| ..\Software\sestem\(Default) |
| ..\Software\Microsoft\active setup\installed components\{8ca175c0-c448-4b2b-99fa-dfbee61750e4}\(Default) |
| ..\Software\Microsoft\Windows\CurrentVersion\Run\\"..exe"\"%root%\input\11811_backdoor.win32.ircbot_20091109\fe2af458.exe" |
| ..\Software\ff3456xch65zu\(Default) |
| ..\Software\Microsoft\Windows\CurrentVersion\Run\\"dd"\"%root%\input\7400_backdoor.win32.ircbot_20091105\c57d72aa.exe" |
| ..\Software\Microsoft\active setup\installed components\{9b4ba00c-6f68-ec8d-af53-d6b2cec6a6cd}\(Default) |
| ..\Software\Microsoft\Windows\CurrentVersion\RunServices\\"updatewin"\"%win.sys32%\activedsh.exe" |
| ..\Software\Microsoft\Windows\CurrentVersion\Run\\"updatewin"\"%win.sys32%\activedsh.exe" |
| ..\System\CurrentControlSet\Enum\root\legacy_w32timeswprv\(Default) |
| ..\System\CurrentControlSet\Services\w32timeswprv\(Default) |