Trojan.Siggen3.63843

Technical Information

To ensure autorun and distribution:

Substitutes the following executable system files:

<SYSTEM32>\setup.exe with <SYSTEM32>\setup.bmp
<SYSTEM32>\msvbvm60.dll with <SYSTEM32>\Msvbvm60.dll

Creates the following files on removable media:

<Drive name for removable media>:\Msvbvm60.dll
<Drive name for removable media>:\FOUND.007.exe
<Drive name for removable media>:\Autorun.inf

Malicious functions:

Creates and executes the following:

%WINDIR%\AE 0124 BE.exe
<DRIVERS>\winlogon.exe

Executes the following:

<SYSTEM32>\rundll32.exe <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %WINDIR%\AE 0124 BE.jpg

Modifies file system :

Creates the following files:

%WINDIR%\pchealth\helpctr\System\images\Centers\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\images\48x48\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\images\Expando\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\images\32x32\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\blurbs\Msvbvm60.dll
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\images\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\images\24x24\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\images\16x16\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\Msvbvm60.dll
<SYSTEM32>\dllcache\Msvbvm60.dll
<SYSTEM32>\config\systemprofile\Templates\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\Msvbvm60.dll
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Msvbvm60.dll
C:\Autorun.inf
<DRIVERS>\Msvbvm60.dll
C:\FOUND.007.exe
%HOMEPATH%\Recent\AE 0124 BE.lnk
C:\Msvbvm60.dll
%WINDIR%\AE 0124 BE.exe
%WINDIR%\Msvbvm60.dll
%WINDIR%\AE 0124 BE.jpg
<DRIVERS>\winlogon.exe
<Current directory>\Msvbvm60.dll
C:\B1uv3nth3x1.diz
%HOMEPATH%\Recent\WINDOWS.lnk
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\Msvbvm60.dll
%WINDIR%\Media\Msvbvm60.dll
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Msvbvm60.dll
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\Msvbvm60.dll
%WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\chrome\Msvbvm60.dll
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\Msvbvm60.dll
%WINDIR%\Help\Tours\htmlTour\Msvbvm60.dll
%WINDIR%\Cursors\Msvbvm60.dll
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\Msvbvm60.dll
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\Msvbvm60.dll
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Msvbvm60.dll

Sets the 'hidden' attribute to the following files:

%WINDIR%\pchealth\helpctr\System\images\Expando\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\images\Centers\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\images\48x48\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\images\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\blurbs\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\images\16x16\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\images\32x32\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\images\24x24\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\Msvbvm60.dll
<SYSTEM32>\dllcache\Msvbvm60.dll
<SYSTEM32>\config\systemprofile\Templates\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\Msvbvm60.dll
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\Msvbvm60.dll
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Msvbvm60.dll
<Drive name for removable media>:\Autorun.inf
C:\Msvbvm60.dll
<Drive name for removable media>:\FOUND.007.exe
%WINDIR%\Cursors\Msvbvm60.dll
<Drive name for removable media>:\Msvbvm60.dll
C:\FOUND.007.exe
<DRIVERS>\winlogon.exe
%WINDIR%\Msvbvm60.dll
<Current directory>\Msvbvm60.dll
C:\Autorun.inf
<DRIVERS>\Msvbvm60.dll
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Msvbvm60.dll
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\Msvbvm60.dll
%WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\chrome\Msvbvm60.dll
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Msvbvm60.dll
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\Msvbvm60.dll
%WINDIR%\Media\Msvbvm60.dll
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\Msvbvm60.dll
%WINDIR%\Help\Tours\htmlTour\Msvbvm60.dll
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Msvbvm60.dll
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\Msvbvm60.dll
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\Msvbvm60.dll

