Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Avatar3D' = '<Full path to virus>'
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\blurbs\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\$000000.tmp
- <SYSTEM32>\oobe\images\$000000.tmp
- %WINDIR%\Web\Wallpaper\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\48x48\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\16x16\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\24x24\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\32x32\$000000.tmp
- <SYSTEM32>\oobe\html\mouse\images\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\$000000.tmp
- <SYSTEM32>\$000000.tmp
- <SYSTEM32>\CatRoot2\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\$000000.tmp
- %WINDIR%\$000000.tmp
- %WINDIR%\Help\Tours\mmTour\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\DVDUpgrd\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\$000000.tmp
- <DRIVERS>\$000000.tmp
- <SYSTEM32>\Restore\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Web\Wallpaper\Ascent.jpg to %WINDIR%\Web\Wallpaper\$000000.tmp
- from %WINDIR%\Web\Wallpaper\Azul.jpg to %WINDIR%\Web\Wallpaper\$000000.tmp
- from %WINDIR%\Web\Wallpaper\Follow.jpg to %WINDIR%\Web\Wallpaper\$000000.tmp
- from <SYSTEM32>\oobe\images\wpatop.jpg to <SYSTEM32>\oobe\images\$000000.tmp
- from <SYSTEM32>\oobe\images\skipover.jpg to <SYSTEM32>\oobe\images\$000000.tmp
- from <SYSTEM32>\oobe\images\wpaback.jpg to <SYSTEM32>\oobe\images\$000000.tmp
- from <SYSTEM32>\oobe\images\wpaflag.jpg to <SYSTEM32>\oobe\images\$000000.tmp
- from %WINDIR%\Web\Wallpaper\Home.jpg to %WINDIR%\Web\Wallpaper\$000000.tmp
- from %WINDIR%\Web\Wallpaper\Vortec space.jpg to %WINDIR%\Web\Wallpaper\$000000.tmp
- from %WINDIR%\Web\Wallpaper\Windows XP.jpg to %WINDIR%\Web\Wallpaper\$000000.tmp
- from %WINDIR%\Blue Lace 16.bmp to %WINDIR%\$000000.tmp
- from %WINDIR%\Web\Wallpaper\Stonehenge.jpg to %WINDIR%\Web\Wallpaper\$000000.tmp
- from %WINDIR%\Web\Wallpaper\Peace.jpg to %WINDIR%\Web\Wallpaper\$000000.tmp
- from %WINDIR%\Web\Wallpaper\Purple flower.jpg to %WINDIR%\Web\Wallpaper\$000000.tmp
- from %WINDIR%\Web\Wallpaper\Red moon desert.jpg to %WINDIR%\Web\Wallpaper\$000000.tmp
- from <SYSTEM32>\oobe\html\mouse\images\venice.jpg to <SYSTEM32>\oobe\html\mouse\images\$000000.tmp
- from <SYSTEM32>\oobe\html\mouse\images\verona.jpg to <SYSTEM32>\oobe\html\mouse\images\$000000.tmp
- from <SYSTEM32>\oobe\images\backdown.jpg to <SYSTEM32>\oobe\images\$000000.tmp
- from <SYSTEM32>\oobe\html\mouse\images\tyrol.jpg to <SYSTEM32>\oobe\html\mouse\images\$000000.tmp
- from <SYSTEM32>\oobe\html\mouse\images\paris.jpg to <SYSTEM32>\oobe\html\mouse\images\$000000.tmp
- from <SYSTEM32>\oobe\html\mouse\images\pisa.jpg to <SYSTEM32>\oobe\html\mouse\images\$000000.tmp
- from <SYSTEM32>\oobe\html\mouse\images\prague.jpg to <SYSTEM32>\oobe\html\mouse\images\$000000.tmp
- from <SYSTEM32>\oobe\images\backover.jpg to <SYSTEM32>\oobe\images\$000000.tmp
- from <SYSTEM32>\oobe\images\nextoff.jpg to <SYSTEM32>\oobe\images\$000000.tmp
- from <SYSTEM32>\oobe\images\nextup.jpg to <SYSTEM32>\oobe\images\$000000.tmp
- from <SYSTEM32>\oobe\images\skipdown.jpg to <SYSTEM32>\oobe\images\$000000.tmp
- from <SYSTEM32>\oobe\images\newtop8.jpg to <SYSTEM32>\oobe\images\$000000.tmp
- from <SYSTEM32>\oobe\images\mslogo.jpg to <SYSTEM32>\oobe\images\$000000.tmp
- from <SYSTEM32>\oobe\images\newbtm8.jpg to <SYSTEM32>\oobe\images\$000000.tmp
- from <SYSTEM32>\oobe\images\newmark8.jpg to <SYSTEM32>\oobe\images\$000000.tmp
- from %WINDIR%\FeatherTexture.bmp to %WINDIR%\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_normal.bmp to %WINDIR%\pchealth\helpctr\System\images\24x24\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\images\32x32\logo.bmp to %WINDIR%\pchealth\helpctr\System\images\32x32\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_01.bmp to %WINDIR%\pchealth\helpctr\System\images\48x48\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mousedown.bmp to %WINDIR%\pchealth\helpctr\System\images\24x24\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\images\16x16\compat.bmp to %WINDIR%\pchealth\helpctr\System\images\16x16\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\images\16x16\support.bmp to %WINDIR%\pchealth\helpctr\System\images\16x16\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\images\16x16\update.bmp to %WINDIR%\pchealth\helpctr\System\images\16x16\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_03.bmp to %WINDIR%\pchealth\helpctr\System\images\48x48\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendVoice.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\StopControl.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\up.bmp to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Quit.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_generic.bmp to %WINDIR%\pchealth\helpctr\System\images\48x48\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\TakeControl.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\HelpCenter.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\$000000.tmp
- from %WINDIR%\Zapotec.bmp to %WINDIR%\$000000.tmp
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\logo.bmp to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\$000000.tmp
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\header.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\$000000.tmp
- from %WINDIR%\winnt.bmp to %WINDIR%\$000000.tmp
- from %WINDIR%\Greenstone.bmp to %WINDIR%\$000000.tmp
- from %WINDIR%\Rhododendron.bmp to %WINDIR%\$000000.tmp
- from %WINDIR%\Santa Fe Stucco.bmp to %WINDIR%\$000000.tmp
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\watermark.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\images\icon_newwindow_12x.bmp to %WINDIR%\pchealth\helpctr\System\images\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\images\icon_tours_12x.bmp to %WINDIR%\pchealth\helpctr\System\images\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\images\16x16\arrow_blue_normal_shadow.bmp to %WINDIR%\pchealth\helpctr\System\images\16x16\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\images\icon_articles_12x.bmp to %WINDIR%\pchealth\helpctr\System\images\$000000.tmp
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\header.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\$000000.tmp
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\watermark.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\blurbs\watermark_300x.bmp to %WINDIR%\pchealth\helpctr\System\blurbs\$000000.tmp
- from <SYSTEM32>\oobe\html\mouse\images\heidelb.jpg to <SYSTEM32>\oobe\html\mouse\images\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\best_secure.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\img004b.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\img033.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\img034.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\gradient.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\end_up.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\mmTour\segment5.txt to %WINDIR%\Help\Tours\mmTour\$000000.tmp
- from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU1.txt to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\$000000.tmp
- from %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\dd_dotnetfx3error.txt to %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\$000000.tmp
- from %WINDIR%\Help\Tours\mmTour\segment3.txt to %WINDIR%\Help\Tours\mmTour\$000000.tmp
- from %WINDIR%\OEWABLog.txt to %WINDIR%\$000000.tmp
- from %WINDIR%\Help\Tours\mmTour\intro.txt to %WINDIR%\Help\Tours\mmTour\$000000.tmp
- from %WINDIR%\Help\Tours\mmTour\segment1.txt to %WINDIR%\Help\Tours\mmTour\$000000.tmp
- from %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\VSMsiLog22FD.txt to %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\$000000.tmp
- from <SYSTEM32>\Restore\MachineGuid.txt to <SYSTEM32>\Restore\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\best_road.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from <DRIVERS>\gmreadme.txt to <DRIVERS>\$000000.tmp
- from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\dd_dotnetfx35error.txt to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\$000000.tmp
- from <SYSTEM32>\eula.txt to <SYSTEM32>\$000000.tmp
- from <SYSTEM32>\CatRoot2\dberr.txt to <SYSTEM32>\CatRoot2\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\img046.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\window_up.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\ul_logo.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\DVDUpgrd\stripe.jpg to %WINDIR%\pchealth\helpctr\System\DVDUpgrd\$000000.tmp
- from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\greendot.jpg to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\$000000.tmp
- from <SYSTEM32>\oobe\html\mouse\images\bulzano.jpg to <SYSTEM32>\oobe\html\mouse\images\$000000.tmp
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\$000000.tmp
- from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\$000000.tmp
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\$000000.tmp
- from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\img116.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\img123.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\img136.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\img109.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\img068.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\img074a.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\img100.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\intro_logo.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\start_up.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\pen_icon.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\read_icon.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- from %WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg to %WINDIR%\Help\Tours\htmlTour\$000000.tmp