Trojan.MulDrop6.64052

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '<SYSTEM32>\3PLANE~1.SCR'

Malicious functions:

Executes the following:

'<SYSTEM32>\3Planesoft\Screensaver Manager\Configurator.exe'
'%TEMP%\is-IT4IN.tmp\screensavermanager.tmp' /SL5="$10140,1884149,53248,%TEMP%\is-8R4FD.tmp\screensavermanager.exe" /VERYSILENT /LANG=en
'<SYSTEM32>\taskkill.exe' /F /IM 3Planesoft_Screensaver_Manager.scr /T
'<SYSTEM32>\3Planesoft_Screensaver_Manager.scr' /c
'%TEMP%\RarSFX0\ring.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\7ZipSfx.000\x86-x64.exe' /s
'%TEMP%\is-8R4FD.tmp\screensavermanager.exe' /VERYSILENT /LANG=en
'%TEMP%\is-BSAO0.tmp\ring.tmp' /SL5="$10108,3391414,74240,%TEMP%\RarSFX0\ring.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Modifies file system:

Creates the following files:

<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9DR59.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-1MFHQ.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-TE8MM.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JRJM7.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9HJT2.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JAL9N.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-5QNJ8.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-HIEEE.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-QU1D4.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-T1O73.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GO374.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-NCOD0.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-0GR1C.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-ESHDB.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-1EUBD.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9RP6L.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2J8J1.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-SJS01.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-J5M28.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-J7MGS.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GINB4.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-F9IHK.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-065D9.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-KSGUA.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-RMQFA.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-5ATBI.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-1J6GV.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-I26CT.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-EMCT5.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-5TT9O.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-NPUC8.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-TCDB6.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-N1I62.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-TR8T4.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-DK6R6.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-L1EUT.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-ICELO.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-AFKDQ.tmp
%ProgramFiles%\3Planesoft Screensaver Manager\unins000.dat
<SYSTEM32>\ScreensaverManager.log
%TEMP%\~DFC2EA.tmp
%HOMEPATH%\Desktop\3Planesoft Screensaver Manager.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\Screensaver Manager\Open 3Planesoft Screensaver Manager.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\Screensaver Manager\License.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\Screensaver Manager\Uninstall 3Planesoft Screensaver Manager.lnk
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-THO42.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-PROMI.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-74846.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-M0A3K.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-S0UUK.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GA989.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-P62TP.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-PNRUK.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2N9HF.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-0SIFH.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-4NMF3.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-DO5PT.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-968I3.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-V2UVN.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-VEC11.tmp
%TEMP%\is-IT4IN.tmp\screensavermanager.tmp
%TEMP%\is-NA1JU.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-NA1JU.tmp\_isetup\_shfoldr.dll
%TEMP%\is-8R4FD.tmp\screensavermanager.exe
%ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\The One Ring 3D Screensaver\License.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\The One Ring 3D Screensaver\Uninstall The One Ring 3D Screensaver.lnk
%ProgramFiles%\The One Ring 3D Screensaver\unins000.dat
%ProgramFiles%\3Planesoft Screensaver Manager\is-OL97I.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\is-9B18T.tmp
<SYSTEM32>\is-P6VH0.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-P6FJL.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\is-3SO1U.tmp
<SYSTEM32>\is-LTO21.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\is-TPLVH.tmp
%ProgramFiles%\3Planesoft Screensaver Manager\is-HUMHD.tmp
%TEMP%\is-8R4FD.tmp\_isetup\_shfoldr.dll
%ProgramFiles%\The One Ring 3D Screensaver\is-4HMOH.tmp
%ProgramFiles%\The One Ring 3D Screensaver\is-L67SA.tmp
%TEMP%\is-8R4FD.tmp\_isetup\_RegDLL.tmp
%TEMP%\7ZipSfx.000\x86-x64.exe
%TEMP%\RarSFX0\ring.exe
%TEMP%\is-BSAO0.tmp\ring.tmp
<SYSTEM32>\is-MTHUG.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\The One Ring 3D Screensaver\Take a look at more 3D screensavers from 3Planesoft.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\The One Ring 3D Screensaver\Open The One Ring 3D Screensaver.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\The One Ring 3D Screensaver\The One Ring 3D Screensaver on the Web.lnk
<SYSTEM32>\is-VJRMG.tmp
<SYSTEM32>\is-VSILN.tmp
%ProgramFiles%\The One Ring 3D Screensaver\is-D0670.tmp
%ProgramFiles%\The One Ring 3D Screensaver\is-H1VFN.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-OJ43J.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-FNRMR.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JLIJE.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-M6JIP.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-UIPR8.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-Q0768.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-CA5TF.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-PCHFM.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GC53P.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2Q4LP.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-1OJ43.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-G3V4Q.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-U0HV5.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9KQNP.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-FUEB2.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-70O2U.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-1QN3S.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-BLP5O.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JB3OD.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-39445.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-3R76U.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-U6D65.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-80E1E.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-NUFD8.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-KUBDC.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-P8T3A.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-K4RKF.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-E0J72.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-HR5BE.tmp
<SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-6H1AI.tmp

Deletes the following files:

%TEMP%\is-8R4FD.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-8R4FD.tmp\_isetup\_shfoldr.dll
%TEMP%\is-BSAO0.tmp\ring.tmp
%TEMP%\is-8R4FD.tmp\screensavermanager.exe
%TEMP%\is-NA1JU.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-NA1JU.tmp\_isetup\_shfoldr.dll
%TEMP%\is-IT4IN.tmp\screensavermanager.tmp

Moves the following files:

from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9DR59.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fireside_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-1MFHQ.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\valentine.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-TE8MM.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\valentine_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JAL9N.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\iceclock.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-5QNJ8.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\iceclock_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JRJM7.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fireside.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-1EUBD.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\waterfall_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-NCOD0.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\deepspace.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-QU1D4.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\deepspace_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-HIEEE.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\koifish.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-0GR1C.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\koifish_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-ESHDB.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\waterfall.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-065D9.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\earth_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-I26CT.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\coralclock.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-EMCT5.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\coralclock_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9RP6L.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\tower.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2J8J1.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\tower_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-SJS01.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\earth.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-RMQFA.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\cuckooclock_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-5ATBI.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\lagoon.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9HJT2.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\lagoon_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-5TT9O.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\columbus.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-1J6GV.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\columbus_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-KSGUA.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\cuckooclock.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-T1O73.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\waterclock.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-4NMF3.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\dutchwindmills.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-DK6R6.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\dutchwindmills_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-L1EUT.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\hauntedhouse.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-DO5PT.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\coralreef_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2N9HF.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\lighthousepoint.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-0SIFH.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\lighthousepoint_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-TCDB6.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\snowvillage.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-N1I62.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\snowvillage_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-AFKDQ.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\updates.xml
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-ICELO.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\hauntedhouse_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-TR8T4.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\crystalfireplace.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-NPUC8.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\crystalfireplace_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-P62TP.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\railway.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-M0A3K.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\railway_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-THO42.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\bells.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GO374.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\waterclock_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-S0UUK.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\koipond.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GA989.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\koipond_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-968I3.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\zodiacclock.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-V2UVN.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\zodiacclock_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-VEC11.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\coralreef.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-PROMI.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\bells_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-74846.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\sweethearts.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-PNRUK.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\sweethearts_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-39445.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\sofire.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-3R76U.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\sof_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-U6D65.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fmoon.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\is-9B18T.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Configurator.exe
from <SYSTEM32>\is-P6VH0.tmp to <SYSTEM32>\ScreensaverManager.log
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-P6FJL.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\screensavers.xml
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-BLP5O.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\watermill.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-80E1E.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\watermill_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-E0J72.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\nautilus.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JB3OD.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fmoon_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-70O2U.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\galleon.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-1QN3S.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\galleon_screen.jpg
from <SYSTEM32>\is-VSILN.tmp to <SYSTEM32>\The One Ring 3D Screensaver.exe
from %ProgramFiles%\The One Ring 3D Screensaver\is-D0670.tmp to %ProgramFiles%\The One Ring 3D Screensaver\The screensaver on the Web.url
from %ProgramFiles%\The One Ring 3D Screensaver\is-H1VFN.tmp to %ProgramFiles%\The One Ring 3D Screensaver\license.txt
from %ProgramFiles%\The One Ring 3D Screensaver\is-4HMOH.tmp to %ProgramFiles%\The One Ring 3D Screensaver\unins000.exe
from %ProgramFiles%\The One Ring 3D Screensaver\is-L67SA.tmp to %ProgramFiles%\The One Ring 3D Screensaver\Take a look at more 3D screensavers from 3Planesoft.url
from <SYSTEM32>\is-MTHUG.tmp to <SYSTEM32>\The_One_Ring_3D_Screensaver.scr
from <SYSTEM32>\3Planesoft\Screensaver Manager\is-TPLVH.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Screensavers Updater.exe
from %ProgramFiles%\3Planesoft Screensaver Manager\is-HUMHD.tmp to %ProgramFiles%\3Planesoft Screensaver Manager\license.txt
from <SYSTEM32>\3Planesoft\Screensaver Manager\is-3SO1U.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Help.chm
from <SYSTEM32>\is-VJRMG.tmp to <SYSTEM32>\The One Ring.log
from %ProgramFiles%\3Planesoft Screensaver Manager\is-OL97I.tmp to %ProgramFiles%\3Planesoft Screensaver Manager\unins000.exe
from <SYSTEM32>\is-LTO21.tmp to <SYSTEM32>\3Planesoft_Screensaver_Manager.scr
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-HR5BE.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\nautilus_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-FUEB2.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\clock_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-G3V4Q.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\flag.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GC53P.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\flag_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-PCHFM.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\nature.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-U0HV5.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\nature_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9KQNP.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\clock.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GINB4.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fish_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-F9IHK.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fireplace.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-J5M28.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fireplace_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2Q4LP.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\watch.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-1OJ43.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\watch_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-J7MGS.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fish.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-KUBDC.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\castle_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-P8T3A.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\halloween.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-UIPR8.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\halloween_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-6H1AI.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\discovery.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-K4RKF.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\discovery_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-NUFD8.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\castle.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-OJ43J.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\lantern_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-FNRMR.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\theonering.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JLIJE.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\ring_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-Q0768.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\christmas.ico
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-CA5TF.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\christmas_screen.jpg
from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-M6JIP.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\lantern.ico

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'Display Properties'
ClassName: '' WindowName: 'Screen Saver Settings'
ClassName: '' WindowName: '3Planesoft Screensaver Manager'
ClassName: 'EDIT' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: ''

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial