Text 122, 1193 rader
Skriven 2006-06-11 18:11:00 av KURT WISMER (1:123/140)
Ärende: News, June 11 2006
==========================
[cut-n-paste from sophos.com]
Name W32/Sdbot-BUK
Type
* Spyware Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Modifies data on the computer
* Deletes files off the computer
* Steals information
* Uses its own emailing engine
* Downloads code from the internet
* Reduces system security
* Installs itself in the Registry
* Exploits system or software vulnerabilities
* Used in DOS attacks
* Downloads updates
* Enables remote access
* Scans network for vulnerabilities
* Scans network for weak passwords
* Scans network for open ports
Aliases
* WORM_RBOT.GR
* W32.Linkbot
* Backdoor.Win32.Rbot.aem
Prevalence (1-5) 2
Description
W32/Sdbot-BUK is a worm for the Windows platform.
W32/Sdbot-BUK spreads
- to computers vulnerable to common exploits, including: LSASS
(MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049), WebDav (MS03-007),
Veritas (CAN-2004-1172), Dameware (CAN-2003-1030), PNP (MS05-039) and
ASN.1 (MS04-007)
- to network shares protected by weak passwords
The worm contains an IRC backdoor component which allows remote
attackers the ability to gain access and control over the infected
computer.
Advanced
W32/Sdbot-BUK is a worm for the Windows platform.
W32/Sdbot-BUK spreads
- to computers vulnerable to common exploits, including: LSASS
(MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049), WebDav (MS03-007),
Veritas (CAN-2004-1172), Dameware (CAN-2003-1030), PNP (MS05-039) and
ASN.1 (MS04-007)
- to network shares protected by weak passwords
The worm contains an IRC backdoor component which allows remote
attackers the ability to gain access and control over the infected
computer.
When first run, the worm copies itself to the Windows system folder
using one of the following randomly chosen filenames:
algs.exe
csrs.exe
explorer.exe
firewall.exe
iexplore.exe
Isass.exe
logon.exe
lssas.exe
spooIsv.exe
spoolsvc.exe
winamp.exe
winIogon.exe
The worm creates a registry entry under the following in order to run
each time a user logs on:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Name W32/Rbot-DZX
Type
* Spyware Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Allows others to access the computer
* Steals information
* Downloads code from the internet
* Records keystrokes
* Installs itself in the Registry
* Exploits system or software vulnerabilities
* Used in DOS attacks
Aliases
* W32/Sdbot.worm.gen.bp
Prevalence (1-5) 2
Description
W32/Rbot-DZX is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Rbot-DZX spreads to other network computers by:
- exploiting common buffer overflow vulnerabilities, including: LSASS
(MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812),
WebDav (MS03-007), Veritas (CAN-2004-1172), ASN.1 (MS04-007)
- backdoors left behind by the W32/MyDoom and W32/Bagle family of worms
- networks protected by weak passwords
W32/Rbot-DZX runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Rbot-DZX includes functionality to:
- access the internet and communicate with a remote server via HTTP
- record keystrokes
- act as a proxy redirecting internet traffic
- steal CD game keys
- terminate security and anti-virus related processes
- perform DDoS attacks
Advanced
W32/Rbot-DZX is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Rbot-DZX spreads to other network computers by:
- exploiting common buffer overflow vulnerabilities, including: LSASS
(MS04-011), RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812),
WebDav (MS03-007), Veritas (CAN-2004-1172), ASN.1 (MS04-007)
- backdoors left behind by the W32/MyDoom and W32/Bagle family of worms
- networks protected by weak passwords
W32/Rbot-DZX runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Rbot-DZX includes functionality to:
- access the internet and communicate with a remote server via HTTP
- record keystrokes
- act as a proxy redirecting internet traffic
- steal CD game keys
- terminate security and anti-virus related processes
- perform DDoS attacks
When first run W32/Rbot-DZX copies itself to <System>\qopz.exe.
The following registry entries are created to run qopz.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
RPC Service
qopz.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RPC Service
qopz.exe
The following registry entry is set:
HKCU\Software\Microsoft\OLE
RPC Service
qopz.exe
Name Troj/Mailbot-AJ
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Installs itself in the Registry
Aliases
* Trojan-Proxy.Win32.Slaper.c
* Spam-Mailbot
Prevalence (1-5) 2
Description
Troj/Mailbot-AJ is a Trojan for the Windows platform.
