Trojan.Encoder.343

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\CRT.CLOSED\Shell\Open\command] '' = '"notepad.exe" "C:\Прочти_меня"'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\Прочти_меня.TXT
%HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk.SECURITY

Malicious functions:

Executes the following:

'<SYSTEM32>\taskkill.exe' /IM <Virus name>.exe
'<SYSTEM32>\cmd.exe' /c <Current directory>\$$336699.bat

Modifies file system :

Creates the following files:

%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\System\DVDUpgrd\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\System\DFS\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\System\ErrMsg\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\System\NetDiag\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\System\errors\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\System\CompatCtr\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\Config\Cache\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\System\blurbs\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\System\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\System\panels\Прочти_меня.TXT
<SYSTEM32>\oobe\html\dslmain\Прочти_меня.TXT
<SYSTEM32>\oobe\error\Прочти_меня.TXT
<SYSTEM32>\oobe\html\iconnect\Прочти_меня.TXT
<SYSTEM32>\oobe\html\mouse\Прочти_меня.TXT
<SYSTEM32>\oobe\html\isptype\Прочти_меня.TXT
<SYSTEM32>\oobe\actsetup\Прочти_меня.TXT
<SYSTEM32>\config\systemprofile\Templates\Прочти_меня.TXT
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Entertainment\Прочти_меня.TXT
<DRIVERS>\Прочти_меня.TXT
<SYSTEM32>\oobe\Прочти_меня.TXT
<SYSTEM32>\ias\Прочти_меня.TXT
<SYSTEM32>\Restore\Прочти_меня.TXT
<SYSTEM32>\oobe\setup\Прочти_меня.TXT
%WINDIR%\Web\Прочти_меня.TXT
<Current directory>\$$336699.bat
%WINDIR%\Web\Wallpaper\Прочти_меня.TXT
<SYSTEM32>\oobe\regerror\Прочти_меня.TXT
<SYSTEM32>\oobe\html\sconnect\Прочти_меня.TXT
<SYSTEM32>\oobe\html\mouse\images\Прочти_меня.TXT
<SYSTEM32>\oobe\icserror\Прочти_меня.TXT
<SYSTEM32>\oobe\isperror\Прочти_меня.TXT
<SYSTEM32>\oobe\images\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\System\sysinfo\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\System\UpdateCtr\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\System\rc\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\System\panels\subpanels\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\Прочти_меня.TXT
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\Internet Explorer\Прочти_меня.TXT
<SYSTEM32>\CatRoot2\Прочти_меня.TXT
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Прочти_меня.TXT
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\Прочти_меня.TXT
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Прочти_меня.TXT
<SYSTEM32>\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Unsolicited\Прочти_меня.TXT
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\Прочти_меня.TXT
C:\Far2\Addons\Прочти_меня.TXT
%HOMEPATH%\Templates\Прочти_меня.TXT
C:\Far2\Documentation\eng\Прочти_меня.TXT
C:\Far2\Plugins\7-Zip\Прочти_меня.TXT
C:\Far2\Documentation\rus\Прочти_меня.TXT
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\Прочти_меня.TXT
%HOMEPATH%\Start Menu\Прочти_меня.TXT
%HOMEPATH%\Recent\Прочти_меня.TXT
%HOMEPATH%\Start Menu\Programs\Прочти_меня.TXT
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\Прочти_меня.TXT
%HOMEPATH%\Start Menu\Programs\Accessories\Прочти_меня.TXT
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\Прочти_меня.TXT
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\Прочти_меня.TXT
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\Прочти_меня.TXT
%PROGRAM_FILES%\FireFox\defaults\profile\Прочти_меня.TXT
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\Прочти_меня.TXT
%PROGRAM_FILES%\FireFox\Прочти_меня.TXT
C:\Far2\Plugins\ExtSearch\doc\Прочти_меня.TXT
