfile
  863. REGISTRY_COMPARE_KEY_VALUE16=HKEY_CLASSES_ROOT,.reg,,rnjfile
  864. REGISTRY_COMPARE_KEY_VALUE17=HKEY_CLASSES_ROOT,.vqf,,rnjfile
  865. REGISTRY_COMPARE_KEY_VALUE18=HKEY_CLASSES_ROOT,.wma,,rnjfile
  866. REGISTRY_COMPARE_KEY_VALUE19=HKEY_CLASSES_ROOT,.wmf,,rnjfile
  867. REGISTRY_COMPARE_KEY_VALUE20=HKEY_CLASSES_ROOT,.wmv,,rnjfile
  868. REGISTRY_COMPARE_KEY_VALUE21=HKEY_CLASSES_ROOT,.xls,,rnjfile
  869. REGISTRY_COMPARE_KEY_VALUE22=HKEY_CLASSES_ROOT,.zip,,rnjfile
  870.  
  871. [Stator.Clear]
  872. REGISTRY_SET_KEY_VALUE0=HKEY_CLASSES_ROOT,exefile\shell\open\command,"",""%1" %*"
  873. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,ScanRegistry
  874. FILE_DELETE_BY_PATH0=%SystemRoot%\LOADPE.COM
  875. FILE_DELETE_BY_PATH1=%SystemRoot%\SCANREGW.EXE
  876. DLL_EXEC_FUNCTION_VOID0=QRVKRN.DLL,QRVAUX_ClearW32Stator
  877.  
  878. [W32/Reeezak.A.Clear]
  879. PROC_TERMINATE_BY_NAME0=Christmas.exe
  880. FILE_DELETE_BY_PATH0=%WindowsRoot%\Christmas.exe
  881. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,ZaCker
  882. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start page,http://geocities.com/jobreee/ZaCker.htm,http://www.pandasoftware.com
  883.  
  884.  
  885. [W32/Updater.Clear]
  886. FILE_DELETE_BY_PATH0=%WindowsRoot%\Update.exe
  887. FILE_DELETE_BY_PATH1=%StartUpRoot%\Update.vbs
  888. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Update
  889.  
  890. [W32/Goner.A.Clear]
  891. FILE_DELETE_BY_PATH0=%SystemRoot%\Gone.scr
  892. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,%SystemRoot%\gone.scr
  893.  
  894. [I-Worm/Happy.Clear]
  895. FILE_DELETE_BY_PATH0=%SystemRoot%\Ska.exe
  896. FILE_DELETE_BY_PATH1=%SystemRoot%\Ska.dll
  897. FILE_DELETE_BY_PATH2=%SystemRoot%\Liste.ska
  898. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunOnce,SKA.EXE
  899. FILE_MOVE_BY_PATH_TO_PATH0=%SystemRoot%\WSOCK32.SKA,%SystemRoot%\Wsock32.dll
  900.  
  901. [W32/Qaz.Clear]
  902. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,startIE
  903. FILE_MOVE_BY_PATH_TO_PATH0=%WindowsRoot%\Note.com,%WindowsRoot%\Notepad.exe
  904.  
  905. [W32/MSInit.A.Clear]
  906. FILE_DELETE_BY_PATH0=%SystemRoot%\WININIT.EXE
  907. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,bymer.scanner 
  908. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,distributed.net.client
  909. INI_SET_KEY_VALUE0=%WindowsRoot%\WIN.INI,windows,load,""
  910.  
  911. [W32/Badtrans.Clear]
  912. PROC_TERMINATE_BY_NAME0=Kernel32.EXE
  913. FILE_DELETE_BY_PATH0=%SystemRoot%\Kernel32.exe
  914. FILE_DELETE_BY_PATH1=%SystemRoot%\Kdll.dll
  915. FILE_DELETE_BY_PATH2=%SystemRoot%\KERN32.EXE
  916. FILE_DELETE_BY_PATH3=%WindowsRoot%\INETD.EXE
  917. FILE_REPLACE_TEXT1=%WindowsRoot%\WIN.INI,"\INETD.EXE","",FALSE
  918. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,Kernel32
  919. REGISTRY_NULL_KEY_VALUE0=HKEY_CURRENT_USER,Software\Microsoft\Windows NT\CurrentVersion\Windows,Run
  920.  
