HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM NAME]" = "%SystemDrive%\Documents and Settings\Administrator\Local Settings\Application Data\[RANDOM FILE NAME].exe"
HKEY_CURRENT_USER\Software\Games-Attack
HKEY_CURRENT_USER\Software\fcn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Games-Attack
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\[RANDOM NAME]
HKEY_LOCAL_MACHINE\SOFTWARE\Games-Attack

%UserProfile%\Application Data\Games-Attack\data\translation_file_games_attack.xml
%UserProfile%\Application Data\Games-Attack\flash\GA.exe
%UserProfile%\Application Data\Games-Attack\flash\IntroAnimation\loading.swf
%UserProfile%\Application Data\Games-Attack\flash\IntroAnimation\opening02.swf
%UserProfile%\Application Data\Games-Attack\flash\xml\category.xml
%UserProfile%\Application Data\Games-Attack\flash\xml\CustomMessage.xml
%UserProfile%\Application Data\Games-Attack\flash\xml\language.xml
%UserProfile%\Application Data\Games-Attack\flash\xml\linkURL.xml
%UserProfile%\Application Data\Games-Attack\flash\xml\news.xml
%UserProfile%\Application Data\Games-Attack\flash\xml\skin.xml
%UserProfile%\Application Data\Games-Attack\flash\xml\topuser.xml
%UserProfile%\Desktop\Games-Attack.lnk
%UserProfile%\Local Settings\Application Data\[RANDOM FILE NAME].dat
%UserProfile%\Local Settings\Application Data\[RANDOM FILE NAME].exe (a copy of Trojan.Skintrim)
%UserProfile%\Local Settings\Application Data\[RANDOM FILE NAME]_nav.dat
%UserProfile%\Local Settings\Application Data\[RANDOM FILE NAME]_navps.dat
%UserProfile%\Local Settings\Temp\anim.zip
%UserProfile%\Local Settings\Temp\GA.zip
%SystemDrive%\Documents and Settings\All Users\Start Menu\Programs\Games-Attack\Games-Attack.lnk
%SystemDrive%\Documents and Settings\All Users\Start Menu\Programs\Games-Attack\Uninstall.lnk
%SystemDrive%\Documents and Settings\All Users\Start Menu\Programs\Games-Attack\Website.url
%ProgramFiles%\Games-Attack\Games-Attack.exe
%ProgramFiles%\Games-Attack\Uninstall.exe