C:\Far2\Plugins\Colorer\hrc\Прочти_меня.TXT
C:\Far2\Plugins\FTP\Прочти_меня.TXT
%CommonProgramFiles%\System\ado\Прочти_меня.TXT
%CommonProgramFiles%\Microsoft Shared\Stationery\Прочти_меня.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\Прочти_меня.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\Прочти_меня.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Прочти_меня.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Games\Прочти_меня.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\Прочти_меня.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\Прочти_меня.TXT
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Прочти_меня.TXT
C:\Прочти_меня.TXT
%ALLUSERSPROFILE%\Start Menu\Прочти_меня.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Прочти_меня.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Прочти_меня.TXT
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Прочти_меня.TXT
%APPDATA%\Microsoft\Internet Explorer\Прочти_меня.TXT
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\Прочти_меня.TXT
%HOMEPATH%\My Documents\My Pictures\Прочти_меня.TXT
%HOMEPATH%\My Documents\My Music\Прочти_меня.TXT
C:\Documents and Settings\Default User\Templates\Прочти_меня.TXT
C:\Documents and Settings\Default User\Start Menu\Programs\Прочти_меня.TXT
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Прочти_меня.TXT
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Прочти_меня.TXT
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\Прочти_меня.TXT
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\Прочти_меня.TXT
%PROGRAM_FILES%\Messenger\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\Прочти_меня.TXT
<Auxiliary element>
%PROGRAM_FILES%\Windows NT\Pinball\Прочти_меня.TXT
%WINDIR%\Прочти_меня.TXT
%WINDIR%\$NtUninstallWIC$\spuninst\Прочти_меня.TXT
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\Прочти_меня.TXT
%PROGRAM_FILES%\Windows Media Player\Прочти_меня.TXT
%PROGRAM_FILES%\Movie Maker\Shared\Profiles\Прочти_меня.TXT
%PROGRAM_FILES%\Movie Maker\Shared\Прочти_меня.TXT
%PROGRAM_FILES%\NetMeeting\Прочти_меня.TXT
%PROGRAM_FILES%\Outlook Express\Прочти_меня.TXT
%PROGRAM_FILES%\Online Services\Прочти_меня.TXT
%WINDIR%\Media\Прочти_меня.TXT
%WINDIR%\Installer\$PatchCache$\Managed\26DDC2EC4210AC63483DF9D4FCC5B59D\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\Прочти_меня.TXT
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\Прочти_меня.TXT
%WINDIR%\Help\Tours\WindowsMediaPlayer\Cnt\Прочти_меня.TXT
%WINDIR%\Help\Tours\htmlTour\Прочти_меня.TXT
%WINDIR%\Help\Прочти_меня.TXT
%WINDIR%\Help\Tours\mmTour\Прочти_меня.TXT
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\Прочти_меня.TXT
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Прочти_меня.TXT

Deletes the following files:

%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\ShieldsUpMsg.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen9.htm
<SYSTEM32>\eula.txt
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Unsolicited\UnSolicitedRCUI.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen8.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen6.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen5.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen7.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen6_head.htm
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Notepad.lnk
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Command Prompt.lnk
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Synchronize.lnk
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Program Compatibility Wizard.lnk
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Windows Media Player.lnk
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\Internet Explorer\brndlog.bak
<SYSTEM32>\CatRoot2\dberr.txt
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Remote Assistance.lnk
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\Internet Explorer\brndlog.txt
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\ConnIssue.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\rcstatus.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\RAHelp.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\LearnInternet.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\confirm.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\OfflineDC.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Connection.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\pss_getting_worldwide_help.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\OfflineOptions.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcDetails.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\escalationhelp.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen4.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcInviteStatus.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcscreen3.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcConnection.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\RCMoreInfo.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcscreen2.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcscreen1.htm
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Tour Windows XP.lnk
<SYSTEM32>\oobe\actsetup\adeskerr.htm
<SYSTEM32>\oobe\actsetup\actlan.htm
<SYSTEM32>\oobe\actsetup\apolicy.htm
<SYSTEM32>\oobe\actsetup\adrdyreg.htm
<SYSTEM32>\oobe\actsetup\activsvc.htm
<SYSTEM32>\oobe\actsetup\actdone.htm
<SYSTEM32>\oobe\actsetup\actconn.htm
<SYSTEM32>\oobe\actsetup\activerr.htm
<SYSTEM32>\oobe\actsetup\activ.htm
<SYSTEM32>\oobe\error\dialtone.htm
<SYSTEM32>\oobe\error\cnncterr.htm
<SYSTEM32>\oobe\error\isp2busy.htm
<SYSTEM32>\oobe\error\hndshake.htm
<SYSTEM32>\oobe\actsetup\ausrinfo.htm
<SYSTEM32>\oobe\actsetup\areg1.htm
<SYSTEM32>\oobe\actsetup\aprvcyms.htm
<SYSTEM32>\oobe\actsetup\aregdone.htm
<SYSTEM32>\oobe\actsetup\aregdial.htm
<SYSTEM32>\config\systemprofile\Templates\excel.xls
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Entertainment\Windows Media Player.lnk
<SYSTEM32>\config\systemprofile\Templates\sndrec.wav
<SYSTEM32>\config\systemprofile\Templates\excel4.xls
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\Utility Manager.lnk
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\Magnifier.lnk
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Windows Explorer.lnk
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk
<SYSTEM32>\oobe\dtsgnup.htm
<SYSTEM32>\oobe\actshell.htm
<SYSTEM32>\oobe\updshell.htm
<SYSTEM32>\oobe\msobshel.htm
<SYSTEM32>\ias\ias.mdb
<SYSTEM32>\config\systemprofile\Templates\winword2.doc
<SYSTEM32>\config\systemprofile\Templates\winword.doc
<SYSTEM32>\ias\dnary.mdb
<DRIVERS>\gmreadme.txt
%WINDIR%\pchealth\helpctr\System\panels\subpanels\Search.htm
%WINDIR%\pchealth\helpctr\System\panels\subpanels\Options.htm
%WINDIR%\pchealth\helpctr\System\rc\rcRequest.htm
%WINDIR%\pchealth\helpctr\System\panels\subpanels\Subsite.htm
%WINDIR%\pchealth\helpctr\System\panels\subpanels\Index.htm
%WINDIR%\pchealth\helpctr\System\panels\subpanels\Channels.htm
%WINDIR%\pchealth\helpctr\System\panels\Topics.htm
%WINDIR%\pchealth\helpctr\System\panels\subpanels\History.htm
%WINDIR%\pchealth\helpctr\System\panels\subpanels\Favorites.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\RAHelp.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\LearnInternet.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\DividerBar.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\RCMoreInfo.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\ConnIssue.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\helpeeaccept.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\ding.wav
%WINDIR%\pchealth\helpctr\System\Remote Assistance\rcBuddy.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\RAStartPage.htm
%WINDIR%\pchealth\helpctr\System\NetDiag\dglogs.htm
%WINDIR%\pchealth\helpctr\System\errors\unreachable.htm
%WINDIR%\pchealth\helpctr\System\panels\AdvSearch.htm
%WINDIR%\pchealth\helpctr\System\NetDiag\dglogshelp.htm
%WINDIR%\pchealth\helpctr\System\errors\redirect.htm
%WINDIR%\pchealth\helpctr\System\errors\indexfirstlevel.htm
%WINDIR%\pchealth\helpctr\System\errors\connection.htm
%WINDIR%\pchealth\helpctr\System\errors\offline.htm
%WINDIR%\pchealth\helpctr\System\errors\notfound.htm
%WINDIR%\pchealth\helpctr\System\panels\Options.htm
%WINDIR%\pchealth\helpctr\System\panels\NavBar.htm
%WINDIR%\pchealth\helpctr\System\panels\ShareHelp.htm
%WINDIR%\pchealth\helpctr\System\panels\RemoteHelp.htm
%WINDIR%\pchealth\helpctr\System\panels\MiniNavBar.htm
%WINDIR%\pchealth\helpctr\System\panels\Context.htm
%WINDIR%\pchealth\helpctr\System\panels\blank.htm
%WINDIR%\pchealth\helpctr\System\panels\HHWrapper.htm
%WINDIR%\pchealth\helpctr\System\panels\firstpage.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAChatClient.htm
%WINDIR%\pchealth\helpctr\System\sysinfo\sysInfoLaunch.htm
%WINDIR%\pchealth\helpctr\System\sysinfo\sysHealthInfo.htm
%WINDIR%\pchealth\helpctr\System\sysinfo\sysinfosum.htm
%WINDIR%\pchealth\helpctr\System\sysinfo\sysinfomain.htm
%WINDIR%\pchealth\helpctr\System\sysinfo\sysEvtLogInfo.htm
%WINDIR%\pchealth\helpctr\System\sysinfo\sysComponentInfo.htm
%WINDIR%\pchealth\helpctr\System\sysinfo\RSoP.htm
%WINDIR%\pchealth\helpctr\System\sysinfo\sysDiskTS.htm
%WINDIR%\pchealth\helpctr\System\sysinfo\sysConfigLaunch.htm
%WINDIR%\pchealth\helpctr\System\UpdateCtr\LearnInternet.htm
%WINDIR%\pchealth\helpctr\System\UpdateCtr\Learn.htm
%WINDIR%\pchealth\helpctr\System\UpdateCtr\updatecenter.htm
%WINDIR%\pchealth\helpctr\System\UpdateCtr\learnWU.htm
%WINDIR%\pchealth\helpctr\System\UpdateCtr\AboutWU.htm
%WINDIR%\pchealth\helpctr\System\sysinfo\sysServicesInfo.htm
%WINDIR%\pchealth\helpctr\System\sysinfo\sysRemoteInfo.htm
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\greendot.jpg
%WINDIR%\pchealth\helpctr\System\sysinfo\sysSoftwareInfo.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\ErrorMsgs.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\setting.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\voicefirewallmsg.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\RCFileXfer.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\rctoolScreen1.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAStatusBar.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAClient.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\rcscreen6_head.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAToolBar.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\SettingServer.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\RAServerToolBar.htm
%WINDIR%\pchealth\helpctr\System\sysinfo\msinfo.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\TakeControlMsgs.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\RAServer.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\DividerBar1.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\VOIPMsgs.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\RAChatServer.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\DividerBar2.htm
<SYSTEM32>\oobe\error\noanswer.htm
<SYSTEM32>\oobe\setup\hnwprmpt.htm
<SYSTEM32>\oobe\setup\fini.htm
<SYSTEM32>\oobe\setup\ics.htm
<SYSTEM32>\oobe\setup\iconn.htm
<SYSTEM32>\oobe\setup\dtiwait.htm
<SYSTEM32>\oobe\setup\drdymig.htm
<SYSTEM32>\oobe\setup\drdyisp.htm
<SYSTEM32>\oobe\setup\drdyref.htm
<SYSTEM32>\oobe\setup\drdyoem.htm
<SYSTEM32>\oobe\setup\keybd.htm
<SYSTEM32>\oobe\setup\jndom_a.htm
<SYSTEM32>\oobe\setup\migdial.htm
<SYSTEM32>\oobe\setup\keybdcmt.htm
<SYSTEM32>\oobe\setup\jndomain.htm
<SYSTEM32>\oobe\setup\ident2.htm
<SYSTEM32>\oobe\setup\ident1.htm
<SYSTEM32>\oobe\setup\ispwait.htm
<SYSTEM32>\oobe\setup\isp.htm
<SYSTEM32>\oobe\regerror\rpberr.htm
<SYSTEM32>\oobe\regerror\rnomdm.htm
<SYSTEM32>\oobe\regerror\rtoobusy.htm
<SYSTEM32>\oobe\regerror\rpulse.htm
<SYSTEM32>\oobe\regerror\rnoansw.htm
<SYSTEM32>\oobe\regerror\rcnterr.htm
<SYSTEM32>\oobe\isperror\ispsbusy.htm
<SYSTEM32>\oobe\regerror\rhndshk.htm
<SYSTEM32>\oobe\regerror\rdtone.htm
<SYSTEM32>\oobe\setup\badpkey.htm
<SYSTEM32>\oobe\setup\badeula.htm
<SYSTEM32>\oobe\setup\dialup.htm
<SYSTEM32>\oobe\setup\compname.htm
<SYSTEM32>\oobe\setup\au_plcy.htm
<SYSTEM32>\oobe\setup\activate.htm
<SYSTEM32>\oobe\setup\acterror.htm
<SYSTEM32>\oobe\setup\autoupdt.htm
<SYSTEM32>\oobe\setup\act_plcy.htm
<SYSTEM32>\oobe\setup\miglist.htm
%WINDIR%\Web\Wallpaper\Moon flower.jpg
%WINDIR%\Web\Wallpaper\Home.jpg
%WINDIR%\Web\Wallpaper\Power.jpg
%WINDIR%\Web\Wallpaper\Peace.jpg
%WINDIR%\Web\Wallpaper\Friend.jpg
%WINDIR%\Web\Wallpaper\Azul.jpg
%WINDIR%\Web\Wallpaper\Autumn.jpg
%WINDIR%\Web\Wallpaper\Follow.jpg
%WINDIR%\Web\Wallpaper\Crystal.jpg
%WINDIR%\Web\Wallpaper\Vortec space.jpg
%WINDIR%\Web\Wallpaper\Tulips.jpg
%WINDIR%\Web\Wallpaper\Windows XP.jpg
%WINDIR%\Web\Wallpaper\Wind.jpg
%WINDIR%\Web\Wallpaper\Stonehenge.jpg
%WINDIR%\Web\Wallpaper\Radiance.jpg
%WINDIR%\Web\Wallpaper\Purple flower.jpg
%WINDIR%\Web\Wallpaper\Ripple.jpg
%WINDIR%\Web\Wallpaper\Red moon desert.jpg
<SYSTEM32>\oobe\setup\prvcyms.htm
<SYSTEM32>\oobe\setup\prodkey.htm
<SYSTEM32>\oobe\setup\reg1.htm
<SYSTEM32>\oobe\setup\refdial.htm
<SYSTEM32>\oobe\setup\Oobedisc.htm
<SYSTEM32>\oobe\setup\neweula.htm
<SYSTEM32>\oobe\setup\migpage.htm
<SYSTEM32>\oobe\setup\oempriv.htm
<SYSTEM32>\oobe\setup\neweula2.htm
<SYSTEM32>\Restore\MachineGuid.txt
<SYSTEM32>\oobe\setup\welcome.htm
%WINDIR%\Web\Wallpaper\Ascent.jpg
%WINDIR%\Web\tip.htm
<SYSTEM32>\oobe\setup\username.htm
<SYSTEM32>\oobe\setup\regdial.htm
<SYSTEM32>\oobe\setup\reg3.htm
<SYSTEM32>\oobe\setup\timezone.htm
<SYSTEM32>\oobe\setup\security.htm
<SYSTEM32>\oobe\html\mouse\images\heidelbm.jpg
<SYSTEM32>\oobe\html\mouse\images\heidelb.jpg
<SYSTEM32>\oobe\html\mouse\images\parism.jpg
<SYSTEM32>\oobe\html\mouse\images\paris.jpg
<SYSTEM32>\oobe\html\mouse\images\bulzanom.jpg
<SYSTEM32>\oobe\html\mouse\mouse_j.htm
<SYSTEM32>\oobe\html\mouse\mouse_i.htm
<SYSTEM32>\oobe\html\mouse\images\bulzano.jpg
<SYSTEM32>\oobe\html\mouse\mouse_k.htm
<SYSTEM32>\oobe\html\mouse\images\venice.jpg
<SYSTEM32>\oobe\html\mouse\images\tyrolm.jpg
<SYSTEM32>\oobe\html\mouse\images\verona.jpg
<SYSTEM32>\oobe\html\mouse\images\venicem.jpg
<SYSTEM32>\oobe\html\mouse\images\tyrol.jpg
<SYSTEM32>\oobe\html\mouse\images\pisam.jpg
<SYSTEM32>\oobe\html\mouse\images\pisa.jpg
<SYSTEM32>\oobe\html\mouse\images\praguem.jpg
<SYSTEM32>\oobe\html\mouse\images\prague.jpg
<SYSTEM32>\oobe\html\iconnect\icntlast.htm
<SYSTEM32>\oobe\html\dslmain\dsl_b.htm
<SYSTEM32>\oobe\html\isptype\isptype.htm
<SYSTEM32>\oobe\html\iconnect\iconnect.htm
<SYSTEM32>\oobe\html\dslmain\dsl_a.htm
<SYSTEM32>\oobe\error\pulse.htm
<SYSTEM32>\oobe\error\pberr.htm
<SYSTEM32>\oobe\html\dslmain\dslmain.htm
<SYSTEM32>\oobe\error\toobusy.htm
<SYSTEM32>\oobe\html\mouse\mouse_f.htm
<SYSTEM32>\oobe\html\mouse\mouse_e.htm
<SYSTEM32>\oobe\html\mouse\mouse_h.htm
<SYSTEM32>\oobe\html\mouse\mouse_g.htm
<SYSTEM32>\oobe\html\mouse\mouse_d.htm
<SYSTEM32>\oobe\html\mouse\mouse_a.htm
<SYSTEM32>\oobe\html\mouse\mouse.htm
<SYSTEM32>\oobe\html\mouse\mouse_c.htm
<SYSTEM32>\oobe\html\mouse\mouse_b.htm
<SYSTEM32>\oobe\html\mouse\images\veronam.jpg
<SYSTEM32>\oobe\images\wpaback.jpg
<SYSTEM32>\oobe\images\skipup.jpg
<SYSTEM32>\oobe\images\wpaflag.jpg
<SYSTEM32>\oobe\images\wpabtm.jpg
<SYSTEM32>\oobe\images\skipover.jpg
<SYSTEM32>\oobe\images\oemcoa.jpg
<SYSTEM32>\oobe\images\nextup.jpg
<SYSTEM32>\oobe\images\skipoff.jpg
<SYSTEM32>\oobe\images\skipdown.jpg
<SYSTEM32>\oobe\isperror\ispnoanw.htm
<SYSTEM32>\oobe\isperror\ispins.htm
<SYSTEM32>\oobe\isperror\ispphbsy.htm
<SYSTEM32>\oobe\isperror\isppberr.htm
<SYSTEM32>\oobe\isperror\isphdshk.htm
<SYSTEM32>\oobe\images\wpatop.jpg
<SYSTEM32>\oobe\images\wpakey.jpg
<SYSTEM32>\oobe\isperror\ispdtone.htm
<SYSTEM32>\oobe\isperror\ispcnerr.htm
<SYSTEM32>\oobe\images\backup.jpg
<SYSTEM32>\oobe\images\backover.jpg
<SYSTEM32>\oobe\images\mslogo.jpg
<SYSTEM32>\oobe\images\clickerx.wav
<SYSTEM32>\oobe\images\backoff.jpg
<SYSTEM32>\oobe\html\sconnect\sconnect.htm
<SYSTEM32>\oobe\html\sconnect\scntlast.htm
<SYSTEM32>\oobe\images\backdown.jpg
<SYSTEM32>\oobe\icserror\icsdc.htm
<SYSTEM32>\oobe\images\nextdown.jpg
<SYSTEM32>\oobe\images\newtop8.jpg
<SYSTEM32>\oobe\images\nextover.jpg
<SYSTEM32>\oobe\images\nextoff.jpg
<SYSTEM32>\oobe\images\newtop1.jpg
<SYSTEM32>\oobe\images\newbtm8.jpg
<SYSTEM32>\oobe\images\newbtm1.jpg
<SYSTEM32>\oobe\images\newmark8.jpg
<SYSTEM32>\oobe\images\newmark1.jpg
%WINDIR%\Help\Tours\htmlTour\start_taskbar.htm
%WINDIR%\Help\Tours\htmlTour\start_menu.htm
%WINDIR%\Help\Tours\htmlTour\start_windows.htm
%WINDIR%\Help\Tours\htmlTour\start_up.jpg
%WINDIR%\Help\Tours\htmlTour\start_icons.htm
%WINDIR%\Help\Tours\htmlTour\start_ending.htm
%WINDIR%\Help\Tours\htmlTour\start_desktop.htm
%WINDIR%\Help\Tours\htmlTour\start_fr.htm
%WINDIR%\Help\Tours\htmlTour\start_files.htm
%WINDIR%\Help\Tours\htmlTour\unlock_fr.htm
%WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_optimized.htm
%WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg
%WINDIR%\Help\Tours\htmlTour\ul_logo.jpg
%WINDIR%\Help\Tours\htmlTour\taskbar_up.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_built.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_built.htm
%WINDIR%\Help\Tours\htmlTour\safe_easy_better.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easier.htm
%WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg
%WINDIR%\Help\Tours\htmlTour\safe_better.htm
%WINDIR%\Help\Tours\htmlTour\pen_icon.jpg
%WINDIR%\Help\Tours\htmlTour\logo.jpg
%WINDIR%\Help\Tours\htmlTour\read_icon.jpg
%WINDIR%\Help\Tours\htmlTour\question_icon.jpg
%WINDIR%\Help\Tours\htmlTour\safe_faster.htm
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\start_control.htm
%WINDIR%\Help\Tours\htmlTour\safe_fr.htm
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_optimized_big.jpg
%WINDIR%\Installer\$PatchCache$\Managed\26DDC2EC4210AC63483DF9D4FCC5B59D\CacheSize.txt
%WINDIR%\Help\Tours\WindowsMediaPlayer\Cnt\contents.htm
%WINDIR%\Media\chord.wav
%WINDIR%\Media\chimes.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud9.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud6.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud5.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud8.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud7.wav
%WINDIR%\Media\tada.wav
%WINDIR%\Media\start.wav
%WINDIR%\Media\Windows XP Battery Critical.wav
%WINDIR%\Media\Windows XP Balloon.wav
%WINDIR%\Media\ringout.wav
%WINDIR%\Media\notify.wav
%WINDIR%\Media\ding.wav
%WINDIR%\Media\ringin.wav
%WINDIR%\Media\recycle.wav
%WINDIR%\Help\Tours\mmTour\intro.txt
%WINDIR%\Help\Tours\htmlTour\window_up.jpg
%WINDIR%\Help\Tours\mmTour\segment1.txt
%WINDIR%\Help\Tours\mmTour\nav.txt
%WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_playing.htm
%WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud2.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud1.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud4.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud3.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\snd.htm
%WINDIR%\Help\Tours\mmTour\segment3.txt
%WINDIR%\Help\Tours\mmTour\segment2.txt
%WINDIR%\Help\Tours\mmTour\segment5.txt
%WINDIR%\Help\Tours\mmTour\segment4.txt
%WINDIR%\Help\Tours\htmlTour\connected_data.htm
%WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure.htm
%WINDIR%\Help\Tours\htmlTour\connected_networks.htm
%WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_networks.jpg
%WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_fr.htm
%WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg
%WINDIR%\Help\Tours\htmlTour\connected_multiple.htm
%WINDIR%\Help\ciadmin.htm
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt
%WINDIR%\Help\ixqlang.htm
%WINDIR%\Help\ciquery.htm
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.txt
%WINDIR%\imsins.BAK
%WINDIR%\clock.avi
%WINDIR%\setuplog.txt
%WINDIR%\OEWABLog.txt
%WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\best_road_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust.htm
%WINDIR%\Help\Tours\htmlTour\best_road.jpg
%WINDIR%\Help\migwiz2.htm
%WINDIR%\Help\migwiz.htm
%WINDIR%\Help\Tours\htmlTour\best_road.htm
%WINDIR%\Help\Tours\htmlTour\best_fr.htm
%WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\img089.jpg
%WINDIR%\Help\Tours\htmlTour\img074a.jpg
%WINDIR%\Help\Tours\htmlTour\img103.jpg
%WINDIR%\Help\Tours\htmlTour\img100.jpg
%WINDIR%\Help\Tours\htmlTour\img072.jpg
%WINDIR%\Help\Tours\htmlTour\img046.jpg
%WINDIR%\Help\Tours\htmlTour\img040.jpg
%WINDIR%\Help\Tours\htmlTour\img068.jpg
%WINDIR%\Help\Tours\htmlTour\img060.jpg
%WINDIR%\Help\Tours\htmlTour\img136.jpg
%WINDIR%\Help\Tours\htmlTour\img126.jpg
%WINDIR%\Help\Tours\htmlTour\intro_logo.jpg
%WINDIR%\Help\Tours\htmlTour\img149.jpg
%WINDIR%\Help\Tours\htmlTour\img123.jpg
%WINDIR%\Help\Tours\htmlTour\img110.jpg
%WINDIR%\Help\Tours\htmlTour\img109.jpg
%WINDIR%\Help\Tours\htmlTour\img121.jpg
%WINDIR%\Help\Tours\htmlTour\img116.jpg
%WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg
%WINDIR%\Help\Tours\htmlTour\default.htm
%WINDIR%\Help\Tours\htmlTour\end_up.jpg
%WINDIR%\Help\Tours\htmlTour\desktop_up.jpg
%WINDIR%\Help\Tours\htmlTour\control_up.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard.htm
%WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg
%WINDIR%\Help\Tours\htmlTour\img033.jpg
%WINDIR%\Help\Tours\htmlTour\img014.jpg
%WINDIR%\Help\Tours\htmlTour\img034.jpg
%WINDIR%\Help\Tours\htmlTour\img033a.jpg
%WINDIR%\Help\Tours\htmlTour\img004b.jpg
%WINDIR%\Help\Tours\htmlTour\footer.htm
%WINDIR%\Help\Tours\htmlTour\folder_up.jpg
%WINDIR%\Help\Tours\htmlTour\icon_up.jpg
%WINDIR%\Help\Tours\htmlTour\gradient.jpg
%WINDIR%\Media\Windows XP Battery Low.wav
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\DHtmlHeader.html
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\eula.rtf
%WINDIR%\pchealth\helpctr\System\blurbs\windows_newsgroups.htm
%WINDIR%\pchealth\helpctr\System\blurbs\tools.htm
%WINDIR%\pchealth\helpctr\System\CompatCtr\CompatMode.htm
%WINDIR%\pchealth\helpctr\System\CompatCtr\AboutCompat.htm
%WINDIR%\pchealth\helpctr\System\blurbs\searchtips.htm
%WINDIR%\pchealth\helpctr\System\blurbs\keywordhelp.htm
%WINDIR%\pchealth\helpctr\System\blurbs\isupport.htm
%WINDIR%\pchealth\helpctr\System\blurbs\searchblurb.htm
%WINDIR%\pchealth\helpctr\System\blurbs\options.htm
%WINDIR%\pchealth\helpctr\System\DVDUpgrd\stripe.jpg
%WINDIR%\pchealth\helpctr\System\DVDUpgrd\dvdupgrd.htm
%WINDIR%\pchealth\helpctr\System\errors\badurl.htm
%WINDIR%\pchealth\helpctr\System\ErrMsg\ErrorMessagesOffline.htm
%WINDIR%\pchealth\helpctr\System\DFS\xmldialog.htm
%WINDIR%\pchealth\helpctr\System\CompatCtr\LearnCompat.htm
%WINDIR%\pchealth\helpctr\System\CompatCtr\CompatOffline.htm
%WINDIR%\pchealth\helpctr\System\DFS\uplddrvinfo.htm
%WINDIR%\pchealth\helpctr\System\DFS\privacy.htm
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\eula.rtf
%WINDIR%\pchealth\helpctr\System\blurbs\ftshelp.htm
%WINDIR%\pchealth\helpctr\System\blurbs\Favorites.htm
%WINDIR%\pchealth\helpctr\System\blurbs\Index.htm
%WINDIR%\pchealth\helpctr\System\blurbs\History.htm
%WINDIR%\pchealth\helpctr\System\blurbs\about_support.htm
%WINDIR%\pchealth\helpctr\System\Headlines.htm
%WINDIR%\pchealth\helpctr\Config\Cache\Professional_32_1033.dat.bak
%WINDIR%\pchealth\helpctr\System\HomePage__SERVER.htm
%WINDIR%\pchealth\helpctr\System\HomePage__DESKTOP.htm
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\repairRedist.htm
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\EULA.rtf
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU2.txt
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU1.txt
%WINDIR%\Media\Windows XP Startup.wav
%WINDIR%\Media\Windows XP Ringout.wav
%WINDIR%\Media\Windows XP Ringin.wav
%WINDIR%\Media\Windows XP Start.wav
%WINDIR%\Media\Windows XP Shutdown.wav
%WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\dd_dotnetfx3error.txt
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
%WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\VSMsiLog22FD.txt
%WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\dd_dotnetfx3install.txt
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\SmartNav.htm
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
%WINDIR%\Media\Windows XP Hardware Insert.wav
%WINDIR%\Media\Windows XP Hardware Fail.wav
%WINDIR%\Media\Windows XP Information Bar.wav
%WINDIR%\Media\Windows XP Hardware Remove.wav
%WINDIR%\Media\Windows XP Exclamation.wav
%WINDIR%\Media\Windows XP Default.wav
%WINDIR%\Media\Windows XP Critical Stop.wav
%WINDIR%\Media\Windows XP Error.wav
%WINDIR%\Media\Windows XP Ding.wav
%WINDIR%\Media\Windows XP Print complete.wav
%WINDIR%\Media\Windows XP Pop-up Blocked.wav
%WINDIR%\Media\Windows XP Restore.wav
%WINDIR%\Media\Windows XP Recycle.wav
%WINDIR%\Media\Windows XP Notify.wav
%WINDIR%\Media\Windows XP Logon Sound.wav
%WINDIR%\Media\Windows XP Logoff Sound.wav
%WINDIR%\Media\Windows XP Minimize.wav
%WINDIR%\Media\Windows XP Menu Command.wav
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1025.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\dd_dotnetfx35install.txt
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\dd_dotnetfx35error.txt
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.3082.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1055.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1053.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2070.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2052.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\eula.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\DHtmlHeader.html
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1035.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1033.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1037.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1036.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1032.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1029.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1028.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1031.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1030.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1045.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1044.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1049.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1046.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1043.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1040.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1038.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1042.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1041.rtf

Deletes itself.

Miscellaneous:

Searches for the following windows:

ClassName: 'MS_WINHELP' WindowName: '(null)'
ClassName: '(null)' WindowName: '(null)'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial