Created Files

• %Temp%spwA.tmp
• %Desktop%Antivirus Protection.lnk
• %Desktop%Antivirus Protection.lnk

Created Folders

• %CommonPrograms%Antivirus Protection
• %ProgramFiles%Antivirus Protection
• %StartMenu%Programs\Antivirus Protection
• %StartMenu%Programs\Antivirus Protection
• %StartMenu%Program\Antivirus Protection

Registry Entries

• Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\antivirusprotection.exe
• Value:
• Data:
• Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\antivirus protection
• Value:
• Data:
• Key: HKEY_LOCAL_MACHINE\software\telecom advance
• Value:
• Data:
• Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
• Value: antivirusprotection
• Data:
• Key: HKEY_LOCAL_MACHINE\software\telecom advance\antivirus protection
• Value:
• Data:
• Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• Value: AntivirusProtection
• Data: C:\Program Files\Antivirus Protection\antivirusprotection.exe /scanstartup