Trojan.DownLoader29.61957

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Sophos AutoUpdate Monitor' = '%ProgramFiles%\Sophos\AutoUpdate\almon.exe'

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\Sophos AutoUpdate Service] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\Sophos AutoUpdate Service] 'ImagePath' = '"%ProgramFiles%\Sophos\AutoUpdate\ALsvc.exe" '

Modifies file system

Creates the following files

%TEMP%\7zs1.tmp\crt\data.zip
%ProgramFiles%\sophos\autoupdate\defaultconfig\isched.cfg
%ProgramFiles%\sophos\autoupdate\defaultconfig\iupd.cfg
%ProgramFiles%\sophos\autoupdate\sauconfigdll.dll
%ProgramFiles%\sophos\autoupdate\en\alhelp.chm
%ProgramFiles%\sophos\autoupdate\en\almonres.dll
%ProgramFiles%\sophos\autoupdate\en\iconfres.dll
%ProgramFiles%\sophos\autoupdate\en\ilogres.dll
%ProgramFiles%\sophos\autoupdate\en\ischdres.dll
%ProgramFiles%\sophos\autoupdate\en\sharedres.dll
%ProgramFiles%\sophos\autoupdate\fr\alhelp.chm
%ProgramFiles%\sophos\autoupdate\fr\almonres.dll
%ProgramFiles%\sophos\autoupdate\fr\iconfres.dll
%ProgramFiles%\sophos\autoupdate\fr\ilogres.dll
%ProgramFiles%\sophos\autoupdate\fr\ischdres.dll
%ProgramFiles%\sophos\autoupdate\fr\sharedres.dll
%ProgramFiles%\sophos\autoupdate\defaultconfig\imon.cfg
%ProgramFiles%\sophos\autoupdate\singleguiplugin.dll
%ProgramFiles%\sophos\autoupdate\defaultconfig\ilog.cfg
%ProgramFiles%\sophos\autoupdate\defaultconfig\iconn.cfg
%ProgramFiles%\sophos\remote management system\cac.pem
%ProgramFiles%\sophos\remote management system\mrinit.conf
%WINDIR%\installer\149679.mst
%ProgramFiles%\sophos\autoupdate\zh_cn\alhelp.chm
%ProgramFiles%\sophos\autoupdate\zh_cn\almonres.dll
%ProgramFiles%\sophos\autoupdate\zh_cn\iconfres.dll
%ProgramFiles%\sophos\autoupdate\zh_cn\ilogres.dll
%ProgramFiles%\sophos\autoupdate\zh_cn\ischdres.dll
%ProgramFiles%\sophos\autoupdate\zh_cn\sharedres.dll
%ProgramFiles%\sophos\autoupdate\zh_tw\alhelp.chm
%ProgramFiles%\sophos\autoupdate\zh_tw\almonres.dll
%ProgramFiles%\sophos\autoupdate\zh_tw\iconfres.dll
%ProgramFiles%\sophos\autoupdate\zh_tw\ilogres.dll
%ProgramFiles%\sophos\autoupdate\zh_tw\ischdres.dll
%ProgramFiles%\sophos\autoupdate\zh_tw\sharedres.dll
%ProgramFiles%\sophos\autoupdate\defaultconfig\idata.cfg
%TEMP%\avremove.log
%TEMP%\crtdef.cfg
%ProgramFiles%\sophos\autoupdate\de\ilogres.dll
%ProgramFiles%\sophos\autoupdate\cidsync.dll
%ProgramFiles%\sophos\autoupdate\config.dll
%ProgramFiles%\sophos\autoupdate\crypto.dll
%ProgramFiles%\sophos\autoupdate\eecustomactions.dll
%ProgramFiles%\sophos\autoupdate\inetconn.dll
%ProgramFiles%\sophos\autoupdate\instlmgr.dll
%ProgramFiles%\sophos\autoupdate\libcurl.dll
%ProgramFiles%\sophos\autoupdate\libeay32.dll
%ProgramFiles%\sophos\autoupdate\license_agreements.txt
%ProgramFiles%\sophos\autoupdate\logger.dll
%ProgramFiles%\sophos\autoupdate\ps.crl
%ProgramFiles%\sophos\autoupdate\ps_rootca.crt
%ProgramFiles%\sophos\autoupdate\retailer.dll
%ProgramFiles%\sophos\autoupdate\scf.dat
%ProgramFiles%\sophos\autoupdate\de\almonres.dll
%ProgramFiles%\sophos\autoupdate\channelupdater.dll
%ProgramFiles%\sophos\autoupdate\de\iconfres.dll
%ProgramFiles%\sophos\autoupdate\boost_date_time-vc71-mt-1_32.dll
%ProgramFiles%\sophos\autoupdate\de\alhelp.chm
%ProgramFiles%\sophos\autoupdate\de\ischdres.dll
%ProgramFiles%\sophos\autoupdate\de\sharedres.dll
%ProgramFiles%\sophos\autoupdate\it\alhelp.chm
%ProgramFiles%\sophos\autoupdate\it\almonres.dll
%ProgramFiles%\sophos\autoupdate\it\iconfres.dll
%ProgramFiles%\sophos\autoupdate\it\ilogres.dll
%ProgramFiles%\sophos\autoupdate\it\ischdres.dll
%ProgramFiles%\sophos\autoupdate\it\sharedres.dll
%ProgramFiles%\sophos\autoupdate\ja\alhelp.chm
%ProgramFiles%\sophos\autoupdate\ja\almonres.dll
%ProgramFiles%\sophos\autoupdate\ja\iconfres.dll
%ProgramFiles%\sophos\autoupdate\ja\ilogres.dll
%ProgramFiles%\sophos\autoupdate\ja\ischdres.dll
%ProgramFiles%\sophos\autoupdate\ja\sharedres.dll
%ProgramFiles%\sophos\autoupdate\alsvc.exe
%ProgramFiles%\sophos\autoupdate\auadapter.dll
%TEMP%\sophosa\program files\sophos\autoupdate\es\alhelp.chm
%ProgramFiles%\sophos\autoupdate\alupdate.exe
%TEMP%\sophosa\program files\sophos\autoupdate\zh_tw\iconfres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\it\ilogres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\it\ischdres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\it\sharedres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\ja\alhelp.chm
%TEMP%\sophosa\program files\sophos\autoupdate\ja\almonres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\ja\iconfres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\ja\ilogres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\ja\ischdres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\ja\sharedres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\libcurl.dll
%TEMP%\sophosa\program files\sophos\autoupdate\libeay32.dll
%TEMP%\sophosa\program files\sophos\autoupdate\license_agreements.txt
%TEMP%\sophosa\program files\sophos\autoupdate\logger.dll
%TEMP%\sophosa\program files\sophos\autoupdate\mfc71.dll
%TEMP%\sophosa\program files\sophos\autoupdate\msvcp71.dll
%TEMP%\sophosa\program files\sophos\autoupdate\it\iconfres.dll
%TEMP%\crt\psapi.dll
%TEMP%\sophosa\program files\sophos\autoupdate\it\almonres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\ispsheet.dll
%TEMP%\sophosa\program files\sophos\autoupdate\es\iconfres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\es\ilogres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\es\ischdres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\es\sharedres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\fr\alhelp.chm
%TEMP%\sophosa\program files\sophos\autoupdate\fr\almonres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\fr\iconfres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\fr\ilogres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\fr\ischdres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\fr\sharedres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\iconfig.ppi
%TEMP%\sophosa\program files\sophos\autoupdate\ilog.ppi
%TEMP%\sophosa\program files\sophos\autoupdate\inetconn.dll
%TEMP%\sophosa\program files\sophos\autoupdate\instlmgr.dll
%TEMP%\sophosa\program files\sophos\autoupdate\isched.ppi
%TEMP%\sophosa\program files\sophos\autoupdate\it\alhelp.chm
%TEMP%\crt\w9xpopen.exe
%TEMP%\crt\version.txt
%TEMP%\sophosa\program files\sophos\autoupdate\retailer.dll
%TEMP%\sophosa\setup.dll
%TEMP%\sophosa\sophos autoupdate.msi
%TEMP%\sophosa\toplevelcatalogue.dat
%TEMP%\res2.tmp
%TEMP%\res3.tmp
%TEMP%\sophos es setup.log
%TEMP%\crt\avremove.exe
%TEMP%\crt\avremovew.exe
%TEMP%\crt\cidsync.upd
%TEMP%\crt\data.zip
%TEMP%\crt\library.zip
%TEMP%\crt\license_agreements.txt
%TEMP%\crt\manifest.dat
%TEMP%\crt\msvcr71.dll
%TEMP%\sophosa\program files\sophos\autoupdate\ps.crl
%TEMP%\sophosa\program files\sophos\autoupdate\zh_tw\sharedres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\ps_rootca.crt
%TEMP%\sophosa\program files\sophos\autoupdate\zh_tw\ischdres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\msvcr71.dll
%TEMP%\sophosa\program files\sophos\autoupdate\sauconfigdll.dll
%TEMP%\sophosa\program files\sophos\autoupdate\scf.dat
%TEMP%\sophosa\program files\sophos\autoupdate\singleguiplugin.dll
%TEMP%\sophosa\program files\sophos\autoupdate\swlocale.dll
%TEMP%\sophosa\program files\sophos\autoupdate\xmlcpp.dll
%TEMP%\sophosa\program files\sophos\autoupdate\xmlparse.dll
%TEMP%\sophosa\program files\sophos\autoupdate\xmltok.dll
%TEMP%\sophosa\program files\sophos\autoupdate\zh_cn\alhelp.chm
%TEMP%\sophosa\program files\sophos\autoupdate\zh_cn\almonres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\zh_cn\iconfres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\zh_cn\ilogres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\zh_cn\ischdres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\zh_cn\sharedres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\zh_tw\alhelp.chm
%TEMP%\sophosa\program files\sophos\autoupdate\zh_tw\almonres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\zh_tw\ilogres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\es\almonres.dll
%ProgramFiles%\sophos\autoupdate\swlocale.dll
%ProgramFiles%\sophos\autoupdate\almon.exe
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\libeay32.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\license_agreements.txt
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\logger.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\mfc71.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\msvcp71.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\msvcr71.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\ps.crl
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\ps_rootca.crt
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\retailer.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\sauconfigdll.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\scf.dat
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\singleguiplugin.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\swlocale.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\xmlcpp.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\xmlparse.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\libcurl.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\fr\ischdres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\ja\sharedres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\ja\ilogres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\iconfig.ppi
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\ilog.ppi
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\inetconn.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\instlmgr.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\isched.ppi
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\ispsheet.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\it\alhelp.chm
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\it\almonres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\it\iconfres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\it\ilogres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\it\ischdres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\it\sharedres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\ja\alhelp.chm
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\ja\almonres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\ja\iconfres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\ja\ischdres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\fr\sharedres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\xmltok.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\zh_cn\ilogres.dll
%WINDIR%\temp\sophos_autoupdate1.dir\sharedres.dll
%WINDIR%\temp\sophos_autoupdate1.dir\libcurl.dll
%WINDIR%\temp\sophos_autoupdate1.dir\libeay32.dll
%WINDIR%\temp\sophos_autoupdate1.dir\ps.crl
%WINDIR%\temp\sophos_autoupdate1.dir\ps_rootca.crt
%WINDIR%\temp\sophos_autoupdate1.dir\retailer.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\fr\iconfres.dll
%WINDIR%\temp\sophos_autoupdate1.dir\scf.dat
%WINDIR%\temp\sophos_autoupdate1.dir\xmlparse.dll
%WINDIR%\temp\sophos_autoupdate1.dir\xmltok.dll
%ProgramFiles%\sophos\autoupdate\logs\alupdate20190807t212746.6958160.log
%ProgramFiles%\sophos\autoupdate\logs\alc.hdr
%ProgramFiles%\sophos\autoupdate\logs\alc.log
%ProgramFiles%\sophos\autoupdate\cache\sau\cidsync.upd
%WINDIR%\temp\sophos_autoupdate1.dir\boost_date_time-vc71-mt-1_32.dll
%WINDIR%\temp\sophos_autoupdate1.dir\crypto.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\zh_cn\almonres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\zh_cn\alhelp.chm
%WINDIR%\temp\sophos_autoupdate1.dir\cidsync.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\zh_cn\ischdres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\zh_cn\sharedres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\zh_tw\alhelp.chm
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\zh_tw\almonres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\zh_tw\iconfres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\zh_tw\ilogres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\zh_tw\ischdres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\zh_tw\sharedres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\setup.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\toplevelcatalogue.dat
%ProgramFiles%\sophos\autoupdate\config\toplevelcatalogue.dat
%WINDIR%\temp\sophos_autoupdate1.dir\alupdate.exe
%WINDIR%\temp\sophos_autoupdate1.dir\channelupdater.dll
%WINDIR%\temp\sophos_autoupdate1.dir\msvcp71.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\zh_cn\iconfres.dll
%WINDIR%\temp\sophos_autoupdate1.dir\msvcr71.dll
%ProgramFiles%\sophos\autoupdate\xmlparse.dll
%ProgramFiles%\sophos\autoupdate\xmlcpp.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\fr\almonres.dll
%ProgramFiles%\sophos\autoupdate\config\iupd.cfg
%ProgramFiles%\sophos\autoupdate\data\machine_id.txt
%WINDIR%\installer\{15c418eb-7675-42be-b2b3-281952da014d}\arpproducticon.exe
%WINDIR%\installer\{15c418eb-7675-42be-b2b3-281952da014d}\1033.mst
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\1028.mst
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\1031.mst
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\1033.mst
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\1034.mst
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\1036.mst
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\1040.mst
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\1041.mst
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\2052.mst
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\3076.mst
%ProgramFiles%\sophos\autoupdate\config\ilog.cfg
%ProgramFiles%\sophos\autoupdate\config\idata.cfg
%ProgramFiles%\sophos\autoupdate\config\isched.cfg
%ProgramFiles%\sophos\autoupdate\config\imon.cfg
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\cidsync.upd
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\fr\iconfres.dll
%ProgramFiles%\sophos\autoupdate\almon.exe.manifest
%ProgramFiles%\sophos\autoupdate\iconfig.ppi
%ProgramFiles%\sophos\autoupdate\ilog.ppi
%ProgramFiles%\sophos\autoupdate\isched.ppi
%ProgramFiles%\sophos\autoupdate\ispsheet.dll
%ProgramFiles%\sophos\autoupdate\mfc71.dll
%ProgramFiles%\sophos\autoupdate\msvcp71.dll
%ProgramFiles%\sophos\autoupdate\msvcr71.dll
%ProgramFiles%\sophos\autoupdate\es\alhelp.chm
%ProgramFiles%\sophos\autoupdate\es\almonres.dll
%ProgramFiles%\sophos\autoupdate\es\iconfres.dll
%ProgramFiles%\sophos\autoupdate\es\ilogres.dll
%ProgramFiles%\sophos\autoupdate\es\ischdres.dll
%ProgramFiles%\sophos\autoupdate\config\iconn.cfg
%ProgramFiles%\sophos\autoupdate\xmltok.dll
%ProgramFiles%\sophos\autoupdate\es\sharedres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\fr\ilogres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\commonappdata\sophos\autoupdate\defaultconfig\iconn.cfg
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\commonappdata\sophos\autoupdate\defaultconfig\isched.cfg
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\en\alhelp.chm
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\en\almonres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\en\iconfres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\en\ilogres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\en\ischdres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\en\sharedres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\es\alhelp.chm
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\es\almonres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\es\iconfres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\es\ilogres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\es\ischdres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\es\sharedres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\fr\alhelp.chm
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\de\ischdres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\de\ilogres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\eecustomactions.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\de\sharedres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\commonappdata\sophos\autoupdate\defaultconfig\idata.cfg
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\commonappdata\sophos\autoupdate\defaultconfig\ilog.cfg
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\commonappdata\sophos\autoupdate\defaultconfig\iupd.cfg
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\manifest.dat
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\almon.exe
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\almon.exe.manifest
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\alsvc.exe
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\alupdate.exe
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\auadapter.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\boost_date_time-vc71-mt-1_32.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\channelupdater.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\cidsync.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\config.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\crypto.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\de\alhelp.chm
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\de\iconfres.dll
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\commonappdata\sophos\autoupdate\defaultconfig\imon.cfg
%TEMP%\sophos_{9bf40a4e-23ae-48be-9974-5a1f261dbee8}\program files\sophos\autoupdate\de\almonres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\en\sharedres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\en\ischdres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\en\ilogres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\es\ischdres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\fr\ischdres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\ispsheet.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\libcurl.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\libeay32.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\logger.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\mfc71.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\msvcp71.dll
%TEMP%\7zs1.tmp\crt\msvcr71.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\msvcr71.dll
%TEMP%\7zs1.tmp\crt\psapi.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\retailer.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\sauconfigdll.dll
%TEMP%\7zs1.tmp\sau\setup.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\it\ischdres.dll
%TEMP%\7zs1.tmp\setupchs.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_tw\ischdres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\ja\ischdres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\en\iconfres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\de\iconfres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\es\iconfres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\fr\iconfres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_cn\ilogres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_tw\ilogres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\de\ilogres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\ja\ilogres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\it\ilogres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\en\ilogres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\es\ilogres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\fr\ilogres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\inetconn.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\instlmgr.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\de\ischdres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_cn\ischdres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\it\iconfres.dll
%TEMP%\cid_packager_temp\mrinit.conf
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_tw\iconfres.dll
%TEMP%\cid_packager_temp\crt\avremove.exe
%TEMP%\cid_packager_temp\crt\avremovew.exe
%TEMP%\cid_packager_temp\crt\cidsync.upd
%TEMP%\cid_packager_temp\crt\data.zip
%TEMP%\cid_packager_temp\crt\library.zip
%TEMP%\cid_packager_temp\crt\license_agreements.txt
%TEMP%\cid_packager_temp\crt\manifest.dat
%TEMP%\cid_packager_temp\crt\msvcr71.dll
%TEMP%\cid_packager_temp\crt\psapi.dll
%TEMP%\cid_packager_temp\crt\version.txt
%TEMP%\cid_packager_temp\crt\w9xpopen.exe
%TEMP%\cid_packager_temp\customer_id.txt
%TEMP%\cid_packager_temp\escdp.dat
%TEMP%\cid_packager_temp\instmsiw.exe
%TEMP%\cid_packager_temp\master.upd
%TEMP%\cid_packager_temp\cidsync.upd
%TEMP%\7zs1.tmp\setupdeu.dll
%TEMP%\7zs1.tmp\setupcht.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\xmlparse.dll
