Types of Malware
The file paths listed are not necessarily the only paths used by the malware instances. The paths listed are merely the paths where the malware has been observed. Sometimes a malware file will use the same name as a good system or application file, but will be found in a different directory than that used by the good file. This is most typically the case for system files found normally in the c:\windows\ and c:\windows\system32 folders. So, pay careful attention to the path for those cases.
We use the following abbreviations for folder paths:
| %appdata% | %profilepath%\application data, or language variant |
| %commonfiles% | c:\Program Files\Common Files, or language variant |
| %commonprograms% | c:\Documents and Settings\All Users\Start Menu\Programs |
| %desktopdir% | %profilepath%\Desktop, or language variant |
| %favorites% | %profilepath%\Favorites, or language variant |
| %profilepath% | c:\Documents and Settings\..username.., or C:\Users\..username.. |
| %programfiles% | c:\Program Files\, or language variant |
| %programsdir% | c:\Program Files\, or language variant |
| %startprograms% | %profilepath%\Start Menu\Programs |
| %startupfolder% | %profilepath%\Start Menu\Programs\Startup |
| %system% | c:\windows\system32 or c:\winnt\system32 |
| %systemdir% | c:\windows\system32 or c:\winnt\system32 |
| %tempdir% | %profilepath%\local settings\temp or c:\temp or c:\windows\temp |
| %userspath% | c:\Documents and Settings in Nt & Xp systems, and C:\Users in Vista |
| %windir% | c:\windows or c:\winnt |
| %windows% | c:\windows or c:\winnt |