Created Files

• %UserProfile%\application data\microsoft\internet explorer\quick launch\spywareheal 2.2.lnk
• %StartMenu%\spyheal
• %UserProfile%\application data\microsoft\internet explorer\quick launch\spyhea
• %Temp%\sheallang.ini
• %Desktop%\spyheal 3.1.lnk

Created Folders

• %ProgramFiles%\spywareheal
• %StartMenu%\programs\spywareheal
• %ProgramFiles%\spyheals
• %StartupPrograms%\spyheal
• %ProgramFiles%\sh
• %StartMenu%\programs\spyheal 3.1

Registry Entries

• Key: HKEY_CLASSES_ROOT\interface\{0e365e19-98a1-4291-a880-5c40de007342}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{26981c6d-6df6-4867-8784-27e02157b30b}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{5cf9daf8-35aa-44fe-b548-c1acc7de2430}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{5ef67439-a232-49ff-9caa-7314be3b4adf}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{7ae3a21b-21c8-4841-b165-68b6621f1c8b}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{8baa1a22-cd51-422f-86ba-8d2ac9cf5d10}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{94a8f959-d497-415d-a02b-d7843a7c5be8}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{97e04f3d-81f7-4305-974b-41689065833b}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{a7d94862-647a-4760-914a-3e6d7866aac6}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{b9aa641a-7a6e-42f4-862d-222abea5b07b}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{bb797a32-f488-4022-a4f2-a690ec6cddd4}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{beda5701-e71f-43a7-8588-c7313e405ca2}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{cf419fbd-8579-41e9-af42-f27b79f29b09}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{e36724ad-4698-4574-ab32-e67ab01e683a}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{e6b07ddd-1ca1-4e75-b160-31ccfeeb7a5e}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{f82a9a6f-071b-4448-b0dd-d0e1742d75ff}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\clsid\{d584a1f2-6441-7dbf-f659-22a8ca9de1a8}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{0ac0a03a-3176-40e5-b0e3-5f4277455299}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{18905761-3402-4934-99aa-3c1c09ccaffb}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{2b8fe48b-55a1-46b2-ac91-9a295726abaa}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{308606f6-34cc-4b3a-9049-f29ae88cb9b5}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{433463ec-6648-4328-b90a-964f066f89b6}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{472de844-851a-4655-a72e-3206418d009b}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{526a44d6-a35e-477d-b7cf-f3743c00b073}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{569d43ab-d0e8-4bd6-a773-1b1aaf2690d0}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{5f390492-d09d-4c2d-9447-895b9534aa40}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{6921e7e6-39eb-4c66-80a8-a57e13ab0f21}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{a37ae5b5-3dda-4373-8bff-9d920aa3ca54}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{a38ab492-52a8-4f3e-8b88-161c2732da91}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{b48e8853-fcd4-492b-a8e2-4cae5519f463}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{bcab2e0b-a82a-470d-9b4a-2e69383862a5}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{e014dd93-51fd-4d26-8565-f78172ad6297}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{e19ab25d-1c26-4556-acca-e7a798eac3fb}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\typelib\{afa75d89-f998-4f7c-b1bf-d7bcb85dfb2e}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{0a479d87-72ac-4dce-a3f1-fdc882390f60}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{161d399b-0789-4402-864e-f4347690bd48}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{16737204-f9b6-45d0-ba08-ec632aca96ea}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{22c0f9fe-1453-4925-a7c9-7d118611770e}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{37eeb3b8-a21e-4799-9266-9ec7d945674b}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{3bee5ae6-a4d8-4fd3-b5d5-1385cea2a22c}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{46593bfa-1d7a-4a56-90ee-88e852649f3d}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{4a7cc1b7-3ba5-4cf6-8098-56d315ebee11}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{55dadde6-2501-415a-bc5f-6f75d6e771c5}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{6c6e6cb6-8156-4901-aa42-b535181d17a3}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{775ad947-7128-4774-8623-55fadb5f74bb}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{77df43a0-4cd3-4be1-b4fc-8b9f3857cbb6}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{80787cb9-2e40-42ba-927a-c7e09c2c3d2e}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{8458edf5-1dfd-4bf0-95ac-1d7463031d92}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{c5bb6e2b-6cb5-4aad-aef7-2484d3e04eef}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{e7137690-a900-4f77-824e-ec0177d74fd0}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\typelib\{be9dd753-bb1a-4b56-9a06-5bd5e02c90ae}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{085c7a66-1c21-4638-9b1e-24faf4a2cf85}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{3b438fb9-972e-4a97-839e-0d72b0dff09f}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{3cdbf429-8037-457c-8134-441df6c7710c}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{44ce8765-ebc8-4c18-9ab1-cfeff9c5b0c1}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{52b51272-c457-4081-9430-d8e05aa6be45}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{535219e5-fced-4dec-8a80-76c997d4ed20}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{568462ee-119d-4079-a0c6-f18ed0c642c2}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{7bc897ce-c364-409d-8cd2-a43928ad44aa}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{7c8901c9-bb4e-40b6-9302-0a47c04d7605}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{86ce343b-0246-497b-ac16-6bc44370a59b}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{925fa4eb-3282-404a-8533-0337f9ba2f8f}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{9a30e37a-cde7-410e-853a-77baa9942f1c}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{afd60b65-d6a9-4b29-acc4-f82e5f51acfc}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{c7655679-bb96-4d0e-946d-ef6d590a4c75}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\interface\{f0f04b8c-97b4-4211-b6e1-3697089f3bcc}
• Value:
• Data:
• Key: HKEY_CLASSES_ROOT\typelib\{bde40054-8a1e-49a6-8b18-59c1898403f5}
• Value:
• Data:
• Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\spywareheal.exe
• Value:
• Data:
• Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
• Value: SpywareHeal
• Data:
• Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\spywareheal
• Value:
• Data:
• Key: HKEY_LOCAL_MACHINE\software\spywareheal
• Value:
• Data:
• Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\spyheals.exe
• Value:
• Data:
• Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\spyheals
• Value:
• Data:
• Key: HKEY_LOCAL_MACHINE\software\spyheals
• Value:
• Data:
• Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
• Value: SpyHeals
• Data:
• Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\spyheal 3.1.exe 3.1
• Value:
• Data:
• Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\spyheal 3.1
• Value:
• Data:
• Key: HKEY_LOCAL_MACHINE\software\spyheal 3.1
• Value:
• Data:
• Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\spyheal 4.0.exe 4.0
• Value:
• Data:
• Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\spyheal 4.0
• Value:
• Data:
• Key: HKEY_LOCAL_MACHINE\software\spyheal 4.0
• Value:
• Data:
• Key: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
• Value: spyheal 4.0
• Data:
• Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• Value: SpyHeals
• Data: C:\Program Files\SpyHeals\SpyHeals.exe /h