Trojan.PWS.Siggen1.50067

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'

Sets the following service settings

[<HKLM>\SYSTEM\CurrentControlSet\Services\Messenger] 'Start' = '00000002'

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Security Center
Windows Defender

blocks the following features:

User Account Control (UAC)
Windows Security Center

modifies the following system settings:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSaveSettings' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRecentDocsMenu' = '00000001'

Modifies settings of Windows Internet Explorer

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000000'

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system

Creates the following files

%TEMP%\autb49f.tmp
%WINDIR%\cursors\aero\set645a.tmp
%WINDIR%\cursors\aero\set6743.tmp
%WINDIR%\cursors\aero\set6713.tmp
%WINDIR%\cursors\aero\set66e3.tmp
%WINDIR%\cursors\aero\set66b4.tmp
%WINDIR%\cursors\aero\set6674.tmp
%WINDIR%\cursors\aero\set6654.tmp
%WINDIR%\cursors\aero\set6615.tmp
%WINDIR%\cursors\aero\set65c6.tmp
%WINDIR%\cursors\aero\set6596.tmp
%WINDIR%\cursors\aero\set6566.tmp
%WINDIR%\cursors\aero\set6546.tmp
%WINDIR%\cursors\aero\set64d8.tmp
%WINDIR%\cursors\aero\set63fb.tmp
%WINDIR%\cursors\aero\set67b2.tmp
%WINDIR%\cursors\aero\set63ac.tmp
%WINDIR%\cursors\aero\set637c.tmp
%WINDIR%\cursors\aero\set631e.tmp
%WINDIR%\cursors\aero\set62de.tmp
%WINDIR%\cursors\aero\set62af.tmp
%WINDIR%\cursors\aero\set6260.tmp
%WINDIR%\cursors\aero\set623f.tmp
%WINDIR%\cursors\aero\set61b2.tmp
%WINDIR%\cursors\aero\set6173.tmp
%WINDIR%\cursors\aero\set6152.tmp
%WINDIR%\cursors\aero\set5aab.tmp
%WINDIR%\cursors\aero\set6811.tmp
%WINDIR%\cursors\aero\set7008.tmp
%WINDIR%\cursors\aero\set6d0e.tmp
%WINDIR%\cursors\aero\set6d5d.tmp
%WINDIR%\cursors\aero\set6fe8.tmp
%WINDIR%\cursors\aero\set6f99.tmp
%WINDIR%\cursors\aero\set6f79.tmp
%WINDIR%\cursors\aero\set6f59.tmp
%WINDIR%\cursors\aero\set6f29.tmp
%WINDIR%\cursors\aero\set6eca.tmp
%WINDIR%\cursors\aero\set6eaa.tmp
%WINDIR%\cursors\aero\set6e6b.tmp
%WINDIR%\cursors\aero\set6e4a.tmp
%WINDIR%\cursors\aero\set6dfb.tmp
%WINDIR%\cursors\aero\set6dac.tmp
%WINDIR%\cursors\aero\set6123.tmp
%WINDIR%\cursors\aero\set60f3.tmp
%WINDIR%\cursors\aero\set689e.tmp
%WINDIR%\cursors\aero\set6b19.tmp
%WINDIR%\cursors\aero\set6ae9.tmp
%WINDIR%\cursors\aero\set6aba.tmp
%WINDIR%\cursors\aero\set6a8a.tmp
%WINDIR%\cursors\aero\set6a3b.tmp
%WINDIR%\cursors\aero\set6a0b.tmp
%WINDIR%\cursors\aero\set69db.tmp
%WINDIR%\cursors\aero\set69ab.tmp
%WINDIR%\cursors\aero\set698b.tmp
%WINDIR%\cursors\aero\set695b.tmp
%WINDIR%\cursors\aero\set68ed.tmp
%WINDIR%\cursors\aero\set6cb0.tmp
%WINDIR%\cursors\aero\set6763.tmp
%WINDIR%\cursors\aero\set60a4.tmp
%WINDIR%\cursors\aero\set6036.tmp
%WINDIR%\cursors\aero\set7038.tmp
%TEMP%\rarsfx1\i386\working_ba.ani
%WINDIR%\cursors\aero\set5683.tmp
%WINDIR%\cursors\aero\set5663.tmp
%WINDIR%\cursors\aero\set5633.tmp
%WINDIR%\cursors\aero\set55f4.tmp
%WINDIR%\cursors\aero\set55d4.tmp
%WINDIR%\cursors\aero\set55a4.tmp
%WINDIR%\cursors\aero\set5584.tmp
%WINDIR%\cursors\aero\set5544.tmp
%WINDIR%\cursors\aero\set5524.tmp
%WINDIR%\cursors\aero\set54f4.tmp
%WINDIR%\cursors\aero\set5703.tmp
%WINDIR%\cursors\aero\set54d4.tmp
%WINDIR%\cursors\aero\set54a4.tmp
%TEMP%\rarsfx1\i386\we_ba.cur
%TEMP%\rarsfx1\i386\up_ba.cur
%TEMP%\rarsfx1\i386\unavail_ba.cur
%TEMP%\rarsfx1\i386\text_ba.cur
%TEMP%\rarsfx1\i386\textselect.cur
%TEMP%\rarsfx1\i386\precisionselect.cur
%TEMP%\rarsfx1\i386\pen_ba.cur
%TEMP%\rarsfx1\i386\nwse_ba.cur
%TEMP%\rarsfx1\i386\ns_ba.cur
%TEMP%\rarsfx1\i386\nesw_ba.cur
%TEMP%\rarsfx1\i386\move_ba.cur
%WINDIR%\cursors\aero\set56d3.tmp
%TEMP%\rarsfx1\i386\hspin2 tranparents up.cur
%WINDIR%\cursors\aero\set5763.tmp
%WINDIR%\cursors\aero\set57d2.tmp
%WINDIR%\cursors\aero\set6006.tmp
%WINDIR%\cursors\aero\set5733.tmp
%WINDIR%\cursors\aero\set5f59.tmp
%WINDIR%\cursors\aero\set5ecc.tmp
%WINDIR%\cursors\aero\set5e8c.tmp
%WINDIR%\cursors\aero\set5d44.tmp
%WINDIR%\cursors\aero\set5d24.tmp
%WINDIR%\cursors\aero\set5cb5.tmp
%WINDIR%\cursors\aero\set5c95.tmp
%WINDIR%\cursors\aero\set5c46.tmp
%WINDIR%\cursors\aero\set5c26.tmp
%WINDIR%\cursors\aero\set5bc7.tmp
%WINDIR%\cursors\aero\set5783.tmp
%WINDIR%\cursors\aero\set5ba7.tmp
%WINDIR%\cursors\aero\set5afa.tmp
%WINDIR%\cursors\aero\set56a4.tmp
%WINDIR%\cursors\aero\set5a8a.tmp
%WINDIR%\cursors\aero\set5a2c.tmp
%WINDIR%\cursors\aero\set5a0c.tmp
%WINDIR%\cursors\aero\set59ad.tmp
%WINDIR%\cursors\aero\set596e.tmp
%WINDIR%\cursors\aero\set58ff.tmp
%WINDIR%\cursors\aero\set58d0.tmp
%WINDIR%\cursors\aero\set5871.tmp
%WINDIR%\cursors\aero\set5860.tmp
%WINDIR%\cursors\aero\set57f2.tmp
%WINDIR%\cursors\aero\set5b1a.tmp
%TEMP%\rarsfx1\i386\link_ba.cur
%WINDIR%\cursors\aero\set7087.tmp
%WINDIR%\cursors\aero\set743e.tmp
%WINDIR%\cursors\mango\setc9fe.tmp
%WINDIR%\cursors\mango\setc9be.tmp
%WINDIR%\cursors\mango\setc97f.tmp
%WINDIR%\cursors\mango\setc94f.tmp
%WINDIR%\cursors\mango\setc910.tmp
%WINDIR%\cursors\mango\setc8c1.tmp
%WINDIR%\cursors\mango\setc872.tmp
%WINDIR%\cursors\mango\setc842.tmp
%WINDIR%\cursors\mango\setc812.tmp
%WINDIR%\cursors\mango\setc7e2.tmp
%WINDIR%\cursors\mango\setc7c2.tmp
%WINDIR%\cursors\mango\setc792.tmp
%TEMP%\rarsfx1\install.inf
%WINDIR%\cursors\mango\setcaf9.tmp
%TEMP%\rarsfx1\alternate select.ani
%TEMP%\rarsfx1\aero_working.ani
%TEMP%\rarsfx1\aero_up.cur
%TEMP%\rarsfx1\aero_unavail.ani
%TEMP%\rarsfx1\aero_select.ani
%TEMP%\rarsfx1\aero_prec.ani
%TEMP%\rarsfx1\aero_pen.ani
%TEMP%\rarsfx1\aero_nwse.ani
%TEMP%\rarsfx1\aero_ns.ani
%TEMP%\rarsfx1\aero_nesw.ani
%TEMP%\rarsfx1\aero_move.ani
%TEMP%\rarsfx1\precision select.ani
%TEMP%\rarsfx1\aero_ew.ani
%WINDIR%\cursors\mango\setcb19.tmp
%WINDIR%\cursors\windows 8\set19c4.tmp
%WINDIR%\cursors\windows 8\set1994.tmp
%WINDIR%\cursors\windows 8\set1936.tmp
%WINDIR%\cursors\windows 8\set18f6.tmp
%WINDIR%\cursors\windows 8\set18c7.tmp
%WINDIR%\cursors\windows 8\set18a6.tmp
%WINDIR%\cursors\windows 8\set1886.tmp
%WINDIR%\cursors\windows 8\set1856.tmp
%WINDIR%\cursors\windows 8\set1836.tmp
%WINDIR%\cursors\windows 8\set1816.tmp
%WINDIR%\cursors\windows 8\set17e6.tmp
%WINDIR%\cursors\windows 8\set17b6.tmp
%TEMP%\rarsfx1\aero_link.ani
%WINDIR%\cursors\mango\setca1e.tmp
%TEMP%\rarsfx1\aero_select.cur
%TEMP%\rarsfx1\aero_prec.cur
%TEMP%\rarsfx1\aero_alt.cur
%TEMP%\rarsfx1\aero_unavail.cur
%TEMP%\rarsfx1\aero_pen.cur
%TEMP%\rarsfx1\aero_nwse.cur
%TEMP%\rarsfx1\aero_ns.cur
%TEMP%\rarsfx1\aero_nesw.cur
%TEMP%\rarsfx1\aero_move.cur
%TEMP%\rarsfx1\aero_link.cur
%TEMP%\rarsfx1\aero_helpsel.cur
%TEMP%\rarsfx1\aero_ew.cur
%WINDIR%\cursors\windows 8\set1747.tmp
%TEMP%\rarsfx1\aero_arrow.cur
%TEMP%\rarsfx1\aero_helpsel.ani
%TEMP%\rarsfx1\aero_busy.ani
%TEMP%\rarsfx1\i386\aero_nwse_xl.cur
%WINDIR%\cursors\aero\set745e.tmp
%WINDIR%\cursors\aero\set767c.tmp
%WINDIR%\cursors\aero\set764c.tmp
%WINDIR%\cursors\aero\set761c.tmp
%WINDIR%\cursors\aero\set75dd.tmp
%WINDIR%\cursors\aero\set758e.tmp
%WINDIR%\cursors\aero\set756d.tmp
%WINDIR%\cursors\aero\set754d.tmp
%WINDIR%\cursors\aero\set752d.tmp
%WINDIR%\cursors\aero\set74fd.tmp
%WINDIR%\cursors\aero\set74dd.tmp
%WINDIR%\cursors\aero\set749e.tmp
%WINDIR%\cursors\aero\set76ab.tmp
%WINDIR%\cursors\aero\set76cc.tmp
%WINDIR%\cursors\aero\set70a7.tmp
%WINDIR%\cursors\aero\set73cf.tmp
%WINDIR%\cursors\aero\set73af.tmp
%WINDIR%\cursors\aero\set737f.tmp
%WINDIR%\cursors\aero\set7275.tmp
%WINDIR%\cursors\aero\set7254.tmp
%WINDIR%\cursors\aero\set7205.tmp
%WINDIR%\cursors\aero\set71c6.tmp
%WINDIR%\cursors\aero\set7196.tmp
%WINDIR%\cursors\aero\set7176.tmp
%WINDIR%\cursors\aero\set7146.tmp
%WINDIR%\cursors\aero\set7126.tmp
%WINDIR%\cursors\aero\set740e.tmp
%WINDIR%\cursors\aero\set70d7.tmp
%WINDIR%\cursors\aero\set76fb.tmp
%WINDIR%\cursors\aero\set7a16.tmp
%WINDIR%\cursors\aero\set7a37.tmp
%TEMP%\rarsfx1\aero_alt.ani
%TEMP%\rarsfx1\oto.exe
%WINDIR%\cursors\aero\set7e45.tmp
%WINDIR%\cursors\aero\set7df6.tmp
%WINDIR%\cursors\aero\set7d4a.tmp
%WINDIR%\cursors\aero\set7d1a.tmp
%WINDIR%\cursors\aero\set7ccb.tmp
%WINDIR%\cursors\aero\set7c7c.tmp
%WINDIR%\cursors\aero\set7c2d.tmp
%WINDIR%\cursors\aero\set7bce.tmp
%WINDIR%\cursors\aero\set7ab4.tmp
%TEMP%\rarsfx1\aero_arrow.ani
%WINDIR%\cursors\aero\set771c.tmp
%WINDIR%\cursors\aero\set773c.tmp
%WINDIR%\cursors\aero\set7998.tmp
%WINDIR%\cursors\aero\set7968.tmp
%WINDIR%\cursors\aero\set7909.tmp
%WINDIR%\cursors\aero\set78ab.tmp
%WINDIR%\cursors\aero\set787b.tmp
%WINDIR%\cursors\aero\set785b.tmp
%WINDIR%\cursors\aero\set783a.tmp
%WINDIR%\cursors\aero\set77dc.tmp
%WINDIR%\cursors\aero\set77ac.tmp
%WINDIR%\cursors\aero\set777c.tmp
%WINDIR%\cursors\aero\set775c.tmp
%WINDIR%\cursors\aero\set79e7.tmp
%TEMP%\rarsfx1\i386\hspin2 tranparents unavail.cur
%TEMP%\rarsfx1\i386\hspin2 tranparents pen.cur
%TEMP%\rarsfx1\i386\hspin2 tranparents nwse.cur
%WINDIR%\cursors\black aero\aero_nesw.cur
%WINDIR%\cursors\black aero\aero_move.cur
%WINDIR%\cursors\black aero\aero_link.cur
%WINDIR%\cursors\black aero\aero_helpsel.cur
%WINDIR%\cursors\black aero\aero_ew.cur
%WINDIR%\cursors\black aero\aero_cross.cur
%WINDIR%\cursors\black aero\aero_arrow.cur
%WINDIR%\cursors\black aero\aero_working.ani
%WINDIR%\cursors\black aero\aero_busy.ani
%WINDIR%\cursors\aero cursors\oto.exe
%WINDIR%\cursors\aero cursors\kur.reg
%WINDIR%\cursors\aero cursors\kur.bat
%WINDIR%\cursors\aero cursors\aero_working.ani
%WINDIR%\cursors\black aero\aero_text.cur
%WINDIR%\cursors\aero cursors\aero_up.cur
%WINDIR%\cursors\aero cursors\aero_unavail.cur
%WINDIR%\cursors\aero cursors\aero_select.cur
%WINDIR%\cursors\aero cursors\aero_prec.cur
%WINDIR%\cursors\aero cursors\aero_pen.cur
%WINDIR%\cursors\aero cursors\aero_nwse.cur
%WINDIR%\cursors\aero cursors\aero_ns.cur
%WINDIR%\cursors\aero cursors\aero_nesw.cur
%WINDIR%\cursors\aero cursors\aero_move.cur
%WINDIR%\cursors\aero cursors\aero_link.cur
%WINDIR%\cursors\black aero\aero_nwse.cur
%WINDIR%\cursors\aero cursors\install.inf
%TEMP%\rarsfx1\i386\aero_busy_b.ani
%WINDIR%\cursors\black aero\aero_unavail.cur
%TEMP%\rarsfx1\i386\aero_arrow_xl.cur
%TEMP%\rarsfx1\i386\aero_arrow_l.cur
%TEMP%\rarsfx1\i386\aero_arrow_b.cur
%TEMP%\rarsfx1\i386\aero_arrow1.cur
%TEMP%\rarsfx1\i386\aero_arrow.cur
%TEMP%\rarsfx1\i386\aero_alt.cur
%TEMP%\rarsfx1\i386\aeroii working in backround.ani
%TEMP%\rarsfx1\i386\aeroii unavailable.cur
%TEMP%\rarsfx1\i386\aeroii text select.cur
%TEMP%\rarsfx1\i386\aeroii size vert.cur
%TEMP%\rarsfx1\i386\aeroii size horz.cur
%WINDIR%\cursors\aero cursors\aero_helpsel.cur
%TEMP%\rarsfx1\i386\aeroii resize right.cur
%WINDIR%\cursors\black aero\aero_pen.cur
%TEMP%\rarsfx1\i386\aeroii normal select.cur
%TEMP%\rarsfx1\i386\aeroii help select.cur
%TEMP%\rarsfx1\i386\aeroii handwriting.cur
%TEMP%\rarsfx1\i386\aeroii hand.ani
%TEMP%\rarsfx1\i386\aeroii cross.cur
%TEMP%\rarsfx1\i386\aeroii busy.ani
%TEMP%\rarsfx1\i386\aeroii alternate.cur
%TEMP%\rarsfx1\entries_aio_vista_aero_cursors.ini
%TEMP%\rarsfx1\cursor_install.exe
%TEMP%\rarsfx1\aioaero.inf
%WINDIR%\cursors\black aero\aero_up.cur
%TEMP%\rarsfx1\i386\aeroii resize left.cur
%WINDIR%\cursors\aero cursors\aero_ew.cur
%TEMP%\rarsfx1\i386\aero_busy.ani
%WINDIR%\cursors\aero cursors\aero_busy.ani
%WINDIR%\cursors\aero cursors\aero_arrow.cur
%WINDIR%\syswow64\uzantidegistir.dll
%TEMP%\rarsfx1\i386\aero_busy1.ani
%WINDIR%\syswow64\1.bat
%WINDIR%\syswow64\hidden.reg
%WINDIR%\syswow64\uzantigoster.dll
%WINDIR%\syswow64\hiddenfi.dll
%TEMP%\rarsfx0\cwnd.exe
%TEMP%\rarsfx0\03_fonts.exe
%TEMP%\rarsfx0\02_ie.exe
%TEMP%\rarsfx0\01_maviboot.exe
%TEMP%\rarsfx0\bilgilendirme.exe
%TEMP%\rarsfx0\easmurat.reg
%WINDIR%\syswow64\phototoys.dll
%WINDIR%\syswow64\dosya_uzantilarini_goster_gizle_ekle.reg
%TEMP%\rarsfx0\cabuk_ulas.reg
%TEMP%\rarsfx0\aero_cursors4.exe
%TEMP%\rarsfx0\recuva_1.30.435.exe
%TEMP%\rarsfx0\02_easm.exe
%TEMP%\rarsfx0\aero_cursors3.exe
%TEMP%\rarsfx0\03_cabuk_ulas.exe
%TEMP%\rarsfx0\installtips.ini
%TEMP%\rarsfx0\01_sagtus_eklentileri.exe
%TEMP%\rarsfx0\aero_cursors2.exe
%TEMP%\rarsfx0\aero_cursors1.exe
%TEMP%\rarsfx0\install.exe
%ALLUSERSPROFILE%\setup.exe
%TEMP%\rarsfx0\aero_cursors6.exe
%TEMP%\rarsfx0\aero_cursors5.exe
%TEMP%\rarsfx1\i386\aeroii resize all.cur
%WINDIR%\syswow64\uzanti.ico
%ProgramFiles(x86)%\recuva\recuva.exe
%ProgramFiles(x86)%\recuva\uninstall.exe
%WINDIR%\cursors\aero cursors\readme.txt
%WINDIR%\syswow64\cabuk_ulas.reg
%WINDIR%\syswow64\radyocu.ico
%WINDIR%\syswow64\google.exe
%WINDIR%\syswow64\easmurat.exe
%WINDIR%\syswow64\youtube.exe
%WINDIR%\syswow64\twitter.exe
%WINDIR%\syswow64\tnctr.exe
%WINDIR%\syswow64\facebook.exe
%ProgramFiles(x86)%\recuva\uninstall.ini
%HOMEPATH%\desktop\recuva.lnk
%WINDIR%\cursors\aero cursors\aero_alt.cur
%WINDIR%\syswow64\dosya_uzantilarini_goster_gizle.vbs
%WINDIR%\syswow64\preview.dll
%TEMP%\$inst\temp_0.tmp
%TEMP%\$inst\2.tmp
%ProgramFiles(x86)%\[easm]\easm.url
%ProgramFiles(x86)%\[easm]\pckapat.exe
%ProgramFiles(x86)%\[easm]\ip.exe
%ProgramFiles(x86)%\[easm]\browzar.exe
%ProgramFiles(x86)%\[easm]\4.exe
%ProgramFiles(x86)%\[easm]\3.exe
%ProgramFiles(x86)%\[easm]\2.exe
%ProgramFiles(x86)%\[easm]\1.exe
%WINDIR%\syswow64\cwnd.exe
%ProgramFiles(x86)%\recuva\lang\lang-1055.dll
%WINDIR%\cursors\black aero\aero_ns.cur
%TEMP%\rarsfx1\i386\aero_busy_black.ani
%TEMP%\rarsfx1\i386\highspin2 2nd blue.ani
%TEMP%\rarsfx1\i386\aero_working_red.ani
%TEMP%\rarsfx1\i386\highspin2 2nd black.ani
%TEMP%\rarsfx1\i386\helpse_bal.cur
%TEMP%\rarsfx1\i386\gold2nd.ani
%TEMP%\rarsfx1\i386\gold2nd work.ani
%TEMP%\rarsfx1\i386\gold2nd trans.ani
%TEMP%\rarsfx1\i386\cross_ba.cur
%TEMP%\rarsfx1\i386\busy_ba.ani
%TEMP%\rarsfx1\i386\black trans.ani
%TEMP%\rarsfx1\i386\arrow_ba.cur
%TEMP%\rarsfx1\i386\aero_working_xl.ani
%TEMP%\rarsfx1\i386\aero_working_silver.ani
%TEMP%\rarsfx1\i386\aero_busy_blue.ani
%TEMP%\rarsfx1\i386\highspin2 2nd green.ani
%TEMP%\rarsfx1\i386\aero_up.cur
%TEMP%\rarsfx1\i386\aero_working_l.ani
%TEMP%\rarsfx1\i386\aero_working_dgreen.ani
%TEMP%\rarsfx1\i386\aero_working_blue.ani
%TEMP%\rarsfx1\i386\aero_working_black.ani
%TEMP%\rarsfx1\i386\aero_working_b.ani
%TEMP%\rarsfx1\i386\aero_working1.ani
%TEMP%\rarsfx1\i386\aero_working.ani
%TEMP%\rarsfx1\i386\aero_up_xl.cur
%TEMP%\rarsfx1\i386\aero_up_l.cur
%TEMP%\rarsfx1\i386\aero_up_b.cur
%TEMP%\rarsfx1\i386\aero_up1.cur
%TEMP%\rarsfx1\i386\aero_working_ngreen.ani
%TEMP%\rarsfx1\i386\aero_working_pink.ani
%TEMP%\rarsfx1\i386\highspin2 2nd orange.ani
%TEMP%\rarsfx1\i386\highspin2 work orange.ani
%TEMP%\rarsfx1\i386\highspin2 work pink.ani
%TEMP%\rarsfx1\i386\hspin2 tranparents nesw.cur
%TEMP%\rarsfx1\i386\hspin2 tranparents move.cur
%TEMP%\rarsfx1\i386\hspin2 tranparents link.cur
%TEMP%\rarsfx1\i386\hspin2 tranparents help.cur
%TEMP%\rarsfx1\i386\hspin2 tranparents ew.cur
%TEMP%\rarsfx1\i386\hspin2 tranparents arrow.cur
%TEMP%\rarsfx1\i386\hspin transparent press.cur
%TEMP%\rarsfx1\i386\hspin tranparent text.cur
%TEMP%\rarsfx1\i386\highspin2 work.ani
%TEMP%\rarsfx1\i386\highspin2 work red.ani
%TEMP%\rarsfx1\i386\highspin2 work purple.ani
%TEMP%\rarsfx1\i386\hspin2 tranparents ns.cur
%TEMP%\rarsfx1\i386\highspin2 2nd pink.ani
%TEMP%\rarsfx1\i386\highspin2 2nd purple.ani
%TEMP%\rarsfx1\i386\highspin2 work blue.ani
%TEMP%\rarsfx1\i386\highspin2 work black.ani
%TEMP%\rarsfx1\i386\highspin2 sm2nd.ani
%TEMP%\rarsfx1\i386\highspin2 sm2nd red.ani
%TEMP%\rarsfx1\i386\highspin2 sm2nd purple.ani
%TEMP%\rarsfx1\i386\highspin2 sm2nd pink.ani
%TEMP%\rarsfx1\i386\highspin2 sm2nd orange.ani
%TEMP%\rarsfx1\i386\highspin2 sm2nd green.ani
%TEMP%\rarsfx1\i386\highspin2 sm2nd blue.ani
%TEMP%\rarsfx1\i386\highspin2 2nd.ani
%TEMP%\rarsfx1\i386\highspin2 2nd red.ani
%TEMP%\rarsfx1\i386\highspin2 work green.ani
%WINDIR%\cursors\windows 8\set1787.tmp
%WINDIR%\cursors\windows 8\set19f4.tmp
%TEMP%\rarsfx1\i386\aero_unavail_b.cur
%TEMP%\rarsfx1\i386\aero_ew_xl.cur
%TEMP%\rarsfx1\i386\aero_move1.cur
%TEMP%\rarsfx1\i386\aero_move.cur
%TEMP%\rarsfx1\i386\aero_link_xl.cur
%TEMP%\rarsfx1\i386\aero_link_l.cur
%TEMP%\rarsfx1\i386\aero_link_b.cur
%TEMP%\rarsfx1\i386\aero_link1.cur
%TEMP%\rarsfx1\i386\aero_link.cur
%TEMP%\rarsfx1\i386\aero_helpsel_xl.cur
%TEMP%\rarsfx1\i386\aero_helpsel_l.cur
%TEMP%\rarsfx1\i386\aero_helpsel_b.cur
%TEMP%\rarsfx1\i386\aero_helpsel1.cur
%TEMP%\rarsfx1\i386\aero_unavail_l.cur
%TEMP%\rarsfx1\i386\aero_move_l.cur
%TEMP%\rarsfx1\i386\aero_ew_l.cur
%TEMP%\rarsfx1\i386\aero_ew_b.cur
%TEMP%\rarsfx1\i386\aero_ew1.cur
%TEMP%\rarsfx1\i386\aero_ew.cur
%TEMP%\rarsfx1\i386\aero_cross_b.cur
%TEMP%\rarsfx1\i386\aero_busy_xl.ani
%TEMP%\rarsfx1\i386\aero_busy_silver.ani
%TEMP%\rarsfx1\i386\aero_busy_red.ani
%TEMP%\rarsfx1\i386\aero_busy_pink.ani
%TEMP%\rarsfx1\i386\aero_busy_ngreen.ani
%TEMP%\rarsfx1\i386\aero_busy_l.ani
%TEMP%\rarsfx1\i386\aero_busy_dgreen.ani
%TEMP%\rarsfx1\i386\aero_helpsel.cur
%TEMP%\rarsfx1\i386\aero_unavail_xl.cur
%TEMP%\rarsfx1\i386\aero_move_xl.cur
%TEMP%\rarsfx1\i386\aero_nesw_b.cur
%TEMP%\rarsfx1\i386\aero_nesw.cur
%TEMP%\rarsfx1\i386\aero_unavail1.cur
%TEMP%\rarsfx1\i386\aero_unavail.cur
%TEMP%\rarsfx1\i386\aero_text_b.cur
%TEMP%\rarsfx1\i386\aero_select_xl.cur
%TEMP%\rarsfx1\i386\aero_select_l.cur
%TEMP%\rarsfx1\i386\aero_select.cur
%TEMP%\rarsfx1\i386\aero_prec_xl.cur
%TEMP%\rarsfx1\i386\aero_prec_l.cur
%TEMP%\rarsfx1\i386\aero_prec.cur
%TEMP%\rarsfx1\i386\aero_pen_xl.cur
%TEMP%\rarsfx1\i386\aero_pen_l.cur
%TEMP%\rarsfx1\i386\aero_nesw1.cur
%TEMP%\rarsfx1\i386\aero_pen_b.cur
%TEMP%\rarsfx1\i386\aero_move_b.cur
%TEMP%\rarsfx1\i386\aero_nwse_l.cur
%TEMP%\rarsfx1\i386\aero_nwse_b.cur
%TEMP%\rarsfx1\i386\aero_nwse1.cur
%TEMP%\rarsfx1\i386\aero_nwse.cur
%TEMP%\rarsfx1\i386\aero_ns_xl.cur
%TEMP%\rarsfx1\i386\aero_ns_l.cur
%TEMP%\rarsfx1\i386\aero_ns_b.cur
%TEMP%\rarsfx1\i386\aero_ns1.cur
%TEMP%\rarsfx1\i386\aero_ns.cur
%TEMP%\rarsfx1\i386\aero_nesw_xl.cur
%TEMP%\rarsfx1\i386\aero_nesw_l.cur
%TEMP%\rarsfx1\i386\aero_pen.cur
%TEMP%\rarsfx1\boot\ntkrnlpa.exe

Sets the 'hidden' attribute to the following files

%ALLUSERSPROFILE%\setup.exe

Deletes the following files

%TEMP%\autb49f.tmp
%TEMP%\rarsfx1\i386\highspin2 sm2nd pink.ani
%TEMP%\rarsfx1\i386\highspin2 sm2nd purple.ani
%TEMP%\rarsfx1\i386\highspin2 sm2nd red.ani
%TEMP%\rarsfx1\i386\highspin2 sm2nd.ani
%TEMP%\rarsfx1\i386\highspin2 work black.ani
%TEMP%\rarsfx1\i386\highspin2 work blue.ani
%TEMP%\rarsfx1\i386\highspin2 work green.ani
%TEMP%\rarsfx1\i386\highspin2 work orange.ani
%TEMP%\rarsfx1\i386\highspin2 sm2nd green.ani
%TEMP%\rarsfx1\i386\highspin2 sm2nd orange.ani
%TEMP%\rarsfx1\i386\highspin2 work pink.ani
%TEMP%\rarsfx1\i386\highspin2 work.ani
%TEMP%\rarsfx1\i386\hspin tranparent text.cur
%TEMP%\rarsfx1\i386\hspin transparent press.cur
%TEMP%\rarsfx1\i386\hspin2 tranparents arrow.cur
%TEMP%\rarsfx1\i386\hspin2 tranparents ew.cur
%TEMP%\rarsfx1\i386\hspin2 tranparents help.cur
%TEMP%\rarsfx1\i386\hspin2 tranparents link.cur
%TEMP%\rarsfx1\i386\hspin2 tranparents move.cur
%TEMP%\rarsfx1\i386\highspin2 work purple.ani
%TEMP%\rarsfx1\i386\highspin2 work red.ani
%TEMP%\rarsfx1\i386\highspin2 sm2nd blue.ani
%TEMP%\rarsfx1\i386\highspin2 2nd red.ani
%TEMP%\rarsfx1\i386\hspin2 tranparents ns.cur
%TEMP%\rarsfx1\i386\aero_working_ngreen.ani
%TEMP%\rarsfx1\i386\aero_working_pink.ani
%TEMP%\rarsfx1\i386\aero_working_red.ani
%TEMP%\rarsfx1\i386\aero_working_silver.ani
%TEMP%\rarsfx1\i386\aero_working_xl.ani
%TEMP%\rarsfx1\i386\arrow_ba.cur
%TEMP%\rarsfx1\i386\black trans.ani
%TEMP%\rarsfx1\i386\busy_ba.ani
%TEMP%\rarsfx1\i386\cross_ba.cur
%TEMP%\rarsfx1\i386\gold2nd trans.ani
%TEMP%\rarsfx1\i386\gold2nd work.ani
%TEMP%\rarsfx1\i386\gold2nd.ani
%TEMP%\rarsfx1\i386\helpse_bal.cur
%TEMP%\rarsfx1\i386\highspin2 2nd black.ani
%TEMP%\rarsfx1\i386\highspin2 2nd blue.ani
%TEMP%\rarsfx1\i386\highspin2 2nd green.ani
%TEMP%\rarsfx1\i386\highspin2 2nd orange.ani
%TEMP%\rarsfx1\i386\highspin2 2nd pink.ani
%TEMP%\rarsfx1\i386\highspin2 2nd purple.ani
%TEMP%\rarsfx1\i386\hspin2 tranparents nesw.cur
%TEMP%\rarsfx1\i386\aero_working_dgreen.ani
%TEMP%\rarsfx1\i386\highspin2 2nd.ani
%TEMP%\rarsfx1\i386\aero_nwse_l.cur
%TEMP%\rarsfx1\i386\hspin2 tranparents nwse.cur
%TEMP%\rarsfx1\aero_pen.ani
%TEMP%\rarsfx1\aero_prec.ani
%TEMP%\rarsfx1\aero_select.ani
%TEMP%\rarsfx1\aero_unavail.ani
%TEMP%\rarsfx1\aero_up.cur
%TEMP%\rarsfx1\aero_working.ani
%TEMP%\rarsfx1\alternate select.ani
%TEMP%\rarsfx1\install.inf
%TEMP%\rarsfx1\oto.exe
%TEMP%\rarsfx1\precision select.ani
%TEMP%\rarsfx1\aero_alt.cur
%TEMP%\rarsfx1\aero_arrow.cur
%TEMP%\rarsfx1\aero_ew.cur
%TEMP%\rarsfx1\aero_helpsel.cur
%TEMP%\rarsfx1\aero_link.cur
%TEMP%\rarsfx1\aero_move.cur
%TEMP%\rarsfx1\aero_nesw.cur
%TEMP%\rarsfx1\aero_ns.cur
%TEMP%\rarsfx1\aero_nwse.cur
%TEMP%\rarsfx1\aero_pen.cur
%TEMP%\rarsfx1\aero_prec.cur
%TEMP%\rarsfx1\aero_nwse.ani
%TEMP%\rarsfx1\i386\aero_working_blue.ani
%TEMP%\rarsfx1\i386\aero_working_l.ani
%TEMP%\rarsfx1\aero_move.ani
%TEMP%\rarsfx1\i386\hspin2 tranparents unavail.cur
%TEMP%\rarsfx1\i386\hspin2 tranparents up.cur
%TEMP%\rarsfx1\i386\link_ba.cur
%TEMP%\rarsfx1\i386\move_ba.cur
%TEMP%\rarsfx1\i386\nesw_ba.cur
%TEMP%\rarsfx1\i386\ns_ba.cur
%TEMP%\rarsfx1\i386\nwse_ba.cur
%TEMP%\rarsfx1\i386\pen_ba.cur
%TEMP%\rarsfx1\i386\precisionselect.cur
%TEMP%\rarsfx1\i386\textselect.cur
%TEMP%\rarsfx1\i386\text_ba.cur
%TEMP%\rarsfx1\i386\unavail_ba.cur
%TEMP%\rarsfx1\i386\up_ba.cur
%TEMP%\rarsfx1\i386\we_ba.cur
%TEMP%\rarsfx1\i386\working_ba.ani
%TEMP%\rarsfx1\aero_alt.ani
%TEMP%\rarsfx1\aero_arrow.ani
%TEMP%\rarsfx1\aero_busy.ani
%TEMP%\rarsfx1\aero_ew.ani
%TEMP%\rarsfx1\aero_helpsel.ani
%TEMP%\rarsfx1\aero_link.ani
%TEMP%\rarsfx1\aero_nesw.ani
%TEMP%\rarsfx1\i386\hspin2 tranparents pen.cur
%TEMP%\rarsfx1\i386\aero_working_black.ani
%TEMP%\rarsfx1\i386\aero_working_b.ani
%TEMP%\rarsfx1\i386\aero_working1.ani
%TEMP%\rarsfx1\i386\aero_busy1.ani
%TEMP%\rarsfx1\i386\aero_busy_b.ani
%TEMP%\rarsfx1\i386\aero_busy_black.ani
%TEMP%\rarsfx1\i386\aero_busy_blue.ani
%TEMP%\rarsfx1\i386\aero_busy_dgreen.ani
%TEMP%\rarsfx1\i386\aero_busy_l.ani
%TEMP%\rarsfx1\i386\aero_busy_ngreen.ani
%TEMP%\rarsfx1\i386\aero_busy_pink.ani
%TEMP%\rarsfx1\i386\aero_busy_red.ani
%TEMP%\rarsfx1\i386\aero_busy_silver.ani
%TEMP%\rarsfx1\i386\aero_busy_xl.ani
%TEMP%\rarsfx1\i386\aero_cross_b.cur
%TEMP%\rarsfx1\i386\aero_ew.cur
%TEMP%\rarsfx1\i386\aero_ew1.cur
%TEMP%\rarsfx1\i386\aero_ew_b.cur
%TEMP%\rarsfx1\i386\aero_ew_l.cur
%TEMP%\rarsfx1\i386\aero_ew_xl.cur
%TEMP%\rarsfx1\i386\aero_helpsel.cur
%TEMP%\rarsfx1\i386\aero_helpsel1.cur
%TEMP%\rarsfx1\i386\aero_arrow_l.cur
%TEMP%\rarsfx1\i386\aero_arrow1.cur
%TEMP%\rarsfx1\i386\aero_busy.ani
%TEMP%\rarsfx1\aero_select.cur
%TEMP%\rarsfx1\i386\aero_helpsel_b.cur
%TEMP%\rarsfx1\i386\aero_arrow.cur
%TEMP%\$inst\2.tmp
%TEMP%\rarsfx1\aioaero.inf
%TEMP%\rarsfx1\cursor_install.exe
%TEMP%\rarsfx1\entries_aio_vista_aero_cursors.ini
%TEMP%\rarsfx1\i386\aeroii alternate.cur
%TEMP%\rarsfx1\i386\aeroii busy.ani
%TEMP%\rarsfx1\i386\aeroii cross.cur
%TEMP%\rarsfx1\i386\aeroii hand.ani
%TEMP%\rarsfx1\i386\aeroii handwriting.cur
%TEMP%\$inst\temp_0.tmp
%TEMP%\rarsfx1\i386\aeroii help select.cur
%TEMP%\rarsfx1\i386\aeroii resize all.cur
%TEMP%\rarsfx1\i386\aeroii resize left.cur
%TEMP%\rarsfx1\i386\aeroii resize right.cur
%TEMP%\rarsfx1\i386\aeroii size horz.cur
%TEMP%\rarsfx1\i386\aeroii size vert.cur
%TEMP%\rarsfx1\i386\aeroii text select.cur
%TEMP%\rarsfx1\i386\aeroii unavailable.cur
%TEMP%\rarsfx1\i386\aeroii working in backround.ani
%TEMP%\rarsfx1\i386\aero_alt.cur
%TEMP%\rarsfx1\i386\aeroii normal select.cur
%TEMP%\rarsfx1\i386\aero_arrow_b.cur
%TEMP%\rarsfx1\aero_ns.ani
%TEMP%\rarsfx1\i386\aero_helpsel_l.cur
%TEMP%\rarsfx1\i386\aero_link1.cur
%TEMP%\rarsfx1\i386\aero_pen_l.cur
%TEMP%\rarsfx1\i386\aero_pen_xl.cur
%TEMP%\rarsfx1\i386\aero_prec.cur
%TEMP%\rarsfx1\i386\aero_prec_l.cur
%TEMP%\rarsfx1\i386\aero_prec_xl.cur
%TEMP%\rarsfx1\i386\aero_select.cur
%TEMP%\rarsfx1\i386\aero_select_l.cur
%TEMP%\rarsfx1\i386\aero_select_xl.cur
%TEMP%\rarsfx1\i386\aero_text_b.cur
%TEMP%\rarsfx1\i386\aero_unavail.cur
%TEMP%\rarsfx1\i386\aero_unavail1.cur
%TEMP%\rarsfx1\i386\aero_unavail_b.cur
%TEMP%\rarsfx1\i386\aero_unavail_l.cur
%TEMP%\rarsfx1\i386\aero_unavail_xl.cur
%TEMP%\rarsfx1\i386\aero_up.cur
%TEMP%\rarsfx1\i386\aero_up1.cur
%TEMP%\rarsfx1\i386\aero_up_b.cur
%TEMP%\rarsfx1\i386\aero_up_l.cur
%TEMP%\rarsfx1\i386\aero_up_xl.cur
%TEMP%\rarsfx1\i386\aero_working.ani
%TEMP%\rarsfx1\i386\aero_helpsel_xl.cur
%TEMP%\rarsfx1\i386\aero_pen_b.cur
%TEMP%\rarsfx1\i386\aero_link.cur
%TEMP%\rarsfx1\i386\aero_pen.cur
%TEMP%\rarsfx1\i386\aero_arrow_xl.cur
%TEMP%\rarsfx1\i386\aero_link_b.cur
%TEMP%\rarsfx1\i386\aero_link_l.cur
%TEMP%\rarsfx1\i386\aero_link_xl.cur
%TEMP%\rarsfx1\i386\aero_move.cur
%TEMP%\rarsfx1\i386\aero_move1.cur
%TEMP%\rarsfx1\i386\aero_move_b.cur
%TEMP%\rarsfx1\i386\aero_move_l.cur
%TEMP%\rarsfx1\i386\aero_move_xl.cur
%TEMP%\rarsfx1\i386\aero_nesw.cur
%TEMP%\rarsfx1\i386\aero_nesw1.cur
%TEMP%\rarsfx1\i386\aero_nesw_b.cur
%TEMP%\rarsfx1\i386\aero_nesw_l.cur
%TEMP%\rarsfx1\i386\aero_nesw_xl.cur
%TEMP%\rarsfx1\i386\aero_ns.cur
%TEMP%\rarsfx1\i386\aero_ns1.cur
%TEMP%\rarsfx1\i386\aero_ns_b.cur
%TEMP%\rarsfx1\i386\aero_ns_l.cur
%TEMP%\rarsfx1\i386\aero_ns_xl.cur
%TEMP%\rarsfx1\i386\aero_nwse.cur
%TEMP%\rarsfx1\i386\aero_nwse1.cur
%TEMP%\rarsfx1\i386\aero_nwse_b.cur
%TEMP%\rarsfx1\i386\aero_nwse_xl.cur
%TEMP%\rarsfx1\aero_unavail.cur

Moves the following files

from %WINDIR%\cursors\aero\set54a4.tmp to %WINDIR%\cursors\aero\aero_alt.cur
from %WINDIR%\cursors\aero\set74dd.tmp to %WINDIR%\cursors\aero\highspin2 sm2nd pink.ani
from %WINDIR%\cursors\aero\set74fd.tmp to %WINDIR%\cursors\aero\highspin2 sm2nd purple.ani
from %WINDIR%\cursors\aero\set752d.tmp to %WINDIR%\cursors\aero\highspin2 sm2nd red.ani
from %WINDIR%\cursors\aero\set754d.tmp to %WINDIR%\cursors\aero\highspin2 sm2nd.ani
from %WINDIR%\cursors\aero\set756d.tmp to %WINDIR%\cursors\aero\highspin2 work black.ani
from %WINDIR%\cursors\aero\set758e.tmp to %WINDIR%\cursors\aero\highspin2 work blue.ani
from %WINDIR%\cursors\aero\set75dd.tmp to %WINDIR%\cursors\aero\highspin2 work green.ani
from %WINDIR%\cursors\aero\set761c.tmp to %WINDIR%\cursors\aero\highspin2 work orange.ani
from %WINDIR%\cursors\aero\set7126.tmp to %WINDIR%\cursors\aero\gold2nd trans.ani
from %WINDIR%\cursors\aero\set764c.tmp to %WINDIR%\cursors\aero\highspin2 work pink.ani
from %WINDIR%\cursors\aero\set76ab.tmp to %WINDIR%\cursors\aero\highspin2 work red.ani
from %WINDIR%\cursors\aero\set76cc.tmp to %WINDIR%\cursors\aero\highspin2 work.ani
from %WINDIR%\cursors\aero\set76fb.tmp to %WINDIR%\cursors\aero\hspin2 tranparents arrow.cur
from %WINDIR%\cursors\aero\set771c.tmp to %WINDIR%\cursors\aero\hspin2 tranparents ew.cur
from %WINDIR%\cursors\aero\set773c.tmp to %WINDIR%\cursors\aero\hspin2 tranparents help.cur
from %WINDIR%\cursors\aero\set775c.tmp to %WINDIR%\cursors\aero\hspin2 tranparents link.cur
from %WINDIR%\cursors\aero\set777c.tmp to %WINDIR%\cursors\aero\hspin2 tranparents move.cur
from %WINDIR%\cursors\aero\set77ac.tmp to %WINDIR%\cursors\aero\hspin2 tranparents nesw.cur
from %WINDIR%\cursors\aero\set745e.tmp to %WINDIR%\cursors\aero\highspin2 sm2nd green.ani
from %WINDIR%\cursors\aero\set749e.tmp to %WINDIR%\cursors\aero\highspin2 sm2nd orange.ani
from %WINDIR%\cursors\aero\set743e.tmp to %WINDIR%\cursors\aero\highspin2 sm2nd blue.ani
from %WINDIR%\cursors\aero\set740e.tmp to %WINDIR%\cursors\aero\highspin2 2nd.ani
from %WINDIR%\cursors\aero\set73cf.tmp to %WINDIR%\cursors\aero\highspin2 2nd red.ani
from %WINDIR%\cursors\aero\set6f59.tmp to %WINDIR%\cursors\aero\aeroii size horz.cur
from %WINDIR%\cursors\aero\set6f79.tmp to %WINDIR%\cursors\aero\aeroii size vert.cur
from %WINDIR%\cursors\aero\set6f99.tmp to %WINDIR%\cursors\aero\aeroii text select.cur
from %WINDIR%\cursors\aero\set6fe8.tmp to %WINDIR%\cursors\aero\aeroii unavailable.cur
from %WINDIR%\cursors\aero\set7008.tmp to %WINDIR%\cursors\aero\aeroii working in backround.ani
from %WINDIR%\cursors\aero\set7038.tmp to %WINDIR%\cursors\aero\arrow_ba.cur
from %WINDIR%\cursors\aero\set7087.tmp to %WINDIR%\cursors\aero\black trans.ani
from %WINDIR%\cursors\aero\set70a7.tmp to %WINDIR%\cursors\aero\busy_ba.ani
from %WINDIR%\cursors\aero\set77dc.tmp to %WINDIR%\cursors\aero\hspin2 tranparents ns.cur
from %WINDIR%\cursors\aero\set767c.tmp to %WINDIR%\cursors\aero\highspin2 work purple.ani
from %WINDIR%\cursors\aero\set70d7.tmp to %WINDIR%\cursors\aero\cross_ba.cur
from %WINDIR%\cursors\aero\set7176.tmp to %WINDIR%\cursors\aero\gold2nd.ani
from %WINDIR%\cursors\aero\set7196.tmp to %WINDIR%\cursors\aero\helpse_bal.cur
from %WINDIR%\cursors\aero\set71c6.tmp to %WINDIR%\cursors\aero\highspin2 2nd black.ani
from %WINDIR%\cursors\aero\set7205.tmp to %WINDIR%\cursors\aero\highspin2 2nd blue.ani
from %WINDIR%\cursors\aero\set7254.tmp to %WINDIR%\cursors\aero\highspin2 2nd green.ani
from %WINDIR%\cursors\aero\set7275.tmp to %WINDIR%\cursors\aero\highspin2 2nd orange.ani
from %WINDIR%\cursors\aero\set737f.tmp to %WINDIR%\cursors\aero\highspin2 2nd pink.ani
from %WINDIR%\cursors\aero\set73af.tmp to %WINDIR%\cursors\aero\highspin2 2nd purple.ani
from %WINDIR%\cursors\aero\set6f29.tmp to %WINDIR%\cursors\aero\aeroii resize right.cur
from %WINDIR%\cursors\aero\set7146.tmp to %WINDIR%\cursors\aero\gold2nd work.ani
from %WINDIR%\cursors\aero\set783a.tmp to %WINDIR%\cursors\aero\hspin2 tranparents nwse.cur
from %WINDIR%\cursors\aero\set785b.tmp to %WINDIR%\cursors\aero\hspin2 tranparents pen.cur
from %WINDIR%\cursors\aero\set787b.tmp to %WINDIR%\cursors\aero\hspin2 tranparents unavail.cur
from %WINDIR%\cursors\mango\setc94f.tmp to %WINDIR%\cursors\mango\aero_nwse.ani
from %WINDIR%\cursors\mango\setc97f.tmp to %WINDIR%\cursors\mango\aero_nesw.ani
from %WINDIR%\cursors\mango\setc9be.tmp to %WINDIR%\cursors\mango\aero_move.ani
from %WINDIR%\cursors\mango\setc9fe.tmp to %WINDIR%\cursors\mango\aero_link.ani
from %WINDIR%\cursors\mango\setca1e.tmp to %WINDIR%\cursors\mango\aero_prec.ani
from %WINDIR%\cursors\mango\setcaf9.tmp to %WINDIR%\cursors\mango\aero_pen.ani
from %WINDIR%\cursors\mango\setcb19.tmp to %WINDIR%\cursors\mango\aero_alt.ani
from %WINDIR%\cursors\windows 8\set1747.tmp to %WINDIR%\cursors\windows 8\aero_arrow.cur
from %WINDIR%\cursors\windows 8\set1787.tmp to %WINDIR%\cursors\windows 8\aero_helpsel.cur
from %WINDIR%\cursors\windows 8\set17e6.tmp to %WINDIR%\cursors\windows 8\aero_busy.ani
from %WINDIR%\cursors\aero\set6eca.tmp to %WINDIR%\cursors\aero\aeroii resize left.cur
from %WINDIR%\cursors\windows 8\set1816.tmp to %WINDIR%\cursors\windows 8\aero_select.cur
from %WINDIR%\cursors\windows 8\set1836.tmp to %WINDIR%\cursors\windows 8\aero_unavail.cur
from %WINDIR%\cursors\windows 8\set1856.tmp to %WINDIR%\cursors\windows 8\aero_ns.cur
from %WINDIR%\cursors\windows 8\set1886.tmp to %WINDIR%\cursors\windows 8\aero_ew.cur
from %WINDIR%\cursors\windows 8\set18a6.tmp to %WINDIR%\cursors\windows 8\aero_nwse.cur
from %WINDIR%\cursors\windows 8\set18c7.tmp to %WINDIR%\cursors\windows 8\aero_nesw.cur
from %WINDIR%\cursors\windows 8\set18f6.tmp to %WINDIR%\cursors\windows 8\aero_move.cur
from %WINDIR%\cursors\windows 8\set1936.tmp to %WINDIR%\cursors\windows 8\aero_link.cur
from %WINDIR%\cursors\windows 8\set1994.tmp to %WINDIR%\cursors\windows 8\aero_prec.cur
from %WINDIR%\cursors\mango\setc910.tmp to %WINDIR%\cursors\mango\aero_ew.ani
from %WINDIR%\cursors\aero\set7c7c.tmp to %WINDIR%\cursors\aero\text_ba.cur
from %WINDIR%\cursors\mango\setc8c1.tmp to %WINDIR%\cursors\mango\aero_ns.ani
from %WINDIR%\cursors\aero\set7c2d.tmp to %WINDIR%\cursors\aero\precisionselect.cur
from %WINDIR%\cursors\aero\set78ab.tmp to %WINDIR%\cursors\aero\hspin2 tranparents up.cur
from %WINDIR%\cursors\aero\set7909.tmp to %WINDIR%\cursors\aero\hspin tranparent text.cur
from %WINDIR%\cursors\aero\set7968.tmp to %WINDIR%\cursors\aero\hspin transparent press.cur
from %WINDIR%\cursors\aero\set7998.tmp to %WINDIR%\cursors\aero\link_ba.cur
from %WINDIR%\cursors\aero\set79e7.tmp to %WINDIR%\cursors\aero\move_ba.cur
from %WINDIR%\cursors\aero\set7a16.tmp to %WINDIR%\cursors\aero\nesw_ba.cur
from %WINDIR%\cursors\aero\set7a37.tmp to %WINDIR%\cursors\aero\ns_ba.cur
from %WINDIR%\cursors\aero\set7ab4.tmp to %WINDIR%\cursors\aero\nwse_ba.cur
from %WINDIR%\cursors\aero\set7bce.tmp to %WINDIR%\cursors\aero\pen_ba.cur
from %WINDIR%\cursors\windows 8\set19c4.tmp to %WINDIR%\cursors\windows 8\aero_pen.cur
from %WINDIR%\cursors\mango\setc842.tmp to %WINDIR%\cursors\mango\aero_select.ani
from %WINDIR%\cursors\aero\set7ccb.tmp to %WINDIR%\cursors\aero\textselect.cur
from %WINDIR%\cursors\aero\set7d1a.tmp to %WINDIR%\cursors\aero\unavail_ba.cur
from %WINDIR%\cursors\aero\set7d4a.tmp to %WINDIR%\cursors\aero\up_ba.cur
from %WINDIR%\cursors\aero\set7df6.tmp to %WINDIR%\cursors\aero\we_ba.cur
from %WINDIR%\cursors\aero\set7e45.tmp to %WINDIR%\cursors\aero\working_ba.ani
from %WINDIR%\cursors\mango\setc792.tmp to %WINDIR%\cursors\mango\aero_arrow.ani
from %WINDIR%\cursors\mango\setc7c2.tmp to %WINDIR%\cursors\mango\aero_helpsel.ani
from %WINDIR%\cursors\mango\setc7e2.tmp to %WINDIR%\cursors\mango\aero_working.ani
from %WINDIR%\cursors\mango\setc812.tmp to %WINDIR%\cursors\mango\aero_busy.ani
from %WINDIR%\cursors\mango\setc872.tmp to %WINDIR%\cursors\mango\aero_unavail.ani
from %WINDIR%\cursors\windows 8\set17b6.tmp to %WINDIR%\cursors\windows 8\aero_working.ani
from %WINDIR%\cursors\aero\set6eaa.tmp to %WINDIR%\cursors\aero\aeroii resize all.cur
from %WINDIR%\cursors\aero\set6a0b.tmp to %WINDIR%\cursors\aero\aero_working_l.ani
from %WINDIR%\cursors\aero\set5a0c.tmp to %WINDIR%\cursors\aero\aero_helpsel_b.cur
from %WINDIR%\cursors\aero\set5a2c.tmp to %WINDIR%\cursors\aero\aero_helpsel_l.cur
from %WINDIR%\cursors\aero\set5a8a.tmp to %WINDIR%\cursors\aero\aero_helpsel_xl.cur
from %WINDIR%\cursors\aero\set5aab.tmp to %WINDIR%\cursors\aero\aero_link1.cur
from %WINDIR%\cursors\aero\set5afa.tmp to %WINDIR%\cursors\aero\aero_link.cur
from %WINDIR%\cursors\aero\set5b1a.tmp to %WINDIR%\cursors\aero\aero_link_b.cur
from %WINDIR%\cursors\aero\set5ba7.tmp to %WINDIR%\cursors\aero\aero_link_l.cur
from %WINDIR%\cursors\aero\set5bc7.tmp to %WINDIR%\cursors\aero\aero_link_xl.cur
from %WINDIR%\cursors\aero\set5683.tmp to %WINDIR%\cursors\aero\aero_busy_dgreen.ani
from %WINDIR%\cursors\aero\set5c26.tmp to %WINDIR%\cursors\aero\aero_move1.cur
from %WINDIR%\cursors\aero\set5c95.tmp to %WINDIR%\cursors\aero\aero_move_b.cur
from %WINDIR%\cursors\aero\set5cb5.tmp to %WINDIR%\cursors\aero\aero_move_l.cur
from %WINDIR%\cursors\aero\set5d24.tmp to %WINDIR%\cursors\aero\aero_move_xl.cur
from %WINDIR%\cursors\aero\set5d44.tmp to %WINDIR%\cursors\aero\aero_nesw1.cur
from %WINDIR%\cursors\aero\set5e8c.tmp to %WINDIR%\cursors\aero\aero_nesw.cur
from %WINDIR%\cursors\aero\set5ecc.tmp to %WINDIR%\cursors\aero\aero_nesw_b.cur
from %WINDIR%\cursors\aero\set5f59.tmp to %WINDIR%\cursors\aero\aero_nesw_l.cur
from %WINDIR%\cursors\aero\set6006.tmp to %WINDIR%\cursors\aero\aero_nesw_xl.cur
from %WINDIR%\cursors\aero\set596e.tmp to %WINDIR%\cursors\aero\aero_helpsel1.cur
from %WINDIR%\cursors\aero\set59ad.tmp to %WINDIR%\cursors\aero\aero_helpsel.cur
from %WINDIR%\cursors\aero\set58ff.tmp to %WINDIR%\cursors\aero\aero_ew_xl.cur
from %WINDIR%\cursors\aero\set58d0.tmp to %WINDIR%\cursors\aero\aero_ew_l.cur
from %WINDIR%\cursors\aero\set5871.tmp to %WINDIR%\cursors\aero\aero_ew_b.cur
from %WINDIR%\cursors\aero\set54f4.tmp to %WINDIR%\cursors\aero\aero_arrow.cur
from %WINDIR%\cursors\aero\set5524.tmp to %WINDIR%\cursors\aero\aero_arrow_b.cur
from %WINDIR%\cursors\aero\set5544.tmp to %WINDIR%\cursors\aero\aero_arrow_l.cur
from %WINDIR%\cursors\aero\set5584.tmp to %WINDIR%\cursors\aero\aero_arrow_xl.cur
from %WINDIR%\cursors\aero\set55a4.tmp to %WINDIR%\cursors\aero\aero_busy1.ani
from %WINDIR%\cursors\aero\set55d4.tmp to %WINDIR%\cursors\aero\aero_busy.ani
from %WINDIR%\cursors\aero\set55f4.tmp to %WINDIR%\cursors\aero\aero_busy_b.ani
from %WINDIR%\cursors\aero\set5633.tmp to %WINDIR%\cursors\aero\aero_busy_black.ani
from %WINDIR%\cursors\aero\set6036.tmp to %WINDIR%\cursors\aero\aero_ns1.cur
from %WINDIR%\cursors\aero\set5c46.tmp to %WINDIR%\cursors\aero\aero_move.cur
from %WINDIR%\cursors\aero\set5663.tmp to %WINDIR%\cursors\aero\aero_busy_blue.ani
from %WINDIR%\cursors\aero\set56d3.tmp to %WINDIR%\cursors\aero\aero_busy_ngreen.ani
from %WINDIR%\cursors\aero\set5703.tmp to %WINDIR%\cursors\aero\aero_busy_pink.ani
from %WINDIR%\cursors\aero\set5733.tmp to %WINDIR%\cursors\aero\aero_busy_red.ani
from %WINDIR%\cursors\aero\set5763.tmp to %WINDIR%\cursors\aero\aero_busy_silver.ani
from %WINDIR%\cursors\aero\set5783.tmp to %WINDIR%\cursors\aero\aero_busy_xl.ani
from %WINDIR%\cursors\aero\set57d2.tmp to %WINDIR%\cursors\aero\aero_cross_b.cur
from %WINDIR%\cursors\aero\set57f2.tmp to %WINDIR%\cursors\aero\aero_ew1.cur
from %WINDIR%\cursors\aero\set5860.tmp to %WINDIR%\cursors\aero\aero_ew.cur
from %WINDIR%\cursors\aero\set54d4.tmp to %WINDIR%\cursors\aero\aero_arrow1.cur
from %WINDIR%\cursors\aero\set56a4.tmp to %WINDIR%\cursors\aero\aero_busy_l.ani
from %WINDIR%\cursors\aero\set60a4.tmp to %WINDIR%\cursors\aero\aero_ns.cur
from %WINDIR%\cursors\aero\set60f3.tmp to %WINDIR%\cursors\aero\aero_ns_b.cur
from %WINDIR%\cursors\aero\set6123.tmp to %WINDIR%\cursors\aero\aero_ns_l.cur
from %WINDIR%\cursors\aero\set6763.tmp to %WINDIR%\cursors\aero\aero_up_b.cur
from %WINDIR%\cursors\aero\set67b2.tmp to %WINDIR%\cursors\aero\aero_up_l.cur
from %WINDIR%\cursors\aero\set6811.tmp to %WINDIR%\cursors\aero\aero_up_xl.cur
from %WINDIR%\cursors\aero\set689e.tmp to %WINDIR%\cursors\aero\aero_working1.ani
from %WINDIR%\cursors\aero\set68ed.tmp to %WINDIR%\cursors\aero\aero_working.ani
from %WINDIR%\cursors\aero\set695b.tmp to %WINDIR%\cursors\aero\aero_working_b.ani
from %WINDIR%\cursors\aero\set698b.tmp to %WINDIR%\cursors\aero\aero_working_black.ani
from %WINDIR%\cursors\aero\set69ab.tmp to %WINDIR%\cursors\aero\aero_working_blue.ani
from %WINDIR%\cursors\aero\set69db.tmp to %WINDIR%\cursors\aero\aero_working_dgreen.ani
from %WINDIR%\cursors\aero\set6a3b.tmp to %WINDIR%\cursors\aero\aero_working_ngreen.ani
from %WINDIR%\cursors\aero\set6e6b.tmp to %WINDIR%\cursors\aero\aeroii normal select.cur
from %WINDIR%\cursors\aero\set6a8a.tmp to %WINDIR%\cursors\aero\aero_working_pink.ani
from %WINDIR%\cursors\aero\set6aba.tmp to %WINDIR%\cursors\aero\aero_working_red.ani
from %WINDIR%\cursors\aero\set6ae9.tmp to %WINDIR%\cursors\aero\aero_working_silver.ani
from %WINDIR%\cursors\aero\set6b19.tmp to %WINDIR%\cursors\aero\aero_working_xl.ani
from %WINDIR%\cursors\aero\set6cb0.tmp to %WINDIR%\cursors\aero\aeroii alternate.cur
from %WINDIR%\cursors\aero\set6d0e.tmp to %WINDIR%\cursors\aero\aeroii busy.ani
from %WINDIR%\cursors\aero\set6d5d.tmp to %WINDIR%\cursors\aero\aeroii cross.cur
from %WINDIR%\cursors\aero\set6dac.tmp to %WINDIR%\cursors\aero\aeroii hand.ani
from %WINDIR%\cursors\aero\set6dfb.tmp to %WINDIR%\cursors\aero\aeroii handwriting.cur
from %WINDIR%\cursors\aero\set6743.tmp to %WINDIR%\cursors\aero\aero_up.cur
from %WINDIR%\cursors\aero\set63fb.tmp to %WINDIR%\cursors\aero\aero_prec.cur
from %WINDIR%\cursors\aero\set6713.tmp to %WINDIR%\cursors\aero\aero_up1.cur
from %WINDIR%\cursors\aero\set63ac.tmp to %WINDIR%\cursors\aero\aero_pen_xl.cur
from %WINDIR%\cursors\aero\set6152.tmp to %WINDIR%\cursors\aero\aero_ns_xl.cur
from %WINDIR%\cursors\aero\set6173.tmp to %WINDIR%\cursors\aero\aero_nwse1.cur
from %WINDIR%\cursors\aero\set61b2.tmp to %WINDIR%\cursors\aero\aero_nwse.cur
from %WINDIR%\cursors\aero\set623f.tmp to %WINDIR%\cursors\aero\aero_nwse_b.cur
from %WINDIR%\cursors\aero\set6260.tmp to %WINDIR%\cursors\aero\aero_nwse_l.cur
from %WINDIR%\cursors\aero\set62af.tmp to %WINDIR%\cursors\aero\aero_nwse_xl.cur
from %WINDIR%\cursors\aero\set62de.tmp to %WINDIR%\cursors\aero\aero_pen.cur
from %WINDIR%\cursors\aero\set631e.tmp to %WINDIR%\cursors\aero\aero_pen_b.cur
from %WINDIR%\cursors\aero\set637c.tmp to %WINDIR%\cursors\aero\aero_pen_l.cur
from %WINDIR%\cursors\aero\set6e4a.tmp to %WINDIR%\cursors\aero\aeroii help select.cur
from %WINDIR%\cursors\aero\set66b4.tmp to %WINDIR%\cursors\aero\aero_unavail_l.cur
from %WINDIR%\cursors\aero\set645a.tmp to %WINDIR%\cursors\aero\aero_prec_l.cur
from %WINDIR%\cursors\aero\set64d8.tmp to %WINDIR%\cursors\aero\aero_prec_xl.cur
from %WINDIR%\cursors\aero\set6546.tmp to %WINDIR%\cursors\aero\aero_select.cur
from %WINDIR%\cursors\aero\set6566.tmp to %WINDIR%\cursors\aero\aero_select_l.cur
from %WINDIR%\cursors\aero\set6596.tmp to %WINDIR%\cursors\aero\aero_select_xl.cur
from %WINDIR%\cursors\aero\set65c6.tmp to %WINDIR%\cursors\aero\aero_text_b.cur
from %WINDIR%\cursors\aero\set6615.tmp to %WINDIR%\cursors\aero\aero_unavail1.cur
from %WINDIR%\cursors\aero\set6654.tmp to %WINDIR%\cursors\aero\aero_unavail.cur
from %WINDIR%\cursors\aero\set6674.tmp to %WINDIR%\cursors\aero\aero_unavail_b.cur
from %WINDIR%\cursors\aero\set66e3.tmp to %WINDIR%\cursors\aero\aero_unavail_xl.cur
from %WINDIR%\cursors\windows 8\set19f4.tmp to %WINDIR%\cursors\windows 8\aero_alt.cur

Modifies the following files

%LOCALAPPDATA%\microsoft\windows\explorer\explorerstartuplog_runonce.etl

Substitutes the following files

%TEMP%\rarsfx1\aero_working.ani
%TEMP%\rarsfx1\aero_busy.ani
%TEMP%\rarsfx1\aero_up.cur
%TEMP%\rarsfx1\install.inf
%TEMP%\rarsfx1\oto.exe

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''

Creates and executes the following

'%ALLUSERSPROFILE%\setup.exe' /s
'%TEMP%\rarsfx1\cursor_install.exe'
'%TEMP%\rarsfx0\aero_cursors4.exe'
'%WINDIR%\cursors\aero cursors\oto.exe'
'%TEMP%\rarsfx0\01_maviboot.exe'
'%TEMP%\rarsfx0\aero_cursors1.exe'
'%TEMP%\rarsfx0\03_cabuk_ulas.exe'
'%TEMP%\rarsfx1\oto.exe'
'%TEMP%\rarsfx0\install.exe'
'%TEMP%\rarsfx0\aero_cursors2.exe'
'%TEMP%\rarsfx0\aero_cursors5.exe'
'%TEMP%\rarsfx0\02_easm.exe'
'%TEMP%\rarsfx0\01_sagtus_eklentileri.exe'
'%TEMP%\rarsfx0\aero_cursors6.exe'
'%TEMP%\rarsfx0\cwnd.exe' /hide @
'%WINDIR%\syswow64\cwnd.exe' /hide @
'%TEMP%\rarsfx0\aero_cursors3.exe'
'%TEMP%\rarsfx0\recuva_1.30.435.exe'
'%TEMP%\rarsfx0\aero_cursors3.exe' ' (with hidden window)
'%TEMP%\rarsfx0\aero_cursors5.exe' ' (with hidden window)
'%TEMP%\rarsfx0\aero_cursors4.exe' ' (with hidden window)
'%TEMP%\rarsfx0\aero_cursors1.exe' ' (with hidden window)
'%WINDIR%\syswow64\regedit.exe' /S kur.reg' (with hidden window)
'%TEMP%\rarsfx0\aero_cursors6.exe' ' (with hidden window)
'%TEMP%\rarsfx0\01_sagtus_eklentileri.exe' ' (with hidden window)
'%TEMP%\rarsfx0\recuva_1.30.435.exe' ' (with hidden window)
'%TEMP%\rarsfx0\02_easm.exe' ' (with hidden window)
'%WINDIR%\syswow64\regedit.exe' /S EASMurat.reg' (with hidden window)
'%TEMP%\rarsfx0\cwnd.exe' /hide @' (with hidden window)
'%TEMP%\rarsfx0\aero_cursors2.exe' ' (with hidden window)
'%TEMP%\rarsfx0\03_cabuk_ulas.exe' ' (with hidden window)
'%TEMP%\rarsfx0\01_maviboot.exe' ' (with hidden window)

Executes the following

'%WINDIR%\syswow64\regedit.exe' /S EASMurat.reg
'%WINDIR%\syswow64\attrib.exe' -h -r -s "<SYSTEM32>\ntkrnlpa.exe"
'%WINDIR%\syswow64\cmd.exe' /c call "%TEMP%\RarSFX1\Boot\.ReplacerTemp\Special.cmd" \CpyBak
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo/"%TEMP%\RarSFX1\Boot\ntkrnlpa.exe""
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo/"<SYSTEM32>\ntkrnlpa.exe""
'%WINDIR%\syswow64\cmd.exe' /c call "%TEMP%\RarSFX1\Boot\.ReplacerTemp\Special.cmd" \KeyScr
'%WINDIR%\syswow64\cmd.exe' /c call "%TEMP%\RarSFX1\Boot\.ReplacerTemp\Special.cmd" \RepScr
'%WINDIR%\syswow64\find.exe' /c /v "" "%TEMP%\RarSFX1\Boot\.ReplacerTemp\.CurrentScript"
'%WINDIR%\syswow64\cmd.exe' /c find/c /v "" "%TEMP%\RarSFX1\Boot\.ReplacerTemp\.CurrentScript"
'%WINDIR%\syswow64\find.exe' /i ";; ReplacerScript" "%TEMP%\RarSFX1\Boot\ntkrnlpa.exe.script"
'%WINDIR%\syswow64\find.exe' "*"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo/"%TEMP%\RarSFX1\Boot\ntkrnlpa.exe.script""
'%WINDIR%\syswow64\cmd.exe' /c call "%TEMP%\RarSFX1\Boot\.ReplacerTemp\Special.cmd" \ChkScr
'%WINDIR%\syswow64\find.exe' "?"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo/"ntkrnlpa.exe.script""
'%WINDIR%\syswow64\cmd.exe' /c call "%TEMP%\RarSFX1\Boot\.ReplacerTemp\Special.cmd" \RepSys
'%WINDIR%\syswow64\expand.exe' "%TEMP%\RarSFX1\Boot\data" -f:* "%TEMP%\RarSFX1\Boot\.ReplacerTemp"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" ver"
'%WINDIR%\syswow64\cmd.exe' /K replacer.cmd ntkrnlpa.exe.script
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX1\Boot\boot.cmd" "
'%WINDIR%\syswow64\infdefaultinstall.exe' "%TEMP%\RarSFX1\Install.inf"
'%WINDIR%\syswow64\grpconv.exe' -o
'%WINDIR%\syswow64\runonce.exe' -r
'%WINDIR%\syswow64\infdefaultinstall.exe' "%TEMP%\RarSFX1\AIOAero.inf"
'%WINDIR%\syswow64\regedit.exe' /S kur.reg
'%WINDIR%\syswow64\regedit.exe' /S CABUK_ULAS.reg
'%WINDIR%\syswow64\regsvr32.exe' /s preview.dll
'%WINDIR%\syswow64\regedit.exe' /s Dosya_UZANTILARINI_goster_gizle_EKLE.reg
'%WINDIR%\syswow64\regedit.exe' /s hidden.reg
'%WINDIR%\syswow64\regsvr32.exe' /s hiddenfi.dll
'%WINDIR%\syswow64\cmd.exe' /c ""<SYSTEM32>\1.bat" "
'%WINDIR%\syswow64\find.exe' "NT"
'%WINDIR%\syswow64\cmd.exe' /c call "%TEMP%\RarSFX1\Boot\.ReplacerTemp\Special.cmd" \CpyErr

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial