Trojan.Encoder.30905

Technical Information

Malicious functions

Reads files which store third party applications passwords

%LOCALAPPDATA%\google\chrome\user data\default\web data

Modifies file system

Creates the following files

C:\users\all users\adobe\arm\reader_15.007.20033\readerdcmanifest.msi
C:\users\all users\microsoft\windows\start menu\programs\mozilla thunderbird.lnk
C:\users\all users\microsoft\windows\start menu\programs\mozilla firefox.lnk
C:\users\all users\microsoft\windows\start menu\programs\mirc\versions.txt.lnk
C:\users\all users\microsoft\windows\start menu\programs\mirc\readme.txt.lnk
C:\users\all users\microsoft\windows\start menu\programs\mirc\mirc.lnk
C:\users\all users\microsoft\windows\start menu\programs\mirc\mirc help.lnk
C:\users\all users\microsoft\windows\start menu\programs\mirc\ircintro help.lnk
C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft word 2010.lnk
C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft sharepoint workspace 2010.lnk
C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft publisher 2010.lnk
C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft powerpoint 2010.lnk
C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft outlook 2010.lnk
C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft onenote 2010.lnk
C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office picture manager.lnk
C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office 2010 upload center.lnk
C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office 2010 language preferences.lnk
C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft clip organizer.lnk
C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\digital certificate for vba projects.lnk
C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft infopath filler 2010.lnk
C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft infopath designer 2010.lnk
C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft excel 2010.lnk
C:\users\all users\microsoft\windows\start menu\programs\microsoft .net framework sdk v1.1\tools.lnk
C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft access 2010.lnk
C:\users\all users\microsoft\windows\start menu\programs\opera.lnk
C:\users\all users\microsoft\windows\start menu\programs\pidgin.lnk
C:\users\all users\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_088cc9f7\report.wer
C:\users\all users\microsoft\windows\start menu\windows update.lnk
C:\users\all users\microsoft\windows\start menu\programs\xps viewer.lnk
C:\users\all users\microsoft\windows\start menu\programs\winrar\winrar.lnk
C:\users\all users\microsoft\windows\start menu\programs\winrar\winrar help.lnk
C:\users\all users\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk
C:\users\all users\microsoft\windows\start menu\programs\winrar\console rar manual.lnk
C:\users\all users\microsoft\windows\start menu\programs\windows media player.lnk
C:\users\all users\microsoft\windows\start menu\programs\windows fax and scan.lnk
C:\users\all users\microsoft\windows\start menu\programs\windows dvd maker.lnk
C:\users\all users\microsoft\windows\start menu\programs\winamp\winamp (safe mode).lnk
C:\users\all users\microsoft\windows\start menu\programs\microsoft .net framework sdk v1.1\documentation.lnk
C:\users\all users\microsoft\windows\start menu\programs\winamp\what's new.lnk
C:\users\all users\microsoft\windows\start menu\programs\winamp\uninstall winamp.lnk
C:\users\all users\microsoft\windows\start menu\programs\steam\steam.lnk
C:\users\all users\microsoft\windows\start menu\programs\steam\steam support center.url
C:\users\all users\microsoft\windows\start menu\programs\startup\desktop.ini
C:\users\all users\microsoft\windows\start menu\programs\sidebar.lnk
C:\users\all users\microsoft\windows\start menu\programs\sharepoint\microsoft sharepoint workspace 2010.lnk
C:\users\all users\microsoft\windows\start menu\programs\qip 2012\uninstall qip 2012.lnk
C:\users\all users\microsoft\windows\start menu\programs\qip 2012\qip 2012.lnk
C:\users\all users\microsoft\windows\start menu\programs\qip 2012\qip 2012 on the web.lnk
C:\users\all users\microsoft\windows\start menu\programs\microsoft .net framework sdk v1.1\overview.lnk
C:\users\all users\microsoft\windows\start menu\programs\media center.lnk
C:\users\all users\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\report.wer
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\directvobsub.lnk
C:\users\all users\microsoft\windows\start menu\programs\java\visit java.com.lnk
C:\users\all users\microsoft\windows\start menu\programs\java\get help.lnk
C:\users\all users\microsoft\windows\start menu\programs\java\configure java.lnk
C:\users\all users\microsoft\windows\start menu\programs\java\check for updates.lnk
C:\users\all users\microsoft\windows\start menu\programs\java\about java.lnk
C:\users\all users\microsoft\windows\start menu\programs\google chrome\google chrome.lnk
C:\users\all users\microsoft\windows\start menu\programs\games\gameexplorer.lnk
C:\users\all users\microsoft\windows\start menu\programs\games\desktop.ini
C:\users\all users\microsoft\windows\start menu\programs\desktop.ini
C:\users\all users\microsoft\windows\start menu\programs\administrative tools\windows powershell modules.lnk
C:\users\all users\microsoft\windows\start menu\programs\administrative tools\windows firewall with advanced security.lnk
C:\users\all users\microsoft\windows\start menu\programs\administrative tools\task scheduler.lnk
C:\users\all users\microsoft\windows\start menu\programs\administrative tools\system configuration.lnk
C:\users\all users\microsoft\windows\start menu\programs\administrative tools\services.lnk
C:\users\all users\microsoft\windows\start menu\programs\administrative tools\security configuration management.lnk
C:\users\all users\microsoft\windows\start menu\programs\administrative tools\print management.lnk
C:\users\all users\microsoft\windows\start menu\programs\administrative tools\performance monitor.lnk
C:\users\all users\microsoft\windows\start menu\programs\administrative tools\microsoft .net framework 1.1 wizards.lnk
C:\users\all users\microsoft\windows\start menu\programs\administrative tools\microsoft .net framework 1.1 configuration.lnk
C:\users\all users\microsoft\windows\start menu\programs\administrative tools\memory diagnostics tool.lnk
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\ffdshow vfw interface (x64).lnk
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\ffdshow vfw interface.lnk
C:\users\all users\microsoft\windows\start menu\programs\maintenance\remote assistance.lnk
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\help\frequently asked questions.lnk
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\media player classic.lnk
C:\users\all users\microsoft\windows\start menu\programs\maintenance\desktop.ini
C:\users\all users\microsoft\windows\start menu\programs\maintenance\create recovery disc.lnk
C:\users\all users\microsoft\windows\start menu\programs\maintenance\backup and restore center.lnk
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\uninstall\uninstall k-lite codec pack.lnk
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\tools\win7dsfiltertweaker.lnk
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\tools\mediainfo.lnk
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\tools\haali muxer.lnk
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\tools\graphstudionext.lnk
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\tools\graphstudionext (x64).lnk
C:\users\all users\microsoft\windows\start menu\programs\winamp\winamp.lnk
C:\users\all users\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_099489dd\report.wer
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\codec tweak tool.lnk
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\x264 vfw (x86).lnk
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\x264 vfw (x64).lnk
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\reset to recommended settings.lnk
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav video.lnk
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav video (x64).lnk
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav splitter.lnk
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav splitter (x64).lnk
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav audio.lnk
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav audio (x64).lnk
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\xvid vfw.lnk
C:\users\all users\microsoft\windows\caches\{1573b5e2-35f5-4eaf-bec0-4e35d1d995f6}.2.ver0x0000000000000002.db
C:\users\all users\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5c82.tmp.appcompat.txt
C:\users\all users\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\state.rsm
C:\users\all users\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\vcredist_x64.exe
C:\users\all users\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\state.rsm
C:\users\all users\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\vcredist_x64.exe
C:\users\all users\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\state.rsm
C:\users\all users\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
C:\users\all users\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm
C:\users\all users\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\vcredist_x86.exe
C:\users\all users\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\state.rsm
C:\users\all users\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\vcredist_x64.exe
C:\users\all users\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\state.rsm
C:\users\all users\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi
C:\users\all users\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\vcruntimeminimum_amd64\cab1.cab
C:\users\all users\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\vcredist_x86.exe
C:\users\all users\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\state.rsm
C:\users\all users\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\windows6.1-kb2999226-x64.msu
C:\users\all users\mozilla\logs\maintenanceservice-uninstall.log
C:\users\all users\mozilla\logs\maintenanceservice-install.log
C:\users\all users\microsoft toolkit\settings.xml
C:\users\all users\microsoft help\nslist.hxl
C:\users\all users\microsoft help\ms.winword.dev.14.1033.hxn
C:\users\all users\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\vcredist_x86.exe
C:\users\all users\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\state.rsm
C:\users\all users\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\vcredist_x86.exe
C:\users\all users\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\state.rsm
C:\users\all users\sun\java\java update\jaureglist.xml
C:\users\all users\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe
C:\users\all users\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\state.rsm
C:\users\all users\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\vcredist_x86.exe
C:\users\all users\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\state.rsm
C:\users\all users\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\vc_redist.x64.exe
C:\users\all users\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\state.rsm
C:\users\all users\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\vcredist_x64.exe
C:\users\all users\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\state.rsm
C:\users\all users\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\vcredist_x86.exe