  921. [W32/Klez.Clear]
  922. PROC_TERMINATE_BY_NAME0=WINSVC.EXE
  923. SERVICE_DELETE_BY_NAME0=WINSVC
  924. SERVICE_DELETE_BY_NAME1=WINK*
  925. FILE_DELETE_BY_PATH0=%SystemRoot%\Winsvc.exe
  926. FILE_DELETE_BY_PATH1=%SystemRoot%\Wqk.exe
  927. FILE_DELETE_BY_PATH2=%SystemRoot%\Wqk.dll
  928. FILE_DELETE_BY_PATH3=%SystemRoot%\Wink*.exe
  929. FILE_DELETE_BY_PATH4=%TempRoot%\k*.EXE
  930. PATH_MAKE_BY_PATH0=%SystemRoot%\Winsvc.exe,1,HSR
  931. PATH_MAKE_BY_PATH1=%SystemRoot%\Wqk.exe,1,HSR
  932. PATH_MAKE_BY_PATH2=%SystemRoot%\Wqk.dll,1,HSR
  933. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Wink
  934. REGISTRY_DELETE_KEY0=HKEY_LOCAL_MACHINE,System\CurrentControlSet\Services\Wink*
  935. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,WinSvc
  936. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,WQK
  937. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Wink
  938. REGISTRY_REPLACE_TEXT_IN_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows,AppInit_DLLs,"Wqk.dll","",FALSE
  939.  
  940.  
  941.  
  942. [VBS/SST.A.Clear]
  943. REGISTRY_DELETE_KEY0=HKEY_CURRENT_USER,Software\OnTheFly
  944. PROC_TERMINATE_BY_NAME0=WSCRIPT.EXE
  945. FILE_DELETE_BY_PATH0=%WindowsRoot%\AnnaKournikova.jpg.vbs
  946.  
  947. [I-Worm/MTX.Clear]
  948. PROC_TERMINATE_BY_NAME0=MTX_.EXE
  949. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,SystemBackup
  950. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,SystemBackup
  951. REGISTRY_DELETE_KEY0=HKEY_LOCAL_MACHINE,Software\[MATRIX]
  952. FILE_DELETE_BY_PATH0=%WindowsRoot%\WIN32.DLL
  953. FILE_DELETE_BY_PATH1=%WindowsRoot%\IE_PACK.EXE
  954. FILE_DELETE_BY_PATH2=%WindowsRoot%\MTX_.EXE
  955. FILE_DELETE_BY_PATH3=%SystemRoot%\WSOCK32.MTX
  956. FILE_COPY_BY_PATH_TO_PATH0=%SystemRoot%\WSOCK32.DLL,%SystemRoot%\WSOCK32.MTX
  957.  
  958. [JS/Kak.Worm.Clear]
  959. OUTLOOKEXPRESS_DELETE_SIGNATURES_IF_CONTAIN_TEXT_BY_VAR0=KAK_A
  960. FILE_DELETE_BY_PATH0=%StartUpRoot%\KAK.HTA
  961. FILE_DELETE_BY_PATH1=%WindowsRoot%\KAK.HTM
  962. FILE_DELETE_BY_PATH2=%WindowsRoot%\KAK.REG
  963. FILE_MOVE_BY_PATH_TO_PATH0=%Root%\AE.KAK,%Root%\AUTOEXEC.BAT
  964. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,cAg0u
  965. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,cAg0u
  966.  
  967. [JS/Kak.Worm.B.Clear]
  968. OUTLOOKEXPRESS_DELETE_SIGNATURES_IF_CONTAIN_TEXT_BY_VAR0=KAK_B
  969. FILE_DELETE_BY_PATH0=%StartUpRoot%\DAY.HTA
  970. FILE_DELETE_BY_PATH1=%WindowsRoot%\COMMAND\DEFAULT.HTM
  971. FILE_DELETE_BY_PATH2=%WindowsRoot%\DAY.REG
  972. FILE_DELETE_BY_PATH3=%WindowsRoot%\Help\DAYS.HTA
  973. FILE_MOVE_BY_PATH_TO_PATH0=%Root%\DAYS.DAY,%Root%\AUTOEXEC.BAT
  974. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,cDays
  975. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,cDays
  976.  
  977. [VBS/ShellScrap.Worm.Clear]
  978. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_USERS,.DEFAULT\SOFTWARE\Mirabilis\ICQ\Agent\Apps\ICQ,Parameters
  979. REGISTRY_SET_KEY_VALUE_WITH_FORMAT_STRING_PATH_PARAMETER0=HKEY_LOCAL_MACHINE,Software\CLASSES\regfile\DefaultIcon,"","%s,1",%WindowsRoot%\REGEDIT.EXE
  980. REGISTRY_SET_KEY_VALUE_WITH_FORMAT_STRING_PATH_PARAMETER1=HKEY_LOCAL_MACHINE,Software\CLASSES\regfile\shell\open\command,"","%s "%1"",%WindowsRoot%\REGEDIT.EXE
  981. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices,ScanReg
  982. REGISTRY_DELETE_KEY_VALUE1=HKEY_USERS,.DEFAULT\SOFTWARE\Mirabilis\ICQ\Agent\Apps\ICQ,Parameters
  983. REGISTRY_DELETE_KEY_VALUE2=HKEY_CLASSES_ROOT,ShellScrap,AlwaysShowExt
  984. REGISTRY_SET_KEY_VALUE0=HKEY_CLASSES_ROOT,ShellScrap,NeverShowExt,
  985. FILE_MOVE_BY_PATH_TO_PATH0=%RecycledRoot%\RECYCLED.VXD,%WindowsRoot%\REGEDIT.EXE
  986. FILE_DELETE_BY_PATH0=%SystemRoot%\MSINFO16.TLB
  987. FILE_DELETE_BY_PATH1=%WindowsRoot%\MSINFO16.TLB
  988. FILE_DELETE_BY_PATH2=%SystemRoot%\SCANREG.VBS
  989. FILE_DELETE_BY_PATH3=%SystemRoot%\VBASET.OLB
  990. FILE_DELETE_BY_PATH4=%RecycledRoot%\DBINDEX.VBS
  991. FILE_DELETE_BY_PATH5=%RecycledRoot%\MSRCYCLD.DAT
  992. FILE_DELETE_BY_PATH6=%RecycledRoot%\RCYCLDBN.DAT
  993. FILE_DELETE_BY_PATH7=%WindowsRoot%\LIFE_STAGES.TXT.SHS
  994. FILE_DELETE_BY_PATH8=%StartUpRoot%\LIFE_STAGES.TXT.SHS
  995. FILE_DELETE_BY_PATH9=%MyDocumentsRoot%\IMPORTANT*.SHS
  996. FILE_DELETE_BY_PATH10=%MyDocumentsRoot%\SECRET*.SHS
  997. FILE_DELETE_BY_PATH11=%MyDocumentsRoot%\UNKNOWN*.SHS
  998. FILE_DELETE_BY_PATH12=%MyDocumentsRoot%\REPORT*.SHS
  999. FILE_DELETE_BY_PATH18=%MyDocumentsRoot%\INFO*.SHS
  1000. FILE_DELETE_BY_PATH13=%Root%\IMPORTANT*.SHS
  1001. FILE_DELETE_BY_PATH14=%Root%\SECRET*.SHS
  1002. FILE_DELETE_BY_PATH15=%Root%\UNKNOWN*.SHS
  1003. FILE_DELETE_BY_PATH16=%Root%\REPORT*.SHS
  1004. FILE_DELETE_BY_PATH17=%Root%\INFO*.SHS
  1005. FILE_DELETE_BY_PATH19=%ProgramsRoot%\IMPORTANT*.SHS
  1006. FILE_DELETE_BY_PATH20=%ProgramsRoot%\SECRET*.SHS
  1007. FILE_DELETE_BY_PATH21=%ProgramsRoot%\UNKNOWN*.SHS
  1008. FILE_DELETE_BY_PATH22=%ProgramsRoot%\REPORT*.SHS
  1009. FILE_DELETE_BY_PATH23=%ProgramsRoot%\INFO*.SHS
  1010. FILE_DELETE_BY_PATH24=%StartUpRoot%\LIFE_STAGES.TXT.SHS
  1011.  
  1012. [VBS/CoolNotepad.Worm.Clear]
  1013. FILE_DELETE_BY_REGISTRY_KEY_VALUE00=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,COOL_NOTEPAD_DEMO
  1014. REGISTRY_DELETE_KEY_VALUE00=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,COOL_NOTEPAD_DEMO
  1015. REGISTRY_SET_KEY_VALUE_WITH_TYPE00=DWORD,HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoDesktop,0,0
  1016. FILE_DELETE_BY_PATH0=%SystemRoot%\COOL_NOTEPAD_DEMO.TXT.VBS
  1017.  
  1018. [VBS/LoveLetter.AS.Clear]
  1019. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,LINUX32
  1020. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,reload
  1021. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,LINUX32
  1022. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,reload
  1023. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://members.fortunecity.com/plancolombia/macromedia32.zip,http://www.pandasoftware.com
  1024. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://members.fortunecity.com/plancolombia/linux321.zip,http://www.pandasoftware.com
  1025. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://members.fortunecity.com/plancolombia/linux322.zip,http://www.pandasoftware.com
  1026. FILE_DELETE_BY_PATH0=%SystemRoot%\US-PRESIDENT-AND-FBI-SECRETS.HTM
  1027.  
  1028. [VBS/LoveLetter.Clear]
  1029. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1030. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1031. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1032. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1033. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1034. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1035. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1036. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1037. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1038. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1039. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1040. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1041. FILE_DELETE_BY_PATH1=%SystemRoot%\LOVE-LETTER-FOR-YOU.HTM
  1042. FILE_DELETE_BY_PATH2=%SystemRoot%\LOVE-LETTER-FOR-YOU.TXT.VBS
  1043.  
  1044. [VBS/LoveLetter.C.Clear]
  1045. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1046. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1047. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1048. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1049. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1050. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1051. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1052. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1053. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1054. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1055. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1056. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1057. FILE_DELETE_BY_PATH1=%SystemRoot%\VERY FUNNY.VBS
  1058. FILE_DELETE_BY_PATH2=%SystemRoot%\VERY FUNNY.HTM
  1059.  
  1060. [VBS/LoveLetter.D.Clear]
  1061. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1062. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1063. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1064. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1065. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1066. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1067. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1068. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1069. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1070. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1071. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1072. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1073. FILE_DELETE_BY_PATH1=%SystemRoot%\MOTHERSDAY.VBS
  1074. FILE_DELETE_BY_PATH2=%SystemRoot%\MOTHERSDAY.HTM
  1075.  
  1076. [VBS/LoveLetter.E.Clear]
  1077. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1078. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1079. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1080. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WinFAT32
  1081. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1082. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1083. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WinFAT32
  1084. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.hackers.com,http://www.pandasoftware.com
  1085. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.2600.com,http://www.pandasoftware.com
  1086. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1087. FILE_DELETE_BY_PATH1=%SystemRoot%\MOTHERSDAY.VBS
  1088. FILE_DELETE_BY_PATH2=%SystemRoot%\MOTHERSDAY.HTM
  1089.  
  1090. [VBS/LoveLetter.F.Clear]
  1091. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1092. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1093. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1094. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1095. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skycable.tucows.com/files2/setup24.exe,http://www.pandasoftware.com
  1096. FILE_DELETE_BY_PATH2=%SystemRoot%\URGENT_VIRUS_WARNING.HTM
  1097.  
  1098. [VBS/LoveLetter.G.Clear]
  1099. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1100. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1101. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1102. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1103. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1104. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://3doc.dailypussy.com/gallery/bunny.html,http://www.pandasoftware.com
  1105. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Search Page,http://astalavista.box.sk,http://www.pandasoftware.com
  1106. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Defaul_Page_URL,http://www.persiankitty.com,http://www.pandasoftware.com
  1107. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Default_Search_URL,http://www.thecrack.net,http://www.pandasoftware.com
  1108. REGISTRY_SET_KEY_VALUE_IF_EQUAL4=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Local Page,system\protect.htm,http://www.pandasoftware.com
  1109. REGISTRY_SET_KEY_VALUE_IF_EQUAL5=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Window Title,Mocro$oft Internet Exploder by Ommen⌐,Microsoft Internet Explorer
  1110. FILE_DELETE_BY_PATH0=%SystemRoot%\SETUP24.EXE
  1111. FILE_DELETE_BY_PATH1=%SystemRoot%\PROTECT.HTM
  1112. FILE_DELETE_BY_PATH2=%SystemRoot%\PROTECT.VBS
  1113.  
  1114. [VBS/LoveLetter.I.Clear]
  1115. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1116. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,ESKernel32
  1117. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,ES32DLL
  1118. ILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1119. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,ESKernel32
  1120. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,ES32DLL
  1121. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1122. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1123. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1124. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1125. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1126. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1127. FILE_DELETE_BY_PATH1=%SystemRoot%\IMPORTANT.HTM
  1128. FILE_DELETE_BY_PATH2=%SystemRoot%\IMPORTANT.TXT.VBS
  1129.  
  1130. [VBS/LoveLetter.J.Clear]
  1131. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1132. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1133. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1134. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1135. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1136. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1137. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1138. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1139. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1140. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1141. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1142. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1143. FILE_DELETE_BY_PATH1=%SystemRoot%\VIRUS-PROTECTION-INSTRUCTIONS.HTM
  1144. FILE_DELETE_BY_PATH2=%SystemRoot%\VIRUS-PROTECTION-INSTRUCTIONS.VBS
  1145.  
  1146. [VBS/LoveLetter.K.Clear]
  1147. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1148. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1149. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1150. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1151. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1152. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1153. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1154. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1155. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1156. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1157. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1158. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1159. FILE_DELETE_BY_PATH1=%SystemRoot%\NO-HATE-FOR-YOU.HTM
  1160.  
  1161. [VBS/LoveLetter.L.Clear]
  1162. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1163. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1164. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1165. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1166. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1167. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1168. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1169. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1170. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1171. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1172. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1173. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1174. FILE_DELETE_BY_PATH1=%SystemRoot%\BEWERBUNG.HTM
  1175. FILE_DELETE_BY_PATH2=%SystemRoot%\BEWERBUNG.TXT.VBS
  1176.  
  1177. [VBS/LoveLetter.N.Clear]
  1178. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1179. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,SNDVOL32
  1180. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,IEAKDLL
  1181. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1182. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,SNDVOL32
  1183. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,IEAKDLL
  1184. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1185. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.astalavista.box.sk,http://www.pandasoftware.com
  1186. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1187. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1188. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1189. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1190. FILE_DELETE_BY_PATH1=%SystemRoot%\IMPORTANT.HTM
  1191. FILE_DELETE_BY_PATH2=%SystemRoot%\IMPORTANT.TXT.VBS
  1192.  
  1193. [VBS/LoveLetter.P.Clear]
  1194. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1195. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1196. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1197. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1198. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1199. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1200. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.yahoo.com/Vir-Killer.exe,http://www.pandasoftware.com
  1201. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.msn.com/Vir-Killer.exe,http://www.pandasoftware.com
  1202. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.Hotmail.com/Vir-Killer.exe,http://www.pandasoftware.com
  1203. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.Aol.com/Vir-Killer.exe,http://www.pandasoftware.com
  1204. FILE_DELETE_BY_PATH0=%SystemRoot%\SETUP24.EXE
  1205. FILE_DELETE_BY_PATH1=%SystemRoot%\VIR-KILLER.HTM
  1206. FILE_DELETE_BY_PATH2=%SystemRoot%\VIR-KILLER.VBS
  1207.  
  1208. [VBS/LoveLetter.Q.Clear]
  1209. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1210. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MUSERS32.VBS
  1211. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,USER32DLL
  1212. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1213. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MUSERS32.VBS
  1214. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,USER32DLL
  1215. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1216. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1217. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1218. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1219. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1220. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1221. FILE_DELETE_BY_PATH1=%SystemRoot%\LOOK.HTM
  1222. FILE_DELETE_BY_PATH2=%SystemRoot%\LOOK.VBS
  1223.  
  1224. [VBS/LoveLetter.S.Clear]
  1225. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1226. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1227. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1228. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1229. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1230. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1231. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1232. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1233. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1234. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1235. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1236. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1237. FILE_DELETE_BY_PATH1=%SystemRoot%\KILLER.HTM
  1238. FILE_DELETE_BY_PATH2=%SystemRoot%\KILLEMALL.TXT.VBS
  1239.  
  1240. [VBS/LoveLetter.T.Clear]
  1241. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1242. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1243. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1244. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1245. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1246. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1247. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1248. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.2600.com,http://www.pandasoftware.com
  1249. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1250. FILE_DELETE_BY_PATH1=%SystemRoot%\BAND-AID.DOC.VBS
  1251.  
  1252. [VBS/LoveLetter.U.Clear]
  1253. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1254. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1255. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1256. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1257. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1258. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1259. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1260. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1261. REGISTRY_SET_KEY_VALUE_IF_EQUAL1=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1262. REGISTRY_SET_KEY_VALUE_IF_EQUAL2=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1263. REGISTRY_SET_KEY_VALUE_IF_EQUAL3=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe,http://www.pandasoftware.com
  1264. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1265. FILE_DELETE_BY_PATH1=%SystemRoot%\MAJOR BUG & VIRUS FIX.HTM
  1266.  
  1267. [VBS/LoveLetter.V.Clear]
  1268. PROC_TERMINATE_BY_NAME0=WINFAT32.EXE
  1269. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1270. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1271. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1272. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1273. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1274. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1275. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.uol.com.br/,http://www.pandasoftware.com
  1276. FILE_DELETE_BY_PATH0=%SystemRoot%\WINFAT32.EXE
  1277. FILE_DELETE_BY_PATH1=%SystemRoot%\UOL.HTM
  1278. FILE_DELETE_BY_PATH2=%SystemRoot%\UOL.TXT.VBS
  1279.  
  1280. [VBS/LoveLetter.W.Clear]
  1281. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1282. FILE_DELETE_BY_REGISTRY_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1283. FILE_DELETE_BY_REGISTRY_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1284. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,MSKernel32
  1285. REGISTRY_DELETE_KEY_VALUE1=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\RunServices,Win32DLL
  1286. REGISTRY_DELETE_KEY_VALUE2=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,WIN-BUGSFIX
  1287. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://www.2600.com,http://www.pandasoftware.com
  1288. FILE_DELETE_BY_PATH1=%SystemRoot%\BUG AND VIRUS FIX.HTM
  1289. FILE_DELETE_BY_PATH2=%SystemRoot%\BUG AND VIRUS FIX.TXT.VBS
  1290.  
  1291. [I-Worm/Verona.B.Clear]
  1292. FILE_DELETE_BY_PATH0=%WindowsRoot%\Sysrnj.exe
  1293. REGISTRY_SET_KEY_VALUE0=HKEY_CLASSES_ROOT,.arj,,
  1294. REGISTRY_SET_KEY_VALUE1=HKEY_CLASSES_ROOT,.avi,,avifile
  1295. REGISTRY_SET_KEY_VALUE2=HKEY_CLASSES_ROOT,.bmp,,Paint.Picture
  1296. REGISTRY_SET_KEY_VALUE3=HKEY_CLASSES_ROOT,.doc,,
  1297. REGISTRY_SET_KEY_VALUE4=HKEY_CLASSES_ROOT,.exe,,exefile
  1298. REGISTRY_SET_KEY_VALUE5=HKEY_CLASSES_ROOT,.gif,,giffile
  1299. REGISTRY_SET_KEY_VALUE6=HKEY_CLASSES_ROOT,.jpe,,jpegfile
  1300. REGISTRY_SET_KEY_VALUE7=HKEY_CLASSES_ROOT,.jpeg,,jpegfile
  1301. REGISTRY_SET_KEY_VALUE8=HKEY_CLASSES_ROOT,.jpg,,jpegfile
  1302. REGISTRY_SET_KEY_VALUE9=HKEY_CLASSES_ROOT,.lha,,
  1303. REGISTRY_SET_KEY_VALUE10=HKEY_CLASSES_ROOT,.mp2,,mpegfile
  1304. REGISTRY_SET_KEY_VALUE11=HKEY_CLASSES_ROOT,.mp3,,mp3file
  1305. REGISTRY_SET_KEY_VALUE12=HKEY_CLASSES_ROOT,.mpeg,,mpegfile
  1306. REGISTRY_SET_KEY_VALUE13=HKEY_CLASSES_ROOT,.mpg,,mpegfile
  1307. REGISTRY_SET_KEY_VALUE14=HKEY_CLASSES_ROOT,.rar,,
  1308. REGISTRY_SET_KEY_VALUE15=HKEY_CLASSES_ROOT,.reg,,regfile
  1309. REGISTRY_SET_KEY_VALUE16=HKEY_CLASSES_ROOT,.vqf,,
  1310. REGISTRY_SET_KEY_VALUE17=HKEY_CLASSES_ROOT,.wma,,WMAfile
  1311. REGISTRY_SET_KEY_VALUE18=HKEY_CLASSES_ROOT,.wmf,,WMF_auto_file
  1312. REGISTRY_SET_KEY_VALUE19=HKEY_CLASSES_ROOT,.wmv,,WMVFile
  1313. REGISTRY_SET_KEY_VALUE20=HKEY_CLASSES_ROOT,.xls,,
  1314. REGISTRY_SET_KEY_VALUE21=HKEY_CLASSES_ROOT,.zip,,
  1315. REGISTRY_DELETE_KEY0=HKEY_CLASSES_ROOT,rnjfile\DefaultIcon
  1316. REGISTRY_DELETE_KEY1=HKEY_CLASSES_ROOT,rnjfile\shell\open\command
  1317. REGISTRY_DELETE_KEY2=HKEY_CLASSES_ROOT,rnjfile\shell\open
  1318. REGISTRY_DELETE_KEY3=HKEY_CLASSES_ROOT,rnjfile\shell\
  1319. REGISTRY_DELETE_KEY4=HKEY_CLASSES_ROOT,rnjfile
  1320.  
  1321. [W32/Navidad.Clear]
  1322. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Win32BaseServiceMOD
  1323. REGISTRY_SET_KEY_VALUE0=HKEY_CLASSES_ROOT,exefile\shell\open\command,"",""%1" %*"
  1324. FILE_DELETE_BY_PATH1=%SystemRoot%\WINSVRC.VXD
  1325. PROC_TERMINATE_BY_NAME0=NAVIDAD.EXE
  1326.  
  1327. [W32/Navidad.B.Clear]
  1328. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,Win32BaseServiceMOD
  1329. REGISTRY_SET_KEY_VALUE0=HKEY_CLASSES_ROOT,exefile\shell\open\command,"",""%1" %*"
  1330. PROC_TERMINATE_BY_NAME0=WINTASK.EXE
  1331. PROC_TERMINATE_BY_NAME1=EMANUEL.EXE
  1332. FILE_DELETE_BY_PATH0=%SystemRoot%\wintask.exe
  1333.  
  1334. [W32/FunLove.Clear]
  1335. PROC_TERMINATE_BY_NAME0=FLCSS.EXE
  1336. FILE_DELETE_BY_PATH0=%SystemRoot%\FLCSS.EXE
  1337. PATH_MAKE_BY_PATH0=%SystemRoot%\FLCSS.EXE,1,HSR
  1338. SERVICE_DELETE_BY_NAME0=FLC
  1339. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,FLC
  1340.  
  1341. [W32/PrettyPark.Clear]
  1342. REGISTRY_SET_KEY_VALUE0=HKEY_CLASSES_ROOT,exefile\shell\open\command,"",""%1" %*"
  1343. PROC_TERMINATE_BY_NAME0=FILES32.VXD
  1344. FILE_DELETE_BY_PATH0=%SystemRoot%\FILES32.VXD
  1345.  
  1346. [VBS/Help.Clear]
  1347. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_CURRENT_USER,SOFTWARE\Help,wallPaper
  1348. FILE_DELETE_BY_PATH0=%WindowsRoot%\UNTITLED.HTM
  1349. REGISTRY_DELETE_KEY0=HKEY_CURRENT_USER,SOFTWARE\Help
  1350. REGISTRY_SET_KEY_VALUE0=HKEY_CURRENT_USER,Control Panel\Desktop,Wallpaper,""
  1351.  
  1352. [W32/SirCam.Clear.NT]
  1353. PROC_TERMINATE_BY_NAME0=SIRC32.EXE
  1354. PROC_TERMINATE_BY_NAME1=SCAM32.EXE
  1355. PROC_TERMINATE_BY_NAME2=RUN32.EXE
  1356. PROC_TERMINATE_BY_NAME3=RUNDLL32.EXE
  1357. REGISTRY_SET_KEY_VALUE0=HKEY_CLASSES_ROOT,exefile\shell\open\command,"",""%1" %*"
  1358. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices,Driver32
  1359. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices,Driver32
  1360. REGISTRY_DELETE_KEY0=HKEY_LOCAL_MACHINE,SOFTWARE\SirCam
  1361. FILE_DELETE_BY_PATH00=%RecycledRoot%\SIRC32.EXE
  1362. FILE_DELETE_BY_PATH01=%SystemRoot%\SCD.DLL
  1363. FILE_DELETE_BY_PATH02=%SystemRoot%\SCW1.DLL
  1364. FILE_DELETE_BY_PATH03=%SystemRoot%\SCI1.DLL
  1365. FILE_DELETE_BY_PATH04=%SystemRoot%\SCY1.DLL
  1366. FILE_DELETE_BY_PATH05=%SystemRoot%\SCH1.DLL
  1367. FILE_DELETE_BY_PATH06=%SystemRoot%\SCT1.DLL
  1368. FILE_DELETE_BY_PATH07=%WindowsRoot%\ScMx32.exe
  1369. FILE_DELETE_BY_PATH08=%StartUpRoot%\Microsoft Internet Office.exe
  1370. FILE_DELETE_BY_PATH09=%RecycledRoot%\SIRCAM.SYS
  1371. FILE_DELETE_BY_PATH10=%Root%\SIRC32.EXE
  1372. FILE_REPLACE_TEXT0=%Root%\AUTOEXEC.BAT,"@win \recycled\sirc32.exe","",FALSE
  1373. FILE_REPLACE_TEXT1=%WindowsRoot%\WIN.INI,"SirC32.exe="C:\SirC32.exe"","",FALSE
  1374. REGISTRY_REPLACE_TEXT_IN_VALUE0=HKEY_CLASSES_ROOT,"inffile\shell\Install\command","","RUN32.EXE","RUNDLL32.EXE",FALSE
  1375. REGISTRY_REPLACE_TEXT_IN_VALUE1=HKEY_CLASSES_ROOT,"Unknown\shell\openas\command","","RUN32.EXE","RUNDLL32.EXE",FALSE
  1376. FILE_MOVE_BY_PATH_TO_PATH0=%SystemRoot%\RUN32.EXE,%SystemRoot%\RUNDLL32.EXE
  1377.  
  1378. [W32/SirCam.Clear.9X]
  1379. PROC_TERMINATE_BY_NAME0=SIRC32.EXE
  1380. PROC_TERMINATE_BY_NAME1=SCAM32.EXE
  1381. PROC_TERMINATE_BY_NAME2=RUN32.EXE
  1382. PROC_TERMINATE_BY_NAME3=RUNDLL32.EXE
  1383. REGISTRY_SET_KEY_VALUE0=HKEY_CLASSES_ROOT,exefile\shell\open\command,"",""%1" %*"
  1384. FILE_DELETE_BY_REGISTRY_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices,Driver32
  1385. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices,Driver32
  1386. REGISTRY_DELETE_KEY0=HKEY_LOCAL_MACHINE,SOFTWARE\SirCam
  1387. FILE_DELETE_BY_PATH00=%RecycledRoot%\SIRC32.EXE
  1388. FILE_DELETE_BY_PATH01=%SystemRoot%\SCD.DLL
  1389. FILE_DELETE_BY_PATH02=%SystemRoot%\SCW1.DLL
  1390. FILE_DELETE_BY_PATH03=%SystemRoot%\SCI1.DLL
  1391. FILE_DELETE_BY_PATH04=%SystemRoot%\SCY1.DLL
  1392. FILE_DELETE_BY_PATH05=%SystemRoot%\SCH1.DLL
  1393. FILE_DELETE_BY_PATH06=%SystemRoot%\SCT1.DLL
  1394. FILE_DELETE_BY_PATH07=%WindowsRoot%\ScMx32.exe
  1395. FILE_DELETE_BY_PATH08=%StartUpRoot%\Microsoft Internet Office.exe
  1396. FILE_DELETE_BY_PATH09=%RecycledRoot%\SIRCAM.SYS
  1397. FILE_DELETE_BY_PATH10=%Root%\SIRC32.EXE
  1398. FILE_REPLACE_TEXT0=%Root%\AUTOEXEC.BAT,"@win \recycled\sirc32.exe","",FALSE
  1399. FILE_REPLACE_TEXT1=%WindowsRoot%\WIN.INI,"SirC32.exe="C:\SirC32.exe"","",FALSE
  1400. REGISTRY_REPLACE_TEXT_IN_VALUE0=HKEY_CLASSES_ROOT,"inffile\shell\Install\command","","RUN32.EXE","RUNDLL.EXE",FALSE
  1401. REGISTRY_REPLACE_TEXT_IN_VALUE1=HKEY_CLASSES_ROOT,"Unknown\shell\openas\command","","RUN32.EXE","RUNDLL32.EXE",FALSE
  1402. FILE_MOVE_BY_PATH_TO_PATH0=%WindowsRoot%\RUN32.EXE,%WindowsRoot%\RUNDLL32.EXE
  1403.  
  1404. [W32/Nimda.Clear]
  1405. PROC_TERMINATE_BY_NAME0=LOAD.EXE
  1406. FILE_DELETE_BY_PATH00=%WindowsRoot%\MMC.EXE
  1407. FILE_DELETE_BY_PATH01=%WindowsRoot%\CSRSS.EXE
  1408. FILE_DELETE_BY_PATH02=%TempRoot%\MEP*.EXE
  1409. FILE_DELETE_BY_PATH03=%WindowsRoot%\WININIT.INI
  1410. FILE_REPLACE_TEXT1=%WindowsRoot%\SYSTEM.INI," load.exe -dontrunold","",FALSE
  1411. FILE_DELETE_BY_PATH04=%TempRoot%\MEP*.*
  1412. FILE_DELETE_BY_PATH05=%WindowsRoot%\MEP*.*
  1413. FILE_DELETE_BY_PATH06=%SystemRoot%\LOAD.EXE
  1414. USER_DISABLE_BY_NAME0=guest
  1415. FILE_DELETE_BY_PATH07=C:\ADMIN.DLL
  1416. FILE_DELETE_BY_PATH08=D:\ADMIN.DLL
  1417. FILE_DELETE_BY_PATH09=E:\ADMIN.DLL
  1418. FILE_DELETE_BY_PATH10=C:\HTTPODBC.DLL
  1419. FILE_DELETE_BY_PATH11=D:\HTTPODBC.DLL
  1420. FILE_DELETE_BY_PATH12=E:\HTTPODBC.DLL
  1421. FILE_DELETE_BY_PATH13=C:\INETPUB\WWWROOT\TFTP*
  1422. FILE_DELETE_BY_PATH14=C:\INETPUB\SCRIPTS\TFTP*
  1423. FILE_DELETE_BY_PATH15=D:\INETPUB\WWWROOT\TFTP*
  1424. FILE_DELETE_BY_PATH16=D:\INETPUB\SCRIPTS\TFTP*
  1425. FILE_DELETE_BY_PATH17=E:\INETPUB\WWWROOT\TFTP*
  1426. FILE_DELETE_BY_PATH18=E:\INETPUB\SCRIPTS\TFTP*
  1427. FILE_DELETE_BY_PATH19=F:\INETPUB\WWWROOT\TFTP*
  1428. FILE_DELETE_BY_PATH20=F:\INETPUB\SCRIPTS\TFTP*
  1429. FILE_DELETE_BY_PATH21=G:\INETPUB\WWWROOT\TFTP*
  1430. FILE_DELETE_BY_PATH22=G:\INETPUB\SCRIPTS\TFTP*
  1431.  
  1432.  
  1433. [W32/Vote.Clear]
  1434. FILE_DELETE_BY_PATH00=%SystemRoot%\Zacker.vbs
  1435. FILE_DELETE_BY_PATH01=%WindowsRoot%\MixDaLaL.vbs
  1436. FILE_DELETE_BY_PATH02=%WindowsRoot%\WTC.exe
  1437. REGISTRY_DELETE_KEY_VALUE0=HKEY_LOCAL_MACHINE,Software\Microsoft\Windows\CurrentVersion\Run,Norton.Thar
  1438. REGISTRY_SET_KEY_VALUE_IF_EQUAL0=HKEY_CURRENT_USER,Software\Microsoft\Internet Explorer\Main,Start Page,http://us.f1.yahoofs.com/users/da36d538/bc/TimeUpdate.exe?bcaVq97ATaW0yAxk,http://www.pandasoftware.com
  1439. FILE_REPLACE_TEXT0=%Root%\AUTOEXEC.BAT,"echo y | format C:","",FALSE
  1440.  
  1441.  
  1442. [ByteStrings]
  1443. KAK_A=4B414B2E48544D
  1444. KAK_B=44454641554C542E48544D
  1445.