|
Der Schädling Win32/Adware.SearchAid Adware
erstellt, bzw. ändert (falls bereits vorhanden) folgende Einträge in der systembeschreibenden Datenbasis:
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Messaging"="C:\Program Files\Instant Messenger Names\IM-svr.EXE"
- [HKEY_CLASSES_ROOT\CLSID\{9125F250-EB4F-49fe-AE17-C17665873A5C}\InProcServer32] "@"="C:\Program Files\BHO\plugin.dll
- [HKEY_LOCAL_MACHINE\SOFTWARE\BHO\files] "plugin.dll"="2"
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9125F250-EB4F-49fe-AE17-C17665873A5C}\InProcServer32] "@"="C:\Program Files\BHO\plugin.dll"
- [HKEY_CURRENT_USER\Software\WinRAR SFX] "C%%Program Files%Instant Messenger Names"="C:\Program Files\Instant Messenger Names"
- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Messaging"="C:\Program Files\Instant Messenger Names\IM-svr.EXE"
- [HKEY_CLASSES_ROOT\CLSID\{9125F250-EB4F-49fe-AE17-C17665873A5C}\InProcServer32] "@"="C:\Program Files\BHO\plugin.dll
- [HKEY_LOCAL_MACHINE\SOFTWARE\BHO\files] "plugin.dll"="2"
- [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9125F250-EB4F-49fe-AE17-C17665873A5C}\InProcServer32] "@"="C:\Program Files\BHO\plugin.dll"
- [HKEY_CURRENT_USER\Software\WinRAR SFX] "C%%Program Files%Instant Messenger Names"="C:\Program Files\Instant Messenger Names"
|