Advanced
Troj/Mailbot-AJ is a Trojan for the Windows platform.
When first run the Trojan copies itself to <System>\mnew6win.exe and
creates the following file:
<System>\helpermnew6win.exe
The file helpermnew6win.exe is also detected as Troj/Mailbot-AJ.
The Trojan installs itself as a service called "mnew6win".
The following registry entry is created in order to run the Trojan on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
mlrnew6
<System>\mnew6win.exe
Name W32/Looked-A
Type
* Virus
How it spreads
* Network shares
* Infected files
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* Worm.Win32.Viking.j
* W32/Gavir.worm
* Win32/Viking.J
* W32.Looked.I
* PE_LOOKED.O-O
Prevalence (1-5) 2
Description
W32/Looked-A is a Windows executable virus and network worm.
The virus infects EXE files found on the infected computer. The virus
also attempts to copy itself to remote network shares.
Advanced
W32/Looked-A is a Windows executable virus and network worm.
The virus infects EXE files found on the infected computer. The virus
also attempts to copy itself to remote network shares.
When first run the virus copies itself to <Windows
folder>\rundl132.exe and creates a file <Windows folder>\vDll.dll,
also detected as W32/Looked-A. This file attempts to download further
malicious code.
Many files with the name "_desktop.ini" are created, in various
folders on the infected computer. These files are harmless text files.
The following registry entry is created in order to run the virus on
startup:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load
<Windows folder>\rundl132.exe
Name Troj/WowPWS-K
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals information
* Drops more malware
* Downloads code from the internet
* Leaves non-infected files on computer
* Monitors system activity
Aliases
* Trojan-PSW.Win32.WOW.r
Prevalence (1-5) 2
Description
Troj/WowPWS-K is a Trojan for the Windows platform.
The Trojan monitors internet activity for traffic to certain online
gaming servers. Troj/WowPWS-K steals usernames, passwords and other
transmitted data.
Advanced
Troj/WowPWS-K is a Trojan for the Windows platform.
When run, Troj/WowPWS-K creates the following files:
<Progam files>\Internet Explorer\signup\GServers.inf (data file)
<Progam files>\Internet Explorer\signup\LServers.inf (data file)
<Progam files>\Internet Explorer\signup\foo (data file)
<Progam files>\Internet Explorer\signup\svchost.exe (also detected as
Troj/WowPWS-K)
<System>\Packet.dll (WinTroj/WowPWS-K is a Trojan for the Windows
platform.
When run, Troj/WowPWS-K creates the following files:
<Progam files>\Internet Explorer\signup\GServers.inf (data file)
<Progam files>\Internet Explorer\signup\LServers.inf (data file)
<Progam files>\Internet Explorer\signup\foo (data file)
<Progam files>\Internet Explorer\signup\svchost.exe (also detected as
Troj/WowPWS-K)
<System>\Packet.dll (WinPCap utility)
<System>\WanPacket.dll (WinPCap utility)
<System>\drivers\npf.sys (WinPCap utility)
<System>\wpcap.dll (WinPCap utility)
The Trojan monitors internet activity for traffic to certain online
gaming servers. Troj/WowPWS-K steals usernames, passwords and other
transmitted data. PCap utility)
<System>\WanPacket.dll (WinPCap utility)
<System>\drivers\npf.sys (WinPCap utility)
<System>\wpcap.dll (WinPCap utility)
The Trojan monitors internet activity for traffic to certain online
gaming servers. Troj/WowPWS-K steals usernames, passwords and other
transmitted data.
Name Troj/DwnLdr-CJJ
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
* Installs itself in the Registry
Aliases
* Trojan-Downloader.Win32.Agent.ams
Prevalence (1-5) 2
Description
Troj/DwnLdr-CJJ is a downloader Trojan for the Windows platform.
Advanced
Troj/DwnLdr-CJJ is a downloader Trojan for the Windows platform.
When first run Troj/DwnLdr-CJJ copies itself to:
<
<System>\<random filename>.exe
The following registry entries are created to run <random
filename>.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
<random filename>
<User>\Local Settings\Application Data\<random filename>.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
<random filename>
<System>\<random filename>
Name W32/Zasran-E
Type
* Spyware Worm
How it spreads
* Email attachments
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Sends itself to email addresses found on the infected computer
* Steals information
* Drops more malware
* Uses its own emailing engine
* Reduces system security
* Installs itself in the Registry
Aliases
* Email-Worm.Win32.Banwarum.a
* W32/Banwarum@MM
* W32.Banwarum@mm
* WORM_RANCHNEG.A
Prevalence (1-5) 2
Description
W32/Zasran-E is a mass mailing worm with backdoor functionality for
the Windows platform.
W32/Zasran-E runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer.
W32/Zasran-E is capable of spreading through email. The worm's email
characteristics may vary.
W32/Zasran-E harvests email addresses from files on the infected
computer and from the Windows address book.
Advanced
W32/Zasran-E is a mass mailing worm with backdoor functionality for
the Windows platform.
W32/Zasran-E runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer.
When W32/Zasran-E is installed it creates the file <Windows system
folder>\mszsrn32.dll. This file is also detected as W32/Zasran-E.
W32/Zasran-E injects mszsrn32.dll into the WINLOGON.EXE process and
creates numerous registry entries under the following entry to run
the DLL component on startup:
HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\mszsrn32
W32/Zasran-E is capable of spreading through email. The worm's email
characteristics may vary.
W32/Zasran-E harvests email addresses from files on the infected
computer and from the Windows address book.
Name W32/Sdbot-BUQ
Type
* Spyware Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Turns off anti-virus applications
* Steals information
* Reduces system security
* Installs itself in the Registry
* Exploits system or software vulnerabilities
Prevalence (1-5) 2
Description
W32/Sdbot-BUQ is a worm for the Windows platform.
W32/Sdbot-BUQ spreads to other network computers by exploiting the
buffer overflow vulnerabilities: RPC-DCOM (MS04-012), PNP (MS05-039)
and ASN.1 (MS04-007) and by copying itself to network shares
protected by weak passwords.
W32/Sdbot-BUQ runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
Advanced
W32/Sdbot-BUQ is a worm for the Windows platform.
W32/Sdbot-BUQ spreads to other network computers by exploiting the
buffer overflow vulnerabilities: RPC-DCOM (MS04-012), PNP (MS05-039)
and ASN.1 (MS04-007) and by copying itself to network shares
protected by weak passwords.
W32/Sdbot-BUQ runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
When first run W32/Sdbot-BUQ copies itself to <Windows>\Mscfg.exe.
The following registry entries are created to run Mscfg.exe on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Ms System Config
Mscfg.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Ms System Config
Mscfg.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
Ms System Config
Mscfg.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Ms System Config
Mscfg.exe
W32/Sdbot-BUQ sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\wuauserv
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
Note: disabling autostart for the SharedAccess service deactivates
the Microsoft Internet Connection Firewall (ICF).
Registry entries are set as follows:
HKCU\SYSTEM\CurrentControlSet\Control\Lsa
Ms System Config
Mscfg.exe
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Ms System Config
Mscfg.exe
HKCU\Software\Microsoft\OLE
Ms System Config
Mscfg.exe
HKLM\SOFTWARE\Microsoft\Ole
Ms System Config
Mscfg.exe
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Name Troj/Banloa-ADN
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Aliases
* Trojan-Downloader.Win32.Banload.ack
* PWS-Banker.dldr
* Win32/TrojanDownloader.Banload.ACK
Prevalence (1-5) 2
Description
Troj/Banloa-ADN is a downloading Trojan for the Windows platform.
Troj/Banloa-ADN includes functionality to access the internet and
communicate with a remote server via HTTP.
Name Troj/GPCode-A
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Deletes files off the computer
* Installs itself in the Registry
* Leaves non-infected files on computer
Aliases
* Win32/Gpcode.AD
* GPcoder.e
Prevalence (1-5) 2
Description
Troj/GPCode-A is a Trojan which encrypts user documents.
Advanced
Troj/GPCode-A is a Trojan which encrypts user documents.
The following registry entry is created to run Troj/GPCode-A on
startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
services
<pathname of the Trojan executable>
Registry entries are also created under:
HKCU\Software\Microsoft\Sysinf\
The Trojan searches available drives for files having an extension
from the following list:
123
akf
c
cvs
dbq
fox
lst
pm4
12m
alv
c??
cwb
dbt
frm
lwp
pm5
3ds
amp
c86
cwk
dbx
frt
lzh
pm6
3dx
ans
cac
cxe
dic
frx
lzs
ppt
4ge
ap
cat
cyp
dif
fsl
lzw
prf
4gl
apa
cbl
d
dm
gtd
ma
prx
a
apo
cc
db
dmd
gz
mak
ps
a86
app
cdb
db0
doc
gzip
man
pst
abc
arc
cdr
db1
dok
h
maq
pw
acd
db2
dox
ha
mar
pwa
ace
arh
cgi
dsc
hh
mbx
pwl
act
arj
dwg
hjt
mdb
pwm
ada
arx
db3
dxf
hog
mdf
pwp
adi
asc
cmd
db4
dxr
htm
mmf
pxl
aex
ask
cnt
dba
eps
html
mo
rar
af3
bb
cob
dbb
exp
htx
myd
rle
afd
bcp
col
dbc
f
ice
old
rmr
ag4
bdb
cpp
dbd
fas
icf
p12
rnd
ai
bh
cpt
dbe
fax
ihtml
pak
rtf
aif
bib
crp
dbf
fdb
pdf
safe
aifc
bsa
cru
fla
ish
pem
sar
aiff
btr
csc
jar
pfx
sig
ain
bup
css
dbk
flb
jsp
pgp
sln
aio
bwb
csv
dbm
key
pl
swf
ais
bz
ctx
dbo
fm
kwm
pm3
tar
tbb
tex
tga
txt
vp
xcr
xls
xml
zip
zoo
The Trojan will then encrypt any matching files. In every folder in
which files have been encrypted, Troj/GPCode-A creates a file named
"readme.txt" containing the following message:
Some files are coded by RSA method.
To buy decode mail: k<number>@mail.ru
with subject: REPLY
(where <number> is a decimal number)
The Trojan also creates the file autosave.sin in the user's temporary
folder. This file contains a list of all files which the Trojan has
scanned during encryption.
Name W32/Tilebot-FD
Type
* Worm
How it spreads
* Network shares
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Drops more malware
* Downloads code from the internet
* Installs itself in the Registry
* Exploits system or software vulnerabilities
* Used in DOS attacks
Aliases
* WORM_SDBOT.IL
* Backdoor.Win32.SdBot.xd
Prevalence (1-5) 2
Description
W32/Tilebot-FD is a worm and IRC backdoor Trojan for the Windows
platform.
Advanced
W32/Tilebot-FD is a worm and IRC backdoor Trojan for the Windows
platform.
W32/Tilebot-FD spreads to other network computers by exploiting
common buffer overflow vulnerabilities, including: LSASS (MS04-011),
RPC-DCOM (MS04-012), WKS (MS03-049) (CAN-2003-0812), PNP (MS05-039)
and ASN.1 (MS04-007) and by copying itself to network shares
protected by weak passwords.
W32/Tilebot-FD runs continuously in the background, providing a
backdoor server which allows a remote intruder to gain access and
control over the computer via IRC channels.
W32/Tilebot-FD includes functionality to access the internet and
communicate with a remote server via HTTP.
When first run W32/Tilebot-FD copies itself to <Windows>\smss.exe.
The file <Windows>\smss.exe is registered as a new system driver
service named "Aol Software", with a display name of "aol software"
and a startup type of automatic, so that it is started automatically
during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\Aol Software\
W32/Tilebot-FD sets the following registry entries, disabling the
automatic startup of other software:
HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4
HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4
Registry entries are set as follows:
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1
HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1
Registry entries are created under:
HKCR\.key\
HKLM\SOFTWARE\Microsoft\Security Center\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\
Name Troj/Backdr-C
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
Aliases
* BKDR_TINYDOG.C
* Backdoor.Win32.Shell.b
Prevalence (1-5) 2
Description
Troj/Backdr-C is a backdoor Trojan for the Windows platform.
Troj/Backdr-C allows a remote intruder access to the infected computer.
Name Troj/Banloa-AFG
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Downloads code from the internet
Aliases
* Trojan-Downloader.Win32.Banload.atn
* PWS-Banker.gen.i
Prevalence (1-5) 2
Description
Troj/Banloa-AFG is a Trojan for the Windows platform.
Troj/Banloa-AFG includes functionality to access the internet and
download further malicious code.
Name Troj/Banker-BWC
Type
* Spyware Trojan
Affected operating systems
* Windows
Side effects
* Steals credit card details
* Steals information
* Uses its own emailing engine
* Installs itself in the Registry
Aliases
* Trojan-Spy.Win32.Banker.anv
* W32/Banker.RQK
* PWS-Banker.gen.bb
* Infostealer.Bancos
* TSPY_BANKER.EGM
Prevalence (1-5) 2
Description
Troj/Banker-BWC is a password-stealing Trojan for the Windows platform.
Advanced
Troj/Banker-BWC is a password-stealing Trojan for the Windows platform.
Troj/Banker-BWC includes functionality to send notification messages
to remote locations.
The Trojan monitors browser activity for access to specific internet
banking websites. When one of these sites is visited, the Trojan
displays a fake login interface in order to capture the user's
account details.
When first run Troj/Banker-BWC copies itself to:
<Startup>\lsass32.exe
<Windows system folder>\lsass32.exe
The following registry entry is created to run lsass32.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
lsass32
<Windows system folder>\lsass32.exe
Name Troj/Zlob-MW
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Installs itself in the Registry
Aliases
* Trojan-Downloader.Win32.Zlob.rw
* Win32/TrojanDownloader.Zlob.PZ
Prevalence (1-5) 2
Description
Troj/Zlob-MW is a Trojan for the Windows platform.
Advanced
Troj/Zlob-MW is a Trojan for the Windows platform.
When Troj/Zlob-MW is installed the following files are created:
<Program Files>\Media-Codec\ecodec.exe
<Program Files>\Media-Codec\uninst.exe
<System>\regperf.exe
<System>\ld<rnd>.tmp
<Temp>\nsa4.tmp\Loader.dll
for some randomly generated number <rnd>. The files ecodec.exe,
regperf.exe, Loader.dll and ld<rnd>.tmp are also detected as
Troj/Zlob-MW.
The following registry entry is created to run regperf.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run
wininet.dll
regperf.exe
Registry entries are created under:
HKCR\EMediaCodec.Chl\CLSID\
HKCR\Media-Codec.Chl\CLSID\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Media-Codec\
Name Troj/Zapchas-BL
Type
* Trojan
Affected operating systems
* Windows
Side effects
* Allows others to access the computer
* Drops more malware
* Installs itself in the Registry
* Leaves non-infected files on computer
Prevalence (1-5) 2
Description
Troj/Zapchas-BL is a multi-component backdoor Trojan for the Windows
platform.
Troj/Zapchas-BL drops the virus W32/Parite-B.
Advanced
Troj/Zapchas-BL is a multi-component backdoor Trojan for the Windows
platform.
When Troj/Zapchas-BL is installed the following files are created:
<System>\You Have Been HaCkeD By Me.jpg
<System>\aliases.ini
<System>\control.ini
<System>\fullname.txt
<System>\ident.txt
<System>\mirc.ico
<System>\mirc.ini
<System>\nicks.txt
<System>\popups.txt
<System>\remote.ini
<System>\script.ini
<System>\servers.ini
<System>\sup.bat
<System>\sup.reg
<System>\svchost.exe
<System>\users.ini
<System>\yaddress.ico
The files mirc.ini anc script.ini are also detected as
Troj/Zapchas-BL. The file svchost.exe is a mIRC chat application,
infected with W32/Parite-B. The other files are harmless and may be
deleted.
The following registry entries are set or modified, so that
svchost.exe is run when files with extensions of CHA and IRC are
opened/launched:
HKCR\ChatFile\Shell\open\command
(default)
<System>\svchost.exe" -noconnect
HKCR\irc\Shell\open\command
(default)
<System>\svchost.exe" -noconnect
Registry entries are set as follows:
HKCR\ChatFile\DefaultIcon
(default)
<System>\svchost.exe
HKCR\irc\DefaultIcon
(default)
<System>\svchost.exe
Registry entries are created under:
HKCU\Software\Microsoft\Microsoft Agent\
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mIRC\
--- MultiMail/Win32 v0.43
* Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)
|