Trojan.Encoder.255

Technical Information

Modifies file system :

Creates the following files:

%WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\connected_data.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\control_up.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\connected_networks.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Coffee Bean.bmp.mrcryptorfile@yahoo.com_crypt
%WINDIR%\FeatherTexture.bmp.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Gone Fishing.bmp.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Blue Lace 16.bmp.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00117.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.txt.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Greenstone.bmp.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\best_secure.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\best_robust.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\best_road.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\best_road_big.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img103.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img109.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img110.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img100.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img072.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img074a.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img089.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img116.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img149.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\intro_logo.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\logo.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img136.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img121.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img123.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img126.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\gradient.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\icon_up.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img004b.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\folder_up.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\desktop_up.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\end_up.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img014.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img046.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img060.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img068.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img040.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img033.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img033a.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\img034.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00076.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00077.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00078.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00075.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00072.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00073.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00074.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00079.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00084.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00085.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00086.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00083.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00080.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00081.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00082.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00061.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00062.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00063.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00060.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00057.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00058.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00059.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00064.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00069.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00070.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00071.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00068.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00065.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00066.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00067.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00106.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00107.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00108.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00105.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00102.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00103.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00104.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00109.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00114.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00115.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00116.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00113.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00110.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00111.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00112.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00091.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00092.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00093.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00090.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00087.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00088.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00089.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00094.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00099.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00100.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00101.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00098.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00095.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00096.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00097.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\pen_icon.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Ringout.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Shutdown.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Start.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Ringin.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Print complete.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Recycle.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Restore.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Startup.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU1.txt.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU2.txt.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\EULA.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Exclamation.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Hardware Fail.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Hardware Insert.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Error.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Critical Stop.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Default.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Ding.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Hardware Remove.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Minimize.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Notify.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Pop-up Blocked.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Menu Command.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Information Bar.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Logoff Sound.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Logon Sound.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1044.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1045.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1046.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1043.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1040.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1041.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1042.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1049.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.3082.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\logo.bmp.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\dd_dotnetfx35error.txt.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2070.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1053.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1055.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2052.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1025.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1028.