Moves the following system files:

from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Quit.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Quit.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendChat.gif to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendChat.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Options.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Options.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\hide-chat.gif to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\hide-chat.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\info.gif to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\info.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendFile.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendFile.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\ESC_key.gif to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\ESC_key.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\Helpee_line.gif to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\Helpee_line.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\show-chat.gif to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\show-chat.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendVoice.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendVoice.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendVoiceOn.gif to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendVoiceOn.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\icon_warning_32x.gif to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\icon_warning_32x.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\Animation.gif to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\Animation.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\icon_information_32x.gif to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\icon_information_32x.exe
from %WINDIR%\pchealth\helpctr\System\images\Expando\helpdoc.gif to %WINDIR%\pchealth\helpctr\System\images\Expando\helpdoc.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\ding.wav to %WINDIR%\pchealth\helpctr\System\Remote Assistance\ding.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\combobox_line.gif to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\combobox_line.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\UpArrow.gif to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\UpArrow.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\HelpCenter.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\HelpCenter.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\TakeControl.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\TakeControl.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\connected.gif to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\connected.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\DownArrow.gif to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\DownArrow.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\monitor.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\monitor.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\personalizing.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\personalizing.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\info.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\info.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\GArrow.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\GArrow.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\gears.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\gears.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\PieChart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\PieChart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\r1_c1.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\r1_c1.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\r1_c2.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\r1_c2.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\printer.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\printer.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\PieGrey.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\PieGrey.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\PieWhite.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\PieWhite.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\card.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\card.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\cd.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\cd.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\BArrow.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\BArrow.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\StopControl.bmp to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\StopControl.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\alert.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\alert.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\check.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\check.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\error.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\error.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\floppy.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\floppy.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\drive.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\drive.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\chip.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\chip.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\down.bmp to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\down.exe
from %WINDIR%\pchealth\helpctr\System\images\Expando\expanded.gif to %WINDIR%\pchealth\helpctr\System\images\Expando\expanded.exe
from %WINDIR%\pchealth\helpctr\System\images\icon_onlineinline_12x.bmp to %WINDIR%\pchealth\helpctr\System\images\icon_onlineinline_12x.exe
from %WINDIR%\pchealth\helpctr\System\images\icon_tours_12x.bmp to %WINDIR%\pchealth\helpctr\System\images\icon_tours_12x.exe
from %WINDIR%\pchealth\helpctr\System\images\icon_newwindow_12x.bmp to %WINDIR%\pchealth\helpctr\System\images\icon_newwindow_12x.exe
from %WINDIR%\pchealth\helpctr\System\images\icon_articles_12x.bmp to %WINDIR%\pchealth\helpctr\System\images\icon_articles_12x.exe
from %WINDIR%\pchealth\helpctr\System\images\icon_blank_12x.bmp to %WINDIR%\pchealth\helpctr\System\images\icon_blank_12x.exe
from %WINDIR%\pchealth\helpctr\System\images\icon_tutorials_12x.bmp to %WINDIR%\pchealth\helpctr\System\images\icon_tutorials_12x.exe
from %WINDIR%\pchealth\helpctr\System\images\wrapperhelp.gif to %WINDIR%\pchealth\helpctr\System\images\wrapperhelp.exe
from %WINDIR%\pchealth\helpctr\System\images\16x16\arrow_blue_normal_shadow.bmp to %WINDIR%\pchealth\helpctr\System\images\16x16\arrow_blue_normal_shadow.exe
from %WINDIR%\pchealth\helpctr\System\images\warning.gif to %WINDIR%\pchealth\helpctr\System\images\warning.exe
from %WINDIR%\pchealth\helpctr\System\images\info.gif to %WINDIR%\pchealth\helpctr\System\images\info.exe
from %WINDIR%\pchealth\helpctr\System\images\progbar.gif to %WINDIR%\pchealth\helpctr\System\images\progbar.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\header.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\header.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SplashScreen.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SplashScreen.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\watermark.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\watermark.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\header.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\header.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SplashScreen.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SplashScreen.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\watermark.bmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\watermark.exe
from %WINDIR%\pchealth\helpctr\System\images\flyout_arrow.gif to %WINDIR%\pchealth\helpctr\System\images\flyout_arrow.exe
from %WINDIR%\pchealth\helpctr\System\images\get_conn.gif to %WINDIR%\pchealth\helpctr\System\images\get_conn.exe
from %WINDIR%\pchealth\helpctr\System\images\feedback.gif to %WINDIR%\pchealth\helpctr\System\images\feedback.exe
from %WINDIR%\pchealth\helpctr\System\blurbs\watermark_300x.bmp to %WINDIR%\pchealth\helpctr\System\blurbs\watermark_300x.exe
from %WINDIR%\pchealth\helpctr\System\images\error.gif to %WINDIR%\pchealth\helpctr\System\images\error.exe
from %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_04.bmp to %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_04.exe
from %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_generic.bmp to %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_generic.exe
from %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_03.bmp to %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_03.exe
from %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_01.bmp to %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_01.exe
from %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_02.bmp to %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_02.exe
from %WINDIR%\pchealth\helpctr\System\images\Centers\blue_arrow.gif to %WINDIR%\pchealth\helpctr\System\images\Centers\blue_arrow.exe
from %WINDIR%\pchealth\helpctr\System\images\Expando\collapsed.gif to %WINDIR%\pchealth\helpctr\System\images\Expando\collapsed.exe
from %WINDIR%\pchealth\helpctr\System\images\Expando\endnode.gif to %WINDIR%\pchealth\helpctr\System\images\Expando\endnode.exe
from %WINDIR%\pchealth\helpctr\System\images\Centers\Uabrand.gif to %WINDIR%\pchealth\helpctr\System\images\Centers\Uabrand.exe
from %WINDIR%\pchealth\helpctr\System\images\Centers\Connect.gif to %WINDIR%\pchealth\helpctr\System\images\Centers\Connect.exe
from %WINDIR%\pchealth\helpctr\System\images\Centers\IULogo.gif to %WINDIR%\pchealth\helpctr\System\images\Centers\IULogo.exe
from %WINDIR%\pchealth\helpctr\System\images\16x16\support.bmp to %WINDIR%\pchealth\helpctr\System\images\16x16\support.exe
from %WINDIR%\pchealth\helpctr\System\images\16x16\tools.bmp to %WINDIR%\pchealth\helpctr\System\images\16x16\tools.exe
from %WINDIR%\pchealth\helpctr\System\images\16x16\errmsg.bmp to %WINDIR%\pchealth\helpctr\System\images\16x16\errmsg.exe
from %WINDIR%\pchealth\helpctr\System\images\16x16\arrow_green_normal_shadow.bmp to %WINDIR%\pchealth\helpctr\System\images\16x16\arrow_green_normal_shadow.exe
from %WINDIR%\pchealth\helpctr\System\images\16x16\compat.bmp to %WINDIR%\pchealth\helpctr\System\images\16x16\compat.exe
from %WINDIR%\pchealth\helpctr\System\images\16x16\update.bmp to %WINDIR%\pchealth\helpctr\System\images\16x16\update.exe
from %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_normal.bmp to %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_normal.exe
from %WINDIR%\pchealth\helpctr\System\images\32x32\logo.bmp to %WINDIR%\pchealth\helpctr\System\images\32x32\logo.exe
from %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mouseover.bmp to %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mouseover.exe
from %WINDIR%\pchealth\helpctr\System\images\16x16\warning.gif to %WINDIR%\pchealth\helpctr\System\images\16x16\warning.exe
from %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mousedown.bmp to %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mousedown.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\icon_information_32x.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\icon_information_32x.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\icon_warning_32x.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\icon_warning_32x.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\status_ok.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\status_ok.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\r3_c2.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\r3_c2.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\spacer.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\spacer.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\address_book.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\address_book.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy_attention.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy_attention.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy_away.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy_away.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\arrow.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\arrow.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\attention.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\attention.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\90_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\90_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\95_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\95_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\85_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\85_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\75_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\75_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\80_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\80_chart.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\GArrow.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\GArrow.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\r1_c2.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\r1_c2.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\r1_c3.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\r1_c3.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\r1_c1.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\r1_c1.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\GRect.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\GRect.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Info_Icon.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Info_Icon.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\outlook_express.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\outlook_express.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\square_bullet.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\square_bullet.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\outlook.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\outlook.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\monitor_left.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\monitor_left.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\monitor_right.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\monitor_right.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\check.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\check.exe
from <SYSTEM32>\config\systemprofile\Templates\sndrec.wav to <SYSTEM32>\config\systemprofile\Templates\sndrec.exe
from <SYSTEM32>\dllcache\gm.dls to <SYSTEM32>\dllcache\gm.exe
from <SYSTEM32>\ntimage.gif to <SYSTEM32>\ntimage.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\help.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\help.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreenshot3.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreenshot3.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Envelope.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Envelope.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\floppy.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\floppy.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy_offline.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy_offline.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy_busy.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy_busy.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy_none.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy_none.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\generic_mail.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\generic_mail.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\logon_anim.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\logon_anim.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\messenger_big.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\messenger_big.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\info.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\info.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\icon_extweb.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\icon_extweb.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\IM_icon.gif to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\IM_icon.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\70_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\70_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\30_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\30_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\35_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\35_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\25_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\25_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\15_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\15_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\20_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\20_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\40_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\40_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\5_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\5_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\60_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\60_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\55_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\55_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\45_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\45_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\50_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\50_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\system.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\system.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\Untitled.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\Untitled.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\spacer.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\spacer.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\r1_c3.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\r1_c3.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\r3_c2.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\r3_c2.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\up.bmp to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\up.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\100_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\100_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\10_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\10_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\0_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\0_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\usb.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\usb.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\windows.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\windows.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\35_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\35_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\40_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\40_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\30_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\30_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\20_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\20_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\25_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\25_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\45_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\45_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\60_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\60_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\65_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\65_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\5_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\5_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\50_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\50_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\55_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\55_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\80_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\80_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\85_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\85_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\75_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\75_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\65_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\65_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\70_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\70_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\90_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\90_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\10_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\10_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\15_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\15_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\100_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\100_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\95_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\95_chart.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\0_chart.gif to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\0_chart.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.exe
from %WINDIR%\Help\Tours\htmlTour\nav_start_here.gif to %WINDIR%\Help\Tours\htmlTour\nav_start_here.exe
from %WINDIR%\Help\Tours\htmlTour\nav_start_here_down.gif to %WINDIR%\Help\Tours\htmlTour\nav_start_here_down.exe
from %WINDIR%\Help\Tours\htmlTour\nav_safe_easy_down.gif to %WINDIR%\Help\Tours\htmlTour\nav_safe_easy_down.exe
from %WINDIR%\Help\Tours\htmlTour\nav_gray.gif to %WINDIR%\Help\Tours\htmlTour\nav_gray.exe
from %WINDIR%\Help\Tours\htmlTour\nav_safe_easy.gif to %WINDIR%\Help\Tours\htmlTour\nav_safe_easy.exe
from %WINDIR%\Help\Tours\htmlTour\nav_unlock.gif to %WINDIR%\Help\Tours\htmlTour\nav_unlock.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud2.wav to %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud2.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud3.wav to %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud3.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud1.wav to %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud1.exe
from %WINDIR%\Help\Tours\htmlTour\nav_unlock_down.gif to %WINDIR%\Help\Tours\htmlTour\nav_unlock_down.exe
from %WINDIR%\Help\Tours\htmlTour\spacer.gif to %WINDIR%\Help\Tours\htmlTour\spacer.exe
from %WINDIR%\Cursors\wagtail.ani to %WINDIR%\Cursors\wagtail.exe
from %WINDIR%\Help\Tours\htmlTour\bluearrow.gif to %WINDIR%\Help\Tours\htmlTour\bluearrow.exe
from %WINDIR%\Cursors\vanisher.ani to %WINDIR%\Cursors\vanisher.exe
from %WINDIR%\Cursors\sizewe.ani to %WINDIR%\Cursors\sizewe.exe
from %WINDIR%\Cursors\stopwtch.ani to %WINDIR%\Cursors\stopwtch.exe
from %WINDIR%\Help\Tours\htmlTour\bot_bar.gif to %WINDIR%\Help\Tours\htmlTour\bot_bar.exe
from %WINDIR%\Help\Tours\htmlTour\nav_connected.gif to %WINDIR%\Help\Tours\htmlTour\nav_connected.exe
from %WINDIR%\Help\Tours\htmlTour\nav_connected_down.gif to %WINDIR%\Help\Tours\htmlTour\nav_connected_down.exe
from %WINDIR%\Help\Tours\htmlTour\nav_blank.gif to %WINDIR%\Help\Tours\htmlTour\nav_blank.exe
from %WINDIR%\Help\Tours\htmlTour\nav_best.gif to %WINDIR%\Help\Tours\htmlTour\nav_best.exe
from %WINDIR%\Help\Tours\htmlTour\nav_best_down.gif to %WINDIR%\Help\Tours\htmlTour\nav_best_down.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\cloapph.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\cloapph.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\cnt.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\cnt.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\cloapp.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\cloapp.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\bktr.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\bktr.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\bktrh.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\bktrh.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\cntd.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\cntd.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\taon.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\taon.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\taonh.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\taonh.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\taoffh.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\taoffh.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\cnth.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\cnth.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\taoff.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\taoff.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud7.wav to %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud7.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud8.wav to %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud8.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud6.wav to %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud6.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud4.wav to %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud4.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud5.wav to %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud5.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud9.wav to %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud9.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\videobg.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\videobg.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\vidsamp.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\vidsamp.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\tourbg.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\tourbg.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\mplogo.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\mplogo.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\mplogoh.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\mplogoh.exe
from %WINDIR%\Cursors\sizenwse.ani to %WINDIR%\Cursors\sizenwse.exe
from %WINDIR%\Zapotec.bmp to %WINDIR%\Zapotec.exe
from %WINDIR%\Cursors\appstar2.ani to %WINDIR%\Cursors\appstar2.exe
from %WINDIR%\winnt256.bmp to %WINDIR%\winnt256.exe
from %WINDIR%\Soap Bubbles.bmp to %WINDIR%\Soap Bubbles.exe
from %WINDIR%\winnt.bmp to %WINDIR%\winnt.exe
from %WINDIR%\Cursors\appstar3.ani to %WINDIR%\Cursors\appstar3.exe
from %WINDIR%\Cursors\coin.ani to %WINDIR%\Cursors\coin.exe
from %WINDIR%\Cursors\counter.ani to %WINDIR%\Cursors\counter.exe
from %WINDIR%\Cursors\barber.ani to %WINDIR%\Cursors\barber.exe
from %WINDIR%\Cursors\appstart.ani to %WINDIR%\Cursors\appstart.exe
from %WINDIR%\Cursors\banana.ani to %WINDIR%\Cursors\banana.exe
from %WINDIR%\Coffee Bean.bmp to %WINDIR%\Coffee Bean.exe
from %WINDIR%\FeatherTexture.bmp to %WINDIR%\FeatherTexture.exe
from %WINDIR%\clock.avi to %WINDIR%\clock.exe
from <SYSTEM32>\msvbvm60.dll to <SYSTEM32>\Msvbvm60.dlll
from %WINDIR%\Blue Lace 16.bmp to %WINDIR%\Blue Lace 16.exe
from %WINDIR%\Gone Fishing.bmp to %WINDIR%\Gone Fishing.exe
from %WINDIR%\River Sumida.bmp to %WINDIR%\River Sumida.exe
from %WINDIR%\Santa Fe Stucco.bmp to %WINDIR%\Santa Fe Stucco.exe
from %WINDIR%\Rhododendron.bmp to %WINDIR%\Rhododendron.exe
from %WINDIR%\Greenstone.bmp to %WINDIR%\Greenstone.exe
from %WINDIR%\Prairie Wind.bmp to %WINDIR%\Prairie Wind.exe
from %WINDIR%\Cursors\hourgla3.ani to %WINDIR%\Cursors\hourgla3.exe
from %WINDIR%\Cursors\hourglas.ani to %WINDIR%\Cursors\hourglas.exe
from %WINDIR%\Cursors\hourgla2.ani to %WINDIR%\Cursors\hourgla2.exe
from %WINDIR%\Cursors\handwe.ani to %WINDIR%\Cursors\handwe.exe
from %WINDIR%\Cursors\horse.ani to %WINDIR%\Cursors\horse.exe
from %WINDIR%\Cursors\metronom.ani to %WINDIR%\Cursors\metronom.exe
from %WINDIR%\Cursors\sizenesw.ani to %WINDIR%\Cursors\sizenesw.exe
from %WINDIR%\Cursors\sizens.ani to %WINDIR%\Cursors\sizens.exe
from %WINDIR%\Cursors\raindrop.ani to %WINDIR%\Cursors\raindrop.exe
from %WINDIR%\Cursors\piano.ani to %WINDIR%\Cursors\piano.exe
from %WINDIR%\Cursors\rainbow.ani to %WINDIR%\Cursors\rainbow.exe
from %WINDIR%\Cursors\fillitup.ani to %WINDIR%\Cursors\fillitup.exe
from %WINDIR%\Cursors\hand.ani to %WINDIR%\Cursors\hand.exe
from %WINDIR%\Cursors\drum.ani to %WINDIR%\Cursors\drum.exe
from %WINDIR%\Cursors\dinosau2.ani to %WINDIR%\Cursors\dinosau2.exe
from %WINDIR%\Cursors\dinosaur.ani to %WINDIR%\Cursors\dinosaur.exe
from %WINDIR%\Cursors\handapst.ani to %WINDIR%\Cursors\handapst.exe
from %WINDIR%\Cursors\handnwse.ani to %WINDIR%\Cursors\handnwse.exe
from %WINDIR%\Cursors\handwait.ani to %WINDIR%\Cursors\handwait.exe
from %WINDIR%\Cursors\handns.ani to %WINDIR%\Cursors\handns.exe
from %WINDIR%\Cursors\handnesw.ani to %WINDIR%\Cursors\handnesw.exe
from %WINDIR%\Cursors\handno.ani to %WINDIR%\Cursors\handno.exe
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.exe
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.exe
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.exe
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.exe
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.exe
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.exe
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.exe
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.exe
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.exe
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_1x1.gif to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_1x1.exe
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.exe
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.exe
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.exe
from %WINDIR%\Media\Windows XP Startup.wav to %WINDIR%\Media\Windows XP Startup.exe
from %WINDIR%\Media\Windows XP Shutdown.wav to %WINDIR%\Media\Windows XP Shutdown.exe
from %WINDIR%\Media\Windows XP Start.wav to %WINDIR%\Media\Windows XP Start.exe
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.exe
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.exe
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.exe
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.exe
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.exe
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_1x1.gif to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_1x1.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.exe
from %WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\chrome\chrome.jar to %WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\chrome\chrome.exe
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.exe
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\logo.bmp to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\logo.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.exe
from %WINDIR%\Media\Windows XP Ringout.wav to %WINDIR%\Media\Windows XP Ringout.exe
from %WINDIR%\Media\chord.wav to %WINDIR%\Media\chord.exe
from %WINDIR%\Media\ding.wav to %WINDIR%\Media\ding.exe
from %WINDIR%\Media\chimes.wav to %WINDIR%\Media\chimes.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm8.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm8.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm9.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm9.exe
from %WINDIR%\Media\notify.wav to %WINDIR%\Media\notify.exe
from %WINDIR%\Media\start.wav to %WINDIR%\Media\start.exe
from %WINDIR%\Media\tada.wav to %WINDIR%\Media\tada.exe
from %WINDIR%\Media\ringout.wav to %WINDIR%\Media\ringout.exe
from %WINDIR%\Media\recycle.wav to %WINDIR%\Media\recycle.exe
from %WINDIR%\Media\ringin.wav to %WINDIR%\Media\ringin.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\tplayh.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\tplayh.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm1.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm1.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\tplay.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\tplay.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\tpause.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\tpause.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\tpauseh.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\tpauseh.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm2.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm2.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm6.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm6.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm7.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm7.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm5.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm5.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm3.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm3.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm4.gif to %WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm4.exe
from %WINDIR%\Media\Windows XP Menu Command.wav to %WINDIR%\Media\Windows XP Menu Command.exe
from %WINDIR%\Media\Windows XP Minimize.wav to %WINDIR%\Media\Windows XP Minimize.exe
from %WINDIR%\Media\Windows XP Logon Sound.wav to %WINDIR%\Media\Windows XP Logon Sound.exe
from %WINDIR%\Media\Windows XP Information Bar.wav to %WINDIR%\Media\Windows XP Information Bar.exe
from %WINDIR%\Media\Windows XP Logoff Sound.wav to %WINDIR%\Media\Windows XP Logoff Sound.exe
from %WINDIR%\Media\Windows XP Notify.wav to %WINDIR%\Media\Windows XP Notify.exe
from %WINDIR%\Media\Windows XP Restore.wav to %WINDIR%\Media\Windows XP Restore.exe
from %WINDIR%\Media\Windows XP Ringin.wav to %WINDIR%\Media\Windows XP Ringin.exe
from %WINDIR%\Media\Windows XP Recycle.wav to %WINDIR%\Media\Windows XP Recycle.exe
from %WINDIR%\Media\Windows XP Pop-up Blocked.wav to %WINDIR%\Media\Windows XP Pop-up Blocked.exe
from %WINDIR%\Media\Windows XP Print complete.wav to %WINDIR%\Media\Windows XP Print complete.exe
from %WINDIR%\Media\Windows XP Critical Stop.wav to %WINDIR%\Media\Windows XP Critical Stop.exe
from %WINDIR%\Media\Windows XP Default.wav to %WINDIR%\Media\Windows XP Default.exe
from %WINDIR%\Media\Windows XP Battery Low.wav to %WINDIR%\Media\Windows XP Battery Low.exe
from %WINDIR%\Media\Windows XP Balloon.wav to %WINDIR%\Media\Windows XP Balloon.exe
from %WINDIR%\Media\Windows XP Battery Critical.wav to %WINDIR%\Media\Windows XP Battery Critical.exe
from %WINDIR%\Media\Windows XP Ding.wav to %WINDIR%\Media\Windows XP Ding.exe
from %WINDIR%\Media\Windows XP Hardware Insert.wav to %WINDIR%\Media\Windows XP Hardware Insert.exe
from %WINDIR%\Media\Windows XP Hardware Remove.wav to %WINDIR%\Media\Windows XP Hardware Remove.exe
from %WINDIR%\Media\Windows XP Hardware Fail.wav to %WINDIR%\Media\Windows XP Hardware Fail.exe
from %WINDIR%\Media\Windows XP Error.wav to %WINDIR%\Media\Windows XP Error.exe
from %WINDIR%\Media\Windows XP Exclamation.wav to %WINDIR%\Media\Windows XP Exclamation.exe

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial