Trojan.DownLoader8.18244

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Command Processor] 'Autorun' = ''

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\ Startup.exe
%HOMEPATH%\Start Menu\Programs\Startup\ Startup.exe

Malicious functions:

Creates and executes the following:

%HOMEPATH%\My Documents\My Pictures\taskmgr.exe hiddenly

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\FireFox\chrome\en-US\locale\ locale.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\ en-US.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\ browser.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\branding\ branding.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\communicator\ communicator.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\preferences\ preferences.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\places\ places.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabview\ tabview.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\ tabbrowser.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\sidebar\ sidebar.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\safebrowsing\ safebrowsing.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\ en-US.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser-region\ browser-region.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\preferences\ preferences.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\feeds\ feeds.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\downloads\ downloads.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\ places.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\migration\ migration.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\feeds\ feeds.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\safebrowsing\ safebrowsing.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\preferences\ preferences.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\ skin.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\search\ search.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\ places.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\history\ history.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\ feeds.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\ pageinfo.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\migration\ migration.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\ tabbrowser.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\ preferences.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\ browser.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabview\ tabview.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\places\ places.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\ aero.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\ classic.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\ feeds.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\ browser.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\alerts\ alerts.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\necko\ necko.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\xpinstall\ xpinstall.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pipnss\ pipnss.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\passwordmgr\ passwordmgr.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\update\ update.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\plugins\ plugins.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\handling\ handling.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\profile\ profile.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\preferences\ preferences.exe
%PROGRAM_FILES%\FireFox\chrome\pippki\content\pippki\ pippki.exe
%PROGRAM_FILES%\FireFox\chrome\pippki\content\ content.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\ content.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\ toolkit.exe
%PROGRAM_FILES%\FireFox\chrome\pippki\ pippki.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\places\ places.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pippki\ pippki.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\feedback\ feedback.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\services\ services.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\extensions\ extensions.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\security\ security.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\search\ search.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xml\ xml.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\svg\ svg.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\layout\ layout.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\cookie\ cookie.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\autoconfig\ autoconfig.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\dom\ dom.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\ global.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-region\ global-region.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\win\ win.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\ downloads.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\ mozapps.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\unix\ unix.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xslt\ xslt.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xpinstall\ xpinstall.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\mac\ mac.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\ global-platform.exe
%CommonProgramFiles%\Microsoft Shared\Speech\1033\ 1033.exe
%CommonProgramFiles%\Microsoft Shared\Speech\ Speech.exe
%CommonProgramFiles%\Microsoft Shared\TextConv\ TextConv.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ Stationery.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\ MSInfo.exe
%CommonProgramFiles%\Microsoft Shared\DW\1042\ 1042.exe
%CommonProgramFiles%\Microsoft Shared\DW\1041\ 1041.exe
%CommonProgramFiles%\Microsoft Shared\DW\3082\ 3082.exe
%CommonProgramFiles%\Microsoft Shared\DW\2052\ 2052.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\ admcgi.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\ 40.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\ admisapi.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\scripts\ scripts.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\ web server extensions.exe
%CommonProgramFiles%\Microsoft Shared\VC\ VC.exe
%CommonProgramFiles%\Microsoft Shared\Triedit\ Triedit.exe
%CommonProgramFiles%\Microsoft Shared\Web Folders\ Web Folders.exe
%CommonProgramFiles%\Microsoft Shared\VGX\ VGX.exe
%CommonProgramFiles%\Microsoft Shared\DW\1040\ 1040.exe
C:\Far2\PluginSDK\Headers.pas\ Headers.pas.exe
C:\Far2\PluginSDK\Headers.c\ Headers.c.exe
%PROGRAM_FILES%\ Program Files.exe
<Auxiliary element>
C:\Far2\PluginSDK\ PluginSDK.exe
C:\Far2\Plugins\WinSCP\release\ release.exe
C:\Far2\Plugins\WinSCP\putty\windows\ windows.exe
C:\Far2\Plugins\WinSCP\windows\ windows.exe
C:\Far2\Plugins\WinSCP\resource\ resource.exe
%CommonProgramFiles%\Microsoft Shared\DW\1031\ 1031.exe
%CommonProgramFiles%\Microsoft Shared\DW\1028\ 1028.exe
%CommonProgramFiles%\Microsoft Shared\DW\1036\ 1036.exe
%CommonProgramFiles%\Microsoft Shared\DW\1033\ 1033.exe
%CommonProgramFiles%\Microsoft Shared\DW\1025\ 1025.exe
%CommonProgramFiles%\Microsoft Shared\ Microsoft Shared.exe
%CommonProgramFiles%\ Common Files.exe
%CommonProgramFiles%\Microsoft Shared\DW\ DW.exe
%CommonProgramFiles%\Microsoft Shared\DAO\ DAO.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\scripts\ scripts.exe
%CommonProgramFiles%\System\ado\ ado.exe
%CommonProgramFiles%\System\ System.exe
%CommonProgramFiles%\System\Ole DB\ Ole DB.exe
%CommonProgramFiles%\System\msadc\ msadc.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\ 1033.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\ Lexicon.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\ Microsoft.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\ TTS.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\ 1033.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\ browser.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\branding\ branding.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\certerror\ certerror.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\bookmarks\ bookmarks.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\ content.exe
%PROGRAM_FILES%\FireFox\ FireFox.exe
%PROGRAM_FILES%\ComPlus Applications\ ComPlus Applications.exe
%PROGRAM_FILES%\FireFox\chrome\browser\ browser.exe
%PROGRAM_FILES%\FireFox\chrome\ chrome.exe
%CommonProgramFiles%\SpeechEngines\ SpeechEngines.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_aut\ _vti_aut.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_adm\ _vti_adm.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\ _vti_bin.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\servsupp\ servsupp.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\ isapi.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\ 1033.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\ bin.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\vinavbar\ vinavbar.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\ bots.exe
%CommonProgramFiles%\ODBC\ ODBC.exe
%CommonProgramFiles%\MSSoap\Binaries\Resources\1033\ 1033.exe
%CommonProgramFiles%\Services\ Services.exe
%CommonProgramFiles%\ODBC\Data Sources\ Data Sources.exe
%CommonProgramFiles%\MSSoap\Binaries\Resources\ Resources.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_aut\ _vti_aut.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_adm\ _vti_adm.exe
%CommonProgramFiles%\MSSoap\Binaries\ Binaries.exe
%CommonProgramFiles%\MSSoap\ MSSoap.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\cookie\ cookie.exe
%PROGRAM_FILES%\Internet Explorer\SIGNUP\ SIGNUP.exe
%PROGRAM_FILES%\Internet Explorer\PLUGINS\ PLUGINS.exe
%PROGRAM_FILES%\microsoft frontpage\ microsoft frontpage.exe
%PROGRAM_FILES%\Messenger\ Messenger.exe
%PROGRAM_FILES%\Internet Explorer\MUI\0409\ 0409.exe
%PROGRAM_FILES%\Internet Explorer\ Internet Explorer.exe
%PROGRAM_FILES%\FireFox\uninstall\ uninstall.exe
%PROGRAM_FILES%\Internet Explorer\MUI\ MUI.exe
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\ Connection Wizard.exe
%PROGRAM_FILES%\Movie Maker\MUI\0409\ 0409.exe
%PROGRAM_FILES%\Movie Maker\MUI\ MUI.exe
%PROGRAM_FILES%\Movie Maker\Shared\Profiles\ Profiles.exe
%PROGRAM_FILES%\Movie Maker\Shared\ Shared.exe
%PROGRAM_FILES%\Movie Maker\ Movie Maker.exe
%PROGRAM_FILES%\microsoft frontpage\version3.0\bin\ bin.exe
%PROGRAM_FILES%\microsoft frontpage\version3.0\ version3.0.exe
%PROGRAM_FILES%\Microsoft.NET\RedistList\ RedistList.exe
%PROGRAM_FILES%\Microsoft.NET\ Microsoft.NET.exe
%PROGRAM_FILES%\FireFox\searchplugins\ searchplugins.exe
%PROGRAM_FILES%\FireFox\modules\ modules.exe
%PROGRAM_FILES%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\ {972ce4c6-7e08-4474-a285-3208198ce6fd}.exe
%PROGRAM_FILES%\FireFox\modules\services-sync\ services-sync.exe
%PROGRAM_FILES%\FireFox\modules\services-crypto\ services-crypto.exe
%PROGRAM_FILES%\FireFox\extensions\ extensions.exe
%PROGRAM_FILES%\FireFox\defaults\profile\ profile.exe
%PROGRAM_FILES%\FireFox\defaults\pref\ pref.exe
%PROGRAM_FILES%\FireFox\dictionaries\ dictionaries.exe
%PROGRAM_FILES%\FireFox\defaults\profile\chrome\ chrome.exe
%PROGRAM_FILES%\FireFox\res\entityTables\ entityTables.exe
%PROGRAM_FILES%\FireFox\res\dtd\ dtd.exe
%PROGRAM_FILES%\FireFox\res\html\ html.exe
%PROGRAM_FILES%\FireFox\res\fonts\ fonts.exe
%PROGRAM_FILES%\FireFox\res\ res.exe
%PROGRAM_FILES%\FireFox\modules\services-sync\ext\ ext.exe
%PROGRAM_FILES%\FireFox\modules\services-sync\engines\ engines.exe
%PROGRAM_FILES%\FireFox\plugins\ plugins.exe
%PROGRAM_FILES%\FireFox\modules\tabview\ tabview.exe
%PROGRAM_FILES%\MSBuild\ MSBuild.exe
%PROGRAM_FILES%\Windows Media Player\Icons\ Icons.exe
%PROGRAM_FILES%\Windows Media Player\ Windows Media Player.exe
%PROGRAM_FILES%\Windows Media Player\Skins\ Skins.exe
%PROGRAM_FILES%\Windows Media Player\Sample Playlists\ Sample Playlists.exe
%PROGRAM_FILES%\Uninstall Information\ Uninstall Information.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\ v3.5.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\ SubsetList.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\ SubsetList.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\ RedistList.exe
%PROGRAM_FILES%\xerox\nwwia\ nwwia.exe
%PROGRAM_FILES%\xerox\ xerox.exe
C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\ S-1-5-21-2052111302-484763869-725345543-1003.exe
C:\RECYCLER\ RECYCLER.exe
%PROGRAM_FILES%\WindowsUpdate\ WindowsUpdate.exe
%PROGRAM_FILES%\Windows NT\ Windows NT.exe
%PROGRAM_FILES%\Windows Media Player\Visualizations\ Visualizations.exe
%PROGRAM_FILES%\Windows NT\Pinball\ Pinball.exe
%PROGRAM_FILES%\Windows NT\Accessories\ Accessories.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\ RedistList.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\ Install.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\ MSNCoreFiles.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\OOBE\ OOBE.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\ MSN9Components.exe
%PROGRAM_FILES%\MSN\ MSN.exe
%PROGRAM_FILES%\MSBuild\Microsoft\Windows Workflow Foundation\ Windows Workflow Foundation.exe
%PROGRAM_FILES%\MSBuild\Microsoft\ Microsoft.exe
%PROGRAM_FILES%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\ v3.5.exe
%PROGRAM_FILES%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\ v3.0.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\ Microsoft.exe
%PROGRAM_FILES%\Reference Assemblies\ Reference Assemblies.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\ v3.0.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\ Framework.exe
%PROGRAM_FILES%\Outlook Express\ Outlook Express.exe
%PROGRAM_FILES%\MSN Gaming Zone\Windows\ Windows.exe
%PROGRAM_FILES%\MSN Gaming Zone\ MSN Gaming Zone.exe
%PROGRAM_FILES%\Online Services\ Online Services.exe
%PROGRAM_FILES%\NetMeeting\ NetMeeting.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\ checkbox.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\ arrow.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\dirListing\ dirListing.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\console\ console.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\alerts\ alerts.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\ classic.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\ skin.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\ global.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\ aero.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\toolbar\ toolbar.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\ splitter.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\ mozapps.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\tree\ tree.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\scrollbar\ scrollbar.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\ media.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\ icons.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\ radio.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\printpreview\ printpreview.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\ res.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\ mozapps.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\xml\ xml.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\extensions\ extensions.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\downloads\ downloads.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\svg\ svg.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\alerts\ alerts.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\ global.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ cpow.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\ bindings.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\passwordmgr\ passwordmgr.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\xpinstall\ xpinstall.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\xbl-marquee\ xbl-marquee.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\satchel\ satchel.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\update\ update.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\plugins\ plugins.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\handling\ handling.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\profile\ profile.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\preferences\ preferences.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\ downloads.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\ extensions.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\ downloads.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\passwordmgr\ passwordmgr.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\handling\ handling.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\ mozapps.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\splitter\ splitter.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\scrollbar\ scrollbar.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\tree\ tree.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\toolbar\ toolbar.exe
%PROGRAM_FILES%\FireFox\components\ components.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\xpinstall\ xpinstall.exe
%PROGRAM_FILES%\FireFox\defaults\autoconfig\ autoconfig.exe
%PROGRAM_FILES%\FireFox\defaults\ defaults.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\viewsource\ viewsource.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\plugins\ plugins.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\places\ places.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\update\ update.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\profile\ profile.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\radio\ radio.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\update\ update.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\profile\ profile.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\xpinstall\ xpinstall.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\viewsource\ viewsource.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\plugins\ plugins.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\handling\ handling.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\ extensions.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\places\ places.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\passwordmgr\ passwordmgr.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\icons\ icons.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\dirListing\ dirListing.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\printpreview\ printpreview.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\media\ media.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\console\ console.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\alerts\ alerts.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\ global.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\checkbox\ checkbox.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\ arrow.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\ Application Data.exe
C:\Documents and Settings\LocalService\Local Settings\ Local Settings.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\ Credentials.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\ Microsoft.exe
C:\Documents and Settings\LocalService\Cookies\ Cookies.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\ Certificates.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\ My.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\ CTLs.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\ CRLs.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\ Content.IE5.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\ Temporary Internet Files.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\ CJCTQ25G.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\ BGGTYMH1.exe
C:\Documents and Settings\LocalService\Local Settings\Temp\ Temp.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\ Windows.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\ S-1-5-19.exe
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\ History.IE5.exe
C:\Documents and Settings\LocalService\Local Settings\History\ History.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\ SystemCertificates.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\ Accessories.exe
C:\Documents and Settings\Default User\Start Menu\Programs\ Programs.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\ Entertainment.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\ Accessibility.exe
C:\Documents and Settings\Default User\Start Menu\ Start Menu.exe
C:\Documents and Settings\Default User\PrintHood\ PrintHood.exe
C:\Documents and Settings\Default User\NetHood\ NetHood.exe
C:\Documents and Settings\Default User\SendTo\ SendTo.exe
C:\Documents and Settings\Default User\Recent\ Recent.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\ S-1-5-19.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\ Credentials.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\ Media Player.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\ Internet Explorer.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\ Microsoft.exe
C:\Documents and Settings\Default User\Templates\ Templates.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\ Startup.exe
C:\Documents and Settings\LocalService\Application Data\ Application Data.exe
C:\Documents and Settings\LocalService\ LocalService.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\ LBMMC3H3.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ 2VAZY7AN.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\ Content.IE5.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ U98D4X8H.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ KHMHGZ4F.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\ Temporary Internet Files.exe
C:\Documents and Settings\NetworkService\Local Settings\History\ History.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\ Windows.exe
C:\Documents and Settings\NetworkService\Local Settings\Temp\ Temp.exe
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\ History.IE5.exe
%APPDATA%\Microsoft\Address Book\ Address Book.exe
%APPDATA%\Microsoft\ Microsoft.exe
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\ S-1-5-21-2052111302-484763869-725345543-1003.exe
%APPDATA%\Microsoft\Credentials\ Credentials.exe
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\ {5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}.exe
%HOMEPATH%\ %USERNAME%.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\ YPORKZYZ.exe
%APPDATA%\Identities\ Identities.exe
%APPDATA%\ Application Data.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\ S-1-5-20.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\ Internet Explorer.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\ S-1-5-20.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\ SystemCertificates.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\ Media Player.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\ Credentials.exe
C:\Documents and Settings\NetworkService\ NetworkService.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\ MOE00UY1.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\ Microsoft.exe
C:\Documents and Settings\NetworkService\Application Data\ Application Data.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\ Application Data.exe
C:\Documents and Settings\NetworkService\Local Settings\ Local Settings.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\ Credentials.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\ Microsoft.exe
C:\Documents and Settings\NetworkService\Cookies\ Cookies.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\ Certificates.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\ My.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\ CTLs.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\ CRLs.exe
%ALLUSERSPROFILE%\Documents\ Documents.exe
%ALLUSERSPROFILE%\Desktop\ Desktop.exe
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\ My Playlists.exe
%ALLUSERSPROFILE%\Documents\My Music\ My Music.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ Default Pictures.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\ Cm.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\ Connections.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\ User Account Pictures.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\ Pbk.exe
%ALLUSERSPROFILE%\DRM\ DRM.exe
%ALLUSERSPROFILE%\Documents\My Videos\ My Videos.exe
%ALLUSERSPROFILE%\Start Menu\ Start Menu.exe
%ALLUSERSPROFILE%\Favorites\ Favorites.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\ Sample Pictures.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\ Sample Playlists.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\ Sample Music.exe
%ALLUSERSPROFILE%\Documents\My Pictures\ My Pictures.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\ 0338E140.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\ Network.exe
%ALLUSERSPROFILE%\Application Data\ Application Data.exe
%ALLUSERSPROFILE%\ All Users.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\ Crypto.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\ Microsoft.exe
C:\Documents and Settings\ Documents and Settings.exe
%HOMEPATH%\My Documents\My Music\Jai SiyaRam.exe
%HOMEPATH%\My Documents\My Pictures\taskmgr.exe
<Current directory>\ af32d3b0.exe
C:\ .exe
%ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\ HTML Help.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\ Dr Watson.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\ Media Player.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\ Media Index.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\ S-1-5-18.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\ MachineKeys.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\ DSS.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\ MachineKeys.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\ RSA.exe
%ALLUSERSPROFILE%\Start Menu\Programs\ Programs.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\ Windows Media.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\ Media Player.exe
C:\Documents and Settings\Default User\Local Settings\History\ History.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\ 9.0.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\ Microsoft.exe
C:\Documents and Settings\Default User\Favorites\ Favorites.exe
C:\Documents and Settings\Default User\Desktop\ Desktop.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\ Application Data.exe
C:\Documents and Settings\Default User\Local Settings\ Local Settings.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ U98D4X8H.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ KHMHGZ4F.exe
C:\Documents and Settings\Default User\My Documents\ My Documents.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\ YPORKZYZ.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ 2VAZY7AN.exe
C:\Documents and Settings\Default User\Local Settings\Temp\ Temp.exe
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\ History.IE5.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\ Content.IE5.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\ Temporary Internet Files.exe
C:\Documents and Settings\Default User\Cookies\ Cookies.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Games\ Games.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\ Administrative Tools.exe
C:\Documents and Settings\Default User\ Default User.exe
%ALLUSERSPROFILE%\Templates\ Templates.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\ System Tools.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\ Accessibility.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\ Accessories.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\ Entertainment.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\ Communications.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\ Certificates.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\ My.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\ CTLs.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\ CRLs.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\ SystemCertificates.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\ Microsoft.exe
C:\Documents and Settings\Default User\Application Data\ Application Data.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\ Media Player.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\ Internet Explorer.exe
%APPDATA%\Microsoft\Internet Explorer\ Internet Explorer.exe
C:\Far2\Plugins\Align\ Align.exe
C:\Far2\Plugins\7-Zip\ 7-Zip.exe
C:\Far2\Plugins\AutoWrap\ AutoWrap.exe
C:\Far2\Plugins\arclite\ arclite.exe
C:\Far2\Plugins\ Plugins.exe
C:\Far2\Documentation\rus\ rus.exe
C:\Far2\Documentation\eng\ eng.exe
C:\Far2\FExcept\ FExcept.exe
C:\Far2\Encyclopedia\ Encyclopedia.exe
C:\Far2\Plugins\Colorer\hrd\ hrd.exe
C:\Far2\Plugins\Colorer\hrc\auto\types\ types.exe
C:\Far2\Plugins\Colorer\hrd\console\contrib\ contrib.exe
C:\Far2\Plugins\Colorer\hrd\console\ console.exe
C:\Far2\Plugins\Colorer\hrc\auto\ auto.exe
C:\Far2\Plugins\Colorer\ Colorer.exe
C:\Far2\Plugins\Brackets\ Brackets.exe
C:\Far2\Plugins\Colorer\hrc\ hrc.exe
C:\Far2\Plugins\Colorer\bin\ bin.exe
C:\Far2\Documentation\ Documentation.exe
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\ Entertainment.exe
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\ Accessibility.exe
C:\Far2\ Far2.exe
%HOMEPATH%\Templates\ Templates.exe
%HOMEPATH%\Start Menu\Programs\Accessories\ Accessories.exe
%HOMEPATH%\SendTo\ SendTo.exe
%HOMEPATH%\Recent\ Recent.exe
%HOMEPATH%\Start Menu\Programs\ Programs.exe
%HOMEPATH%\Start Menu\ Start Menu.exe
C:\Far2\Addons\Shell\ Shell.exe
C:\Far2\Addons\SetUp\ SetUp.exe
C:\Far2\Addons\XLat\Russian\ Russian.exe
C:\Far2\Addons\XLat\ XLat.exe
C:\Far2\Addons\Macros\ Macros.exe
C:\Far2\Addons\Colors\ Colors.exe
C:\Far2\Addons\ Addons.exe
C:\Far2\Addons\Colors\Default Highlighting\ Default Highlighting.exe
C:\Far2\Addons\Colors\Custom Highlighting\ Custom Highlighting.exe
C:\Far2\Plugins\Compare\ Compare.exe
C:\Far2\Plugins\WinSCP\filezilla\misc\ misc.exe
C:\Far2\Plugins\WinSCP\filezilla\ filezilla.exe
C:\Far2\Plugins\WinSCP\lib\ lib.exe
C:\Far2\Plugins\WinSCP\forms\ forms.exe
C:\Far2\Plugins\WinSCP\fari\ fari.exe
C:\Far2\Plugins\WinSCP\core\ core.exe
C:\Far2\Plugins\WinSCP\console\ console.exe
C:\Far2\Plugins\WinSCP\far\ far.exe
C:\Far2\Plugins\WinSCP\dragext\ dragext.exe
C:\Far2\Plugins\WinSCP\packages\theme\ theme.exe
C:\Far2\Plugins\WinSCP\packages\tbx\ tbx.exe
C:\Far2\Plugins\WinSCP\putty\charset\ charset.exe
C:\Far2\Plugins\WinSCP\putty\ putty.exe
C:\Far2\Plugins\WinSCP\packages\tb2k\ tb2k.exe
C:\Far2\Plugins\WinSCP\packages\dragndrop\ dragndrop.exe
C:\Far2\Plugins\WinSCP\packages\ packages.exe
C:\Far2\Plugins\WinSCP\packages\my\ my.exe
C:\Far2\Plugins\WinSCP\packages\filemng\ filemng.exe
C:\Far2\Plugins\WinSCP\components\ components.exe
C:\Far2\Plugins\ExtSearch\sources\ sources.exe
C:\Far2\Plugins\ExtSearch\keys\ keys.exe
C:\Far2\Plugins\FarCmds\ FarCmds.exe
C:\Far2\Plugins\ExtSearch\sources\RegExp\ RegExp.exe
C:\Far2\Plugins\ExtSearch\doc\ doc.exe
C:\Far2\Plugins\EditCase\ EditCase.exe
C:\Far2\Plugins\DrawLine\ DrawLine.exe
C:\Far2\Plugins\ExtSearch\ ExtSearch.exe
C:\Far2\Plugins\EMenu\ EMenu.exe
C:\Far2\Plugins\ProcList\ ProcList.exe
C:\Far2\Plugins\Network\ Network.exe
C:\Far2\Plugins\WinSCP\ WinSCP.exe
C:\Far2\Plugins\TmpPanel\ TmpPanel.exe
C:\Far2\Plugins\MacroView\ MacroView.exe
C:\Far2\Plugins\FTP\ FTP.exe
C:\Far2\Plugins\FileCase\ FileCase.exe
C:\Far2\Plugins\HlfViewer\ HlfViewer.exe
C:\Far2\Plugins\FTP\lib\ lib.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\ Microsoft.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\ {5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}.exe
<LS_APPDATA>\Microsoft\ Microsoft.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\ Outlook Express.exe
<LS_APPDATA>\Identities\ Identities.exe
%HOMEPATH%\Favorites\Links\ Links.exe
%HOMEPATH%\Favorites\ Favorites.exe
<LS_APPDATA>\ Application Data.exe
%HOMEPATH%\Local Settings\ Local Settings.exe
<LS_APPDATA>\Microsoft\Windows Media\9.0\ 9.0.exe
<LS_APPDATA>\Microsoft\Windows Media\ Windows Media.exe
<LS_APPDATA>\Mozilla\Firefox\ Firefox.exe
<LS_APPDATA>\Mozilla\ Mozilla.exe
<LS_APPDATA>\Microsoft\Windows\ Windows.exe
<LS_APPDATA>\Microsoft\Credentials\ Credentials.exe
<LS_APPDATA>\Microsoft\CD Burning\ CD Burning.exe
<LS_APPDATA>\Microsoft\Media Player\ Media Player.exe
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\ S-1-5-21-2052111302-484763869-725345543-1003.exe
%HOMEPATH%\Desktop\ Desktop.exe
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\ CRLs.exe
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\ Certificates.exe
%APPDATA%\Microsoft\Windows\ Windows.exe
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\ CTLs.exe
%APPDATA%\Microsoft\SystemCertificates\My\ My.exe
%APPDATA%\Microsoft\Media Player\ Media Player.exe
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\ Quick Launch.exe
%APPDATA%\Microsoft\SystemCertificates\ SystemCertificates.exe
%APPDATA%\Microsoft\MMC\ MMC.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\ bookmarkbackups.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\ cwdgt0y8.default.exe
%HOMEPATH%\Cookies\ Cookies.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\ chrome.exe
%APPDATA%\Mozilla\Firefox\Profiles\ Profiles.exe
%APPDATA%\Mozilla\ Mozilla.exe
%APPDATA%\Microsoft\Windows\Themes\ Themes.exe
%APPDATA%\Mozilla\Firefox\ Firefox.exe
%APPDATA%\Mozilla\Extensions\ Extensions.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\ Profiles.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ Content.IE5.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\ Temporary Internet Files.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ KHMHGZ4F.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ 2VAZY7AN.exe
%TEMP%\ Temp.exe
%HOMEPATH%\Local Settings\History\ History.exe
<LS_APPDATA>\VMware\ VMware.exe
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\ MSHist012011111020111111.exe
%HOMEPATH%\Local Settings\History\History.IE5\ History.IE5.exe
%HOMEPATH%\My Documents\My Received Files\ My Received Files.exe
%HOMEPATH%\My Documents\My Pictures\ My Pictures.exe
%HOMEPATH%\PrintHood\ PrintHood.exe
%HOMEPATH%\NetHood\ NetHood.exe
%HOMEPATH%\My Documents\My Music\ My Music.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\ YPORKZYZ.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ U98D4X8H.exe
%HOMEPATH%\My Documents\Downloads\ Downloads.exe
%HOMEPATH%\My Documents\ My Documents.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\ startupCache.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\ 4.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\ 3.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\ 6.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\ 5.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\ 2.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\ Cache.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\ cwdgt0y8.default.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\ 1.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\ 0.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\ D.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\ C.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\ F.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\ E.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\ B.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\ 8.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\ 7.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\ A.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\ 9.exe

Sets the 'hidden' attribute to the following files:

%PROGRAM_FILES%\FireFox\chrome\en-US\locale\ locale.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\ en-US.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\ browser.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\branding\ branding.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\communicator\ communicator.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\preferences\ preferences.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\places\ places.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabview\ tabview.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\ tabbrowser.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\sidebar\ sidebar.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\safebrowsing\ safebrowsing.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\ en-US.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser-region\ browser-region.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\preferences\ preferences.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\feeds\ feeds.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\downloads\ downloads.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\ places.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\migration\ migration.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\feeds\ feeds.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\safebrowsing\ safebrowsing.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\preferences\ preferences.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\ skin.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\search\ search.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\ places.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\history\ history.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\ feeds.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\ pageinfo.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\migration\ migration.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\ tabbrowser.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\ preferences.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\ browser.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabview\ tabview.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\places\ places.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\ aero.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\ classic.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\ feeds.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\ browser.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\alerts\ alerts.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\necko\ necko.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\xpinstall\ xpinstall.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pipnss\ pipnss.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\passwordmgr\ passwordmgr.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\update\ update.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\plugins\ plugins.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\handling\ handling.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\profile\ profile.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\preferences\ preferences.exe
%PROGRAM_FILES%\FireFox\chrome\pippki\content\pippki\ pippki.exe
%PROGRAM_FILES%\FireFox\chrome\pippki\content\ content.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\ content.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\ toolkit.exe
%PROGRAM_FILES%\FireFox\chrome\pippki\ pippki.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\places\ places.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pippki\ pippki.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\feedback\ feedback.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\services\ services.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\extensions\ extensions.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\security\ security.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\search\ search.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xml\ xml.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\svg\ svg.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\layout\ layout.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\cookie\ cookie.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\autoconfig\ autoconfig.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\dom\ dom.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\ global.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-region\ global-region.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\win\ win.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\ downloads.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\ mozapps.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\unix\ unix.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xslt\ xslt.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xpinstall\ xpinstall.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\mac\ mac.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\ global-platform.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\certerror\ certerror.exe
%CommonProgramFiles%\Microsoft Shared\Speech\ Speech.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\ MSInfo.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\ Stationery.exe
%CommonProgramFiles%\Microsoft Shared\Speech\1033\ 1033.exe
%CommonProgramFiles%\Microsoft Shared\DW\3082\ 3082.exe
%CommonProgramFiles%\Microsoft Shared\DW\1041\ 1041.exe
%CommonProgramFiles%\Microsoft Shared\DW\1040\ 1040.exe
%CommonProgramFiles%\Microsoft Shared\DW\2052\ 2052.exe
%CommonProgramFiles%\Microsoft Shared\DW\1042\ 1042.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\ 40.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\ web server extensions.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\scripts\ scripts.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\ admcgi.exe
%CommonProgramFiles%\Microsoft Shared\Web Folders\ Web Folders.exe
%CommonProgramFiles%\Microsoft Shared\Triedit\ Triedit.exe
%CommonProgramFiles%\Microsoft Shared\TextConv\ TextConv.exe
%CommonProgramFiles%\Microsoft Shared\VGX\ VGX.exe
%CommonProgramFiles%\Microsoft Shared\VC\ VC.exe
%CommonProgramFiles%\Microsoft Shared\DW\1036\ 1036.exe
C:\Far2\PluginSDK\Headers.c\ Headers.c.exe
C:\Far2\PluginSDK\ PluginSDK.exe
<Auxiliary element>
C:\Far2\PluginSDK\Headers.pas\ Headers.pas.exe
C:\Far2\Plugins\WinSCP\windows\ windows.exe
C:\Far2\Plugins\WinSCP\putty\windows\ windows.exe
C:\Far2\Plugins\WinSCP\putty\charset\ charset.exe
C:\Far2\Plugins\WinSCP\resource\ resource.exe
C:\Far2\Plugins\WinSCP\release\ release.exe
%CommonProgramFiles%\Microsoft Shared\DW\1028\ 1028.exe
%CommonProgramFiles%\Microsoft Shared\DW\1025\ 1025.exe
%CommonProgramFiles%\Microsoft Shared\DW\1033\ 1033.exe
%CommonProgramFiles%\Microsoft Shared\DW\1031\ 1031.exe
%CommonProgramFiles%\Microsoft Shared\DW\ DW.exe
%CommonProgramFiles%\ Common Files.exe
%PROGRAM_FILES%\ Program Files.exe
%CommonProgramFiles%\Microsoft Shared\DAO\ DAO.exe
%CommonProgramFiles%\Microsoft Shared\ Microsoft Shared.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\ admisapi.exe
%CommonProgramFiles%\System\ System.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\ 1033.exe
%CommonProgramFiles%\System\msadc\ msadc.exe
%CommonProgramFiles%\System\ado\ ado.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\ TTS.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\ Microsoft.exe
%CommonProgramFiles%\SpeechEngines\ SpeechEngines.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\ 1033.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\ Lexicon.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\branding\ branding.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\ content.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\bookmarks\ bookmarks.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\ browser.exe
%PROGRAM_FILES%\FireFox\chrome\browser\ browser.exe
%PROGRAM_FILES%\ComPlus Applications\ ComPlus Applications.exe
%CommonProgramFiles%\System\Ole DB\ Ole DB.exe
%PROGRAM_FILES%\FireFox\chrome\ chrome.exe
%PROGRAM_FILES%\FireFox\ FireFox.exe
%CommonProgramFiles%\Services\ Services.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_adm\ _vti_adm.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\ isapi.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\servsupp\ servsupp.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_aut\ _vti_aut.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\vinavbar\ vinavbar.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\ bin.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\scripts\ scripts.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\ bots.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\ 1033.exe
%CommonProgramFiles%\MSSoap\Binaries\Resources\1033\ 1033.exe
%CommonProgramFiles%\MSSoap\Binaries\Resources\ Resources.exe
%CommonProgramFiles%\ODBC\Data Sources\ Data Sources.exe
%CommonProgramFiles%\ODBC\ ODBC.exe
%CommonProgramFiles%\MSSoap\Binaries\ Binaries.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_adm\ _vti_adm.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\ _vti_bin.exe
%CommonProgramFiles%\MSSoap\ MSSoap.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_aut\ _vti_aut.exe
%PROGRAM_FILES%\Internet Explorer\SIGNUP\ SIGNUP.exe
%PROGRAM_FILES%\Internet Explorer\PLUGINS\ PLUGINS.exe
%PROGRAM_FILES%\microsoft frontpage\ microsoft frontpage.exe
%PROGRAM_FILES%\Messenger\ Messenger.exe
%PROGRAM_FILES%\Internet Explorer\MUI\0409\ 0409.exe
%PROGRAM_FILES%\Internet Explorer\ Internet Explorer.exe
%PROGRAM_FILES%\FireFox\uninstall\ uninstall.exe
%PROGRAM_FILES%\Internet Explorer\MUI\ MUI.exe
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\ Connection Wizard.exe
%PROGRAM_FILES%\Movie Maker\MUI\0409\ 0409.exe
%PROGRAM_FILES%\Movie Maker\MUI\ MUI.exe
%PROGRAM_FILES%\Movie Maker\Shared\Profiles\ Profiles.exe
%PROGRAM_FILES%\Movie Maker\Shared\ Shared.exe
%PROGRAM_FILES%\Movie Maker\ Movie Maker.exe
%PROGRAM_FILES%\microsoft frontpage\version3.0\bin\ bin.exe
%PROGRAM_FILES%\microsoft frontpage\version3.0\ version3.0.exe
%PROGRAM_FILES%\Microsoft.NET\RedistList\ RedistList.exe
%PROGRAM_FILES%\Microsoft.NET\ Microsoft.NET.exe
%PROGRAM_FILES%\FireFox\searchplugins\ searchplugins.exe
%PROGRAM_FILES%\FireFox\modules\ modules.exe
%PROGRAM_FILES%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\ {972ce4c6-7e08-4474-a285-3208198ce6fd}.exe
%PROGRAM_FILES%\FireFox\modules\services-sync\ services-sync.exe
%PROGRAM_FILES%\FireFox\modules\services-crypto\ services-crypto.exe
%PROGRAM_FILES%\FireFox\extensions\ extensions.exe
%PROGRAM_FILES%\FireFox\defaults\profile\ profile.exe
%PROGRAM_FILES%\FireFox\defaults\pref\ pref.exe
%PROGRAM_FILES%\FireFox\dictionaries\ dictionaries.exe
%PROGRAM_FILES%\FireFox\defaults\profile\chrome\ chrome.exe
%PROGRAM_FILES%\FireFox\res\entityTables\ entityTables.exe
%PROGRAM_FILES%\FireFox\res\dtd\ dtd.exe
%PROGRAM_FILES%\FireFox\res\html\ html.exe
%PROGRAM_FILES%\FireFox\res\fonts\ fonts.exe
%PROGRAM_FILES%\FireFox\res\ res.exe
%PROGRAM_FILES%\FireFox\modules\services-sync\ext\ ext.exe
%PROGRAM_FILES%\FireFox\modules\services-sync\engines\ engines.exe
%PROGRAM_FILES%\FireFox\plugins\ plugins.exe
%PROGRAM_FILES%\FireFox\modules\tabview\ tabview.exe
%PROGRAM_FILES%\MSBuild\ MSBuild.exe
%PROGRAM_FILES%\Windows Media Player\Icons\ Icons.exe
%PROGRAM_FILES%\Windows Media Player\ Windows Media Player.exe
%PROGRAM_FILES%\Windows Media Player\Skins\ Skins.exe
%PROGRAM_FILES%\Windows Media Player\Sample Playlists\ Sample Playlists.exe
%PROGRAM_FILES%\Uninstall Information\ Uninstall Information.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\ v3.5.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\ SubsetList.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\ SubsetList.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\ RedistList.exe
%PROGRAM_FILES%\xerox\nwwia\ nwwia.exe
%PROGRAM_FILES%\xerox\ xerox.exe
C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\ S-1-5-21-2052111302-484763869-725345543-1003.exe
C:\RECYCLER\ RECYCLER.exe
%PROGRAM_FILES%\WindowsUpdate\ WindowsUpdate.exe
%PROGRAM_FILES%\Windows NT\ Windows NT.exe
%PROGRAM_FILES%\Windows Media Player\Visualizations\ Visualizations.exe
%PROGRAM_FILES%\Windows NT\Pinball\ Pinball.exe
%PROGRAM_FILES%\Windows NT\Accessories\ Accessories.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\ RedistList.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\ Install.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\ MSNCoreFiles.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\OOBE\ OOBE.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\ MSN9Components.exe
%PROGRAM_FILES%\MSN\ MSN.exe
%PROGRAM_FILES%\MSBuild\Microsoft\Windows Workflow Foundation\ Windows Workflow Foundation.exe
%PROGRAM_FILES%\MSBuild\Microsoft\ Microsoft.exe
%PROGRAM_FILES%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\ v3.5.exe
%PROGRAM_FILES%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\ v3.0.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\ Microsoft.exe
%PROGRAM_FILES%\Reference Assemblies\ Reference Assemblies.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\ v3.0.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\ Framework.exe
%PROGRAM_FILES%\Outlook Express\ Outlook Express.exe
%PROGRAM_FILES%\MSN Gaming Zone\Windows\ Windows.exe
%PROGRAM_FILES%\MSN Gaming Zone\ MSN Gaming Zone.exe
%PROGRAM_FILES%\Online Services\ Online Services.exe
%PROGRAM_FILES%\NetMeeting\ NetMeeting.exe
%PROGRAM_FILES%\FireFox\defaults\autoconfig\ autoconfig.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\ arrow.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\alerts\ alerts.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\console\ console.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\ checkbox.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\ global.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\ skin.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\ res.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\ aero.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\ classic.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\ splitter.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\scrollbar\ scrollbar.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\tree\ tree.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\toolbar\ toolbar.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\ radio.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\ icons.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\dirListing\ dirListing.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\printpreview\ printpreview.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\ media.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\xbl-marquee\ xbl-marquee.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\xml\ xml.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\svg\ svg.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\downloads\ downloads.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\ mozapps.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\ cpow.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\ global.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\cookie\ cookie.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\ bindings.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\alerts\ alerts.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\xpinstall\ xpinstall.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\update\ update.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\satchel\ satchel.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\passwordmgr\ passwordmgr.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\profile\ profile.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\handling\ handling.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\extensions\ extensions.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\preferences\ preferences.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\plugins\ plugins.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\ mozapps.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\ downloads.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\ mozapps.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\handling\ handling.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\ extensions.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\tree\ tree.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\scrollbar\ scrollbar.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\radio\ radio.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\toolbar\ toolbar.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\splitter\ splitter.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\xpinstall\ xpinstall.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\viewsource\ viewsource.exe
%PROGRAM_FILES%\FireFox\defaults\ defaults.exe
%PROGRAM_FILES%\FireFox\components\ components.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\update\ update.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\places\ places.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\passwordmgr\ passwordmgr.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\profile\ profile.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\plugins\ plugins.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\printpreview\ printpreview.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\profile\ profile.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\plugins\ plugins.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\viewsource\ viewsource.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\update\ update.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\places\ places.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\ extensions.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\ downloads.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\passwordmgr\ passwordmgr.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\handling\ handling.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\dirListing\ dirListing.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\console\ console.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\media\ media.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\icons\ icons.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\checkbox\ checkbox.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\ global.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\xpinstall\ xpinstall.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\ arrow.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\alerts\ alerts.exe
C:\Documents and Settings\LocalService\Local Settings\ Local Settings.exe
C:\Documents and Settings\LocalService\Cookies\ Cookies.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\ Microsoft.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\ Application Data.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\ CTLs.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\ My.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\ SystemCertificates.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\ CRLs.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\ Certificates.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\ Temporary Internet Files.exe
C:\Documents and Settings\LocalService\Local Settings\Temp\ Temp.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\ BGGTYMH1.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\ Content.IE5.exe
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\ History.IE5.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\ S-1-5-19.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\ Credentials.exe
C:\Documents and Settings\LocalService\Local Settings\History\ History.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\ Windows.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\ Media Player.exe
C:\Documents and Settings\Default User\Start Menu\Programs\ Programs.exe
C:\Documents and Settings\Default User\Start Menu\ Start Menu.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\ Accessibility.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\ Accessories.exe
C:\Documents and Settings\Default User\SendTo\ SendTo.exe
C:\Documents and Settings\Default User\NetHood\ NetHood.exe
C:\Documents and Settings\Default User\My Documents\ My Documents.exe
C:\Documents and Settings\Default User\Recent\ Recent.exe
C:\Documents and Settings\Default User\PrintHood\ PrintHood.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\ Credentials.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\ Microsoft.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\ Internet Explorer.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\ S-1-5-19.exe
C:\Documents and Settings\LocalService\Application Data\ Application Data.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\ Startup.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\ Entertainment.exe
C:\Documents and Settings\LocalService\ LocalService.exe
C:\Documents and Settings\Default User\Templates\ Templates.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\ CJCTQ25G.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\ Content.IE5.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\ Temporary Internet Files.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ KHMHGZ4F.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ 2VAZY7AN.exe
C:\Documents and Settings\NetworkService\Local Settings\Temp\ Temp.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\ Windows.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\ S-1-5-20.exe
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\ History.IE5.exe
C:\Documents and Settings\NetworkService\Local Settings\History\ History.exe
%APPDATA%\Microsoft\ Microsoft.exe
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\ {5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}.exe
%APPDATA%\Microsoft\Credentials\ Credentials.exe
%APPDATA%\Microsoft\Address Book\ Address Book.exe
%APPDATA%\Identities\ Identities.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\ YPORKZYZ.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ U98D4X8H.exe
%APPDATA%\ Application Data.exe
%HOMEPATH%\ %USERNAME%.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\ Credentials.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\ S-1-5-20.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\ Credentials.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\ Media Player.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\ Internet Explorer.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\ Microsoft.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\ MOE00UY1.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\ LBMMC3H3.exe
C:\Documents and Settings\NetworkService\Application Data\ Application Data.exe
C:\Documents and Settings\NetworkService\ NetworkService.exe
C:\Documents and Settings\NetworkService\Local Settings\ Local Settings.exe
C:\Documents and Settings\NetworkService\Cookies\ Cookies.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\ Microsoft.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\ Application Data.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\ CTLs.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\ My.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\ SystemCertificates.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\ CRLs.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\ Certificates.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\ YPORKZYZ.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ Default Pictures.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\ User Account Pictures.exe
%ALLUSERSPROFILE%\Documents\ Documents.exe
%ALLUSERSPROFILE%\Desktop\ Desktop.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\ Pbk.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\ Network.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\ Media Player.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\ Cm.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\ Connections.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\ Sample Pictures.exe
%ALLUSERSPROFILE%\Documents\My Pictures\ My Pictures.exe
%ALLUSERSPROFILE%\DRM\ DRM.exe
%ALLUSERSPROFILE%\Documents\My Videos\ My Videos.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\ 0338E140.exe
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\ My Playlists.exe
%ALLUSERSPROFILE%\Documents\My Music\ My Music.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\ Sample Playlists.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\ Sample Music.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\ Media Index.exe
C:\Documents and Settings\ Documents and Settings.exe
<Current directory>\ af32d3b0.exe
%ALLUSERSPROFILE%\Application Data\ Application Data.exe
%ALLUSERSPROFILE%\ All Users.exe
C:\ .exe
%HOMEPATH%\My Documents\My Music\Jai SiyaRam.exe
%HOMEPATH%\My Documents\My Pictures\taskmgr.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\ Startup.exe
%HOMEPATH%\Start Menu\Programs\Startup\ Startup.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\ S-1-5-18.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\ MachineKeys.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\ HTML Help.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\ Dr Watson.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\ RSA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\ Crypto.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\ Microsoft.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\ MachineKeys.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\ DSS.exe
%ALLUSERSPROFILE%\Favorites\ Favorites.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\ Microsoft.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\ Application Data.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\ Windows Media.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\ Media Player.exe
C:\Documents and Settings\Default User\Local Settings\ Local Settings.exe
C:\Documents and Settings\Default User\Cookies\ Cookies.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\ CTLs.exe
C:\Documents and Settings\Default User\Favorites\ Favorites.exe
C:\Documents and Settings\Default User\Desktop\ Desktop.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ 2VAZY7AN.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\ Content.IE5.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ U98D4X8H.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ KHMHGZ4F.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\ Temporary Internet Files.exe
C:\Documents and Settings\Default User\Local Settings\History\ History.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\ 9.0.exe
C:\Documents and Settings\Default User\Local Settings\Temp\ Temp.exe
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\ History.IE5.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\ CRLs.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\ System Tools.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\ Entertainment.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Games\ Games.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\ Administrative Tools.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\ Communications.exe
%ALLUSERSPROFILE%\Start Menu\Programs\ Programs.exe
%ALLUSERSPROFILE%\Start Menu\ Start Menu.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\ Accessibility.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\ Accessories.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\ SystemCertificates.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\ Media Player.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\ Certificates.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\ My.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\ Internet Explorer.exe
C:\Documents and Settings\Default User\ Default User.exe
%ALLUSERSPROFILE%\Templates\ Templates.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\ Microsoft.exe
C:\Documents and Settings\Default User\Application Data\ Application Data.exe
C:\Far2\Plugins\7-Zip\ 7-Zip.exe
C:\Far2\Plugins\ Plugins.exe
C:\Far2\Plugins\arclite\ arclite.exe
C:\Far2\Plugins\Align\ Align.exe
C:\Far2\FExcept\ FExcept.exe
C:\Far2\Documentation\eng\ eng.exe
C:\Far2\Documentation\ Documentation.exe
C:\Far2\Encyclopedia\ Encyclopedia.exe
C:\Far2\Documentation\rus\ rus.exe
C:\Far2\Plugins\Colorer\hrc\auto\types\ types.exe
C:\Far2\Plugins\Colorer\hrc\auto\ auto.exe
C:\Far2\Plugins\Colorer\hrd\console\ console.exe
C:\Far2\Plugins\Colorer\hrd\ hrd.exe
C:\Far2\Plugins\Colorer\hrc\ hrc.exe
C:\Far2\Plugins\Brackets\ Brackets.exe
C:\Far2\Plugins\AutoWrap\ AutoWrap.exe
C:\Far2\Plugins\Colorer\bin\ bin.exe
C:\Far2\Plugins\Colorer\ Colorer.exe
C:\Far2\Addons\XLat\Russian\ Russian.exe
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\ Accessibility.exe
%HOMEPATH%\Start Menu\Programs\Accessories\ Accessories.exe
%HOMEPATH%\Templates\ Templates.exe
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\ Entertainment.exe
%HOMEPATH%\Start Menu\Programs\ Programs.exe
%HOMEPATH%\Recent\ Recent.exe
%HOMEPATH%\PrintHood\ PrintHood.exe
%HOMEPATH%\Start Menu\ Start Menu.exe
%HOMEPATH%\SendTo\ SendTo.exe
C:\Far2\Addons\SetUp\ SetUp.exe
C:\Far2\Addons\Macros\ Macros.exe
C:\Far2\Addons\XLat\ XLat.exe
C:\Far2\Addons\Shell\ Shell.exe
C:\Far2\Addons\Colors\Default Highlighting\ Default Highlighting.exe
C:\Far2\Addons\ Addons.exe
C:\Far2\ Far2.exe
C:\Far2\Addons\Colors\Custom Highlighting\ Custom Highlighting.exe
C:\Far2\Addons\Colors\ Colors.exe
C:\Far2\Plugins\Colorer\hrd\console\contrib\ contrib.exe
C:\Far2\Plugins\WinSCP\filezilla\ filezilla.exe
C:\Far2\Plugins\WinSCP\fari\ fari.exe
C:\Far2\Plugins\WinSCP\forms\ forms.exe
C:\Far2\Plugins\WinSCP\filezilla\misc\ misc.exe
C:\Far2\Plugins\WinSCP\far\ far.exe
C:\Far2\Plugins\WinSCP\console\ console.exe
C:\Far2\Plugins\WinSCP\components\ components.exe
C:\Far2\Plugins\WinSCP\dragext\ dragext.exe
C:\Far2\Plugins\WinSCP\core\ core.exe
C:\Far2\Plugins\WinSCP\packages\tbx\ tbx.exe
C:\Far2\Plugins\WinSCP\packages\tb2k\ tb2k.exe
C:\Far2\Plugins\WinSCP\putty\ putty.exe
C:\Far2\Plugins\WinSCP\packages\theme\ theme.exe
C:\Far2\Plugins\WinSCP\packages\my\ my.exe
C:\Far2\Plugins\WinSCP\packages\ packages.exe
C:\Far2\Plugins\WinSCP\lib\ lib.exe
C:\Far2\Plugins\WinSCP\packages\filemng\ filemng.exe
C:\Far2\Plugins\WinSCP\packages\dragndrop\ dragndrop.exe
C:\Far2\Plugins\WinSCP\ WinSCP.exe
C:\Far2\Plugins\ExtSearch\keys\ keys.exe
C:\Far2\Plugins\ExtSearch\doc\ doc.exe
C:\Far2\Plugins\ExtSearch\sources\RegExp\ RegExp.exe
C:\Far2\Plugins\ExtSearch\sources\ sources.exe
C:\Far2\Plugins\ExtSearch\ ExtSearch.exe
C:\Far2\Plugins\DrawLine\ DrawLine.exe
C:\Far2\Plugins\Compare\ Compare.exe
C:\Far2\Plugins\EMenu\ EMenu.exe
C:\Far2\Plugins\EditCase\ EditCase.exe
C:\Far2\Plugins\Network\ Network.exe
C:\Far2\Plugins\MacroView\ MacroView.exe
C:\Far2\Plugins\TmpPanel\ TmpPanel.exe
C:\Far2\Plugins\ProcList\ ProcList.exe
C:\Far2\Plugins\HlfViewer\ HlfViewer.exe
C:\Far2\Plugins\FileCase\ FileCase.exe
C:\Far2\Plugins\FarCmds\ FarCmds.exe
C:\Far2\Plugins\FTP\lib\ lib.exe
C:\Far2\Plugins\FTP\ FTP.exe
%HOMEPATH%\NetHood\ NetHood.exe
<LS_APPDATA>\Identities\ Identities.exe
<LS_APPDATA>\ Application Data.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\ Microsoft.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\ {5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}.exe
%HOMEPATH%\Local Settings\ Local Settings.exe
%HOMEPATH%\Desktop\ Desktop.exe
%HOMEPATH%\Cookies\ Cookies.exe
%HOMEPATH%\Favorites\Links\ Links.exe
%HOMEPATH%\Favorites\ Favorites.exe
<LS_APPDATA>\Microsoft\Windows\ Windows.exe
<LS_APPDATA>\Microsoft\Media Player\ Media Player.exe
<LS_APPDATA>\Microsoft\Windows Media\9.0\ 9.0.exe
<LS_APPDATA>\Microsoft\Windows Media\ Windows Media.exe
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\ S-1-5-21-2052111302-484763869-725345543-1003.exe
<LS_APPDATA>\Microsoft\ Microsoft.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\ Outlook Express.exe
<LS_APPDATA>\Microsoft\Credentials\ Credentials.exe
<LS_APPDATA>\Microsoft\CD Burning\ CD Burning.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\ chrome.exe
%APPDATA%\Microsoft\SystemCertificates\My\ My.exe
%APPDATA%\Microsoft\SystemCertificates\ SystemCertificates.exe
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\ CRLs.exe
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\ Certificates.exe
%APPDATA%\Microsoft\MMC\ MMC.exe
%APPDATA%\Microsoft\Internet Explorer\ Internet Explorer.exe
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\ S-1-5-21-2052111302-484763869-725345543-1003.exe
%APPDATA%\Microsoft\Media Player\ Media Player.exe
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\ Quick Launch.exe
%APPDATA%\Mozilla\Firefox\Profiles\ Profiles.exe
%APPDATA%\Mozilla\Firefox\ Firefox.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\ bookmarkbackups.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\ cwdgt0y8.default.exe
%APPDATA%\Mozilla\Extensions\ Extensions.exe
%APPDATA%\Microsoft\Windows\ Windows.exe
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\ CTLs.exe
%APPDATA%\Mozilla\ Mozilla.exe
%APPDATA%\Microsoft\Windows\Themes\ Themes.exe
<LS_APPDATA>\Mozilla\ Mozilla.exe
%TEMP%\ Temp.exe
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\ MSHist012011111020111111.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ Content.IE5.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\ Temporary Internet Files.exe
%HOMEPATH%\Local Settings\History\History.IE5\ History.IE5.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\ startupCache.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\ F.exe
%HOMEPATH%\Local Settings\History\ History.exe
<LS_APPDATA>\VMware\ VMware.exe
%HOMEPATH%\My Documents\My Music\ My Music.exe
%HOMEPATH%\My Documents\Downloads\ Downloads.exe
%HOMEPATH%\My Documents\My Received Files\ My Received Files.exe
%HOMEPATH%\My Documents\My Pictures\ My Pictures.exe
%HOMEPATH%\My Documents\ My Documents.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ KHMHGZ4F.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\ 2VAZY7AN.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\ YPORKZYZ.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\ U98D4X8H.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\ E.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\ 2.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\ 1.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\ 4.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\ 3.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\ 0.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\ Profiles.exe
<LS_APPDATA>\Mozilla\Firefox\ Firefox.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\ Cache.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\ cwdgt0y8.default.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\ B.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\ A.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\ D.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\ C.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\ 9.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\ 6.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\ 5.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\ 8.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\ 7.exe

Network activity:

Connects to:

'www.fa###ook.com':443
'localhost':1035

UDP:

DNS ASK www.fa###ook.com

Miscellaneous:

Searches for the following windows:

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'IEFrame' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial