Technical Information
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe,<Full path to file>,'
- C:\myrep.dat
- %TEMP%\bot4317.tmp
- %TEMP%\bot450c.tmp
- %TEMP%\bot4589.tmp
- %TEMP%\bot45e8.tmp
- %TEMP%\bot4675.tmp
- %TEMP%\bot46a5.tmp
- %TEMP%\bot4781.tmp
- %TEMP%\bot3959.tmp
- %TEMP%\bot485c.tmp
- %TEMP%\bot49d4.tmp
- %TEMP%\bot6c91.tmp
- %TEMP%\bot6d00.tmp
- %TEMP%\bot6d5e.tmp
- %TEMP%\bot6e88.tmp
- %TEMP%\bot6ec7.tmp
- %TEMP%\bot6f26.tmp
- %TEMP%\bot4289.tmp
- %TEMP%\bot42c8.tmp
- %TEMP%\bot421b.tmp
- %TEMP%\bot41bc.tmp
- %TEMP%\bot416d.tmp
- %TEMP%\bot37bb.tmp
- %TEMP%\bot37dc.tmp
- %TEMP%\bot381b.tmp
- %TEMP%\bot385a.tmp
- %TEMP%\bot388a.tmp
- %TEMP%\bot38ba.tmp
- %TEMP%\bot38f9.tmp
- %TEMP%\bot6f65.tmp
- %TEMP%\bot489b.tmp
- %TEMP%\bot391a.tmp
- %TEMP%\bot3d70.tmp
- %TEMP%\bot3dde.tmp
- %TEMP%\bot3ee9.tmp
- %TEMP%\bot3f76.tmp
- %TEMP%\bot4003.tmp
- %TEMP%\bot4062.tmp
- %TEMP%\bot40ef.tmp
- %TEMP%\bot374d.tmp
- %TEMP%\bot3998.tmp
- %TEMP%\bot929b.tmp
- %TEMP%\botb862.tmp
- %TEMP%\bot739c.tmp
- %TEMP%\bota446.tmp
- %TEMP%\bota4e3.tmp
- %TEMP%\bota754.tmp
- %TEMP%\bota800.tmp
- %TEMP%\bota8eb.tmp
- %TEMP%\bota94a.tmp
- %TEMP%\botaa35.tmp
- %TEMP%\bot6fa4.tmp
- %TEMP%\botadaf.tmp
- %TEMP%\botae8c.tmp
- %TEMP%\botaf96.tmp
- %TEMP%\botb004.tmp
- %TEMP%\botb082.tmp
- %TEMP%\botb0d1.tmp
- %TEMP%\botb13f.tmp
- %TEMP%\botb6fa.tmp
- %TEMP%\bota0ab.tmp
- %TEMP%\bota37a.tmp
- %TEMP%\bota02e.tmp
- %TEMP%\bot9fb0.tmp
- %TEMP%\bot9ec5.tmp
- %TEMP%\bot7988.tmp
- %TEMP%\bot7f33.tmp
- %TEMP%\bot806c.tmp
- %TEMP%\bot851f.tmp
- %TEMP%\bot85ac.tmp
- %TEMP%\bot8697.tmp
- %TEMP%\bot8744.tmp
- %TEMP%\bot7013.tmp
- %TEMP%\bot372d.tmp
- %TEMP%\bot925c.tmp
- %TEMP%\bot93b6.tmp
- %TEMP%\bot9434.tmp
- %TEMP%\bot95bb.tmp
- %TEMP%\bot9703.tmp
- %TEMP%\bot9b39.tmp
- %TEMP%\bot9d3d.tmp
- %TEMP%\bot9e37.tmp
- %TEMP%\bot73fb.tmp
- %TEMP%\bot9329.tmp
- %TEMP%\botae2d.tmp
- %TEMP%\bot36de.tmp
- %TEMP%\bot3500.tmp
- %TEMP%\botd8e.tmp
- %TEMP%\botded.tmp
- %TEMP%\bote8a.tmp
- %TEMP%\botf37.tmp
- %TEMP%\botfa5.tmp
- %TEMP%\bot1032.tmp
- %TEMP%\bot10a0.tmp
- %TEMP%\bot585.tmp
- %TEMP%\bot110f.tmp
- %TEMP%\bot118d.tmp
- %TEMP%\bot11ec.tmp
- %TEMP%\bot120c.tmp
- %TEMP%\bot128a.tmp
- %TEMP%\bot12aa.tmp
- %TEMP%\bot1309.tmp
- %TEMP%\bot1348.tmp
- %TEMP%\botc74.tmp
- %TEMP%\botd20.tmp
- %TEMP%\botc34.tmp
- %TEMP%\botbe5.tmp
- %TEMP%\bota20.tmp
- %TEMP%\botfa85.tmp
- %TEMP%\botfde0.tmp
- %TEMP%\botfe1f.tmp
- %TEMP%\botfe4f.tmp
- %TEMP%\botfe8e.tmp
- %TEMP%\botff0c.tmp
- %TEMP%\bot84.tmp
- %TEMP%\bot1397.tmp
- %TEMP%\bot113e.tmp
- %TEMP%\bot45b.tmp
- %TEMP%\bot623.tmp
- %TEMP%\bot672.tmp
- %TEMP%\bot74d.tmp
- %TEMP%\bot78d.tmp
- %TEMP%\bot7eb.tmp
- %TEMP%\bot963.tmp
- %TEMP%\bot9a2.tmp
- %TEMP%\botfa36.tmp
- %TEMP%\bot5b5.tmp
- %TEMP%\bot1884.tmp
- %TEMP%\bot369e.tmp
- %TEMP%\bot14f1.tmp
- %TEMP%\bot32a7.tmp
- %TEMP%\bot32f6.tmp
- %TEMP%\bot3326.tmp
- %TEMP%\bot33a4.tmp
- %TEMP%\bot3422.tmp
- %TEMP%\bot3461.tmp
- %TEMP%\bot3491.tmp
- %TEMP%\bot1425.tmp
- %TEMP%\bot34d0.tmp
- %TEMP%\bot353f.tmp
- %TEMP%\bot357f.tmp
- %TEMP%\bot35be.tmp
- %TEMP%\bot35ee.tmp
- %TEMP%\bot361e.tmp
- %TEMP%\bot363e.tmp
- %TEMP%\bot365e.tmp
- %TEMP%\bot31da.tmp
- %TEMP%\bot3277.tmp
- %TEMP%\bot319b.tmp
- %TEMP%\bot313c.tmp
- %TEMP%\bot2f0a.tmp
- %TEMP%\bot160c.tmp
- %TEMP%\bot169a.tmp
- %TEMP%\bot16d9.tmp
- %TEMP%\bot1718.tmp
- %TEMP%\bot1748.tmp
- %TEMP%\bot1788.tmp
- %TEMP%\bot17b7.tmp
- %TEMP%\bot1483.tmp
- %TEMP%\bot36be.tmp
- %TEMP%\bot1845.tmp
- %TEMP%\bot289d.tmp
- %TEMP%\bot28dc.tmp
- %TEMP%\bot290c.tmp
- %TEMP%\bot295b.tmp
- %TEMP%\bot29ba.tmp
- %TEMP%\bot29f9.tmp
- %TEMP%\bot2cd7.tmp
- %TEMP%\bot15bd.tmp
- %TEMP%\bot286d.tmp
- %TEMP%\botbbec.tmp
- C:\myrep.dat
- %TEMP%\botfa36.tmp
- %TEMP%\bot4317.tmp
- %TEMP%\bot450c.tmp
- %TEMP%\bot4589.tmp
- %TEMP%\bot45e8.tmp
- %TEMP%\bot4675.tmp
- %TEMP%\bot46a5.tmp
- %TEMP%\bot4781.tmp
- %TEMP%\bot6fa4.tmp
- %TEMP%\bot485c.tmp
- %TEMP%\bot49d4.tmp
- %TEMP%\bot6c91.tmp
- %TEMP%\bot6d00.tmp
- %TEMP%\bot6d5e.tmp
- %TEMP%\bot6e88.tmp
- %TEMP%\bot6ec7.tmp
- %TEMP%\bot6f26.tmp
- %TEMP%\bot4289.tmp
- %TEMP%\bot42c8.tmp
- %TEMP%\bot489b.tmp
- %TEMP%\bot6f65.tmp
- %TEMP%\bot416d.tmp
- %TEMP%\bot381b.tmp
- %TEMP%\bot385a.tmp
- %TEMP%\bot388a.tmp
- %TEMP%\bot38ba.tmp
- %TEMP%\bot38f9.tmp
- %TEMP%\bot391a.tmp
- %TEMP%\bot3959.tmp
- %TEMP%\bot3998.tmp
- %TEMP%\bot3d70.tmp
- %TEMP%\bot3dde.tmp
- %TEMP%\bot3ee9.tmp
- %TEMP%\bot3f76.tmp
- %TEMP%\bot4003.tmp
- %TEMP%\bot4062.tmp
- %TEMP%\bot40ef.tmp
- %TEMP%\bot41bc.tmp
- %TEMP%\bot37bb.tmp
- %TEMP%\bot421b.tmp
- %TEMP%\bot286d.tmp
- %TEMP%\bot7013.tmp
- %TEMP%\bota37a.tmp
- %TEMP%\bota4e3.tmp
- %TEMP%\bota754.tmp
- %TEMP%\bota800.tmp
- %TEMP%\bota8eb.tmp
- %TEMP%\bota94a.tmp
- %TEMP%\botaa35.tmp
- %TEMP%\botadaf.tmp
- %TEMP%\bot739c.tmp
- %TEMP%\botae2d.tmp
- %TEMP%\botaf96.tmp
- %TEMP%\botb004.tmp
- %TEMP%\botb082.tmp
- %TEMP%\botb0d1.tmp
- %TEMP%\botb13f.tmp
- %TEMP%\botb6fa.tmp
- %TEMP%\bota0ab.tmp
- %TEMP%\bota02e.tmp
- %TEMP%\bota446.tmp
- %TEMP%\bot9fb0.tmp
- %TEMP%\bot9ec5.tmp
- %TEMP%\bot73fb.tmp
- %TEMP%\bot7f33.tmp
- %TEMP%\bot806c.tmp
- %TEMP%\bot851f.tmp
- %TEMP%\bot85ac.tmp
- %TEMP%\bot8697.tmp
- %TEMP%\bot8744.tmp
- %TEMP%\bot374d.tmp
- %TEMP%\bot925c.tmp
- %TEMP%\bot37dc.tmp
- %TEMP%\bot9329.tmp
- %TEMP%\bot9434.tmp
- %TEMP%\bot95bb.tmp
- %TEMP%\bot9703.tmp
- %TEMP%\bot9b39.tmp
- %TEMP%\bot9d3d.tmp
- %TEMP%\bot9e37.tmp
- %TEMP%\bot929b.tmp
- %TEMP%\bot7988.tmp
- %TEMP%\bot93b6.tmp
- %TEMP%\bot372d.tmp
- %TEMP%\bot36de.tmp
- %TEMP%\bot36be.tmp
- %TEMP%\bote8a.tmp
- %TEMP%\botf37.tmp
- %TEMP%\botfa5.tmp
- %TEMP%\bot1032.tmp
- %TEMP%\bot10a0.tmp
- %TEMP%\bot110f.tmp
- %TEMP%\bot113e.tmp
- %TEMP%\bot118d.tmp
- %TEMP%\bot11ec.tmp
- %TEMP%\bot120c.tmp
- %TEMP%\bot128a.tmp
- %TEMP%\bot12aa.tmp
- %TEMP%\bot1309.tmp
- %TEMP%\bot1348.tmp
- %TEMP%\bot1397.tmp
- %TEMP%\botd20.tmp
- %TEMP%\botc34.tmp
- %TEMP%\botded.tmp
- %TEMP%\botc74.tmp
- %TEMP%\botbe5.tmp
- %TEMP%\bot5b5.tmp
- %TEMP%\botfde0.tmp
- %TEMP%\botfe1f.tmp
- %TEMP%\botfe4f.tmp
- %TEMP%\botfe8e.tmp
- %TEMP%\botff0c.tmp
- %TEMP%\bot84.tmp
- %TEMP%\bot45b.tmp
- %TEMP%\bot1425.tmp
- %TEMP%\botb862.tmp
- %TEMP%\bot585.tmp
- %TEMP%\bot672.tmp
- %TEMP%\bot74d.tmp
- %TEMP%\bot78d.tmp
- %TEMP%\bot7eb.tmp
- %TEMP%\bot963.tmp
- %TEMP%\bot9a2.tmp
- %TEMP%\bota20.tmp
- %TEMP%\botfa85.tmp
- %TEMP%\bot623.tmp
- %TEMP%\botae8c.tmp
- %TEMP%\bot1483.tmp
- %TEMP%\bot169a.tmp
- %TEMP%\bot3326.tmp
- %TEMP%\bot33a4.tmp
- %TEMP%\bot3422.tmp
- %TEMP%\bot3461.tmp
- %TEMP%\bot3491.tmp
- %TEMP%\bot34d0.tmp
- %TEMP%\botd8e.tmp
- %TEMP%\bot3500.tmp
- %TEMP%\bot357f.tmp
- %TEMP%\bot35be.tmp
- %TEMP%\bot35ee.tmp
- %TEMP%\bot361e.tmp
- %TEMP%\bot363e.tmp
- %TEMP%\bot365e.tmp
- %TEMP%\bot369e.tmp
- %TEMP%\bot3277.tmp
- %TEMP%\bot353f.tmp
- %TEMP%\bot32f6.tmp
- %TEMP%\bot32a7.tmp
- %TEMP%\bot31da.tmp
- %TEMP%\bot319b.tmp
- %TEMP%\bot16d9.tmp
- %TEMP%\bot1718.tmp
- %TEMP%\bot1748.tmp
- %TEMP%\bot1788.tmp
- %TEMP%\bot17b7.tmp
- %TEMP%\bot1845.tmp
- %TEMP%\bot14f1.tmp
- %TEMP%\bot1884.tmp
- %TEMP%\bot15bd.tmp
- %TEMP%\bot289d.tmp
- %TEMP%\bot290c.tmp
- %TEMP%\bot295b.tmp
- %TEMP%\bot29ba.tmp
- %TEMP%\bot29f9.tmp
- %TEMP%\bot2cd7.tmp
- %TEMP%\bot2f0a.tmp
- %TEMP%\bot160c.tmp
- %TEMP%\bot313c.tmp
- %TEMP%\bot28dc.tmp
- %TEMP%\botbbec.tmp
- http://www.microsoft.com/
- DNS ASK fl##web.org
- DNS ASK microsoft.com