Backdoor.IRC.ABN [PC Tools] is known to be created as:
%System%\dk\reg.dll
%System%\drive\reg.dll
%System%\drivers\etc\reg.dll
%System%\drivers\etc\svchost.exe
%System%\mui\0406\reg.dll
%System%\oobe\reg.dll
%System%\oobe\svchost.exe
%System%\ttt\reg.dll
%Windir%\system\reg.dll
%Windir%\system\svchost.exe
Notes:
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.