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1029.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\VSMsiLog22FD.txt.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\dd_dotnetfx3error.txt.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\dd_dotnetfx3install.txt.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1030.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1036.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1037.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1038.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1035.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1031.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1032.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1033.rtf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\unlock_optimized_big.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\mmTour\nav.txt.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\mmTour\segment1.swf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\mmTour\segment1.txt.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\mmTour\nav.swf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\window_up.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\mmTour\intro.swf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\mmTour\intro.txt.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\question_icon.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\read_icon.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\safe_easy_better.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\taskbar_up.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\ul_logo.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\unlock_built.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\start_up.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\chord.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\ding.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\notify.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\chimes.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud8.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud9.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\imsins.BAK.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\recycle.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Balloon.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Battery Critical.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\Windows XP Battery Low.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\tada.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\ringin.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\ringout.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Media\start.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\mmTour\segment4.swf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\mmTour\segment4.txt.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\mmTour\segment5.swf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\mmTour\segment3.txt.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\mmTour\segment2.swf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\mmTour\segment2.txt.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\mmTour\segment3.swf.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\mmTour\segment5.txt.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud5.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud6.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud7.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud4.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud1.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud2.wav.mrcryptorfile@yahoo.com_crypt
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud3.wav.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\Colorer\README.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\Compare\changelog.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\DrawLine\changelog.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\Colorer\LICENSE.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\AutoWrap\changelog.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\Brackets\changelog.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\Colorer\hrc\changes.txt.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\EditCase\changelog.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\FarCmds\changelog.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\EMenu\changelog.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.mrcryptorfile@yahoo.com_crypt
C:\Far2\Documentation\eng\TechInfo.txt.mrcryptorfile@yahoo.com_crypt
C:\Far2\Documentation\rus\Arc.Support.txt.mrcryptorfile@yahoo.com_crypt
C:\Far2\Documentation\rus\Bug.Report.txt.mrcryptorfile@yahoo.com_crypt
C:\Far2\Documentation\eng\Plugins.Review.txt.mrcryptorfile@yahoo.com_crypt
C:\Far2\Documentation\eng\Bug.Report.txt.mrcryptorfile@yahoo.com_crypt
C:\Far2\Documentation\eng\Far.FAQ.txt.mrcryptorfile@yahoo.com_crypt
C:\Far2\Documentation\eng\Plugins.Install.txt.mrcryptorfile@yahoo.com_crypt
C:\Far2\Documentation\rus\Far.FAQ.txt.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\7-Zip\far7z.txt.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\Align\changelog.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\arclite\changelog.mrcryptorfile@yahoo.com_crypt
C:\Far2\FExcept\changelog.mrcryptorfile@yahoo.com_crypt
C:\Far2\Documentation\rus\Plugins.Install.txt.mrcryptorfile@yahoo.com_crypt
C:\Far2\Documentation\rus\Plugins.Review.txt.mrcryptorfile@yahoo.com_crypt
C:\Far2\Documentation\rus\TechInfo.txt.mrcryptorfile@yahoo.com_crypt
%CommonProgramFiles%\Microsoft Shared\Stationery\Nature Bkgrd.jpg.mrcryptorfile@yahoo.com_crypt
%CommonProgramFiles%\Microsoft Shared\Stationery\Pie Charts Bkgrd.jpg.mrcryptorfile@yahoo.com_crypt
%CommonProgramFiles%\Microsoft Shared\Stationery\Sunflower Bkgrd.jpg.mrcryptorfile@yahoo.com_crypt
%CommonProgramFiles%\Microsoft Shared\Stationery\Maize Bkgrd.jpg.mrcryptorfile@yahoo.com_crypt
%CommonProgramFiles%\Microsoft Shared\Stationery\Fiesta Bkgrd.jpg.mrcryptorfile@yahoo.com_crypt
%CommonProgramFiles%\Microsoft Shared\Stationery\Glacier Bkgrd.jpg.mrcryptorfile@yahoo.com_crypt
%CommonProgramFiles%\Microsoft Shared\Stationery\Leaves Bkgrd.jpg.mrcryptorfile@yahoo.com_crypt
%CommonProgramFiles%\Services\bigfoot.bmp.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\notfound.wav.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\panelarrow-horizontal.svg.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\panelarrow-vertical.svg.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\keyhole-forward-mask.svg.mrcryptorfile@yahoo.com_crypt
%CommonProgramFiles%\Services\verisign.bmp.mrcryptorfile@yahoo.com_crypt
%CommonProgramFiles%\Services\whowhere.bmp.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\keyhole-forward-mask.svg.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\FTP\Notes.txt.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\FTP\Notes_rus.txt.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\HlfViewer\changelog.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\FTP\FtpCmds_rus.txt.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\FileCase\changelog.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\FTP\changelog.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\FTP\FtpCmds.txt.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\MacroView\changelog.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\WinSCP\readme.mrcryptorfile@yahoo.com_crypt
<Auxiliary element>
%CommonProgramFiles%\Microsoft Shared\Stationery\Clear Day Bkgrd.jpg.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\WinSCP\licence.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\Network\changelog.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\ProcList\changelog.mrcryptorfile@yahoo.com_crypt
C:\Far2\Plugins\TmpPanel\changelog.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.mrcryptorfile@yahoo.com_crypt
C:\как_расшифровать.txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\d42cc0c3858a58db2db37658219e6400_23ef5514-3059-436f-a4a7-4cefaab20eb1.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.mrcryptorfile@yahoo.com_crypt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\_CACHE_MAP_.mrcryptorfile@yahoo.com_crypt
%HOMEPATH%\Templates\excel.xls.mrcryptorfile@yahoo.com_crypt
%HOMEPATH%\Templates\excel4.xls.mrcryptorfile@yahoo.com_crypt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\_CACHE_003_.mrcryptorfile@yahoo.com_crypt
<LS_APPDATA>\IconCache.db.mrcryptorfile@yahoo.com_crypt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\_CACHE_001_.mrcryptorfile@yahoo.com_crypt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\_CACHE_002_.mrcryptorfile@yahoo.com_crypt
%HOMEPATH%\Templates\powerpnt.ppt.mrcryptorfile@yahoo.com_crypt
C:\Far2\changelog.mrcryptorfile@yahoo.com_crypt
C:\Far2\changelog_eng.mrcryptorfile@yahoo.com_crypt
C:\Far2\Documentation\eng\Arc.Support.txt.mrcryptorfile@yahoo.com_crypt
C:\Far2\Addons\README.TXT.mrcryptorfile@yahoo.com_crypt
%HOMEPATH%\Templates\sndrec.wav.mrcryptorfile@yahoo.com_crypt
%HOMEPATH%\Templates\winword.doc.mrcryptorfile@yahoo.com_crypt
%HOMEPATH%\Templates\winword2.doc.mrcryptorfile@yahoo.com_crypt
C:\Documents and Settings\Default User\Templates\excel4.xls.mrcryptorfile@yahoo.com_crypt
C:\Documents and Settings\Default User\Templates\powerpnt.ppt.mrcryptorfile@yahoo.com_crypt
C:\Documents and Settings\Default User\Templates\sndrec.wav.mrcryptorfile@yahoo.com_crypt
C:\Documents and Settings\Default User\Templates\excel.xls.mrcryptorfile@yahoo.com_crypt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.mrcryptorfile@yahoo.com_crypt
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.bak.mrcryptorfile@yahoo.com_crypt
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.mrcryptorfile@yahoo.com_crypt
C:\Documents and Settings\Default User\Templates\winword.doc.mrcryptorfile@yahoo.com_crypt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.mrcryptorfile@yahoo.com_crypt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.mrcryptorfile@yahoo.com_crypt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.mrcryptorfile@yahoo.com_crypt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.mrcryptorfile@yahoo.com_crypt
C:\Documents and Settings\Default User\Templates\winword2.doc.mrcryptorfile@yahoo.com_crypt
%APPDATA%\Microsoft\Internet Explorer\brndlog.bak.mrcryptorfile@yahoo.com_crypt
%APPDATA%\Microsoft\Internet Explorer\brndlog.txt.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\extensions.svg.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00013.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00014.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00015.mrcryptorfile@yahoo.com_crypt
C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\INFO2.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND9.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND999.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\table.bmp.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00016.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00021.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00022.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00023.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00020.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00017.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00018.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00019.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND563.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND57.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND58.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND560.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND53.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND54.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND55.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND6.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND735.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND8.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND827.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND713.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND65.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND68.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND7.WAV.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00044.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00045.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00046.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00043.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00040.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00041.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00042.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00047.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00054.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00055.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00056.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00053.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00048.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00049.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00052.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00028.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00029.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00030.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00027.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00024.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00025.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00026.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00031.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00036.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00037.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00039.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00035.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00032.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00033.mrcryptorfile@yahoo.com_crypt
%WINDIR%\$NtUninstallKB942288-v3$\reg00034.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND105.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND108.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND111.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND104.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows Media Player\npdrmv2.zip.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows Media Player\npds.zip.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND1.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND112.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND14.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND16.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND17.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND136.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND12.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND13.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND131.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Messenger\newalert.wav.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Messenger\newemail.wav.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Messenger\online.wav.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\FireFox\README.txt.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\panelarrow-horizontal.svg.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\panelarrow-vertical.svg.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\extensions.svg.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Messenger\type.wav.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\NetMeeting\Blip.wav.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\NetMeeting\TestSnd.wav.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Outlook Express\msoe.txt.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Movie Maker\Shared\Sample2.jpg.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Movie Maker\Shared\Empty.txt.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Movie Maker\Shared\Profiles\Blank.txt.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Movie Maker\Shared\Sample1.jpg.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND38.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND39.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND4.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND36.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND30.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND34.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND35.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND42.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND5.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND50.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND528.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND49D.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND43.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND45.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND49.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND21.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND22.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND24.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND20.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND18.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND181.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND19.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND240.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND28.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND29.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND3.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND27.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND243.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND25.WAV.mrcryptorfile@yahoo.com_crypt
%PROGRAM_FILES%\Windows NT\Pinball\SOUND26.WAV.mrcryptorfile@yahoo.com_crypt

Deletes the following files:

%WINDIR%\Help\Tours\mmTour\intro.txt
%WINDIR%\Help\Tours\mmTour\nav.swf
%WINDIR%\Help\Tours\htmlTour\window_up.jpg
%WINDIR%\Help\Tours\mmTour\intro.swf
%WINDIR%\Help\Tours\mmTour\segment1.txt
%WINDIR%\Help\Tours\mmTour\segment2.swf
%WINDIR%\Help\Tours\mmTour\nav.txt
%WINDIR%\Help\Tours\mmTour\segment1.swf
%WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_built.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_optimized_big.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg
%WINDIR%\Help\Tours\mmTour\segment2.txt
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud6.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud7.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud4.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud5.wav
%WINDIR%\imsins.BAK
%WINDIR%\Media\chimes.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud8.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud9.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud3.wav
%WINDIR%\Help\Tours\mmTour\segment4.swf
%WINDIR%\Help\Tours\mmTour\segment4.txt
%WINDIR%\Help\Tours\mmTour\segment3.swf
%WINDIR%\Help\Tours\mmTour\segment3.txt
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud1.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud2.wav
%WINDIR%\Help\Tours\mmTour\segment5.swf
%WINDIR%\Help\Tours\mmTour\segment5.txt
%WINDIR%\Help\Tours\htmlTour\img110.jpg
%WINDIR%\Help\Tours\htmlTour\img116.jpg
%WINDIR%\Help\Tours\htmlTour\img103.jpg
%WINDIR%\Help\Tours\htmlTour\img109.jpg
%WINDIR%\Help\Tours\htmlTour\img126.jpg
%WINDIR%\Help\Tours\htmlTour\img136.jpg
%WINDIR%\Help\Tours\htmlTour\img121.jpg
%WINDIR%\Help\Tours\htmlTour\img123.jpg
%WINDIR%\Help\Tours\htmlTour\img100.jpg
%WINDIR%\Help\Tours\htmlTour\img046.jpg
%WINDIR%\Help\Tours\htmlTour\img060.jpg
%WINDIR%\Help\Tours\htmlTour\img034.jpg
%WINDIR%\Help\Tours\htmlTour\img040.jpg
%WINDIR%\Help\Tours\htmlTour\img074a.jpg
%WINDIR%\Help\Tours\htmlTour\img089.jpg
%WINDIR%\Help\Tours\htmlTour\img068.jpg
%WINDIR%\Help\Tours\htmlTour\img072.jpg
%WINDIR%\Help\Tours\htmlTour\img149.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\taskbar_up.jpg
%WINDIR%\Help\Tours\htmlTour\ul_logo.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\start_up.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg
%WINDIR%\Help\Tours\htmlTour\pen_icon.jpg
%WINDIR%\Help\Tours\htmlTour\question_icon.jpg
%WINDIR%\Help\Tours\htmlTour\intro_logo.jpg
%WINDIR%\Help\Tours\htmlTour\logo.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\read_icon.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_better.jpg
%WINDIR%\Media\chord.wav
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1029.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1030.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1025.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1028.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1033.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1035.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1031.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1032.rtf
%WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\VSMsiLog22FD.txt
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\EULA.rtf
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
%WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\dd_dotnetfx3error.txt
%WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\dd_dotnetfx3install.txt
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1036.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1055.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2052.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1049.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1053.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\logo.bmp
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\dd_dotnetfx35error.txt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2070.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.3082.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1046.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1040.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1041.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1037.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1038.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1044.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1045.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1042.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1043.rtf
%WINDIR%\Media\Windows XP Default.wav
%WINDIR%\Media\Windows XP Ding.wav
%WINDIR%\Media\Windows XP Battery Low.wav
%WINDIR%\Media\Windows XP Critical Stop.wav
%WINDIR%\Media\Windows XP Hardware Fail.wav
%WINDIR%\Media\Windows XP Hardware Insert.wav
%WINDIR%\Media\Windows XP Error.wav
%WINDIR%\Media\Windows XP Exclamation.wav
%WINDIR%\Media\Windows XP Battery Critical.wav
%WINDIR%\Media\recycle.wav
%WINDIR%\Media\ringin.wav
%WINDIR%\Media\ding.wav
%WINDIR%\Media\notify.wav
%WINDIR%\Media\tada.wav
%WINDIR%\Media\Windows XP Balloon.wav
%WINDIR%\Media\ringout.wav
%WINDIR%\Media\start.wav
%WINDIR%\Media\Windows XP Hardware Remove.wav
%WINDIR%\Media\Windows XP Ringout.wav
%WINDIR%\Media\Windows XP Shutdown.wav
%WINDIR%\Media\Windows XP Restore.wav
%WINDIR%\Media\Windows XP Ringin.wav
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU1.txt
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU2.txt
%WINDIR%\Media\Windows XP Start.wav
%WINDIR%\Media\Windows XP Startup.wav
%WINDIR%\Media\Windows XP Recycle.wav
%WINDIR%\Media\Windows XP Logon Sound.wav
%WINDIR%\Media\Windows XP Menu Command.wav
%WINDIR%\Media\Windows XP Information Bar.wav
%WINDIR%\Media\Windows XP Logoff Sound.wav
%WINDIR%\Media\Windows XP Pop-up Blocked.wav
%WINDIR%\Media\Windows XP Print complete.wav
%WINDIR%\Media\Windows XP Minimize.wav
%WINDIR%\Media\Windows XP Notify.wav
%WINDIR%\Help\Tours\htmlTour\img033a.jpg
%WINDIR%\$NtUninstallKB942288-v3$\reg00061
%WINDIR%\$NtUninstallKB942288-v3$\reg00062
%WINDIR%\$NtUninstallKB942288-v3$\reg00059
%WINDIR%\$NtUninstallKB942288-v3$\reg00060
%WINDIR%\$NtUninstallKB942288-v3$\reg00065
%WINDIR%\$NtUninstallKB942288-v3$\reg00066
%WINDIR%\$NtUninstallKB942288-v3$\reg00063
%WINDIR%\$NtUninstallKB942288-v3$\reg00064
%WINDIR%\$NtUninstallKB942288-v3$\reg00058
%WINDIR%\$NtUninstallKB942288-v3$\reg00052
%WINDIR%\$NtUninstallKB942288-v3$\reg00053
%WINDIR%\$NtUninstallKB942288-v3$\reg00048
%WINDIR%\$NtUninstallKB942288-v3$\reg00049
%WINDIR%\$NtUninstallKB942288-v3$\reg00056
%WINDIR%\$NtUninstallKB942288-v3$\reg00057
%WINDIR%\$NtUninstallKB942288-v3$\reg00054
%WINDIR%\$NtUninstallKB942288-v3$\reg00055
%WINDIR%\$NtUninstallKB942288-v3$\reg00067
%WINDIR%\$NtUninstallKB942288-v3$\reg00079
%WINDIR%\$NtUninstallKB942288-v3$\reg00080
%WINDIR%\$NtUninstallKB942288-v3$\reg00077
%WINDIR%\$NtUninstallKB942288-v3$\reg00078
%WINDIR%\$NtUninstallKB942288-v3$\reg00083
%WINDIR%\$NtUninstallKB942288-v3$\reg00084
%WINDIR%\$NtUninstallKB942288-v3$\reg00081
%WINDIR%\$NtUninstallKB942288-v3$\reg00082
%WINDIR%\$NtUninstallKB942288-v3$\reg00076
%WINDIR%\$NtUninstallKB942288-v3$\reg00070
%WINDIR%\$NtUninstallKB942288-v3$\reg00071
%WINDIR%\$NtUninstallKB942288-v3$\reg00068
%WINDIR%\$NtUninstallKB942288-v3$\reg00069
%WINDIR%\$NtUninstallKB942288-v3$\reg00074
%WINDIR%\$NtUninstallKB942288-v3$\reg00075
%WINDIR%\$NtUninstallKB942288-v3$\reg00072
%WINDIR%\$NtUninstallKB942288-v3$\reg00073
%WINDIR%\$NtUninstallKB942288-v3$\reg00023
%WINDIR%\$NtUninstallKB942288-v3$\reg00024
%WINDIR%\$NtUninstallKB942288-v3$\reg00021
%WINDIR%\$NtUninstallKB942288-v3$\reg00022
%WINDIR%\$NtUninstallKB942288-v3$\reg00027
%WINDIR%\$NtUninstallKB942288-v3$\reg00028
%WINDIR%\$NtUninstallKB942288-v3$\reg00025
%WINDIR%\$NtUninstallKB942288-v3$\reg00026
%WINDIR%\$NtUninstallKB942288-v3$\reg00020
%WINDIR%\$NtUninstallKB942288-v3$\reg00014
%WINDIR%\$NtUninstallKB942288-v3$\reg00015
<Auxiliary element>
%WINDIR%\$NtUninstallKB942288-v3$\reg00013
%WINDIR%\$NtUninstallKB942288-v3$\reg00018
%WINDIR%\$NtUninstallKB942288-v3$\reg00019
%WINDIR%\$NtUninstallKB942288-v3$\reg00016
%WINDIR%\$NtUninstallKB942288-v3$\reg00017
%WINDIR%\$NtUninstallKB942288-v3$\reg00029
%WINDIR%\$NtUninstallKB942288-v3$\reg00042
%WINDIR%\$NtUninstallKB942288-v3$\reg00043
%WINDIR%\$NtUninstallKB942288-v3$\reg00040
%WINDIR%\$NtUninstallKB942288-v3$\reg00041
%WINDIR%\$NtUninstallKB942288-v3$\reg00046
%WINDIR%\$NtUninstallKB942288-v3$\reg00047
%WINDIR%\$NtUninstallKB942288-v3$\reg00044
%WINDIR%\$NtUninstallKB942288-v3$\reg00045
%WINDIR%\$NtUninstallKB942288-v3$\reg00039
%WINDIR%\$NtUninstallKB942288-v3$\reg00032
%WINDIR%\$NtUninstallKB942288-v3$\reg00033
%WINDIR%\$NtUninstallKB942288-v3$\reg00030
%WINDIR%\$NtUninstallKB942288-v3$\reg00031
%WINDIR%\$NtUninstallKB942288-v3$\reg00036
%WINDIR%\$NtUninstallKB942288-v3$\reg00037
%WINDIR%\$NtUninstallKB942288-v3$\reg00034
%WINDIR%\$NtUninstallKB942288-v3$\reg00035
%WINDIR%\$NtUninstallKB942288-v3$\reg00085
%WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg
%WINDIR%\Gone Fishing.bmp
%WINDIR%\Greenstone.bmp
%WINDIR%\Coffee Bean.bmp
%WINDIR%\FeatherTexture.bmp
%WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust.jpg
%WINDIR%\Help\Tours\htmlTour\best_road.jpg
%WINDIR%\Help\Tours\htmlTour\best_road_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg
%WINDIR%\Help\Tours\htmlTour\folder_up.jpg
%WINDIR%\Help\Tours\htmlTour\gradient.jpg
%WINDIR%\Help\Tours\htmlTour\desktop_up.jpg
%WINDIR%\Help\Tours\htmlTour\end_up.jpg
%WINDIR%\Help\Tours\htmlTour\img014.jpg
%WINDIR%\Help\Tours\htmlTour\img033.jpg
%WINDIR%\Help\Tours\htmlTour\icon_up.jpg
%WINDIR%\Help\Tours\htmlTour\img004b.jpg
%WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg
%WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_networks.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\control_up.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg
%WINDIR%\$NtUninstallKB942288-v3$\reg00097
%WINDIR%\$NtUninstallKB942288-v3$\reg00098
%WINDIR%\$NtUninstallKB942288-v3$\reg00095
%WINDIR%\$NtUninstallKB942288-v3$\reg00096
%WINDIR%\$NtUninstallKB942288-v3$\reg00101
%WINDIR%\$NtUninstallKB942288-v3$\reg00102
%WINDIR%\$NtUninstallKB942288-v3$\reg00099
%WINDIR%\$NtUninstallKB942288-v3$\reg00100
%WINDIR%\$NtUninstallKB942288-v3$\reg00094
%WINDIR%\$NtUninstallKB942288-v3$\reg00088
%WINDIR%\$NtUninstallKB942288-v3$\reg00089
%WINDIR%\$NtUninstallKB942288-v3$\reg00086
%WINDIR%\$NtUninstallKB942288-v3$\reg00087
%WINDIR%\$NtUninstallKB942288-v3$\reg00092
%WINDIR%\$NtUninstallKB942288-v3$\reg00093
%WINDIR%\$NtUninstallKB942288-v3$\reg00090
%WINDIR%\$NtUninstallKB942288-v3$\reg00091
%WINDIR%\$NtUninstallKB942288-v3$\reg00103
%WINDIR%\$NtUninstallKB942288-v3$\reg00115
%WINDIR%\$NtUninstallKB942288-v3$\reg00116
%WINDIR%\$NtUninstallKB942288-v3$\reg00113
%WINDIR%\$NtUninstallKB942288-v3$\reg00114
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt
%WINDIR%\Blue Lace 16.bmp
%WINDIR%\$NtUninstallKB942288-v3$\reg00117
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.txt
%WINDIR%\$NtUninstallKB942288-v3$\reg00112
%WINDIR%\$NtUninstallKB942288-v3$\reg00106
%WINDIR%\$NtUninstallKB942288-v3$\reg00107
%WINDIR%\$NtUninstallKB942288-v3$\reg00104
%WINDIR%\$NtUninstallKB942288-v3$\reg00105
%WINDIR%\$NtUninstallKB942288-v3$\reg00110
%WINDIR%\$NtUninstallKB942288-v3$\reg00111
%WINDIR%\$NtUninstallKB942288-v3$\reg00108
%WINDIR%\$NtUninstallKB942288-v3$\reg00109

Network activity:

Connects to:

'mr####.byethost14.com':80

TCP:

HTTP GET requests:

mr####.byethost14.com/host.php?id#######################################################################################################################################################################

UDP:

DNS ASK mr####.byethost14.com

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial