File::
c:\\windows\\UC.PIF
c:\\windows\\RAR.PIF
c:\\windows\\PKZIP.PIF
c:\\windows\\PKUNZIP.PIF
c:\\windows\\NOCLOSE.PIF
c:\\windows\\LHA.PIF
c:\\windows\\ARJ.PIF
c:\\windows\\s.exe
C:\\jkl.exe
c:\\windows\\xd.exe
Registry::
[HKLM\\~\\startupfolder\\C:^Documents and Settings^go?ci^Menu Start^Programy^Autostart^xe0304.exe]
path=c:\\documents and settings\\go?ci\\Menu Start\\Programy\\Autostart\\xe0304.exe
backup=c:\\windows\\pss\\xe0304.exeStartup
[HKEY_LOCAL_MACHINE\\software\\microsoft\\shared tools\\msconfig\\startupreg\\s.exe]
2010-11-11 17:44 858624 ----a-w- c:\\windows\\s.exe
[HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\mountpoints2\\{87749190-7e19-11df-b15f-001d7d2185a4}]
\\Shell\\AutoRun\\command - E:\\AutoRun.exe