MonitoringTool:Win32/Winspy (Microsoft); Spyware.BCWinSpy (Symantec); Trojan-Spy.Win32.WinSpy.u (Kaspersky); Trojan.Win32.Generic!BT (Sunbelt); Trojan horse PSW.Generic4.VWK (AVG)

 Plate-forme:

Windows 2000, Windows XP, Windows Server 2003

 Overall Risk:
 Dommages potentiels: :
 Distribution potentielle: :
 reportedInfection:
Faible
Medium
Élevé
Critique

  • Type de grayware:
    Trojan

  • Destructif:
    Non

  • Chiffrement:
     

  • In the wild::
    Oui

  Overview


  Détails techniques

File size: 126,976 bytes
File type: EXE
Memory resident: Non
Date de réception des premiers échantillons: 14 mai 2013

Installation

Erstellt die folgenden Ordner:

  • %Program Files%\Accessories
  • %Program Files%\Accessories\Temp299
  • %Program Files%\Accessories\Temp299\Archive
  • %Program Files%\Accessories\Temp299\Archive\WC
  • %Program Files%\Accessories\Temp299\WC
  • %Program Files%\Accessories\Temp120
  • %Program Files%\Accessories\Temp120\Archive
  • %Program Files%\Accessories\Temp120\Archive\WC
  • %Program Files%\Accessories\Temp120\WC
  • %Program Files%\Accessories\Temp222
  • %Program Files%\Accessories\Temp222\Archive
  • %Program Files%\Accessories\Temp222\Archive\WC
  • %Program Files%\Accessories\Temp222\WC
  • %Program Files%\Accessories\Temp112
  • %Program Files%\Accessories\Temp112\Archive
  • %Program Files%\Accessories\Temp112\Archive\WC
  • %Program Files%\Accessories\Temp112\WC
  • %Program Files%\Accessories\Temp90
  • %Program Files%\Accessories\Temp90\Archive
  • %Program Files%\Accessories\Temp90\Archive\WC
  • %Program Files%\Accessories\Temp90\WC
  • %Program Files%\Accessories\Temp4
  • %Program Files%\Accessories\Temp4\Archive
  • %Program Files%\Accessories\Temp4\Archive\WC
  • %Program Files%\Accessories\Temp4\WC
  • %Program Files%\Accessories\Temp283
  • %Program Files%\Accessories\Temp283\Archive
  • %Program Files%\Accessories\Temp283\Archive\WC
  • %Program Files%\Accessories\Temp283\WC

(Hinweis: %Program Files%ist der Standardordner 'Programme', normalerweise C:\Programme.)

Andere Systemänderungen

Fügt die folgenden Registrierungsschlüssel hinzu:

HKEY_LOCAL_MACHINE\SOFTWARE\Office2000

HKEY_LOCAL_MACHINE\SOFTWARE\MSN

HKEY_LOCAL_MACHINE\SOFTWARE\QLogic

HKEY_LOCAL_MACHINE\SOFTWARE\Net

HKEY_LOCAL_MACHINE\SOFTWARE\TCPIP

HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC

HKEY_LOCAL_MACHINE\SOFTWARE\WinZip

HKEY_LOCAL_MACHINE\SOFTWARE\XPDriver

HKEY_LOCAL_MACHINE\SOFTWARE\ZoneLabs

Fügt die folgenden Registrierungseinträge hinzu:

HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
FLSC = "%Program Files%\Accessories\Temp299"

HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
FLWC = "%Program Files%\Accessories\Temp299\WC"

HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
FLAR = "%Program Files%\Accessories\Temp299\Archive"

HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
FLWR = "%Program Files%\Accessories\Temp299\Archive\WC"

HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
FLKF = "%Program Files%\Accessories\Temp299"

HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
FLKK = "ReportLog.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
FLPF = "%Program Files%"

HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
FLWU = "WebsitesSummary.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
FLWE = "WebsitesDetail.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
FLCT = "ChatConversations.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
FLOT = "OnlineTime.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
FLH1 = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\MSN
FLSC = "%Program Files%\Accessories\Temp120"

HKEY_LOCAL_MACHINE\SOFTWARE\MSN
FLWC = "%Program Files%\Accessories\Temp120\WC"

HKEY_LOCAL_MACHINE\SOFTWARE\MSN
FLAR = "%Program Files%\Accessories\Temp120\Archive"

HKEY_LOCAL_MACHINE\SOFTWARE\MSN
FLWR = "%Program Files%\Accessories\Temp120\Archive\WC"

HKEY_LOCAL_MACHINE\SOFTWARE\MSN
FLKF = "%Program Files%\Accessories\Temp120"

HKEY_LOCAL_MACHINE\SOFTWARE\MSN
FLKK = "ReportLog.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\MSN
FLPF = "%Program Files%"

HKEY_LOCAL_MACHINE\SOFTWARE\MSN
FLWU = "WebsitesSummary.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\MSN
FLWE = "WebsitesDetail.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\MSN
FLCT = "ChatConversations.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\MSN
FLOT = "OnlineTime.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\MSN
FLH1 = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
FLSC = "%Program Files%\Accessories\Temp222"

HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
FLWC = "%Program Files%\Accessories\Temp222\WC"

HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
FLAR = "%Program Files%\Accessories\Temp222\Archive"

HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
FLWR = "%Program Files%\Accessories\Temp222\Archive\WC"

HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
FLKF = "%Program Files%\Accessories\Temp222"

HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
FLKK = "ReportLog.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
FLPF = "%Program Files%"

HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
FLWU = "WebsitesSummary.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
FLWE = "WebsitesDetail.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
FLCT = "ChatConversations.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
FLOT = "OnlineTime.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
FLH1 = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
FLSC = "%Program Files%\Accessories\Temp112"

HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
FLWC = "%Program Files%\Accessories\Temp112\WC"

HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
FLAR = "%Program Files%\Accessories\Temp112\Archive"

HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
FLWR = "%Program Files%\Accessories\Temp112\Archive\WC"

HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
FLKF = "%Program Files%\Accessories\Temp112"

HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
FLKK = "ReportLog.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
FLPF = "%Program Files%"

HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
FLWU = "WebsitesSummary.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
FLWE = "WebsitesDetail.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
FLCT = "ChatConversations.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
FLOT = "OnlineTime.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
FLH1 = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Net
FLSC = "%Program Files%\Accessories\Temp90"

HKEY_LOCAL_MACHINE\SOFTWARE\Net
FLWC = "%Program Files%\Accessories\Temp90\WC"

HKEY_LOCAL_MACHINE\SOFTWARE\Net
FLAR = "%Program Files%\Accessories\Temp90\Archive"

HKEY_LOCAL_MACHINE\SOFTWARE\Net
FLWR = "%Program Files%\Accessories\Temp90\Archive\WC"

HKEY_LOCAL_MACHINE\SOFTWARE\Net
FLKF = "%Program Files%\Accessories\Temp90"

HKEY_LOCAL_MACHINE\SOFTWARE\Net
FLKK = "ReportLog.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\Net
FLPF = "%Program Files%"

HKEY_LOCAL_MACHINE\SOFTWARE\Net
FLWU = "WebsitesSummary.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\Net
FLWE = "WebsitesDetail.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\Net
FLCT = "ChatConversations.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\Net
FLOT = "OnlineTime.txt"

HKEY_LOCAL_MACHINE\SOFTWARE\Net
FLH1 = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\MSN
FLSC = "%Program Files%\Accessories\Temp4"

HKEY_LOCAL_MACHINE\SOFTWARE\MSN
FLWC = "%Program Files%\Accessories\Temp4\WC"

HKEY_LOCAL_MACHINE\SOFTWARE\MSN
FLAR = "%Program Files%\Accessories\Temp4\Archive"

HKEY_LOCAL_MACHINE\SOFTWARE\MSN
FLWR = "%Program Files%\Accessories\Temp4\Archive\WC"

HKEY_LOCAL_MACHINE\SOFTWARE\MSN
FLKF = "%Program Files%\Accessories\Temp4"

HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
FLSC = "%Program Files%\Accessories\Temp283"

HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
FLWC = "%Program Files%\Accessories\Temp283\WC"

HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
FLAR = "%Program Files%\Accessories\Temp283\Archive"

HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
FLWR = "%Program Files%\Accessories\Temp283\Archive\WC"

HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
FLKF = "%Program Files%\Accessories\Temp283"

Löscht die folgenden Registrierungsschlüssel:

HKEY_LOCAL_MACHINE\SOFTWARE\XPDriver\
FH

HKEY_LOCAL_MACHINE\SOFTWARE\XPDriver\
KA

HKEY_LOCAL_MACHINE\SOFTWARE\XPDriver\
US

HKEY_LOCAL_MACHINE\SOFTWARE\Net\
FH

HKEY_LOCAL_MACHINE\SOFTWARE\Net\
KA

HKEY_LOCAL_MACHINE\SOFTWARE\Net\
US

HKEY_LOCAL_MACHINE\SOFTWARE\MSN\
FH

HKEY_LOCAL_MACHINE\SOFTWARE\MSN\
KA

HKEY_LOCAL_MACHINE\SOFTWARE\MSN\
US

HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC\
FH

HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC\
KA

HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC\
US

HKEY_LOCAL_MACHINE\SOFTWARE\TCPIP\
FH

HKEY_LOCAL_MACHINE\SOFTWARE\TCPIP\
KA

HKEY_LOCAL_MACHINE\SOFTWARE\TCPIP\
US

HKEY_LOCAL_MACHINE\SOFTWARE\ZoneLabs\
FH

HKEY_LOCAL_MACHINE\SOFTWARE\ZoneLabs\
KA

HKEY_LOCAL_MACHINE\SOFTWARE\ZoneLabs\
US

HKEY_LOCAL_MACHINE\SOFTWARE\Office2000\
FH

HKEY_LOCAL_MACHINE\SOFTWARE\Office2000\
KA

HKEY_LOCAL_MACHINE\SOFTWARE\Office2000\
US

HKEY_LOCAL_MACHINE\SOFTWARE\QLogic\
FH

HKEY_LOCAL_MACHINE\SOFTWARE\QLogic\
KA

HKEY_LOCAL_MACHINE\SOFTWARE\QLogic\
US

HKEY_LOCAL_MACHINE\SOFTWARE\WinZip\
FH

HKEY_LOCAL_MACHINE\SOFTWARE\WinZip\
KA

HKEY_LOCAL_MACHINE\SOFTWARE\WinZip\
US

  Solutions

Moteur de scan minimum: 9.300

Step 1

Für Windows ME und XP Benutzer: Stellen Sie vor einer Suche sicher, dass die Systemwiederherstellung deaktiviert ist, damit der gesamte Computer durchsucht werden kann.

Step 2

Diesen Registrierungsschlüssel löschen

[ learnMore ]

Wichtig: Eine nicht ordnungsgemäße Bearbeitung der Windows Registrierung kann zu einer dauerhaften Fehlfunktion des Systems führen. Führen Sie diesen Schritt nur durch, wenn Sie mit der Vorgehensweise vertraut sind oder wenn Sie Ihren Systemadministrator um Unterstützung bitten können. Lesen Sie ansonsten zuerst diesen Microsoft Artikel, bevor Sie die Registrierung Ihres Computers ändern.

  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • Office2000
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • MSN
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • QLogic
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • Net
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • TCPIP
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • MACDAC
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • WinZip
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • XPDriver
  • In HKEY_LOCAL_MACHINE\SOFTWARE
    • ZoneLabs

Step 3

Diesen Registrierungswert löschen

[ learnMore ]

Wichtig: Eine nicht ordnungsgemäße Bearbeitung der Windows Registrierung kann zu einer dauerhaften Fehlfunktion des Systems führen. Führen Sie diesen Schritt nur durch, wenn Sie mit der Vorgehensweise vertraut sind oder wenn Sie Ihren Systemadministrator um Unterstützung bitten können. Lesen Sie ansonsten zuerst diesen Microsoft Artikel, bevor Sie die Registrierung Ihres Computers ändern.

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
    • FLSC = "%Program Files%\Accessories\Temp299"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
    • FLWC = "%Program Files%\Accessories\Temp299\WC"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
    • FLAR = "%Program Files%\Accessories\Temp299\Archive"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
    • FLWR = "%Program Files%\Accessories\Temp299\Archive\WC"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
    • FLKF = "%Program Files%\Accessories\Temp299"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
    • FLKK = "ReportLog.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
    • FLPF = "%Program Files%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
    • FLWU = "WebsitesSummary.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
    • FLWE = "WebsitesDetail.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
    • FLCT = "ChatConversations.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
    • FLOT = "OnlineTime.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Office2000
    • FLH1 = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MSN
    • FLSC = "%Program Files%\Accessories\Temp120"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MSN
    • FLWC = "%Program Files%\Accessories\Temp120\WC"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MSN
    • FLAR = "%Program Files%\Accessories\Temp120\Archive"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MSN
    • FLWR = "%Program Files%\Accessories\Temp120\Archive\WC"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MSN
    • FLKF = "%Program Files%\Accessories\Temp120"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MSN
    • FLKK = "ReportLog.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MSN
    • FLPF = "%Program Files%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MSN
    • FLWU = "WebsitesSummary.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MSN
    • FLWE = "WebsitesDetail.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MSN
    • FLCT = "ChatConversations.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MSN
    • FLOT = "OnlineTime.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MSN
    • FLH1 = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
    • FLSC = "%Program Files%\Accessories\Temp222"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
    • FLWC = "%Program Files%\Accessories\Temp222\WC"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
    • FLAR = "%Program Files%\Accessories\Temp222\Archive"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
    • FLWR = "%Program Files%\Accessories\Temp222\Archive\WC"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
    • FLKF = "%Program Files%\Accessories\Temp222"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
    • FLKK = "ReportLog.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
    • FLPF = "%Program Files%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
    • FLWU = "WebsitesSummary.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
    • FLWE = "WebsitesDetail.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
    • FLCT = "ChatConversations.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
    • FLOT = "OnlineTime.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\QLogic
    • FLH1 = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
    • FLSC = "%Program Files%\Accessories\Temp112"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
    • FLWC = "%Program Files%\Accessories\Temp112\WC"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
    • FLAR = "%Program Files%\Accessories\Temp112\Archive"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
    • FLWR = "%Program Files%\Accessories\Temp112\Archive\WC"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
    • FLKF = "%Program Files%\Accessories\Temp112"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
    • FLKK = "ReportLog.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
    • FLPF = "%Program Files%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
    • FLWU = "WebsitesSummary.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
    • FLWE = "WebsitesDetail.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
    • FLCT = "ChatConversations.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
    • FLOT = "OnlineTime.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
    • FLH1 = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Net
    • FLSC = "%Program Files%\Accessories\Temp90"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Net
    • FLWC = "%Program Files%\Accessories\Temp90\WC"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Net
    • FLAR = "%Program Files%\Accessories\Temp90\Archive"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Net
    • FLWR = "%Program Files%\Accessories\Temp90\Archive\WC"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Net
    • FLKF = "%Program Files%\Accessories\Temp90"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Net
    • FLKK = "ReportLog.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Net
    • FLPF = "%Program Files%"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Net
    • FLWU = "WebsitesSummary.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Net
    • FLWE = "WebsitesDetail.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Net
    • FLCT = "ChatConversations.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Net
    • FLOT = "OnlineTime.txt"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Net
    • FLH1 = "0"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MSN
    • FLSC = "%Program Files%\Accessories\Temp4"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MSN
    • FLWC = "%Program Files%\Accessories\Temp4\WC"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MSN
    • FLAR = "%Program Files%\Accessories\Temp4\Archive"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MSN
    • FLWR = "%Program Files%\Accessories\Temp4\Archive\WC"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MSN
    • FLKF = "%Program Files%\Accessories\Temp4"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
    • FLSC = "%Program Files%\Accessories\Temp283"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
    • FLWC = "%Program Files%\Accessories\Temp283\WC"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
    • FLAR = "%Program Files%\Accessories\Temp283\Archive"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
    • FLWR = "%Program Files%\Accessories\Temp283\Archive\WC"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\MACDAC
    • FLKF = "%Program Files%\Accessories\Temp283"

Step 4

Diese Ordner suchen und löschen

[ learnMore ]
Aktivieren Sie unbedingt das Kontrollkästchen Versteckte Elemente durchsuchen unter Weitere erweiterte Optionen, um alle verborgenen Ordner in den Suchergebnissen zu berücksichtigen.
  • %Program Files%\Accessories
  • %Program Files%\Accessories\Temp299
  • %Program Files%\Accessories\Temp299\Archive
  • %Program Files%\Accessories\Temp299\Archive\WC
  • %Program Files%\Accessories\Temp299\WC
  • %Program Files%\Accessories\Temp120
  • %Program Files%\Accessories\Temp120\Archive
  • %Program Files%\Accessories\Temp120\Archive\WC
  • %Program Files%\Accessories\Temp120\WC
  • %Program Files%\Accessories\Temp222
  • %Program Files%\Accessories\Temp222\Archive
  • %Program Files%\Accessories\Temp222\Archive\WC
  • %Program Files%\Accessories\Temp222\WC
  • %Program Files%\Accessories\Temp112
  • %Program Files%\Accessories\Temp112\Archive
  • %Program Files%\Accessories\Temp112\Archive\WC
  • %Program Files%\Accessories\Temp112\WC
  • %Program Files%\Accessories\Temp90
  • %Program Files%\Accessories\Temp90\Archive
  • %Program Files%\Accessories\Temp90\Archive\WC
  • %Program Files%\Accessories\Temp90\WC
  • %Program Files%\Accessories\Temp4
  • %Program Files%\Accessories\Temp4\Archive
  • %Program Files%\Accessories\Temp4\Archive\WC
  • %Program Files%\Accessories\Temp4\WC
  • %Program Files%\Accessories\Temp283
  • %Program Files%\Accessories\Temp283\Archive
  • %Program Files%\Accessories\Temp283\Archive\WC
  • %Program Files%\Accessories\Temp283\WC

Step 5

Durchsuchen Sie Ihren Computer mit Ihrem Trend Micro Produkt, und löschen Sie Dateien, die als TROJ_WINSPY.BI entdeckt werden. Falls die entdeckten Dateien bereits von Ihrem Trend Micro Produkt gesäubert, gelöscht oder in Quarantäne verschoben wurden, sind keine weiteren Schritte erforderlich. Dateien in Quarantäne können einfach gelöscht werden. Auf dieser Knowledge-Base-Seite finden Sie weitere Informationen.


Participez à notre enquête!