C:\users\all users\microsoft help\ms.winword.14.1033.hxn
C:\users\all users\microsoft\windows\start menu\programs\administrative tools\iscsi initiator.lnk
C:\users\all users\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\cab1.cab
C:\users\all users\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi
C:\users\all users\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeadditional_amd64\cab1.cab
C:\users\all users\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\vcredist_x86.exe
C:\users\all users\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\state.rsm
C:\users\all users\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi
C:\users\all users\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\cab1.cab
C:\users\all users\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\vcredist_x64.exe
C:\users\all users\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\state.rsm
C:\users\all users\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\vc_redist.x86.exe
C:\users\all users\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi
C:\users\all users\microsoft help\ms.setlang.14.1033.hxn
C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\directvobsub (x64).lnk
C:\users\all users\microsoft help\ms.powerpnt.14.1033.hxn
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_a.hxw
C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_vs70namedurl.hxw
C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_k.hxw
C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_f.hxw
C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_a.hxw
C:\users\all users\microsoft help\ms.dexplore.hxn
C:\users\all users\microsoft help\hx_1033_mvalidator.lck
C:\users\all users\microsoft help\hx_1033_mvalidator.hxd
C:\users\all users\microsoft help\hx_1033_mtoc_hx.hxh
C:\users\all users\microsoft help\hx_1033_mkwd_namedurl.hxw
C:\users\all users\microsoft help\hx_1033_mkwd_k.hxw
C:\users\all users\microsoft help\hx.hxn
C:\users\all users\microsoft\windows defender\support\mplog-07132009-221054.log
C:\users\all users\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpengine.dll
C:\users\all users\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasdlta.vdm
C:\users\all users\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasbase.vdm
C:\users\all users\microsoft\windows\wer\reportqueue\noncritical_x64_d473a376adfb18a7b165c5e3c26de43cd8bccb_cab_079d8596\report.wer
C:\users\all users\microsoft\windows\wer\reportqueue\noncritical_x64_d473a376adfb18a7b165c5e3c26de43cd8bccb_cab_079d8596\dmi8538.tmp.log.xml
C:\users\all users\microsoft\windows\wer\reportqueue\noncritical_x64_5d5d8b7c1982ab7c66cf747e7b18b39e2441a_cab_073d8027\report.wer
C:\users\all users\microsoft\windows\wer\reportqueue\noncritical_x64_4a8ed64bf1962bf234c1a7153259451034e674_cab_0731c4f1\report.wer
C:\users\all users\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer7f7e.tmp.mdmp
C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.lck
C:\users\all users\microsoft help\ms.excel.14.1033.hxn
C:\users\all users\microsoft help\ms.excel.dev.14.1033.hxn
C:\users\all users\microsoft help\ms.graph.14.1033.hxn
C:\users\all users\microsoft help\ms.outlook.dev.14.1033.hxn
C:\users\all users\microsoft help\ms.outlook.14.1033.hxn
C:\users\all users\microsoft help\ms.onenote.14.1033.hxn
C:\users\all users\microsoft help\ms.ois.14.1033.hxn
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.lck
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.hxd
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mtoc_netsdk.hxh
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_netsdknamedurls.hxw
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_k.hxw
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_f.hxw
C:\users\all users\microsoft help\ms.powerpnt.dev.14.1033.hxn
C:\users\all users\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5cc2.tmp.werinternalmetadata.xml
C:\users\all users\microsoft help\ms.netframeworksdkv1.1.hxn
C:\users\all users\microsoft help\ms.mstore.14.1033.hxn
C:\users\all users\microsoft help\ms.mspub.dev.14.1033.hxn
C:\users\all users\microsoft help\ms.mspub.14.1033.hxn
C:\users\all users\microsoft help\ms.msouc.14.1033.hxn
C:\users\all users\microsoft help\ms.msaccess.dev.14.1033.hxn
C:\users\all users\microsoft help\ms.msaccess.14.1033.hxn
C:\users\all users\microsoft help\ms.infopatheditor.14.1033.hxn
C:\users\all users\microsoft help\ms.infopath.14.1033.hxn
C:\users\all users\microsoft help\ms.groove.14.1033.hxn
C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_cvalidator.hxd
C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.hxd
C:\users\all users\microsoft\windows\start menu\programs\administrative tools\event viewer.lnk
C:\users\all users\microsoft\windows\start menu\programs\administrative tools\desktop.ini
C:\users\all users\microsoft\windows\start menu\programs\administrative tools\data sources (odbc).lnk
C:\users\all users\microsoft\office\uicaptions\3082\grintl32.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\xlslicer.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\xlintl32.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\xlintl32.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\wwintl.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\wwintl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\visintl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\visbrres.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\stintl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\sgres.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\pubwzint.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\pub6intl.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\pub6intl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\ppintl.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\ppintl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\outlwvw.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\outllibr.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\outllibr.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\onintl.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\onintl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\omsintl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\mapir.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\mor6int.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\xlslicer.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\pub6intl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\pub6intl.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\xlintl32.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\xlintl32.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\wwintl.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\wwintl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\visintl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\visbrres.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\stintl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\sgres.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\pubwzint.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\grintl32.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\msointl.rest.trx_dll
C:\users\all users\microsoft\msdn\7.0\3082\dexplore.ctm
C:\users\all users\microsoft\office\uicaptions\3082\ppintl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\outlwvw.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\outllibr.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\outllibr.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\onintl.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\onintl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\omsintl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\msointl.rest.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\msointl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\3082\ppintl.rest.trx_dll
%LOCALAPPDATA%\google\chrome\user data\default\web applications\_crx_aohghmighlieiainnegkcijnfilokake\документы google.ico
C:\users\all users\microsoft\officesoftwareprotectionplatform\cache\cache.dat
C:\users\all users\microsoft\office\uicaptions\1036\mapir.dll.trx_dll
C:\users\all users\microsoft\identitycrl\ppcrlui.dll
C:\users\all users\microsoft\identitycrl\ppcrlconfig.dll
C:\users\all users\microsoft\dbgclr\7.1\1033\dbgclr.ctm
C:\users\all users\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
C:\users\all users\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be032546e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
C:\users\all users\microsoft\crypto\rsa\s-1-5-18\5d91c0b736f4f8dbdd317cf8a037fced_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
C:\users\all users\microsoft\crypto\keys\68383f0e45dd9b02f69c4041b082ee57_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
C:\users\all users\microsoft\assistance\client\1.0\en-us\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q
C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mvalidator.lck
C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mvalidator.h1d
C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mtoc_help.h1h
C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mkwd_bestbet.h1w
C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mkwd_assetid.h1w
C:\users\all users\microsoft\assistance\client\1.0\en-us\help_cvalidator.h1d
C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini
C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.exe
C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi
C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini
C:\users\all users\adobe\arm\s\armmanifest.msi
C:\users\all users\adobe\arm\s\10428\adobearmhelper.exe
C:\users\all users\microsoft\ilscache\imcrcache.xml
C:\users\all users\microsoft\mf\active.grl
C:\users\all users\microsoft\ilscache\ilrcache.xml
C:\users\all users\microsoft\mf\pending.grl
C:\users\all users\microsoft\office\uicaptions\1036\grintl32.rest.trx_dll
C:\users\all users\microsoft\msdn\7.0\1028\dexplore.ctm
C:\users\all users\microsoft\office\uicaptions\1036\grintl32.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\envelopr.dll.trx_dll
C:\users\all users\microsoft\office\sharepointteamsite.ico
C:\users\all users\microsoft\office\sharepointportalsite.ico
C:\users\all users\microsoft\office\mysite.ico
C:\users\all users\microsoft\office\mysharepoints.ico
C:\users\all users\microsoft\office\documentrepository.ico
C:\users\all users\microsoft\office\assetlibrary.ico
C:\users\all users\microsoft\network\downloader\qmgr1.dat
C:\users\all users\microsoft\office\uicaptions\1036\msointl.dll.trx_dll
C:\users\all users\microsoft\office\uicaptions\1036\mor6int.rest.trx_dll
C:\users\all users\microsoft\msdn\7.0\2052\dexplore.ctm
C:\users\all users\microsoft\msdn\7.0\1050\dexplore.ctm
C:\users\all users\microsoft\msdn\7.0\1049\dexplore.ctm
C:\users\all users\microsoft\msdn\7.0\1046\dexplore.ctm
C:\users\all users\microsoft\msdn\7.0\1042\dexplore.ctm
C:\users\all users\microsoft\msdn\7.0\1041\dexplore.ctm
C:\users\all users\microsoft\msdn\7.0\1040\dexplore.ctm
C:\users\all users\microsoft\msdn\7.0\1036\dexplore.ctm
C:\users\all users\microsoft\msdn\7.0\1033\dexplore.ctm
C:\users\all users\microsoft\msdn\7.0\1031\dexplore.ctm
C:\users\all users\microsoft\network\downloader\qmgr0.dat
C:\users\all users\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\state.rsm
C:\users\all users\microsoft\rac\publisheddata\racwmidatabase.sdf
C:\users\all users\microsoft\rac\statedata\racwmidatabookmarks.dat
C:\users\all users\microsoft\windows\start menu\programs\accessories\sticky notes.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\sound recorder.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\snipping tool.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\remote desktop connection.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\paint.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\networkprojection.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\mobility center.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\math input panel.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\displayswitch.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\desktop.ini
C:\users\all users\microsoft\windows\start menu\programs\accessories\calculator.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\accessibility\speech recognition.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini
C:\users\all users\microsoft\windows\start menu\desktop.ini
C:\users\all users\microsoft\windows\start menu\default programs.lnk
C:\users\all users\microsoft\windows\ringtones\ringtone 10.wma
C:\users\all users\microsoft\windows\ringtones\ringtone 09.wma
C:\users\all users\microsoft\windows\ringtones\ringtone 08.wma
C:\users\all users\microsoft\windows\ringtones\ringtone 07.wma
C:\users\all users\microsoft\windows\ringtones\ringtone 06.wma
C:\users\all users\microsoft\windows\ringtones\ringtone 05.wma
C:\users\all users\microsoft\windows\start menu\programs\accessories\sync center.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\character map.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini
C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\dfrgui.lnk
C:\users\all users\microsoft\windows\ringtones\ringtone 03.wma
C:\users\all users\microsoft\windows\start menu\programs\administrative tools\computer management.lnk
C:\users\all users\microsoft\windows\start menu\programs\administrative tools\component services.lnk
C:\users\all users\microsoft\windows\start menu\programs\acrobat reader dc.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\wordpad.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell ise.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell ise (x86).lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell (x86).lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\windows powershell\desktop.ini
C:\users\all users\microsoft\windows\ringtones\ringtone 04.wma
C:\users\all users\microsoft\windows\start menu\programs\accessories\welcome center.lnk
C:\users\all users\microsoft\rac\statedata\racdatabase.sdf
C:\users\all users\microsoft\windows\start menu\programs\accessories\tablet pc\shapecollector.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\tablet pc\desktop.ini
C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\windows easy transfer.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\windows easy transfer reports.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\task scheduler.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\system restore.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\system information.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\resource monitor.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\disk cleanup.lnk
C:\users\all users\microsoft\windows\start menu\programs\accessories\tablet pc\windows journal.lnk
C:\users\all users\microsoft\rac\statedata\racmetadata.dat
C:\users\all users\microsoft\windows\start menu\programs\accessories\tablet pc\tabtip.lnk
C:\users\all users\microsoft\office\uicaptions\3082\envelopr.dll.trx_dll
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciad0002.002
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciad0002.001
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciad0002.000
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0002.002
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0002.001
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0002.000
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0001.002
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0001.001
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0001.000
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.wsb
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.wid
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.dir
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.ci
C:\users\all users\microsoft\search\data\applications\windows\mssres00002.jrs
C:\users\all users\microsoft\search\data\applications\windows\mssres00001.jrs
C:\users\all users\microsoft\search\data\applications\windows\mss00002.log
C:\users\all users\microsoft\search\data\applications\windows\mss.log
C:\users\all users\microsoft\search\data\applications\windows\mss.chk
C:\users\all users\microsoft\search\data\applications\windows\gatherlogs\systemindex\systemindex.1.gthr
C:\users\all users\microsoft\search\data\applications\windows\gatherlogs\systemindex\systemindex.1.crwl
C:\users\all users\microsoft\rac\statedata\racwmieventdata.dat
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\index.000
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\index.001
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\index.002
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\settings.dia
C:\users\all users\microsoft\windows\ringtones\ringtone 01.wma
C:\users\all users\microsoft\windows\drm\v3ks.sec
C:\users\all users\microsoft\windows\drm\v3ks.bla
C:\users\all users\microsoft\windows\drm\drmstore.hds
C:\users\all users\microsoft\windows\drm\blackbox.bin
C:\users\all users\microsoft\windows\caches\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db
C:\users\all users\microsoft\windows\caches\{84c252b6-5dca-4ae7-94d3-461f67359cd9}.2.ver0x0000000000000001.db
C:\users\all users\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db
C:\users\all users\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db
C:\users\all users\microsoft\windows\caches\{4e4260a4-7e39-442e-bc22-7ff751d1c161}.2.ver0x0000000000000002.db
C:\users\all users\microsoft\windows\ringtones\ringtone 02.wma
C:\users\all users\microsoft\windows\caches\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db
C:\users\all users\microsoft\windows\ringtones\desktop.ini
C:\users\all users\microsoft\windows\caches\cversions.2.db
C:\users\all users\microsoft\user account pictures\user.bmp
C:\users\all users\microsoft\user account pictures\guest.bmp
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.002
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.001
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.000
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.002
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.001
C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.000
C:\users\all users\microsoft\windows\caches\{1e8814b6-8f2d-4b97-87f6-9370f7eb40b7}.2.ver0x0000000000000001.db
%LOCALAPPDATA%\google\chrome\user data\default\web applications\_crx_aohghmighlieiainnegkcijnfilokake\документы google.ico.md5

Moves the following files

from C:\users\all users\adobe\arm\reader_15.007.20033\readerdcmanifest.msi to C:\users\all users\adobe\arm\reader_15.007.20033\readerdcmanifest.msi.adv
from C:\users\all users\microsoft\windows\start menu\programs\mozilla thunderbird.lnk to C:\users\all users\microsoft\windows\start menu\programs\mozilla thunderbird.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\mozilla firefox.lnk to C:\users\all users\microsoft\windows\start menu\programs\mozilla firefox.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\mirc\versions.txt.lnk to C:\users\all users\microsoft\windows\start menu\programs\mirc\versions.txt.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\mirc\readme.txt.lnk to C:\users\all users\microsoft\windows\start menu\programs\mirc\readme.txt.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\mirc\mirc.lnk to C:\users\all users\microsoft\windows\start menu\programs\mirc\mirc.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\mirc\mirc help.lnk to C:\users\all users\microsoft\windows\start menu\programs\mirc\mirc help.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\mirc\ircintro help.lnk to C:\users\all users\microsoft\windows\start menu\programs\mirc\ircintro help.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft word 2010.lnk to C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft word 2010.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft sharepoint workspace 2010.lnk to C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft sharepoint workspace 2010.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft publisher 2010.lnk to C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft publisher 2010.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft powerpoint 2010.lnk to C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft powerpoint 2010.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft outlook 2010.lnk to C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft outlook 2010.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft onenote 2010.lnk to C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft onenote 2010.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office picture manager.lnk to C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office picture manager.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office 2010 upload center.lnk to C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office 2010 upload center.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office 2010 language preferences.lnk to C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft office 2010 language preferences.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft clip organizer.lnk to C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\microsoft clip organizer.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\digital certificate for vba projects.lnk to C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft office 2010 tools\digital certificate for vba projects.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft infopath filler 2010.lnk to C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft infopath filler 2010.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft infopath designer 2010.lnk to C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft infopath designer 2010.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft excel 2010.lnk to C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft excel 2010.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\microsoft .net framework sdk v1.1\tools.lnk to C:\users\all users\microsoft\windows\start menu\programs\microsoft .net framework sdk v1.1\tools.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft access 2010.lnk to C:\users\all users\microsoft\windows\start menu\programs\microsoft office\microsoft access 2010.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\opera.lnk to C:\users\all users\microsoft\windows\start menu\programs\opera.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\pidgin.lnk to C:\users\all users\microsoft\windows\start menu\programs\pidgin.lnk.adv
from C:\users\all users\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_088cc9f7\report.wer to C:\users\all users\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_088cc9f7\report.wer.adv
from C:\users\all users\microsoft\windows\start menu\windows update.lnk to C:\users\all users\microsoft\windows\start menu\windows update.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\xps viewer.lnk to C:\users\all users\microsoft\windows\start menu\programs\xps viewer.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\winrar\winrar.lnk to C:\users\all users\microsoft\windows\start menu\programs\winrar\winrar.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\winrar\winrar help.lnk to C:\users\all users\microsoft\windows\start menu\programs\winrar\winrar help.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk to C:\users\all users\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\winrar\console rar manual.lnk to C:\users\all users\microsoft\windows\start menu\programs\winrar\console rar manual.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\windows media player.lnk to C:\users\all users\microsoft\windows\start menu\programs\windows media player.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\windows fax and scan.lnk to C:\users\all users\microsoft\windows\start menu\programs\windows fax and scan.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\windows dvd maker.lnk to C:\users\all users\microsoft\windows\start menu\programs\windows dvd maker.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\winamp\winamp (safe mode).lnk to C:\users\all users\microsoft\windows\start menu\programs\winamp\winamp (safe mode).lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\microsoft .net framework sdk v1.1\documentation.lnk to C:\users\all users\microsoft\windows\start menu\programs\microsoft .net framework sdk v1.1\documentation.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\winamp\what's new.lnk to C:\users\all users\microsoft\windows\start menu\programs\winamp\what's new.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\winamp\uninstall winamp.lnk to C:\users\all users\microsoft\windows\start menu\programs\winamp\uninstall winamp.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\steam\steam.lnk to C:\users\all users\microsoft\windows\start menu\programs\steam\steam.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\steam\steam support center.url to C:\users\all users\microsoft\windows\start menu\programs\steam\steam support center.url.adv
from C:\users\all users\microsoft\windows\start menu\programs\startup\desktop.ini to C:\users\all users\microsoft\windows\start menu\programs\startup\desktop.ini.adv
from C:\users\all users\microsoft\windows\start menu\programs\sidebar.lnk to C:\users\all users\microsoft\windows\start menu\programs\sidebar.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\sharepoint\microsoft sharepoint workspace 2010.lnk to C:\users\all users\microsoft\windows\start menu\programs\sharepoint\microsoft sharepoint workspace 2010.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\qip 2012\uninstall qip 2012.lnk to C:\users\all users\microsoft\windows\start menu\programs\qip 2012\uninstall qip 2012.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\qip 2012\qip 2012.lnk to C:\users\all users\microsoft\windows\start menu\programs\qip 2012\qip 2012.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\qip 2012\qip 2012 on the web.lnk to C:\users\all users\microsoft\windows\start menu\programs\qip 2012\qip 2012 on the web.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\microsoft .net framework sdk v1.1\overview.lnk to C:\users\all users\microsoft\windows\start menu\programs\microsoft .net framework sdk v1.1\overview.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\media center.lnk to C:\users\all users\microsoft\windows\start menu\programs\media center.lnk.adv
from C:\users\all users\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\report.wer to C:\users\all users\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\report.wer.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\directvobsub.lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\directvobsub.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\java\visit java.com.lnk to C:\users\all users\microsoft\windows\start menu\programs\java\visit java.com.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\java\get help.lnk to C:\users\all users\microsoft\windows\start menu\programs\java\get help.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\java\configure java.lnk to C:\users\all users\microsoft\windows\start menu\programs\java\configure java.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\java\check for updates.lnk to C:\users\all users\microsoft\windows\start menu\programs\java\check for updates.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\java\about java.lnk to C:\users\all users\microsoft\windows\start menu\programs\java\about java.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\google chrome\google chrome.lnk to C:\users\all users\microsoft\windows\start menu\programs\google chrome\google chrome.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\games\gameexplorer.lnk to C:\users\all users\microsoft\windows\start menu\programs\games\gameexplorer.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\games\desktop.ini to C:\users\all users\microsoft\windows\start menu\programs\games\desktop.ini.adv
from C:\users\all users\microsoft\windows\start menu\programs\desktop.ini to C:\users\all users\microsoft\windows\start menu\programs\desktop.ini.adv
from C:\users\all users\microsoft\windows\start menu\programs\administrative tools\windows powershell modules.lnk to C:\users\all users\microsoft\windows\start menu\programs\administrative tools\windows powershell modules.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\administrative tools\windows firewall with advanced security.lnk to C:\users\all users\microsoft\windows\start menu\programs\administrative tools\windows firewall with advanced security.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\administrative tools\task scheduler.lnk to C:\users\all users\microsoft\windows\start menu\programs\administrative tools\task scheduler.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\administrative tools\system configuration.lnk to C:\users\all users\microsoft\windows\start menu\programs\administrative tools\system configuration.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\administrative tools\services.lnk to C:\users\all users\microsoft\windows\start menu\programs\administrative tools\services.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\administrative tools\security configuration management.lnk to C:\users\all users\microsoft\windows\start menu\programs\administrative tools\security configuration management.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\administrative tools\print management.lnk to C:\users\all users\microsoft\windows\start menu\programs\administrative tools\print management.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\administrative tools\performance monitor.lnk to C:\users\all users\microsoft\windows\start menu\programs\administrative tools\performance monitor.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\administrative tools\microsoft .net framework 1.1 wizards.lnk to C:\users\all users\microsoft\windows\start menu\programs\administrative tools\microsoft .net framework 1.1 wizards.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\administrative tools\microsoft .net framework 1.1 configuration.lnk to C:\users\all users\microsoft\windows\start menu\programs\administrative tools\microsoft .net framework 1.1 configuration.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\administrative tools\memory diagnostics tool.lnk to C:\users\all users\microsoft\windows\start menu\programs\administrative tools\memory diagnostics tool.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\ffdshow vfw interface (x64).lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\ffdshow vfw interface (x64).lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\ffdshow vfw interface.lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\ffdshow vfw interface.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\maintenance\remote assistance.lnk to C:\users\all users\microsoft\windows\start menu\programs\maintenance\remote assistance.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\help\frequently asked questions.lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\help\frequently asked questions.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\media player classic.lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\media player classic.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\maintenance\desktop.ini to C:\users\all users\microsoft\windows\start menu\programs\maintenance\desktop.ini.adv
from C:\users\all users\microsoft\windows\start menu\programs\maintenance\create recovery disc.lnk to C:\users\all users\microsoft\windows\start menu\programs\maintenance\create recovery disc.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\maintenance\backup and restore center.lnk to C:\users\all users\microsoft\windows\start menu\programs\maintenance\backup and restore center.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\uninstall\uninstall k-lite codec pack.lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\uninstall\uninstall k-lite codec pack.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\tools\win7dsfiltertweaker.lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\tools\win7dsfiltertweaker.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\tools\mediainfo.lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\tools\mediainfo.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\tools\haali muxer.lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\tools\haali muxer.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\tools\graphstudionext.lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\tools\graphstudionext.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\tools\graphstudionext (x64).lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\tools\graphstudionext (x64).lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\winamp\winamp.lnk to C:\users\all users\microsoft\windows\start menu\programs\winamp\winamp.lnk.adv
from C:\users\all users\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_099489dd\report.wer to C:\users\all users\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_099489dd\report.wer.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\codec tweak tool.lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\codec tweak tool.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\x264 vfw (x86).lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\x264 vfw (x86).lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\x264 vfw (x64).lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\x264 vfw (x64).lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\reset to recommended settings.lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\reset to recommended settings.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav video.lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav video.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav video (x64).lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav video (x64).lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav splitter.lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav splitter.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav splitter (x64).lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav splitter (x64).lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav audio.lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav audio.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav audio (x64).lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\lav audio (x64).lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\xvid vfw.lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\xvid vfw.lnk.adv
from C:\users\all users\microsoft\windows\caches\{1573b5e2-35f5-4eaf-bec0-4e35d1d995f6}.2.ver0x0000000000000002.db to C:\users\all users\microsoft\windows\caches\{1573b5e2-35f5-4eaf-bec0-4e35d1d995f6}.2.ver0x0000000000000002.db.adv
from C:\users\all users\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5c82.tmp.appcompat.txt to C:\users\all users\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5c82.tmp.appcompat.txt.adv
from C:\users\all users\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\state.rsm to C:\users\all users\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\state.rsm.adv
from C:\users\all users\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\vcredist_x64.exe to C:\users\all users\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\vcredist_x64.exe.adv
from C:\users\all users\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\state.rsm to C:\users\all users\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\state.rsm.adv
from C:\users\all users\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\vcredist_x64.exe to C:\users\all users\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\vcredist_x64.exe.adv
from C:\users\all users\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\state.rsm to C:\users\all users\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\state.rsm.adv
from C:\users\all users\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe to C:\users\all users\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe.adv
from C:\users\all users\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm to C:\users\all users\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm.adv
from C:\users\all users\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\vcredist_x86.exe to C:\users\all users\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\vcredist_x86.exe.adv
from C:\users\all users\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\state.rsm to C:\users\all users\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\state.rsm.adv
from C:\users\all users\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\vcredist_x64.exe to C:\users\all users\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\vcredist_x64.exe.adv
from C:\users\all users\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\state.rsm to C:\users\all users\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\state.rsm.adv
from C:\users\all users\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi to C:\users\all users\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi.adv
from C:\users\all users\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\vcruntimeminimum_amd64\cab1.cab to C:\users\all users\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\vcruntimeminimum_amd64\cab1.cab.adv
from C:\users\all users\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\vcredist_x86.exe to C:\users\all users\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\vcredist_x86.exe.adv
from C:\users\all users\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\state.rsm to C:\users\all users\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\state.rsm.adv
from C:\users\all users\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\windows6.1-kb2999226-x64.msu to C:\users\all users\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\windows6.1-kb2999226-x64.msu.adv
from C:\users\all users\mozilla\logs\maintenanceservice-uninstall.log to C:\users\all users\mozilla\logs\maintenanceservice-uninstall.log.adv
from C:\users\all users\mozilla\logs\maintenanceservice-install.log to C:\users\all users\mozilla\logs\maintenanceservice-install.log.adv
from C:\users\all users\microsoft toolkit\settings.xml to C:\users\all users\microsoft toolkit\settings.xml.adv
from C:\users\all users\microsoft help\nslist.hxl to C:\users\all users\microsoft help\nslist.hxl.adv
from C:\users\all users\microsoft help\ms.winword.dev.14.1033.hxn to C:\users\all users\microsoft help\ms.winword.dev.14.1033.hxn.adv
from C:\users\all users\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\vcredist_x86.exe to C:\users\all users\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\vcredist_x86.exe.adv
from C:\users\all users\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\state.rsm to C:\users\all users\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\state.rsm.adv
from C:\users\all users\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\vcredist_x86.exe to C:\users\all users\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\vcredist_x86.exe.adv
from C:\users\all users\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\state.rsm to C:\users\all users\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\state.rsm.adv
from C:\users\all users\sun\java\java update\jaureglist.xml to C:\users\all users\sun\java\java update\jaureglist.xml.adv
from C:\users\all users\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe to C:\users\all users\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe.adv
from C:\users\all users\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\state.rsm to C:\users\all users\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\state.rsm.adv
from C:\users\all users\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\vcredist_x86.exe to C:\users\all users\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\vcredist_x86.exe.adv
from C:\users\all users\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\state.rsm to C:\users\all users\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\state.rsm.adv
from C:\users\all users\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\vc_redist.x64.exe to C:\users\all users\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\vc_redist.x64.exe.adv
from C:\users\all users\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\state.rsm to C:\users\all users\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\state.rsm.adv
from C:\users\all users\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\vcredist_x64.exe to C:\users\all users\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\vcredist_x64.exe.adv
from C:\users\all users\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\state.rsm to C:\users\all users\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\state.rsm.adv
from C:\users\all users\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\vcredist_x86.exe to C:\users\all users\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\vcredist_x86.exe.adv
from C:\users\all users\microsoft help\ms.winword.14.1033.hxn to C:\users\all users\microsoft help\ms.winword.14.1033.hxn.adv
from C:\users\all users\microsoft\windows\start menu\programs\administrative tools\iscsi initiator.lnk to C:\users\all users\microsoft\windows\start menu\programs\administrative tools\iscsi initiator.lnk.adv
from C:\users\all users\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\cab1.cab to C:\users\all users\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\cab1.cab.adv
from C:\users\all users\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi to C:\users\all users\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi.adv
from C:\users\all users\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeadditional_amd64\cab1.cab to C:\users\all users\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeadditional_amd64\cab1.cab.adv
from C:\users\all users\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\vcredist_x86.exe to C:\users\all users\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\vcredist_x86.exe.adv
from C:\users\all users\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\state.rsm to C:\users\all users\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\state.rsm.adv
from C:\users\all users\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi to C:\users\all users\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi.adv
from C:\users\all users\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\cab1.cab to C:\users\all users\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\cab1.cab.adv
from C:\users\all users\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\vcredist_x64.exe to C:\users\all users\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\vcredist_x64.exe.adv
from C:\users\all users\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\state.rsm to C:\users\all users\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\state.rsm.adv
from C:\users\all users\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\vc_redist.x86.exe to C:\users\all users\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\vc_redist.x86.exe.adv
from C:\users\all users\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi to C:\users\all users\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi.adv
from C:\users\all users\microsoft help\ms.setlang.14.1033.hxn to C:\users\all users\microsoft help\ms.setlang.14.1033.hxn.adv
from C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\directvobsub (x64).lnk to C:\users\all users\microsoft\windows\start menu\programs\k-lite codec pack\configuration\directvobsub (x64).lnk.adv
from C:\users\all users\microsoft help\ms.powerpnt.14.1033.hxn to C:\users\all users\microsoft help\ms.powerpnt.14.1033.hxn.adv
from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_a.hxw to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_a.hxw.adv
from C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_vs70namedurl.hxw to C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_vs70namedurl.hxw.adv
from C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_k.hxw to C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_k.hxw.adv
from C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_f.hxw to C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_f.hxw.adv
from C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_a.hxw to C:\users\all users\microsoft help\ms.dexplore_1033_mkwd_a.hxw.adv
from C:\users\all users\microsoft help\ms.dexplore.hxn to C:\users\all users\microsoft help\ms.dexplore.hxn.adv
from C:\users\all users\microsoft help\hx_1033_mvalidator.lck to C:\users\all users\microsoft help\hx_1033_mvalidator.lck.adv
from C:\users\all users\microsoft help\hx_1033_mvalidator.hxd to C:\users\all users\microsoft help\hx_1033_mvalidator.hxd.adv
from C:\users\all users\microsoft help\hx_1033_mtoc_hx.hxh to C:\users\all users\microsoft help\hx_1033_mtoc_hx.hxh.adv
from C:\users\all users\microsoft help\hx_1033_mkwd_namedurl.hxw to C:\users\all users\microsoft help\hx_1033_mkwd_namedurl.hxw.adv
from C:\users\all users\microsoft help\hx_1033_mkwd_k.hxw to C:\users\all users\microsoft help\hx_1033_mkwd_k.hxw.adv
from C:\users\all users\microsoft help\hx.hxn to C:\users\all users\microsoft help\hx.hxn.adv
from C:\users\all users\microsoft\windows defender\support\mplog-07132009-221054.log to C:\users\all users\microsoft\windows defender\support\mplog-07132009-221054.log.adv
from C:\users\all users\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpengine.dll to C:\users\all users\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpengine.dll.adv
from C:\users\all users\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasdlta.vdm to C:\users\all users\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasdlta.vdm.adv
from C:\users\all users\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasbase.vdm to C:\users\all users\microsoft\windows defender\definition updates\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\mpasbase.vdm.adv
from C:\users\all users\microsoft\windows\wer\reportqueue\noncritical_x64_d473a376adfb18a7b165c5e3c26de43cd8bccb_cab_079d8596\report.wer to C:\users\all users\microsoft\windows\wer\reportqueue\noncritical_x64_d473a376adfb18a7b165c5e3c26de43cd8bccb_cab_079d8596\report.wer.adv
from C:\users\all users\microsoft\windows\wer\reportqueue\noncritical_x64_d473a376adfb18a7b165c5e3c26de43cd8bccb_cab_079d8596\dmi8538.tmp.log.xml to C:\users\all users\microsoft\windows\wer\reportqueue\noncritical_x64_d473a376adfb18a7b165c5e3c26de43cd8bccb_cab_079d8596\dmi8538.tmp.log.xml.adv
from C:\users\all users\microsoft\windows\wer\reportqueue\noncritical_x64_5d5d8b7c1982ab7c66cf747e7b18b39e2441a_cab_073d8027\report.wer to C:\users\all users\microsoft\windows\wer\reportqueue\noncritical_x64_5d5d8b7c1982ab7c66cf747e7b18b39e2441a_cab_073d8027\report.wer.adv
from C:\users\all users\microsoft\windows\wer\reportqueue\noncritical_x64_4a8ed64bf1962bf234c1a7153259451034e674_cab_0731c4f1\report.wer to C:\users\all users\microsoft\windows\wer\reportqueue\noncritical_x64_4a8ed64bf1962bf234c1a7153259451034e674_cab_0731c4f1\report.wer.adv
from C:\users\all users\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer7f7e.tmp.mdmp to C:\users\all users\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer7f7e.tmp.mdmp.adv
from C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.lck to C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.lck.adv
from C:\users\all users\microsoft help\ms.excel.14.1033.hxn to C:\users\all users\microsoft help\ms.excel.14.1033.hxn.adv
from C:\users\all users\microsoft help\ms.excel.dev.14.1033.hxn to C:\users\all users\microsoft help\ms.excel.dev.14.1033.hxn.adv
from C:\users\all users\microsoft help\ms.graph.14.1033.hxn to C:\users\all users\microsoft help\ms.graph.14.1033.hxn.adv
from C:\users\all users\microsoft help\ms.outlook.dev.14.1033.hxn to C:\users\all users\microsoft help\ms.outlook.dev.14.1033.hxn.adv
from C:\users\all users\microsoft help\ms.outlook.14.1033.hxn to C:\users\all users\microsoft help\ms.outlook.14.1033.hxn.adv
from C:\users\all users\microsoft help\ms.onenote.14.1033.hxn to C:\users\all users\microsoft help\ms.onenote.14.1033.hxn.adv
from C:\users\all users\microsoft help\ms.ois.14.1033.hxn to C:\users\all users\microsoft help\ms.ois.14.1033.hxn.adv
from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.lck to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.lck.adv
from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.hxd to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.hxd.adv
from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mtoc_netsdk.hxh to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mtoc_netsdk.hxh.adv
from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_netsdknamedurls.hxw to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_netsdknamedurls.hxw.adv
from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_k.hxw to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_k.hxw.adv
from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_f.hxw to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_f.hxw.adv
from C:\users\all users\microsoft help\ms.powerpnt.dev.14.1033.hxn to C:\users\all users\microsoft help\ms.powerpnt.dev.14.1033.hxn.adv
from C:\users\all users\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5cc2.tmp.werinternalmetadata.xml to C:\users\all users\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\wer5cc2.tmp.werinternalmetadata.xml.adv
from C:\users\all users\microsoft help\ms.netframeworksdkv1.1.hxn to C:\users\all users\microsoft help\ms.netframeworksdkv1.1.hxn.adv
from C:\users\all users\microsoft help\ms.mstore.14.1033.hxn to C:\users\all users\microsoft help\ms.mstore.14.1033.hxn.adv
from C:\users\all users\microsoft help\ms.mspub.dev.14.1033.hxn to C:\users\all users\microsoft help\ms.mspub.dev.14.1033.hxn.adv
from C:\users\all users\microsoft help\ms.mspub.14.1033.hxn to C:\users\all users\microsoft help\ms.mspub.14.1033.hxn.adv
from C:\users\all users\microsoft help\ms.msouc.14.1033.hxn to C:\users\all users\microsoft help\ms.msouc.14.1033.hxn.adv
from C:\users\all users\microsoft help\ms.msaccess.dev.14.1033.hxn to C:\users\all users\microsoft help\ms.msaccess.dev.14.1033.hxn.adv
from C:\users\all users\microsoft help\ms.msaccess.14.1033.hxn to C:\users\all users\microsoft help\ms.msaccess.14.1033.hxn.adv
from C:\users\all users\microsoft help\ms.infopatheditor.14.1033.hxn to C:\users\all users\microsoft help\ms.infopatheditor.14.1033.hxn.adv
from C:\users\all users\microsoft help\ms.infopath.14.1033.hxn to C:\users\all users\microsoft help\ms.infopath.14.1033.hxn.adv
from C:\users\all users\microsoft help\ms.groove.14.1033.hxn to C:\users\all users\microsoft help\ms.groove.14.1033.hxn.adv
from C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_cvalidator.hxd to C:\users\all users\microsoft help\ms.netframeworksdkv1.1_1033_cvalidator.hxd.adv
from C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.hxd to C:\users\all users\microsoft help\ms.dexplore_1033_mvalidator.hxd.adv
from C:\users\all users\microsoft\windows\start menu\programs\administrative tools\event viewer.lnk to C:\users\all users\microsoft\windows\start menu\programs\administrative tools\event viewer.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\administrative tools\desktop.ini to C:\users\all users\microsoft\windows\start menu\programs\administrative tools\desktop.ini.adv
from C:\users\all users\microsoft\windows\start menu\programs\administrative tools\data sources (odbc).lnk to C:\users\all users\microsoft\windows\start menu\programs\administrative tools\data sources (odbc).lnk.adv
from C:\users\all users\microsoft\office\uicaptions\3082\grintl32.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\grintl32.rest.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\xlslicer.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\xlslicer.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\xlintl32.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\xlintl32.rest.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\xlintl32.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\xlintl32.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\wwintl.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\wwintl.rest.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\wwintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\wwintl.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\visintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\visintl.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\visbrres.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\visbrres.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\stintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\stintl.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\sgres.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\sgres.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\pubwzint.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\pubwzint.rest.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\pub6intl.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\pub6intl.rest.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\pub6intl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\pub6intl.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\ppintl.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\ppintl.rest.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\ppintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\ppintl.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\outlwvw.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\outlwvw.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\outllibr.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\outllibr.rest.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\outllibr.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\outllibr.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\onintl.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\onintl.rest.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\onintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\onintl.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\omsintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\omsintl.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\mapir.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\mapir.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\mor6int.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\mor6int.rest.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\xlslicer.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\xlslicer.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\pub6intl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\pub6intl.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\pub6intl.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\pub6intl.rest.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\xlintl32.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\xlintl32.rest.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\xlintl32.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\xlintl32.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\wwintl.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\wwintl.rest.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\wwintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\wwintl.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\visintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\visintl.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\visbrres.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\visbrres.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\stintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\stintl.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\sgres.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\sgres.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\pubwzint.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\pubwzint.rest.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\grintl32.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\grintl32.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\msointl.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\msointl.rest.trx_dll.adv
from C:\users\all users\microsoft\msdn\7.0\3082\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\3082\dexplore.ctm.adv
from C:\users\all users\microsoft\office\uicaptions\3082\ppintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\ppintl.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\outlwvw.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\outlwvw.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\outllibr.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\outllibr.rest.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\outllibr.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\outllibr.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\onintl.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\onintl.rest.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\onintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\onintl.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\omsintl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\omsintl.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\msointl.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\msointl.rest.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\msointl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\msointl.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\3082\ppintl.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\ppintl.rest.trx_dll.adv
from %LOCALAPPDATA%\google\chrome\user data\default\web applications\_crx_aohghmighlieiainnegkcijnfilokake\документы google.ico to %LOCALAPPDATA%\google\chrome\user data\default\web applications\_crx_aohghmighlieiainnegkcijnfilokake\документы google.ico.adv
from C:\users\all users\microsoft\officesoftwareprotectionplatform\cache\cache.dat to C:\users\all users\microsoft\officesoftwareprotectionplatform\cache\cache.dat.adv
from C:\users\all users\microsoft\office\uicaptions\1036\mapir.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\mapir.dll.trx_dll.adv
from C:\users\all users\microsoft\identitycrl\ppcrlui.dll to C:\users\all users\microsoft\identitycrl\ppcrlui.dll.adv
from C:\users\all users\microsoft\identitycrl\ppcrlconfig.dll to C:\users\all users\microsoft\identitycrl\ppcrlconfig.dll.adv
from C:\users\all users\microsoft\dbgclr\7.1\1033\dbgclr.ctm to C:\users\all users\microsoft\dbgclr\7.1\1033\dbgclr.ctm.adv
from C:\users\all users\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee to C:\users\all users\microsoft\crypto\rsa\s-1-5-18\d42cc0c3858a58db2db37658219e6400_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.adv
from C:\users\all users\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be032546e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee to C:\users\all users\microsoft\crypto\rsa\s-1-5-18\6d14e4b1d8ca773bab785d1be032546e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.adv
from C:\users\all users\microsoft\crypto\rsa\s-1-5-18\5d91c0b736f4f8dbdd317cf8a037fced_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee to C:\users\all users\microsoft\crypto\rsa\s-1-5-18\5d91c0b736f4f8dbdd317cf8a037fced_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.adv
from C:\users\all users\microsoft\crypto\keys\68383f0e45dd9b02f69c4041b082ee57_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee to C:\users\all users\microsoft\crypto\keys\68383f0e45dd9b02f69c4041b082ee57_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee.adv
from C:\users\all users\microsoft\assistance\client\1.0\en-us\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q to C:\users\all users\microsoft\assistance\client\1.0\en-us\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q.adv
from C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mvalidator.lck to C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mvalidator.lck.adv
from C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mvalidator.h1d to C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mvalidator.h1d.adv
from C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mtoc_help.h1h to C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mtoc_help.h1h.adv
from C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mkwd_bestbet.h1w to C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mkwd_bestbet.h1w.adv
from C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mkwd_assetid.h1w to C:\users\all users\microsoft\assistance\client\1.0\en-us\help_mkwd_assetid.h1w.adv
from C:\users\all users\microsoft\assistance\client\1.0\en-us\help_cvalidator.h1d to C:\users\all users\microsoft\assistance\client\1.0\en-us\help_cvalidator.h1d.adv
from C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini to C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini.adv
from C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.exe to C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.exe.adv
from C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi to C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi.adv
from C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini to C:\users\all users\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini.adv
from C:\users\all users\adobe\arm\s\armmanifest.msi to C:\users\all users\adobe\arm\s\armmanifest.msi.adv
from C:\users\all users\adobe\arm\s\10428\adobearmhelper.exe to C:\users\all users\adobe\arm\s\10428\adobearmhelper.exe.adv
from C:\users\all users\microsoft\ilscache\imcrcache.xml to C:\users\all users\microsoft\ilscache\imcrcache.xml.adv
from C:\users\all users\microsoft\mf\active.grl to C:\users\all users\microsoft\mf\active.grl.adv
from C:\users\all users\microsoft\ilscache\ilrcache.xml to C:\users\all users\microsoft\ilscache\ilrcache.xml.adv
from C:\users\all users\microsoft\mf\pending.grl to C:\users\all users\microsoft\mf\pending.grl.adv
from C:\users\all users\microsoft\office\uicaptions\1036\grintl32.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\grintl32.rest.trx_dll.adv
from C:\users\all users\microsoft\msdn\7.0\1028\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\1028\dexplore.ctm.adv
from C:\users\all users\microsoft\office\uicaptions\1036\grintl32.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\grintl32.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\envelopr.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\envelopr.dll.trx_dll.adv
from C:\users\all users\microsoft\office\sharepointteamsite.ico to C:\users\all users\microsoft\office\sharepointteamsite.ico.adv
from C:\users\all users\microsoft\office\sharepointportalsite.ico to C:\users\all users\microsoft\office\sharepointportalsite.ico.adv
from C:\users\all users\microsoft\office\mysite.ico to C:\users\all users\microsoft\office\mysite.ico.adv
from C:\users\all users\microsoft\office\mysharepoints.ico to C:\users\all users\microsoft\office\mysharepoints.ico.adv
from C:\users\all users\microsoft\office\documentrepository.ico to C:\users\all users\microsoft\office\documentrepository.ico.adv
from C:\users\all users\microsoft\office\assetlibrary.ico to C:\users\all users\microsoft\office\assetlibrary.ico.adv
from C:\users\all users\microsoft\network\downloader\qmgr1.dat to C:\users\all users\microsoft\network\downloader\qmgr1.dat.adv
from C:\users\all users\microsoft\office\uicaptions\1036\msointl.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\msointl.dll.trx_dll.adv
from C:\users\all users\microsoft\office\uicaptions\1036\mor6int.rest.trx_dll to C:\users\all users\microsoft\office\uicaptions\1036\mor6int.rest.trx_dll.adv
from C:\users\all users\microsoft\msdn\7.0\2052\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\2052\dexplore.ctm.adv
from C:\users\all users\microsoft\msdn\7.0\1050\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\1050\dexplore.ctm.adv
from C:\users\all users\microsoft\msdn\7.0\1049\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\1049\dexplore.ctm.adv
from C:\users\all users\microsoft\msdn\7.0\1046\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\1046\dexplore.ctm.adv
from C:\users\all users\microsoft\msdn\7.0\1042\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\1042\dexplore.ctm.adv
from C:\users\all users\microsoft\msdn\7.0\1041\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\1041\dexplore.ctm.adv
from C:\users\all users\microsoft\msdn\7.0\1040\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\1040\dexplore.ctm.adv
from C:\users\all users\microsoft\msdn\7.0\1036\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\1036\dexplore.ctm.adv
from C:\users\all users\microsoft\msdn\7.0\1033\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\1033\dexplore.ctm.adv
from C:\users\all users\microsoft\msdn\7.0\1031\dexplore.ctm to C:\users\all users\microsoft\msdn\7.0\1031\dexplore.ctm.adv
from C:\users\all users\microsoft\network\downloader\qmgr0.dat to C:\users\all users\microsoft\network\downloader\qmgr0.dat.adv
from C:\users\all users\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\state.rsm to C:\users\all users\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\state.rsm.adv
from C:\users\all users\microsoft\rac\publisheddata\racwmidatabase.sdf to C:\users\all users\microsoft\rac\publisheddata\racwmidatabase.sdf.adv
from C:\users\all users\microsoft\rac\statedata\racwmidatabookmarks.dat to C:\users\all users\microsoft\rac\statedata\racwmidatabookmarks.dat.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\sticky notes.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\sticky notes.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\sound recorder.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\sound recorder.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\snipping tool.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\snipping tool.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\remote desktop connection.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\remote desktop connection.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\paint.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\paint.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\networkprojection.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\networkprojection.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\mobility center.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\mobility center.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\math input panel.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\math input panel.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\displayswitch.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\displayswitch.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\desktop.ini to C:\users\all users\microsoft\windows\start menu\programs\accessories\desktop.ini.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\calculator.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\calculator.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\accessibility\speech recognition.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\accessibility\speech recognition.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini to C:\users\all users\microsoft\windows\start menu\programs\accessories\accessibility\desktop.ini.adv
from C:\users\all users\microsoft\windows\start menu\desktop.ini to C:\users\all users\microsoft\windows\start menu\desktop.ini.adv
from C:\users\all users\microsoft\windows\start menu\default programs.lnk to C:\users\all users\microsoft\windows\start menu\default programs.lnk.adv
from C:\users\all users\microsoft\windows\ringtones\ringtone 10.wma to C:\users\all users\microsoft\windows\ringtones\ringtone 10.wma.adv
from C:\users\all users\microsoft\windows\ringtones\ringtone 09.wma to C:\users\all users\microsoft\windows\ringtones\ringtone 09.wma.adv
from C:\users\all users\microsoft\windows\ringtones\ringtone 08.wma to C:\users\all users\microsoft\windows\ringtones\ringtone 08.wma.adv
from C:\users\all users\microsoft\windows\ringtones\ringtone 07.wma to C:\users\all users\microsoft\windows\ringtones\ringtone 07.wma.adv
from C:\users\all users\microsoft\windows\ringtones\ringtone 06.wma to C:\users\all users\microsoft\windows\ringtones\ringtone 06.wma.adv
from C:\users\all users\microsoft\windows\ringtones\ringtone 05.wma to C:\users\all users\microsoft\windows\ringtones\ringtone 05.wma.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\sync center.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\sync center.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\character map.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\character map.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini to C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\desktop.ini.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\dfrgui.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\dfrgui.lnk.adv
from C:\users\all users\microsoft\windows\ringtones\ringtone 03.wma to C:\users\all users\microsoft\windows\ringtones\ringtone 03.wma.adv
from C:\users\all users\microsoft\windows\start menu\programs\administrative tools\computer management.lnk to C:\users\all users\microsoft\windows\start menu\programs\administrative tools\computer management.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\administrative tools\component services.lnk to C:\users\all users\microsoft\windows\start menu\programs\administrative tools\component services.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\acrobat reader dc.lnk to C:\users\all users\microsoft\windows\start menu\programs\acrobat reader dc.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\wordpad.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\wordpad.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell ise.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell ise.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell ise (x86).lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell ise (x86).lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell (x86).lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\windows powershell\windows powershell (x86).lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\windows powershell\desktop.ini to C:\users\all users\microsoft\windows\start menu\programs\accessories\windows powershell\desktop.ini.adv
from C:\users\all users\microsoft\windows\ringtones\ringtone 04.wma to C:\users\all users\microsoft\windows\ringtones\ringtone 04.wma.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\welcome center.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\welcome center.lnk.adv
from C:\users\all users\microsoft\rac\statedata\racdatabase.sdf to C:\users\all users\microsoft\rac\statedata\racdatabase.sdf.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\tablet pc\shapecollector.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\tablet pc\shapecollector.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\tablet pc\desktop.ini to C:\users\all users\microsoft\windows\start menu\programs\accessories\tablet pc\desktop.ini.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\windows easy transfer.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\windows easy transfer.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\windows easy transfer reports.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\windows easy transfer reports.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\task scheduler.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\task scheduler.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\system restore.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\system restore.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\system information.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\system information.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\resource monitor.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\resource monitor.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\disk cleanup.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\system tools\disk cleanup.lnk.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\tablet pc\windows journal.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\tablet pc\windows journal.lnk.adv
from C:\users\all users\microsoft\rac\statedata\racmetadata.dat to C:\users\all users\microsoft\rac\statedata\racmetadata.dat.adv
from C:\users\all users\microsoft\windows\start menu\programs\accessories\tablet pc\tabtip.lnk to C:\users\all users\microsoft\windows\start menu\programs\accessories\tablet pc\tabtip.lnk.adv
from C:\users\all users\microsoft\office\uicaptions\3082\envelopr.dll.trx_dll to C:\users\all users\microsoft\office\uicaptions\3082\envelopr.dll.trx_dll.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciad0002.002 to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciad0002.002.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciad0002.001 to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciad0002.001.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciad0002.000 to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciad0002.000.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0002.002 to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0002.002.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0002.001 to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0002.001.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0002.000 to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0002.000.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0001.002 to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0001.002.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0001.001 to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0001.001.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0001.000 to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\ciab0001.000.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.wsb to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.wsb.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.wid to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.wid.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.dir to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.dir.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.ci to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\00010003.ci.adv
from C:\users\all users\microsoft\search\data\applications\windows\mssres00002.jrs to C:\users\all users\microsoft\search\data\applications\windows\mssres00002.jrs.adv
from C:\users\all users\microsoft\search\data\applications\windows\mssres00001.jrs to C:\users\all users\microsoft\search\data\applications\windows\mssres00001.jrs.adv
from C:\users\all users\microsoft\search\data\applications\windows\mss00002.log to C:\users\all users\microsoft\search\data\applications\windows\mss00002.log.adv
from C:\users\all users\microsoft\search\data\applications\windows\mss.log to C:\users\all users\microsoft\search\data\applications\windows\mss.log.adv
from C:\users\all users\microsoft\search\data\applications\windows\mss.chk to C:\users\all users\microsoft\search\data\applications\windows\mss.chk.adv
from C:\users\all users\microsoft\search\data\applications\windows\gatherlogs\systemindex\systemindex.1.gthr to C:\users\all users\microsoft\search\data\applications\windows\gatherlogs\systemindex\systemindex.1.gthr.adv
from C:\users\all users\microsoft\search\data\applications\windows\gatherlogs\systemindex\systemindex.1.crwl to C:\users\all users\microsoft\search\data\applications\windows\gatherlogs\systemindex\systemindex.1.crwl.adv
from C:\users\all users\microsoft\rac\statedata\racwmieventdata.dat to C:\users\all users\microsoft\rac\statedata\racwmieventdata.dat.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\index.000 to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\index.000.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\index.001 to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\index.001.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\index.002 to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\index.002.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\settings.dia to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\indexer\cifiles\settings.dia.adv
from C:\users\all users\microsoft\windows\ringtones\ringtone 01.wma to C:\users\all users\microsoft\windows\ringtones\ringtone 01.wma.adv
from C:\users\all users\microsoft\windows\drm\v3ks.sec to C:\users\all users\microsoft\windows\drm\v3ks.sec.adv
from C:\users\all users\microsoft\windows\drm\v3ks.bla to C:\users\all users\microsoft\windows\drm\v3ks.bla.adv
from C:\users\all users\microsoft\windows\drm\drmstore.hds to C:\users\all users\microsoft\windows\drm\drmstore.hds.adv
from C:\users\all users\microsoft\windows\drm\blackbox.bin to C:\users\all users\microsoft\windows\drm\blackbox.bin.adv
from C:\users\all users\microsoft\windows\caches\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db to C:\users\all users\microsoft\windows\caches\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db.adv
from C:\users\all users\microsoft\windows\caches\{84c252b6-5dca-4ae7-94d3-461f67359cd9}.2.ver0x0000000000000001.db to C:\users\all users\microsoft\windows\caches\{84c252b6-5dca-4ae7-94d3-461f67359cd9}.2.ver0x0000000000000001.db.adv
from C:\users\all users\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db to C:\users\all users\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db.adv
from C:\users\all users\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db to C:\users\all users\microsoft\windows\caches\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db.adv
from C:\users\all users\microsoft\windows\caches\{4e4260a4-7e39-442e-bc22-7ff751d1c161}.2.ver0x0000000000000002.db to C:\users\all users\microsoft\windows\caches\{4e4260a4-7e39-442e-bc22-7ff751d1c161}.2.ver0x0000000000000002.db.adv
from C:\users\all users\microsoft\windows\ringtones\ringtone 02.wma to C:\users\all users\microsoft\windows\ringtones\ringtone 02.wma.adv
from C:\users\all users\microsoft\windows\caches\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db to C:\users\all users\microsoft\windows\caches\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db.adv
from C:\users\all users\microsoft\windows\ringtones\desktop.ini to C:\users\all users\microsoft\windows\ringtones\desktop.ini.adv
from C:\users\all users\microsoft\windows\caches\cversions.2.db to C:\users\all users\microsoft\windows\caches\cversions.2.db.adv
from C:\users\all users\microsoft\user account pictures\user.bmp to C:\users\all users\microsoft\user account pictures\user.bmp.adv
from C:\users\all users\microsoft\user account pictures\guest.bmp to C:\users\all users\microsoft\user account pictures\guest.bmp.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.002 to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.002.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.001 to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.001.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.000 to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\secstore\cist0000.000.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.002 to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.002.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.001 to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.001.adv
from C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.000 to C:\users\all users\microsoft\search\data\applications\windows\projects\systemindex\propmap\cipt0000.000.adv
from C:\users\all users\microsoft\windows\caches\{1e8814b6-8f2d-4b97-87f6-9370f7eb40b7}.2.ver0x0000000000000001.db to C:\users\all users\microsoft\windows\caches\{1e8814b6-8f2d-4b97-87f6-9370f7eb40b7}.2.ver0x0000000000000001.db.adv
from %LOCALAPPDATA%\google\chrome\user data\default\web applications\_crx_aohghmighlieiainnegkcijnfilokake\документы google.ico.md5 to %LOCALAPPDATA%\google\chrome\user data\default\web applications\_crx_aohghmighlieiainnegkcijnfilokake\документы google.ico.md5.adv

Changes user data files extensions (Trojan.Encoder).

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial