Created Files

• %Desktop%Protection System.lnk
• %Desktop%Protection System Support.lnk
• %Desktop%active security.lnk

Created Folders

• Protectionsystem
• %ProgramFiles%Protection System
• %CommonPrograms%Protection System
• %ProgramFiles%active security
• %CommonPrograms%active security

Registry Entries

• Key: HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
• Value:
• Data:
• Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Protection System
• Value:
• Data:
• Key: HKEY_LOCAL_MACHINE\SOFTWARE\Active Security
• Value:
• Data:
• Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Active Security
• Value:
• Data:
• Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
• Value: Active Security
• Data: "C:\Program Files\Active Security\asecurity.exe" -noscan
• Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
• Value: wow64main.exe
• Data: C:\Temp\wow64main.exe
• Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
• Value: winhbt.exe
• Data: C:\Temp\winhbt.exe