%TEMP%\7zs1.tmp\setupesp.dll
%TEMP%\7zs1.tmp\setupfra.dll
%TEMP%\7zs1.tmp\setupita.dll
%TEMP%\7zs1.tmp\setupjpn.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_cn\sharedres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_tw\sharedres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\ja\sharedres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\it\sharedres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\de\sharedres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\en\sharedres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\es\sharedres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\fr\sharedres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\singleguiplugin.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\swlocale.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\xmlcpp.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\xmltok.dll
%TEMP%\7zs1.tmp\setupenu.dll
%TEMP%\cid_packager_temp\cac.pem
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\ja\iconfres.dll
%TEMP%\7zs1.tmp\setup.exe
%TEMP%\7zs1.tmp\sau\commonappdata\sophos\autoupdate\defaultconfig\imon.cfg
%TEMP%\7zs1.tmp\sau\commonappdata\sophos\autoupdate\defaultconfig\isched.cfg
%TEMP%\7zs1.tmp\sau\commonappdata\sophos\autoupdate\defaultconfig\iupd.cfg
%TEMP%\7zs1.tmp\mrinit.conf
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\ps.crl
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\ps_rootca.crt
%TEMP%\7zs1.tmp\escdp.dat
%TEMP%\7zs1.tmp\sau\manifest.dat
%TEMP%\7zs1.tmp\crt\manifest.dat
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\scf.dat
%TEMP%\7zs1.tmp\sau\toplevelcatalogue.dat
%TEMP%\7zs1.tmp\sau\1028.mst
%TEMP%\7zs1.tmp\sau\1031.mst
%TEMP%\7zs1.tmp\sau\1033.mst
%TEMP%\7zs1.tmp\sau\commonappdata\sophos\autoupdate\defaultconfig\idata.cfg
%TEMP%\7zs1.tmp\sau\1034.mst
%TEMP%\7zs1.tmp\sau\commonappdata\sophos\autoupdate\defaultconfig\iconn.cfg
%TEMP%\7zs1.tmp\crt\license_agreements.txt
%TEMP%\7zs1.tmp\crt\library.zip
%TEMP%\7zs1.tmp\sau\sophos autoupdate.msi
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\it\alhelp.chm
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\ja\alhelp.chm
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_tw\alhelp.chm
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_cn\alhelp.chm
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\de\alhelp.chm
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\en\alhelp.chm
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\fr\alhelp.chm
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\es\alhelp.chm
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\almon.exe.manifest
%TEMP%\7zs1.tmp\sdf.xml
%TEMP%\7zs1.tmp\setup.vbs
%TEMP%\7zs1.tmp\customer_id.txt
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\license_agreements.txt
%TEMP%\7zs1.tmp\crt\version.txt
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_cn\iconfres.dll
%TEMP%\cid_packager_temp\root.upd
%TEMP%\7zs1.tmp\sau\commonappdata\sophos\autoupdate\defaultconfig\ilog.cfg
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_cn\almonres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_tw\almonres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\ja\almonres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\de\almonres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\it\almonres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\en\almonres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\fr\almonres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\es\almonres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\auadapter.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\boost_date_time-vc71-mt-1_32.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\channelupdater.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\cidsync.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\config.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\crypto.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\eecustomactions.dll
%TEMP%\7zs1.tmp\crt\w9xpopen.exe
%TEMP%\7zs1.tmp\sau\1040.mst
%TEMP%\7zs1.tmp\sau\1036.mst
%TEMP%\7zs1.tmp\crt\avremovew.exe
%TEMP%\7zs1.tmp\sau\2052.mst
%TEMP%\7zs1.tmp\sau\3076.mst
%TEMP%\7zs1.tmp\cac.pem
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\iconfig.ppi
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\ilog.ppi
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\isched.ppi
%TEMP%\7zs1.tmp\cidsync.upd
%TEMP%\7zs1.tmp\crt\cidsync.upd
%TEMP%\7zs1.tmp\sau\cidsync.upd
%TEMP%\7zs1.tmp\master.upd
%TEMP%\7zs1.tmp\root.upd
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\almon.exe
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\alsvc.exe
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\alupdate.exe
%TEMP%\7zs1.tmp\crt\avremove.exe
%TEMP%\7zs1.tmp\instmsiw.exe
%TEMP%\7zs1.tmp\sau\1041.mst
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\en\ischdres.dll
%TEMP%\cid_packager_temp\sau\1028.mst
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\zh_tw\sharedres.dll
%TEMP%\cid_packager_temp\sau\sophos autoupdate.msi
%TEMP%\cid_packager_temp\sau\toplevelcatalogue.dat
%TEMP%\cid_packager_temp\sdf.xml
%TEMP%\cid_packager_temp\setup.exe
%TEMP%\cid_packager_temp\setup.vbs
%TEMP%\cid_packager_temp\setupchs.dll
%TEMP%\cid_packager_temp\setupcht.dll
%TEMP%\cid_packager_temp\setupdeu.dll
%TEMP%\cid_packager_temp\setupenu.dll
%TEMP%\cid_packager_temp\setupesp.dll
%TEMP%\cid_packager_temp\setupfra.dll
%TEMP%\cid_packager_temp\setupita.dll
%TEMP%\cid_packager_temp\setupjpn.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\zh_tw\ischdres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\zh_tw\ilogres.dll
%TEMP%\cid_packager_temp\sau\setup.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\msvcr71.dll
%TEMP%\setupenu.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\ps_rootca.crt
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\scf.dat
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\singleguiplugin.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\swlocale.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\xmlcpp.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\xmlparse.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\xmltok.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\zh_cn\alhelp.chm
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\zh_cn\almonres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\zh_cn\iconfres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\zh_cn\ilogres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\zh_cn\ischdres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\zh_cn\sharedres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\zh_tw\alhelp.chm
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\zh_tw\iconfres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\retailer.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\zh_tw\almonres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\sauconfigdll.dll
%TEMP%\sophosa\1028.mst
%TEMP%\sophosa\1036.mst
%TEMP%\sophosa\program files\sophos\autoupdate\cidsync.dll
%TEMP%\sophosa\program files\sophos\autoupdate\config.dll
%TEMP%\sophosa\program files\sophos\autoupdate\crypto.dll
%TEMP%\sophosa\program files\sophos\autoupdate\de\alhelp.chm
%TEMP%\sophosa\program files\sophos\autoupdate\de\almonres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\de\iconfres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\de\ilogres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\de\ischdres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\de\sharedres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\eecustomactions.dll
%TEMP%\sophosa\program files\sophos\autoupdate\en\alhelp.chm
%TEMP%\sophosa\program files\sophos\autoupdate\en\almonres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\en\iconfres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\auadapter.dll
%TEMP%\sophosa\program files\sophos\autoupdate\alupdate.exe
%TEMP%\sophosa\program files\sophos\autoupdate\channelupdater.dll
%TEMP%\sophosa\program files\sophos\autoupdate\boost_date_time-vc71-mt-1_32.dll
%TEMP%\sophosa\1031.mst
%TEMP%\sophosa\1033.mst
%TEMP%\sophosa\1040.mst
%TEMP%\sophosa\1041.mst
%TEMP%\sophosa\2052.mst
%TEMP%\sophosa\3076.mst
%TEMP%\sophosa\cidsync.upd
%TEMP%\sophosa\commonappdata\sophos\autoupdate\defaultconfig\iconn.cfg
%TEMP%\sophosa\commonappdata\sophos\autoupdate\defaultconfig\idata.cfg
%TEMP%\sophosa\commonappdata\sophos\autoupdate\defaultconfig\ilog.cfg
%TEMP%\sophosa\commonappdata\sophos\autoupdate\defaultconfig\imon.cfg
%TEMP%\sophosa\commonappdata\sophos\autoupdate\defaultconfig\isched.cfg
%TEMP%\sophosa\commonappdata\sophos\autoupdate\defaultconfig\iupd.cfg
%TEMP%\sophosa\manifest.dat
%TEMP%\sophosa\program files\sophos\autoupdate\almon.exe
%TEMP%\sophosa\program files\sophos\autoupdate\alsvc.exe
%TEMP%\sophosa\1034.mst
%TEMP%\sophosa\program files\sophos\autoupdate\almon.exe.manifest
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\ps.crl
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\msvcp71.dll
%TEMP%\cid_packager_temp\sau\1031.mst
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\boost_date_time-vc71-mt-1_32.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\channelupdater.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\cidsync.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\config.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\crypto.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\de\alhelp.chm
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\de\almonres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\de\iconfres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\de\ilogres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\de\ischdres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\de\sharedres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\eecustomactions.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\en\alhelp.chm
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\en\almonres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\alupdate.exe
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\en\iconfres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\alsvc.exe
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\almon.exe
%TEMP%\cid_packager_temp\sau\1033.mst
%TEMP%\cid_packager_temp\sau\1034.mst
%TEMP%\cid_packager_temp\sau\1036.mst
%TEMP%\cid_packager_temp\sau\1040.mst
%TEMP%\cid_packager_temp\sau\1041.mst
%TEMP%\cid_packager_temp\sau\2052.mst
%TEMP%\cid_packager_temp\sau\3076.mst
%TEMP%\cid_packager_temp\sau\cidsync.upd
%TEMP%\cid_packager_temp\sau\commonappdata\sophos\autoupdate\defaultconfig\iconn.cfg
%TEMP%\cid_packager_temp\sau\commonappdata\sophos\autoupdate\defaultconfig\idata.cfg
%TEMP%\cid_packager_temp\sau\commonappdata\sophos\autoupdate\defaultconfig\ilog.cfg
%TEMP%\cid_packager_temp\sau\commonappdata\sophos\autoupdate\defaultconfig\imon.cfg
%TEMP%\cid_packager_temp\sau\commonappdata\sophos\autoupdate\defaultconfig\isched.cfg
%TEMP%\cid_packager_temp\sau\commonappdata\sophos\autoupdate\defaultconfig\iupd.cfg
%TEMP%\cid_packager_temp\sau\manifest.dat
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\almon.exe.manifest
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\en\ilogres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\auadapter.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\en\ischdres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\it\iconfres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\it\ischdres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\it\sharedres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\ja\alhelp.chm
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\ja\almonres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\ja\iconfres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\ja\ilogres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\ja\ischdres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\ja\sharedres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\libcurl.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\libeay32.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\license_agreements.txt
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\logger.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\mfc71.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\it\almonres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\ispsheet.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\it\ilogres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\it\alhelp.chm
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\isched.ppi
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\en\sharedres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\es\almonres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\es\iconfres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\es\ilogres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\es\ischdres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\es\sharedres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\fr\alhelp.chm
%ProgramFiles%\sophos\autoupdate\cache\sau.map
%WINDIR%\temp\sophos_autoupdate1.dir\xmlcpp.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\fr\almonres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\fr\ischdres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\fr\sharedres.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\iconfig.ppi
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\ilog.ppi
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\inetconn.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\instlmgr.dll
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\es\alhelp.chm
%TEMP%\cid_packager_temp\sau\program files\sophos\autoupdate\fr\ilogres.dll
%ProgramFiles%\sophos\autoupdate\machine_id.txt

Deletes the following files

%TEMP%\res3.tmp
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\config.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\crypto.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\de\alhelp.chm
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\de\almonres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\de\iconfres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\de\ilogres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\de\ischdres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\de\sharedres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\eecustomactions.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\en\alhelp.chm
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\en\almonres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\en\iconfres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\en\ischdres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\fr\sharedres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\en\sharedres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\es\alhelp.chm
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\es\almonres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\es\iconfres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\es\ilogres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\es\ischdres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\es\sharedres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\fr\alhelp.chm
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\fr\almonres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\fr\iconfres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\fr\ilogres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\fr\ischdres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\cidsync.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\en\ilogres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\channelupdater.dll
%TEMP%\7zs1.tmp\sau\2052.mst
%TEMP%\7zs1.tmp\escdp.dat
%TEMP%\7zs1.tmp\instmsiw.exe
%TEMP%\7zs1.tmp\master.upd
%TEMP%\7zs1.tmp\mrinit.conf
%TEMP%\7zs1.tmp\root.upd
%TEMP%\7zs1.tmp\sau\1028.mst
%TEMP%\7zs1.tmp\sau\1031.mst
%TEMP%\7zs1.tmp\sau\1033.mst
%TEMP%\7zs1.tmp\sau\1034.mst
%TEMP%\7zs1.tmp\sau\1036.mst
%TEMP%\7zs1.tmp\sau\1040.mst
%TEMP%\7zs1.tmp\sau\1041.mst
%TEMP%\7zs1.tmp\sau\3076.mst
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\auadapter.dll
%TEMP%\7zs1.tmp\sau\cidsync.upd
%TEMP%\7zs1.tmp\sau\commonappdata\sophos\autoupdate\defaultconfig\iconn.cfg
%TEMP%\7zs1.tmp\sau\commonappdata\sophos\autoupdate\defaultconfig\idata.cfg
%TEMP%\7zs1.tmp\sau\commonappdata\sophos\autoupdate\defaultconfig\ilog.cfg
%TEMP%\7zs1.tmp\sau\commonappdata\sophos\autoupdate\defaultconfig\imon.cfg
%TEMP%\7zs1.tmp\sau\commonappdata\sophos\autoupdate\defaultconfig\isched.cfg
%TEMP%\7zs1.tmp\sau\commonappdata\sophos\autoupdate\defaultconfig\iupd.cfg
%TEMP%\7zs1.tmp\sau\manifest.dat
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\almon.exe
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\almon.exe.manifest
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\alsvc.exe
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\alupdate.exe
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\boost_date_time-vc71-mt-1_32.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\ja\ischdres.dll
%TEMP%\7zs1.tmp\setupita.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\inetconn.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\xmlparse.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\xmltok.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_cn\alhelp.chm
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_cn\almonres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_cn\iconfres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_cn\ilogres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_cn\ischdres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_cn\sharedres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_tw\alhelp.chm
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_tw\almonres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_tw\iconfres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_tw\ilogres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_tw\sharedres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\ilog.ppi
%TEMP%\7zs1.tmp\sau\setup.dll
%TEMP%\7zs1.tmp\sau\sophos autoupdate.msi
%TEMP%\7zs1.tmp\sau\toplevelcatalogue.dat
%TEMP%\7zs1.tmp\sdf.xml
%TEMP%\7zs1.tmp\setup.exe
%TEMP%\7zs1.tmp\setup.vbs
%TEMP%\7zs1.tmp\setupchs.dll
%TEMP%\7zs1.tmp\setupcht.dll
%TEMP%\7zs1.tmp\setupdeu.dll
%TEMP%\7zs1.tmp\setupenu.dll
%TEMP%\7zs1.tmp\setupesp.dll
%TEMP%\7zs1.tmp\setupfra.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\xmlcpp.dll
%TEMP%\7zs1.tmp\customer_id.txt
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\swlocale.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\ja\ilogres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\instlmgr.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\isched.ppi
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\ispsheet.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\it\alhelp.chm
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\it\almonres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\it\iconfres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\it\ilogres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\it\ischdres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\it\sharedres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\ja\alhelp.chm
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\ja\almonres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\ja\iconfres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\iconfig.ppi
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\scf.dat
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\ja\sharedres.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\libcurl.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\libeay32.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\license_agreements.txt
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\logger.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\mfc71.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\msvcp71.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\msvcr71.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\ps.crl
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\ps_rootca.crt
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\retailer.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\sauconfigdll.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\singleguiplugin.dll
%TEMP%\7zs1.tmp\sau\program files\sophos\autoupdate\zh_tw\ischdres.dll
%TEMP%\7zs1.tmp\crt\w9xpopen.exe
%TEMP%\sophosa\setup.dll
%TEMP%\sophosa\program files\sophos\autoupdate\de\alhelp.chm
%TEMP%\sophosa\program files\sophos\autoupdate\de\almonres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\de\iconfres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\de\ilogres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\de\ischdres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\de\sharedres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\eecustomactions.dll
%TEMP%\sophosa\program files\sophos\autoupdate\en\alhelp.chm
%TEMP%\sophosa\program files\sophos\autoupdate\en\almonres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\en\iconfres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\en\ilogres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\en\ischdres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\es\alhelp.chm
%TEMP%\sophosa\program files\sophos\autoupdate\ilog.ppi
%TEMP%\sophosa\program files\sophos\autoupdate\es\almonres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\es\iconfres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\es\ilogres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\es\ischdres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\es\sharedres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\fr\alhelp.chm
%TEMP%\sophosa\program files\sophos\autoupdate\fr\almonres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\fr\iconfres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\fr\ilogres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\fr\ischdres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\fr\sharedres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\iconfig.ppi
%TEMP%\sophosa\program files\sophos\autoupdate\crypto.dll
%TEMP%\sophosa\program files\sophos\autoupdate\en\sharedres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\config.dll
%TEMP%\sophosa\cidsync.upd
%TEMP%\res2.tmp
%TEMP%\crtdef.cfg
%WINDIR%\installer\149679.mst
%TEMP%\sophosa\1028.mst
%TEMP%\sophosa\1031.mst
%TEMP%\sophosa\1033.mst
%TEMP%\sophosa\1034.mst
%TEMP%\sophosa\1036.mst
%TEMP%\sophosa\1040.mst
%TEMP%\sophosa\1041.mst
%TEMP%\sophosa\2052.mst
%TEMP%\sophosa\3076.mst
%TEMP%\sophosa\commonappdata\sophos\autoupdate\defaultconfig\iconn.cfg
%TEMP%\sophosa\program files\sophos\autoupdate\channelupdater.dll
%TEMP%\sophosa\commonappdata\sophos\autoupdate\defaultconfig\idata.cfg
%TEMP%\sophosa\commonappdata\sophos\autoupdate\defaultconfig\ilog.cfg
%TEMP%\sophosa\commonappdata\sophos\autoupdate\defaultconfig\imon.cfg
%TEMP%\sophosa\commonappdata\sophos\autoupdate\defaultconfig\isched.cfg
%TEMP%\sophosa\commonappdata\sophos\autoupdate\defaultconfig\iupd.cfg
%TEMP%\sophosa\manifest.dat
%TEMP%\sophosa\program files\sophos\autoupdate\almon.exe
%TEMP%\sophosa\program files\sophos\autoupdate\almon.exe.manifest
%TEMP%\sophosa\program files\sophos\autoupdate\alsvc.exe
%TEMP%\sophosa\program files\sophos\autoupdate\alupdate.exe
%TEMP%\sophosa\program files\sophos\autoupdate\auadapter.dll
%TEMP%\sophosa\program files\sophos\autoupdate\boost_date_time-vc71-mt-1_32.dll
%TEMP%\sophosa\program files\sophos\autoupdate\cidsync.dll
%TEMP%\sophosa\program files\sophos\autoupdate\libcurl.dll
%TEMP%\7zs1.tmp\crt\psapi.dll
%TEMP%\sophosa\program files\sophos\autoupdate\isched.ppi
%TEMP%\sophosa\program files\sophos\autoupdate\zh_cn\alhelp.chm
%TEMP%\sophosa\program files\sophos\autoupdate\zh_cn\almonres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\zh_cn\iconfres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\zh_cn\ilogres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\zh_cn\ischdres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\zh_cn\sharedres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\zh_tw\alhelp.chm
%TEMP%\sophosa\program files\sophos\autoupdate\zh_tw\almonres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\zh_tw\iconfres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\zh_tw\ilogres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\zh_tw\ischdres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\zh_tw\sharedres.dll
%TEMP%\sophosa\sophos autoupdate.msi
%TEMP%\sophosa\program files\sophos\autoupdate\instlmgr.dll
%TEMP%\sophosa\toplevelcatalogue.dat
%TEMP%\setupenu.dll
%TEMP%\7zs1.tmp\cac.pem
%TEMP%\7zs1.tmp\cidsync.upd
%TEMP%\7zs1.tmp\crt\avremove.exe
%TEMP%\7zs1.tmp\crt\avremovew.exe
%TEMP%\7zs1.tmp\crt\cidsync.upd
%TEMP%\7zs1.tmp\crt\data.zip
%TEMP%\7zs1.tmp\crt\library.zip
%TEMP%\7zs1.tmp\crt\license_agreements.txt
%TEMP%\7zs1.tmp\crt\manifest.dat
%TEMP%\7zs1.tmp\crt\msvcr71.dll
%TEMP%\sophosa\program files\sophos\autoupdate\xmltok.dll
%TEMP%\7zs1.tmp\crt\version.txt
%TEMP%\sophosa\program files\sophos\autoupdate\xmlparse.dll
%TEMP%\sophosa\program files\sophos\autoupdate\ja\sharedres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\ispsheet.dll
%TEMP%\sophosa\program files\sophos\autoupdate\it\alhelp.chm
%TEMP%\sophosa\program files\sophos\autoupdate\it\almonres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\it\iconfres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\it\ilogres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\it\ischdres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\it\sharedres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\ja\alhelp.chm
%TEMP%\sophosa\program files\sophos\autoupdate\ja\almonres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\ja\iconfres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\ja\ilogres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\ja\ischdres.dll
%TEMP%\sophosa\program files\sophos\autoupdate\inetconn.dll
%TEMP%\sophosa\program files\sophos\autoupdate\swlocale.dll
%TEMP%\sophosa\program files\sophos\autoupdate\libeay32.dll
%TEMP%\sophosa\program files\sophos\autoupdate\license_agreements.txt
%TEMP%\sophosa\program files\sophos\autoupdate\logger.dll
%TEMP%\sophosa\program files\sophos\autoupdate\mfc71.dll
%TEMP%\sophosa\program files\sophos\autoupdate\msvcp71.dll
%TEMP%\sophosa\program files\sophos\autoupdate\msvcr71.dll
%TEMP%\sophosa\program files\sophos\autoupdate\ps.crl
%TEMP%\sophosa\program files\sophos\autoupdate\ps_rootca.crt
%TEMP%\sophosa\program files\sophos\autoupdate\retailer.dll
%TEMP%\sophosa\program files\sophos\autoupdate\sauconfigdll.dll
%TEMP%\sophosa\program files\sophos\autoupdate\scf.dat
%TEMP%\sophosa\program files\sophos\autoupdate\singleguiplugin.dll
%TEMP%\sophosa\program files\sophos\autoupdate\xmlcpp.dll
%TEMP%\7zs1.tmp\setupjpn.dll

Moves the following files

from %WINDIR%\installer\{15c418eb-7675-42be-b2b3-281952da014d}\1033.mst to C:\config.msi\14967f.rbf

Substitutes the following files

%WINDIR%\installer\{15c418eb-7675-42be-b2b3-281952da014d}\1033.mst

Network activity

UDP

DNS ASK av###.#ni-hildesheim.de

Miscellaneous

Creates and executes the following

'<SYSTEM32>\wscript.exe' "%TEMP%\7zS1.tmp\setup.vbs"
'%TEMP%\cid_packager_temp\setup.exe' -crt R -ni -mng yes -updp "http://av###.#ni-hildesheim.de/CIDs/S000/SAVSCFXP/" -user savupd -opwd BwiQ1FVnbqNR8wtIwyKU1fNIRlU2h4yOHLo= -g \sophos-sec\Clients\WIN
'%TEMP%\crt\avremovew.exe'
'%ProgramFiles%\sophos\autoupdate\alsvc.exe'
'%ProgramFiles%\sophos\autoupdate\almon.exe' -Embedding
'%WINDIR%\temp\sophos_autoupdate1.dir\alupdate.exe' -Bootstrap -NoGUI -RootPath "%ProgramFiles%\Sophos\AutoUpdate"

Executes the following

'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe' -Embedding E9A443850E49FC8C74B2275CAE4EAE66
'<SYSTEM32>\msiexec.exe' -Embedding B78E5124767DFC15C0F4908186C1DBAA M Global\MSI0000

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial