Library
My library

+ Add to library

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

Your tickets

Profile

Trojan.DownLoader7.15752

Added to the Dr.Web virus database: 2012-11-01

Virus description added:

Technical Information

To ensure autorun and distribution:
Substitutes the following executable system files:
  • <SYSTEM32>\routemon.exe with <SYSTEM32>\routemon.exe.new
  • <SYSTEM32>\rsh.exe with <SYSTEM32>\rsh.exe.new
  • <SYSTEM32>\route.exe with <SYSTEM32>\route.exe.new
  • <SYSTEM32>\dllcache\autoconv.exe with <SYSTEM32>\dllcache\autoconv.exe.new
  • <SYSTEM32>\rsm.exe with <SYSTEM32>\rsm.exe.new
  • <SYSTEM32>\rsnotify.exe with <SYSTEM32>\rsnotify.exe.new
  • <SYSTEM32>\rsopprov.exe with <SYSTEM32>\rsopprov.exe.new
  • <SYSTEM32>\rsmsink.exe with <SYSTEM32>\rsmsink.exe.new
  • <SYSTEM32>\rsmui.exe with <SYSTEM32>\rsmui.exe.new
  • <SYSTEM32>\regsvr32.exe with <SYSTEM32>\regsvr32.exe.new
  • <SYSTEM32>\regwiz.exe with <SYSTEM32>\regwiz.exe.new
  • <SYSTEM32>\regedt32.exe with <SYSTEM32>\regedt32.exe.new
  • <SYSTEM32>\regini.exe with <SYSTEM32>\regini.exe.new
  • <SYSTEM32>\relog.exe with <SYSTEM32>\relog.exe.new
  • <SYSTEM32>\reset.exe with <SYSTEM32>\reset.exe.new
  • <SYSTEM32>\rexec.exe with <SYSTEM32>\rexec.exe.new
  • <SYSTEM32>\dllcache\autochk.exe with <SYSTEM32>\dllcache\autochk.exe.new
  • <SYSTEM32>\replace.exe with <SYSTEM32>\replace.exe.new
  • <SYSTEM32>\schtasks.exe with <SYSTEM32>\schtasks.exe.new
  • <SYSTEM32>\dllcache\blastcln.exe with <SYSTEM32>\dllcache\blastcln.exe.new
  • <SYSTEM32>\sc.exe with <SYSTEM32>\sc.exe.new
  • <SYSTEM32>\scardsvr.exe with <SYSTEM32>\scardsvr.exe.new
  • <SYSTEM32>\sdbinst.exe with <SYSTEM32>\sdbinst.exe.new
  • <SYSTEM32>\sessmgr.exe with <SYSTEM32>\sessmgr.exe.new
  • <SYSTEM32>\sethc.exe with <SYSTEM32>\sethc.exe.new
  • <SYSTEM32>\secedit.exe with <SYSTEM32>\secedit.exe.new
  • <SYSTEM32>\services.exe with <SYSTEM32>\services.exe.new
  • <SYSTEM32>\runas.exe with <SYSTEM32>\runas.exe.new
  • <SYSTEM32>\dllcache\autofmt.exe with <SYSTEM32>\dllcache\autofmt.exe.new
  • <SYSTEM32>\rsvp.exe with <SYSTEM32>\rsvp.exe.new
  • <SYSTEM32>\rtcshare.exe with <SYSTEM32>\rtcshare.exe.new
  • <SYSTEM32>\rundll32.exe with <SYSTEM32>\rundll32.exe.new
  • <SYSTEM32>\dllcache\autolfn.exe with <SYSTEM32>\dllcache\autolfn.exe.new
  • <SYSTEM32>\savedump.exe with <SYSTEM32>\savedump.exe.new
  • <SYSTEM32>\runonce.exe with <SYSTEM32>\runonce.exe.new
  • <SYSTEM32>\rwinsta.exe with <SYSTEM32>\rwinsta.exe.new
  • <SYSTEM32>\reg.exe with <SYSTEM32>\reg.exe.new
  • <SYSTEM32>\pentnt.exe with <SYSTEM32>\pentnt.exe.new
  • <SYSTEM32>\perfmon.exe with <SYSTEM32>\perfmon.exe.new
  • <SYSTEM32>\dllcache\asr_ldm.exe with <SYSTEM32>\dllcache\asr_ldm.exe.new
  • <SYSTEM32>\pathping.exe with <SYSTEM32>\pathping.exe.new
  • <SYSTEM32>\dllcache\asr_pfu.exe with <SYSTEM32>\dllcache\asr_pfu.exe.new
  • <SYSTEM32>\powercfg.exe with <SYSTEM32>\powercfg.exe.new
  • <SYSTEM32>\dllcache\at.exe with <SYSTEM32>\dllcache\at.exe.new
  • <SYSTEM32>\ping.exe with <SYSTEM32>\ping.exe.new
  • <SYSTEM32>\ping6.exe with <SYSTEM32>\ping6.exe.new
  • <SYSTEM32>\odbcad32.exe with <SYSTEM32>\odbcad32.exe.new
  • <SYSTEM32>\odbcconf.exe with <SYSTEM32>\odbcconf.exe.new
  • <SYSTEM32>\bad182 with <SYSTEM32>\arp.exe
  • <SYSTEM32>\nwscript.exe with <SYSTEM32>\nwscript.exe.new
  • <SYSTEM32>\openfiles.exe with <SYSTEM32>\openfiles.exe.new
  • <SYSTEM32>\osuninst.exe with <SYSTEM32>\osuninst.exe.new
  • <SYSTEM32>\packager.exe with <SYSTEM32>\packager.exe.new
  • <SYSTEM32>\dllcache\asr_fmt.exe with <SYSTEM32>\dllcache\asr_fmt.exe.new
  • <SYSTEM32>\osk.exe with <SYSTEM32>\osk.exe.new
  • <SYSTEM32>\rcimlby.exe with <SYSTEM32>\rcimlby.exe.new
  • <SYSTEM32>\rcp.exe with <SYSTEM32>\rcp.exe.new
  • <SYSTEM32>\rasdial.exe with <SYSTEM32>\rasdial.exe.new
  • <SYSTEM32>\rasphone.exe with <SYSTEM32>\rasphone.exe.new
  • <SYSTEM32>\dllcache\auditusr.exe with <SYSTEM32>\dllcache\auditusr.exe.new
  • <SYSTEM32>\rdshost.exe with <SYSTEM32>\rdshost.exe.new
  • <SYSTEM32>\recover.exe with <SYSTEM32>\recover.exe.new
  • <SYSTEM32>\rdpclip.exe with <SYSTEM32>\rdpclip.exe.new
  • <SYSTEM32>\rdsaddin.exe with <SYSTEM32>\rdsaddin.exe.new
  • <SYSTEM32>\proxycfg.exe with <SYSTEM32>\proxycfg.exe.new
  • <SYSTEM32>\dllcache\atmadm.exe with <SYSTEM32>\dllcache\atmadm.exe.new
  • <SYSTEM32>\print.exe with <SYSTEM32>\print.exe.new
  • <SYSTEM32>\proquota.exe with <SYSTEM32>\proquota.exe.new
  • <SYSTEM32>\qappsrv.exe with <SYSTEM32>\qappsrv.exe.new
  • <SYSTEM32>\dllcache\attrib.exe with <SYSTEM32>\dllcache\attrib.exe.new
  • <SYSTEM32>\rasautou.exe with <SYSTEM32>\rasautou.exe.new
  • <SYSTEM32>\qprocess.exe with <SYSTEM32>\qprocess.exe.new
  • <SYSTEM32>\qwinsta.exe with <SYSTEM32>\qwinsta.exe.new
  • <SYSTEM32>\tracerpt.exe with <SYSTEM32>\tracerpt.exe.new
  • <SYSTEM32>\dllcache\cmd.exe with <SYSTEM32>\dllcache\cmd.exe.new
  • <SYSTEM32>\tlntsvr.exe with <SYSTEM32>\tlntsvr.exe.new
  • <SYSTEM32>\tourstart.exe with <SYSTEM32>\tourstart.exe.new
  • <SYSTEM32>\tracert.exe with <SYSTEM32>\tracert.exe.new
  • <SYSTEM32>\tscupgrd.exe with <SYSTEM32>\tscupgrd.exe.new
  • <SYSTEM32>\dllcache\cmdl32.exe with <SYSTEM32>\dllcache\cmdl32.exe.new
  • <SYSTEM32>\tracert6.exe with <SYSTEM32>\tracert6.exe.new
  • <SYSTEM32>\tscon.exe with <SYSTEM32>\tscon.exe.new
  • <SYSTEM32>\tcpsvcs.exe with <SYSTEM32>\tcpsvcs.exe.new
  • <SYSTEM32>\telnet.exe with <SYSTEM32>\telnet.exe.new
  • <SYSTEM32>\dllcache\cleanmgr.exe with <SYSTEM32>\dllcache\cleanmgr.exe.new
  • <SYSTEM32>\tcmsetup.exe with <SYSTEM32>\tcmsetup.exe.new
  • <SYSTEM32>\tftp.exe with <SYSTEM32>\tftp.exe.new
  • <SYSTEM32>\tlntsess.exe with <SYSTEM32>\tlntsess.exe.new
  • <SYSTEM32>\dllcache\clipsrv.exe with <SYSTEM32>\dllcache\clipsrv.exe.new
  • <SYSTEM32>\dllcache\clipbrd.exe with <SYSTEM32>\dllcache\clipbrd.exe.new
  • <SYSTEM32>\tlntadmn.exe with <SYSTEM32>\tlntadmn.exe.new
  • <SYSTEM32>\dllcache\comp.exe with <SYSTEM32>\dllcache\comp.exe.new
  • <SYSTEM32>\verifier.exe with <SYSTEM32>\verifier.exe.new
  • <SYSTEM32>\dllcache\cmstp.exe with <SYSTEM32>\dllcache\cmstp.exe.new
  • <SYSTEM32>\utilman.exe with <SYSTEM32>\utilman.exe.new
  • <SYSTEM32>\vssadmin.exe with <SYSTEM32>\vssadmin.exe.new
  • <SYSTEM32>\w32tm.exe with <SYSTEM32>\w32tm.exe.new
  • <SYSTEM32>\wextract.exe with <SYSTEM32>\wextract.exe.new
  • <SYSTEM32>\dllcache\compact.exe with <SYSTEM32>\dllcache\compact.exe.new
  • <SYSTEM32>\vssvc.exe with <SYSTEM32>\vssvc.exe.new
  • <SYSTEM32>\tsshutdn.exe with <SYSTEM32>\tsshutdn.exe.new
  • <SYSTEM32>\typeperf.exe with <SYSTEM32>\typeperf.exe.new
  • <SYSTEM32>\tsdiscon.exe with <SYSTEM32>\tsdiscon.exe.new
  • <SYSTEM32>\tskill.exe with <SYSTEM32>\tskill.exe.new
  • <SYSTEM32>\dllcache\cmmon32.exe with <SYSTEM32>\dllcache\cmmon32.exe.new
  • <SYSTEM32>\ups.exe with <SYSTEM32>\ups.exe.new
  • <SYSTEM32>\userinit.exe with <SYSTEM32>\userinit.exe.new
  • <SYSTEM32>\unlodctr.exe with <SYSTEM32>\unlodctr.exe.new
  • <SYSTEM32>\upnpcont.exe with <SYSTEM32>\upnpcont.exe.new
  • <SYSTEM32>\taskmgr.exe with <SYSTEM32>\taskmgr.exe.new
  • <SYSTEM32>\smss.exe with <SYSTEM32>\smss.exe.new
  • <SYSTEM32>\sndrec32.exe with <SYSTEM32>\sndrec32.exe.new
  • <SYSTEM32>\smlogsvc.exe with <SYSTEM32>\smlogsvc.exe.new
  • <SYSTEM32>\dllcache\charmap.exe with <SYSTEM32>\dllcache\charmap.exe.new
  • <SYSTEM32>\sndvol32.exe with <SYSTEM32>\sndvol32.exe.new
  • <SYSTEM32>\sort.exe with <SYSTEM32>\sort.exe.new
  • <SYSTEM32>\spider.exe with <SYSTEM32>\spider.exe.new
  • <SYSTEM32>\dllcache\chkdsk.exe with <SYSTEM32>\dllcache\chkdsk.exe.new
  • <SYSTEM32>\sol.exe with <SYSTEM32>\sol.exe.new
  • <SYSTEM32>\shadow.exe with <SYSTEM32>\shadow.exe.new
  • <SYSTEM32>\shmgrate.exe with <SYSTEM32>\shmgrate.exe.new
  • <SYSTEM32>\setup.exe with <SYSTEM32>\setup.exe.new
  • <SYSTEM32>\dllcache\calc.exe with <SYSTEM32>\dllcache\calc.exe.new
  • <SYSTEM32>\shrpubw.exe with <SYSTEM32>\shrpubw.exe.new
  • <SYSTEM32>\skeys.exe with <SYSTEM32>\skeys.exe.new
  • <SYSTEM32>\smbinst.exe with <SYSTEM32>\smbinst.exe.new
  • <SYSTEM32>\shutdown.exe with <SYSTEM32>\shutdown.exe.new
  • <SYSTEM32>\sigverif.exe with <SYSTEM32>\sigverif.exe.new
  • <SYSTEM32>\dllcache\cisvc.exe with <SYSTEM32>\dllcache\cisvc.exe.new
  • <SYSTEM32>\sysocmgr.exe with <SYSTEM32>\sysocmgr.exe.new
  • <SYSTEM32>\syncapp.exe with <SYSTEM32>\syncapp.exe.new
  • <SYSTEM32>\syskey.exe with <SYSTEM32>\syskey.exe.new
  • <SYSTEM32>\systeminfo.exe with <SYSTEM32>\systeminfo.exe.new
  • <SYSTEM32>\dllcache\ckcnv.exe with <SYSTEM32>\dllcache\ckcnv.exe.new
  • <SYSTEM32>\tasklist.exe with <SYSTEM32>\tasklist.exe.new
  • <SYSTEM32>\systray.exe with <SYSTEM32>\systray.exe.new
  • <SYSTEM32>\taskkill.exe with <SYSTEM32>\taskkill.exe.new
  • <SYSTEM32>\spnpinst.exe with <SYSTEM32>\spnpinst.exe.new
  • <SYSTEM32>\spoolsv.exe with <SYSTEM32>\spoolsv.exe.new
  • <SYSTEM32>\dllcache\chkntfs.exe with <SYSTEM32>\dllcache\chkntfs.exe.new
  • <SYSTEM32>\spiisupd.exe with <SYSTEM32>\spiisupd.exe.new
  • <SYSTEM32>\dllcache\cidaemon.exe with <SYSTEM32>\dllcache\cidaemon.exe.new
  • <SYSTEM32>\dllcache\cipher.exe with <SYSTEM32>\dllcache\cipher.exe.new
  • <SYSTEM32>\subst.exe with <SYSTEM32>\subst.exe.new
  • <SYSTEM32>\sprestrt.exe with <SYSTEM32>\sprestrt.exe.new
  • <SYSTEM32>\stimon.exe with <SYSTEM32>\stimon.exe.new
  • <SYSTEM32>\bad24 with <SYSTEM32>\append.exe
  • <SYSTEM32>\XPSViewer\XPSViewer.exe with <SYSTEM32>\XPSViewer\XPSViewer.exe
  • <SYSTEM32>\driverquery.exe with <SYSTEM32>\driverquery.exe.new
  • <SYSTEM32>\wbem\wmiprvse.exe with <SYSTEM32>\wbem\wmiprvse.exe
  • <SYSTEM32>\dpvsetup.exe with <SYSTEM32>\dpvsetup.exe.new
  • <SYSTEM32>\drwtsn32.exe with <SYSTEM32>\drwtsn32.exe.new
  • <SYSTEM32>\dwwin.exe with <SYSTEM32>\dwwin.exe.new
  • <SYSTEM32>\dxdiag.exe with <SYSTEM32>\dxdiag.exe.new
  • <SYSTEM32>\dumprep.exe with <SYSTEM32>\dumprep.exe.new
  • <SYSTEM32>\dvdupgrd.exe with <SYSTEM32>\dvdupgrd.exe.new
  • <SYSTEM32>\wbem\wbemtest.exe with <SYSTEM32>\wbem\wbemtest.exe
  • <SYSTEM32>\wbem\winmgmt.exe with <SYSTEM32>\wbem\winmgmt.exe
  • <SYSTEM32>\wbem\scrcons.exe with <SYSTEM32>\wbem\scrcons.exe
  • <SYSTEM32>\wbem\unsecapp.exe with <SYSTEM32>\wbem\unsecapp.exe
  • <SYSTEM32>\dplaysvr.exe with <SYSTEM32>\dplaysvr.exe.new
  • <SYSTEM32>\wbem\wmic.exe with <SYSTEM32>\wbem\wmic.exe
  • <SYSTEM32>\dpnsvr.exe with <SYSTEM32>\dpnsvr.exe.new
  • <SYSTEM32>\wbem\wmiadap.exe with <SYSTEM32>\wbem\wmiadap.exe
  • <SYSTEM32>\wbem\wmiapsrv.exe with <SYSTEM32>\wbem\wmiapsrv.exe
  • <SYSTEM32>\finger.exe with <SYSTEM32>\finger.exe.new
  • <SYSTEM32>\fixmapi.exe with <SYSTEM32>\fixmapi.exe.new
  • <SYSTEM32>\find.exe with <SYSTEM32>\find.exe.new
  • <SYSTEM32>\findstr.exe with <SYSTEM32>\findstr.exe.new
  • <SYSTEM32>\fltMc.exe with <SYSTEM32>\fltmc.exe.new
  • <SYSTEM32>\freecell.exe with <SYSTEM32>\freecell.exe.new
  • <SYSTEM32>\fsutil.exe with <SYSTEM32>\fsutil.exe.new
  • <SYSTEM32>\fontview.exe with <SYSTEM32>\fontview.exe.new
  • <SYSTEM32>\forcedos.exe with <SYSTEM32>\forcedos.exe.new
  • <SYSTEM32>\eventcreate.exe with <SYSTEM32>\eventcreate.exe.new
  • <Auxiliary element> with <Auxiliary element>
  • <SYSTEM32>\esentutl.exe with <SYSTEM32>\esentutl.exe.new
  • <SYSTEM32>\eudcedit.exe with <SYSTEM32>\eudcedit.exe.new
  • <SYSTEM32>\eventtriggers.exe with <SYSTEM32>\eventtriggers.exe.new
  • <SYSTEM32>\extrac32.exe with <SYSTEM32>\extrac32.exe.new
  • <SYSTEM32>\fc.exe with <SYSTEM32>\fc.exe.new
  • <SYSTEM32>\eventvwr.exe with <SYSTEM32>\eventvwr.exe.new
  • <SYSTEM32>\expand.exe with <SYSTEM32>\expand.exe.new
  • <SYSTEM32>\wbem\mofcomp.exe with <SYSTEM32>\wbem\mofcomp.exe
  • <SYSTEM32>\wupdmgr.exe with <SYSTEM32>\wupdmgr.exe
  • <SYSTEM32>\xcopy.exe with <SYSTEM32>\xcopy.exe
  • <SYSTEM32>\wuauclt1.exe with <SYSTEM32>\wuauclt1.exe
  • <SYSTEM32>\bad60 with <SYSTEM32>\wupdmgr.exe
  • <SYSTEM32>\Com\comrepl.exe with <SYSTEM32>\Com\comrepl.exe
  • <SYSTEM32>\dfrgfat.exe with <SYSTEM32>\dfrgfat.exe.new
  • <SYSTEM32>\dfrgntfs.exe with <SYSTEM32>\dfrgntfs.exe.new
  • <SYSTEM32>\defrag.exe with <SYSTEM32>\defrag.exe.new
  • <SYSTEM32>\Com\comrereg.exe with <SYSTEM32>\Com\comrereg.exe
  • <SYSTEM32>\dcomcnfg.exe with <SYSTEM32>\dcomcnfg.exe.new
  • <SYSTEM32>\bad51 with <SYSTEM32>\wscntfy.exe
  • <SYSTEM32>\wpnpinst.exe with <SYSTEM32>\wpnpinst.exe
  • <SYSTEM32>\write.exe with <SYSTEM32>\write.exe
  • <SYSTEM32>\wscntfy.exe with <SYSTEM32>\wscntfy.exe
  • <SYSTEM32>\bad47 with <SYSTEM32>\wuauclt.exe
  • <SYSTEM32>\ddeshare.exe with <SYSTEM32>\ddeshare.exe.new
  • <SYSTEM32>\bad127 with <SYSTEM32>\wscript.exe
  • <SYSTEM32>\wscript.exe with <SYSTEM32>\wscript.exe
  • <SYSTEM32>\dmadmin.exe with <SYSTEM32>\dmadmin.exe.new
  • <SYSTEM32>\URTTEMP\regtlib.exe with <SYSTEM32>\URTTEMP\regtlib.exe
  • <SYSTEM32>\Restore\srdiag.exe with <SYSTEM32>\Restore\srdiag.exe
  • <SYSTEM32>\spool\prtprocs\w32x86\printfilterpipelinesvc.exe with <SYSTEM32>\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
  • <SYSTEM32>\usmt\migload.exe with <SYSTEM32>\usmt\migload.exe
  • <SYSTEM32>\doskey.exe with <SYSTEM32>\doskey.exe.new
  • <SYSTEM32>\usmt\migwiz_a.exe with <SYSTEM32>\usmt\migwiz_a.exe
  • <SYSTEM32>\dmremote.exe with <SYSTEM32>\dmremote.exe.new
  • <SYSTEM32>\usmt\migwiz.exe with <SYSTEM32>\usmt\migwiz.exe
  • <SYSTEM32>\npp\nppagent.exe with <SYSTEM32>\npp\nppagent.exe
  • <SYSTEM32>\oobe\msoobe.exe with <SYSTEM32>\oobe\msoobe.exe
  • <SYSTEM32>\diantz.exe with <SYSTEM32>\diantz.exe.new
  • <SYSTEM32>\diskpart.exe with <SYSTEM32>\diskpart.exe.new
  • <SYSTEM32>\diskperf.exe with <SYSTEM32>\diskperf.exe.new
  • <SYSTEM32>\Restore\rstrui.exe with <SYSTEM32>\Restore\rstrui.exe
  • <SYSTEM32>\dllhst3g.exe with <SYSTEM32>\dllhst3g.exe.new
  • <SYSTEM32>\oobe\oobebaln.exe with <SYSTEM32>\oobe\oobebaln.exe
  • <SYSTEM32>\dllhost.exe with <SYSTEM32>\dllhost.exe.new
  • <SYSTEM32>\msiexec.exe with <SYSTEM32>\msiexec.exe.new
  • <SYSTEM32>\dllcache\hscupd.exe with <SYSTEM32>\dllcache\hscupd.exe.new
  • <SYSTEM32>\mshearts.exe with <SYSTEM32>\mshearts.exe.new
  • <SYSTEM32>\mshta.exe with <SYSTEM32>\mshta.exe.new
  • <SYSTEM32>\msswchx.exe with <SYSTEM32>\msswchx.exe.new
  • <SYSTEM32>\dllcache\msconfig.exe with <SYSTEM32>\dllcache\msconfig.exe.new
  • <SYSTEM32>\narrator.exe with <SYSTEM32>\narrator.exe.new
  • <SYSTEM32>\mstinit.exe with <SYSTEM32>\mstinit.exe.new
  • <SYSTEM32>\mstsc.exe with <SYSTEM32>\mstsc.exe.new
  • <SYSTEM32>\mqbkup.exe with <SYSTEM32>\mqbkup.exe.new
  • <SYSTEM32>\mqsvc.exe with <SYSTEM32>\mqsvc.exe.new
  • <SYSTEM32>\mplay32.exe with <SYSTEM32>\mplay32.exe.new
  • <SYSTEM32>\mpnotify.exe with <SYSTEM32>\mpnotify.exe.new
  • <SYSTEM32>\mqtgsvc.exe with <SYSTEM32>\mqtgsvc.exe.new
  • <SYSTEM32>\msg.exe with <SYSTEM32>\msg.exe.new
  • <SYSTEM32>\dllcache\helpsvc.exe with <SYSTEM32>\dllcache\helpsvc.exe.new
  • <SYSTEM32>\mrinfo.exe with <SYSTEM32>\mrinfo.exe.new
  • <SYSTEM32>\msdtc.exe with <SYSTEM32>\msdtc.exe.new
  • <SYSTEM32>\nslookup.exe with <SYSTEM32>\nslookup.exe.new
  • <SYSTEM32>\ntbackup.exe with <SYSTEM32>\ntbackup.exe.new
  • <SYSTEM32>\dllcache\uploadm.exe with <SYSTEM32>\dllcache\uploadm.exe.new
  • <SYSTEM32>\notepad.exe with <SYSTEM32>\notepad.exe.new
  • <SYSTEM32>\dllcache\accwiz.exe with <SYSTEM32>\dllcache\accwiz.exe.new
  • <SYSTEM32>\ntsd.exe with <SYSTEM32>\ntsd.exe.new
  • <SYSTEM32>\ntvdm.exe with <SYSTEM32>\ntvdm.exe.new
  • <SYSTEM32>\dllcache\actmovie.exe with <SYSTEM32>\dllcache\actmovie.exe.new
  • <SYSTEM32>\dllcache\ahui.exe with <SYSTEM32>\dllcache\ahui.exe.new
  • <SYSTEM32>\net.exe with <SYSTEM32>\net.exe.new
  • <SYSTEM32>\net1.exe with <SYSTEM32>\net1.exe.new
  • <SYSTEM32>\nbtstat.exe with <SYSTEM32>\nbtstat.exe.new
  • <SYSTEM32>\nddeapir.exe with <SYSTEM32>\nddeapir.exe.new
  • <SYSTEM32>\dllcache\notiflag.exe with <SYSTEM32>\dllcache\notiflag.exe.new
  • <SYSTEM32>\netsh.exe with <SYSTEM32>\netsh.exe.new
  • <SYSTEM32>\netstat.exe with <SYSTEM32>\netstat.exe.new
  • <SYSTEM32>\netdde.exe with <SYSTEM32>\netdde.exe.new
  • <SYSTEM32>\netsetup.exe with <SYSTEM32>\netsetup.exe.new
  • <SYSTEM32>\mountvol.exe with <SYSTEM32>\mountvol.exe.new
  • <SYSTEM32>\ipsec6.exe with <SYSTEM32>\ipsec6.exe.new
  • <SYSTEM32>\ipv6.exe with <SYSTEM32>\ipv6.exe.new
  • <SYSTEM32>\imapi.exe with <SYSTEM32>\imapi.exe.new
  • <SYSTEM32>\ipconfig.exe with <SYSTEM32>\ipconfig.exe.new
  • <SYSTEM32>\ipxroute.exe with <SYSTEM32>\ipxroute.exe.new
  • <SYSTEM32>\lights.exe with <SYSTEM32>\lights.exe.new
  • <SYSTEM32>\lnkstub.exe with <SYSTEM32>\lnkstub.exe.new
  • <SYSTEM32>\dllcache\agentsvr.exe with <SYSTEM32>\dllcache\agentsvr.exe.new
  • <SYSTEM32>\label.exe with <SYSTEM32>\label.exe.new
  • <SYSTEM32>\gpresult.exe with <SYSTEM32>\gpresult.exe.new
  • <SYSTEM32>\gpupdate.exe with <SYSTEM32>\gpupdate.exe.new
  • <SYSTEM32>\ftp.exe with <SYSTEM32>\ftp.exe.new
  • <SYSTEM32>\getmac.exe with <SYSTEM32>\getmac.exe.new
  • <SYSTEM32>\grpconv.exe with <SYSTEM32>\grpconv.exe.new
  • <SYSTEM32>\ie4uinit.exe with <SYSTEM32>\ie4uinit.exe.new
  • <SYSTEM32>\iexpress.exe with <SYSTEM32>\iexpress.exe.new
  • <SYSTEM32>\help.exe with <SYSTEM32>\help.exe.new
  • <SYSTEM32>\hostname.exe with <SYSTEM32>\hostname.exe.new
  • <SYSTEM32>\dllcache\helpctr.exe with <SYSTEM32>\dllcache\helpctr.exe.new
  • <SYSTEM32>\mmc.exe with <SYSTEM32>\mmc.exe.new
  • <SYSTEM32>\magnify.exe with <SYSTEM32>\magnify.exe.new
  • <SYSTEM32>\makecab.exe with <SYSTEM32>\makecab.exe.new
  • <SYSTEM32>\dllcache\helphost.exe with <SYSTEM32>\dllcache\helphost.exe.new
  • <SYSTEM32>\mnmsrvc.exe with <SYSTEM32>\mnmsrvc.exe.new
  • <SYSTEM32>\mobsync.exe with <SYSTEM32>\mobsync.exe.new
  • %WINDIR%\bad51 with %WINDIR%\taskman.exe
  • %WINDIR%\bad80 with %WINDIR%\twunk_32.exe
  • <SYSTEM32>\lodctr.exe with <SYSTEM32>\lodctr.exe.new
  • <SYSTEM32>\logagent.exe with <SYSTEM32>\logagent.exe.new
  • <SYSTEM32>\locator.exe with <SYSTEM32>\locator.exe.new
  • <SYSTEM32>\dllcache\muisetup.exe with <SYSTEM32>\dllcache\muisetup.exe.new
  • <SYSTEM32>\logman.exe with <SYSTEM32>\logman.exe.new
  • <SYSTEM32>\lpq.exe with <SYSTEM32>\lpq.exe.new
  • <SYSTEM32>\lpr.exe with <SYSTEM32>\lpr.exe.new
  • <SYSTEM32>\logoff.exe with <SYSTEM32>\logoff.exe.new
  • <SYSTEM32>\logonui.exe with <SYSTEM32>\logonui.exe.new
  • <SYSTEM32>\dllcache\setup.exe with <SYSTEM32>\dllcache\setup.exe.new
  • <SYSTEM32>\dllcache\shadow.exe with <SYSTEM32>\dllcache\shadow.exe.new
  • <SYSTEM32>\dllcache\sessmgr.exe with <SYSTEM32>\dllcache\sessmgr.exe.new
  • <SYSTEM32>\dllcache\sethc.exe with <SYSTEM32>\dllcache\sethc.exe.new
  • <SYSTEM32>\dllcache\shmgrate.exe with <SYSTEM32>\dllcache\shmgrate.exe.new
  • <SYSTEM32>\dllcache\sigverif.exe with <SYSTEM32>\dllcache\sigverif.exe.new
  • <SYSTEM32>\dllcache\skeys.exe with <SYSTEM32>\dllcache\skeys.exe.new
  • <SYSTEM32>\dllcache\shrpubw.exe with <SYSTEM32>\dllcache\shrpubw.exe.new
  • <SYSTEM32>\dllcache\shutdown.exe with <SYSTEM32>\dllcache\shutdown.exe.new
  • <SYSTEM32>\dllcache\savedump.exe with <SYSTEM32>\dllcache\savedump.exe.new
  • <SYSTEM32>\dllcache\sc.exe with <SYSTEM32>\dllcache\sc.exe.new
  • <SYSTEM32>\dllcache\runonce.exe with <SYSTEM32>\dllcache\runonce.exe.new
  • <SYSTEM32>\dllcache\rwinsta.exe with <SYSTEM32>\dllcache\rwinsta.exe.new
  • <SYSTEM32>\dllcache\scardsvr.exe with <SYSTEM32>\dllcache\scardsvr.exe.new
  • <SYSTEM32>\dllcache\secedit.exe with <SYSTEM32>\dllcache\secedit.exe.new
  • <SYSTEM32>\dllcache\services.exe with <SYSTEM32>\dllcache\services.exe.new
  • <SYSTEM32>\dllcache\sctasks.exe with <SYSTEM32>\dllcache\sctasks.exe.new
  • <SYSTEM32>\dllcache\sdbinst.exe with <SYSTEM32>\dllcache\sdbinst.exe.new
  • <SYSTEM32>\dllcache\sprestrt.exe with <SYSTEM32>\dllcache\sprestrt.exe.new
  • <SYSTEM32>\dllcache\stimon.exe with <SYSTEM32>\dllcache\stimon.exe.new
  • <SYSTEM32>\dllcache\spnpinst.exe with <SYSTEM32>\dllcache\spnpinst.exe.new
  • <SYSTEM32>\dllcache\spoolsv.exe with <SYSTEM32>\dllcache\spoolsv.exe.new
  • <SYSTEM32>\dllcache\subst.exe with <SYSTEM32>\dllcache\subst.exe.new
  • <SYSTEM32>\dllcache\sysocmgr.exe with <SYSTEM32>\dllcache\sysocmgr.exe.new
  • <SYSTEM32>\dllcache\sysinfo.exe with <SYSTEM32>\dllcache\sysinfo.exe.new
  • <SYSTEM32>\dllcache\syncapp.exe with <SYSTEM32>\dllcache\syncapp.exe.new
  • <SYSTEM32>\dllcache\syskey.exe with <SYSTEM32>\dllcache\syskey.exe.new
  • <SYSTEM32>\dllcache\smss.exe with <SYSTEM32>\dllcache\smss.exe.new
  • <SYSTEM32>\dllcache\sndrec32.exe with <SYSTEM32>\dllcache\sndrec32.exe.new
  • <SYSTEM32>\dllcache\smbinst.exe with <SYSTEM32>\dllcache\smbinst.exe.new
  • <SYSTEM32>\dllcache\smlogsvc.exe with <SYSTEM32>\dllcache\smlogsvc.exe.new
  • <SYSTEM32>\dllcache\sndvol32.exe with <SYSTEM32>\dllcache\sndvol32.exe.new
  • <SYSTEM32>\dllcache\spider.exe with <SYSTEM32>\dllcache\spider.exe.new
  • <SYSTEM32>\dllcache\spiisupd.exe with <SYSTEM32>\dllcache\spiisupd.exe.new
  • <SYSTEM32>\dllcache\sol.exe with <SYSTEM32>\dllcache\sol.exe.new
  • <SYSTEM32>\dllcache\sort.exe with <SYSTEM32>\dllcache\sort.exe.new
  • <SYSTEM32>\dllcache\rundll32.exe with <SYSTEM32>\dllcache\rundll32.exe.new
  • <SYSTEM32>\dllcache\rcp.exe with <SYSTEM32>\dllcache\rcp.exe.new
  • <SYSTEM32>\dllcache\rdpclip.exe with <SYSTEM32>\dllcache\rdpclip.exe.new
  • <SYSTEM32>\dllcache\rasphone.exe with <SYSTEM32>\dllcache\rasphone.exe.new
  • <SYSTEM32>\dllcache\rcimlby.exe with <SYSTEM32>\dllcache\rcimlby.exe.new
  • <SYSTEM32>\dllcache\rdsaddin.exe with <SYSTEM32>\dllcache\rdsaddin.exe.new
  • <SYSTEM32>\dllcache\reg.exe with <SYSTEM32>\dllcache\reg.exe.new
  • <SYSTEM32>\dllcache\regedt32.exe with <SYSTEM32>\dllcache\regedt32.exe.new
  • <SYSTEM32>\dllcache\rdshost.exe with <SYSTEM32>\dllcache\rdshost.exe.new
  • <SYSTEM32>\dllcache\recover.exe with <SYSTEM32>\dllcache\recover.exe.new
  • <SYSTEM32>\dllcache\proquota.exe with <SYSTEM32>\dllcache\proquota.exe.new
  • <SYSTEM32>\dllcache\proxycfg.exe with <SYSTEM32>\dllcache\proxycfg.exe.new
  • <SYSTEM32>\dllcache\powercfg.exe with <SYSTEM32>\dllcache\powercfg.exe.new
  • <SYSTEM32>\dllcache\print.exe with <SYSTEM32>\dllcache\print.exe.new
  • <SYSTEM32>\dllcache\qappsrv.exe with <SYSTEM32>\dllcache\qappsrv.exe.new
  • <SYSTEM32>\dllcache\rasautou.exe with <SYSTEM32>\dllcache\rasautou.exe.new
  • <SYSTEM32>\dllcache\rasdial.exe with <SYSTEM32>\dllcache\rasdial.exe.new
  • <SYSTEM32>\dllcache\qprocess.exe with <SYSTEM32>\dllcache\qprocess.exe.new
  • <SYSTEM32>\dllcache\qwinsta.exe with <SYSTEM32>\dllcache\qwinsta.exe.new
  • <SYSTEM32>\dllcache\rsmsink.exe with <SYSTEM32>\dllcache\rsmsink.exe.new
  • <SYSTEM32>\dllcache\rsmui.exe with <SYSTEM32>\dllcache\rsmui.exe.new
  • <SYSTEM32>\dllcache\rsh.exe with <SYSTEM32>\dllcache\rsh.exe.new
  • <SYSTEM32>\dllcache\rsm.exe with <SYSTEM32>\dllcache\rsm.exe.new
  • <SYSTEM32>\dllcache\rsnotify.exe with <SYSTEM32>\dllcache\rsnotify.exe.new
  • <SYSTEM32>\dllcache\rtcshare.exe with <SYSTEM32>\dllcache\rtcshare.exe.new
  • <SYSTEM32>\dllcache\runas.exe with <SYSTEM32>\dllcache\runas.exe.new
  • <SYSTEM32>\dllcache\rsopprov.exe with <SYSTEM32>\dllcache\rsopprov.exe.new
  • <SYSTEM32>\dllcache\rsvp.exe with <SYSTEM32>\dllcache\rsvp.exe.new
  • <SYSTEM32>\dllcache\regwiz.exe with <SYSTEM32>\dllcache\regwiz.exe.new
  • <SYSTEM32>\dllcache\relog.exe with <SYSTEM32>\dllcache\relog.exe.new
  • <SYSTEM32>\dllcache\regini.exe with <SYSTEM32>\dllcache\regini.exe.new
  • <SYSTEM32>\dllcache\regsvr32.exe with <SYSTEM32>\dllcache\regsvr32.exe.new
  • <SYSTEM32>\dllcache\replace.exe with <SYSTEM32>\dllcache\replace.exe.new
  • <SYSTEM32>\dllcache\route.exe with <SYSTEM32>\dllcache\route.exe.new
  • <SYSTEM32>\dllcache\routemon.exe with <SYSTEM32>\dllcache\routemon.exe.new
  • <SYSTEM32>\dllcache\reset.exe with <SYSTEM32>\dllcache\reset.exe.new
  • <SYSTEM32>\dllcache\rexec.exe with <SYSTEM32>\dllcache\rexec.exe.new
  • <SYSTEM32>\dllcache\nppagent.exe with <SYSTEM32>\dllcache\nppagent.exe.new
  • <SYSTEM32>\dllcache\msoobe.exe with <SYSTEM32>\dllcache\msoobe.exe.new
  • <SYSTEM32>\dllcache\comrepl.exe with <SYSTEM32>\dllcache\comrepl.exe.new
  • <SYSTEM32>\dllcache\comrereg.exe with <SYSTEM32>\dllcache\comrereg.exe.new
  • <SYSTEM32>\dllcache\oobebaln.exe with <SYSTEM32>\dllcache\oobebaln.exe.new
  • <SYSTEM32>\dllcache\migload.exe with <SYSTEM32>\dllcache\migload.exe.new
  • <SYSTEM32>\dllcache\migwiz.exe with <SYSTEM32>\dllcache\migwiz.exe.new
  • <SYSTEM32>\dllcache\rstrui.exe with <SYSTEM32>\dllcache\rstrui.exe.new
  • <SYSTEM32>\dllcache\srdiag.exe with <SYSTEM32>\dllcache\srdiag.exe.new
  • <SYSTEM32>\dllcache\wpnpinst.exe with <SYSTEM32>\dllcache\wpnpinst.exe.new
  • <SYSTEM32>\dllcache\write.exe with <SYSTEM32>\dllcache\write.exe.new
  • <SYSTEM32>\dllcache\winver.exe with <SYSTEM32>\dllcache\winver.exe.new
  • <SYSTEM32>\dllcache\wpabaln.exe with <SYSTEM32>\dllcache\wpabaln.exe.new
  • <SYSTEM32>\dllcache\wscntfy.exe with <SYSTEM32>\dllcache\wscntfy.exe.new
  • <SYSTEM32>\dllcache\wupdmgr.exe with <SYSTEM32>\dllcache\wupdmgr.exe.new
  • <SYSTEM32>\dllcache\xcopy.exe with <SYSTEM32>\dllcache\xcopy.exe.new
  • <SYSTEM32>\dllcache\wscript.exe with <SYSTEM32>\dllcache\wscript.exe.new
  • <SYSTEM32>\dllcache\wuauclt1.exe with <SYSTEM32>\dllcache\wuauclt1.exe.new
  • <SYSTEM32>\csrss.exe with <SYSTEM32>\csrss.exe.new
  • <SYSTEM32>\ctfmon.exe with <SYSTEM32>\ctfmon.exe.new
  • <SYSTEM32>\dllcache\wmiprvse.exe with <SYSTEM32>\dllcache\wmiprvse.exe.new
  • <SYSTEM32>\alg.exe with <SYSTEM32>\alg.exe.new
  • <SYSTEM32>\lsass.exe with <SYSTEM32>\lsass.exe.new
  • <SYSTEM32>\dllcache\ctfmon.exe with <SYSTEM32>\dllcache\ctfmon.exe.new
  • <SYSTEM32>\dllcache\lsass.exe with <SYSTEM32>\dllcache\lsass.exe.new
  • <SYSTEM32>\dllcache\alg.exe with <SYSTEM32>\dllcache\alg.exe.new
  • <SYSTEM32>\dllcache\csrss.exe with <SYSTEM32>\dllcache\csrss.exe.new
  • <SYSTEM32>\dllcache\scrcons.exe with <SYSTEM32>\dllcache\scrcons.exe.new
  • <SYSTEM32>\dllcache\unsecapp.exe with <SYSTEM32>\dllcache\unsecapp.exe.new
  • <SYSTEM32>\dllcache\migwiz_a.exe with <SYSTEM32>\dllcache\migwiz_a.exe.new
  • <SYSTEM32>\dllcache\mofcomp.exe with <SYSTEM32>\dllcache\mofcomp.exe.new
  • <SYSTEM32>\dllcache\wbemtest.exe with <SYSTEM32>\dllcache\wbemtest.exe.new
  • <SYSTEM32>\dllcache\wmiapsrv.exe with <SYSTEM32>\dllcache\wmiapsrv.exe.new
  • <SYSTEM32>\dllcache\wmic.exe with <SYSTEM32>\dllcache\wmic.exe.new
  • <SYSTEM32>\dllcache\winmgmt.exe with <SYSTEM32>\dllcache\winmgmt.exe.new
  • <SYSTEM32>\dllcache\wmiadap.exe with <SYSTEM32>\dllcache\wmiadap.exe.new
  • <SYSTEM32>\dllcache\winmsd.exe with <SYSTEM32>\dllcache\winmsd.exe.new
  • <SYSTEM32>\dllcache\tourstrt.exe with <SYSTEM32>\dllcache\tourstrt.exe.new
  • <SYSTEM32>\dllcache\tracerpt.exe with <SYSTEM32>\dllcache\tracerpt.exe.new
  • <SYSTEM32>\dllcache\tlntsess.exe with <SYSTEM32>\dllcache\tlntsess.exe.new
  • <SYSTEM32>\dllcache\tlntsvr.exe with <SYSTEM32>\dllcache\tlntsvr.exe.new
  • <SYSTEM32>\dllcache\tracert.exe with <SYSTEM32>\dllcache\tracert.exe.new
  • <SYSTEM32>\dllcache\tscupgrd.exe with <SYSTEM32>\dllcache\tscupgrd.exe.new
  • <SYSTEM32>\dllcache\tsdiscon.exe with <SYSTEM32>\dllcache\tsdiscon.exe.new
  • <SYSTEM32>\dllcache\tracert6.exe with <SYSTEM32>\dllcache\tracert6.exe.new
  • <SYSTEM32>\dllcache\tscon.exe with <SYSTEM32>\dllcache\tscon.exe.new
  • <SYSTEM32>\dllcache\tasklist.exe with <SYSTEM32>\dllcache\tasklist.exe.new
  • <SYSTEM32>\dllcache\taskmgr.exe with <SYSTEM32>\dllcache\taskmgr.exe.new
  • <SYSTEM32>\dllcache\systray.exe with <SYSTEM32>\dllcache\systray.exe.new
  • <SYSTEM32>\dllcache\taskkill.exe with <SYSTEM32>\dllcache\taskkill.exe.new
  • <SYSTEM32>\dllcache\tcmsetup.exe with <SYSTEM32>\dllcache\tcmsetup.exe.new
  • <SYSTEM32>\dllcache\tftp.exe with <SYSTEM32>\dllcache\tftp.exe.new
  • <SYSTEM32>\dllcache\tlntadmn.exe with <SYSTEM32>\dllcache\tlntadmn.exe.new
  • <SYSTEM32>\dllcache\tcpsvcs.exe with <SYSTEM32>\dllcache\tcpsvcs.exe.new
  • <SYSTEM32>\dllcache\telnet.exe with <SYSTEM32>\dllcache\telnet.exe.new
  • <SYSTEM32>\dllcache\w32tm.exe with <SYSTEM32>\dllcache\w32tm.exe.new
  • <SYSTEM32>\dllcache\wextract.exe with <SYSTEM32>\dllcache\wextract.exe.new
  • <SYSTEM32>\dllcache\vssadmin.exe with <SYSTEM32>\dllcache\vssadmin.exe.new
  • <SYSTEM32>\dllcache\vssvc.exe with <SYSTEM32>\dllcache\vssvc.exe.new
  • <SYSTEM32>\dllcache\wiaacmgr.exe with <SYSTEM32>\dllcache\wiaacmgr.exe.new
  • <SYSTEM32>\dllcache\winlogon.exe with <SYSTEM32>\dllcache\winlogon.exe.new
  • <SYSTEM32>\dllcache\winmine.exe with <SYSTEM32>\dllcache\winmine.exe.new
  • <SYSTEM32>\dllcache\winchat.exe with <SYSTEM32>\dllcache\winchat.exe.new
  • <SYSTEM32>\dllcache\winhstb.exe with <SYSTEM32>\dllcache\winhstb.exe.new
  • <SYSTEM32>\dllcache\typeperf.exe with <SYSTEM32>\dllcache\typeperf.exe.new
  • <SYSTEM32>\dllcache\unlodctr.exe with <SYSTEM32>\dllcache\unlodctr.exe.new
  • <SYSTEM32>\dllcache\tskill.exe with <SYSTEM32>\dllcache\tskill.exe.new
  • <SYSTEM32>\dllcache\tsshutdn.exe with <SYSTEM32>\dllcache\tsshutdn.exe.new
  • <SYSTEM32>\dllcache\upnpcont.exe with <SYSTEM32>\dllcache\upnpcont.exe.new
  • <SYSTEM32>\dllcache\utilman.exe with <SYSTEM32>\dllcache\utilman.exe.new
  • <SYSTEM32>\dllcache\verifier.exe with <SYSTEM32>\dllcache\verifier.exe.new
  • <SYSTEM32>\dllcache\ups.exe with <SYSTEM32>\dllcache\ups.exe.new
  • <SYSTEM32>\dllcache\userinit.exe with <SYSTEM32>\dllcache\userinit.exe.new
  • <SYSTEM32>\dllcache\ping6.exe with <SYSTEM32>\dllcache\ping6.exe.new
  • <SYSTEM32>\wbem\wmiapsrv.exe with <SYSTEM32>\wbem\wmiapsrv.exe.new
  • <SYSTEM32>\wbem\wmic.exe with <SYSTEM32>\wbem\wmic.exe.new
  • <SYSTEM32>\dllcache\dplaysvr.exe with <SYSTEM32>\dllcache\dplaysvr.exe.new
  • <SYSTEM32>\wbem\wmiadap.exe with <SYSTEM32>\wbem\wmiadap.exe.new
  • <SYSTEM32>\dllcache\dpnsvr.exe with <SYSTEM32>\dllcache\dpnsvr.exe.new
  • <SYSTEM32>\dllcache\drvqry.exe with <SYSTEM32>\dllcache\drvqry.exe.new
  • <SYSTEM32>\dllcache\drwtsn32.exe with <SYSTEM32>\dllcache\drwtsn32.exe.new
  • <SYSTEM32>\wbem\wmiprvse.exe with <SYSTEM32>\wbem\wmiprvse.exe.new
  • <SYSTEM32>\dllcache\dpvsetup.exe with <SYSTEM32>\dllcache\dpvsetup.exe.new
  • <SYSTEM32>\dllcache\doskey.exe with <SYSTEM32>\dllcache\doskey.exe.new
  • <SYSTEM32>\usmt\migwiz_a.exe with <SYSTEM32>\usmt\migwiz_a.exe.new
  • <SYSTEM32>\dllcache\dmremote.exe with <SYSTEM32>\dllcache\dmremote.exe.new
  • <SYSTEM32>\usmt\migwiz.exe with <SYSTEM32>\usmt\migwiz.exe.new
  • <SYSTEM32>\wbem\mofcomp.exe with <SYSTEM32>\wbem\mofcomp.exe.new
  • <SYSTEM32>\wbem\wbemtest.exe with <SYSTEM32>\wbem\wbemtest.exe.new
  • <SYSTEM32>\wbem\winmgmt.exe with <SYSTEM32>\wbem\winmgmt.exe.new
  • <SYSTEM32>\wbem\scrcons.exe with <SYSTEM32>\wbem\scrcons.exe.new
  • <SYSTEM32>\wbem\unsecapp.exe with <SYSTEM32>\wbem\unsecapp.exe.new
  • <SYSTEM32>\dllcache\fc.exe with <SYSTEM32>\dllcache\fc.exe.new
  • <SYSTEM32>\dllcache\find.exe with <SYSTEM32>\dllcache\find.exe.new
  • <SYSTEM32>\dllcache\expand.exe with <SYSTEM32>\dllcache\expand.exe.new
  • <SYSTEM32>\dllcache\extrac32.exe with <SYSTEM32>\dllcache\extrac32.exe.new
  • <SYSTEM32>\dllcache\findstr.exe with <SYSTEM32>\dllcache\findstr.exe.new
  • <SYSTEM32>\dllcache\fltmc.exe with <SYSTEM32>\dllcache\fltmc.exe.new
  • <SYSTEM32>\dllcache\fontview.exe with <SYSTEM32>\dllcache\fontview.exe.new
  • <SYSTEM32>\dllcache\finger.exe with <SYSTEM32>\dllcache\finger.exe.new
  • <SYSTEM32>\dllcache\fixmapi.exe with <SYSTEM32>\dllcache\fixmapi.exe.new
  • <SYSTEM32>\dllcache\dwwin.exe with <SYSTEM32>\dllcache\dwwin.exe.new
  • <SYSTEM32>\dllcache\dxdiag.exe with <SYSTEM32>\dllcache\dxdiag.exe.new
  • <SYSTEM32>\dllcache\dumprep.exe with <SYSTEM32>\dllcache\dumprep.exe.new
  • <SYSTEM32>\dllcache\dvdupgrd.exe with <SYSTEM32>\dllcache\dvdupgrd.exe.new
  • <SYSTEM32>\dllcache\esentutl.exe with <SYSTEM32>\dllcache\esentutl.exe.new
  • <SYSTEM32>\dllcache\evtrig.exe with <SYSTEM32>\dllcache\evtrig.exe.new
  • <SYSTEM32>\dllcache\eventvwr.exe with <SYSTEM32>\dllcache\eventvwr.exe.new
  • <SYSTEM32>\dllcache\eudcedit.exe with <SYSTEM32>\dllcache\eudcedit.exe.new
  • <SYSTEM32>\dllcache\evcreate.exe with <SYSTEM32>\dllcache\evcreate.exe.new
  • <SYSTEM32>\usmt\migload.exe with <SYSTEM32>\usmt\migload.exe.new
  • <SYSTEM32>\wpnpinst.exe with <SYSTEM32>\wpnpinst.exe.new
  • <SYSTEM32>\write.exe with <SYSTEM32>\write.exe.new
  • <SYSTEM32>\dllcache\convert.exe with <SYSTEM32>\dllcache\convert.exe.new
  • <SYSTEM32>\wpabaln.exe with <SYSTEM32>\wpabaln.exe.new
  • <SYSTEM32>\dllcache\dcomcnfg.exe with <SYSTEM32>\dllcache\dcomcnfg.exe.new
  • <SYSTEM32>\wuauclt1.exe with <SYSTEM32>\wuauclt1.exe.new
  • <SYSTEM32>\dllcache\ddeshare.exe with <SYSTEM32>\dllcache\ddeshare.exe.new
  • <SYSTEM32>\wscntfy.exe with <SYSTEM32>\wscntfy.exe.new
  • <SYSTEM32>\wscript.exe with <SYSTEM32>\wscript.exe.new
  • <SYSTEM32>\winchat.exe with <SYSTEM32>\winchat.exe.new
  • <SYSTEM32>\winhlp32.exe with <SYSTEM32>\winhlp32.exe.new
  • <SYSTEM32>\wiaacmgr.exe with <SYSTEM32>\wiaacmgr.exe.new
  • <SYSTEM32>\dllcache\conime.exe with <SYSTEM32>\dllcache\conime.exe.new
  • <SYSTEM32>\dllcache\control.exe with <SYSTEM32>\dllcache\control.exe.new
  • <SYSTEM32>\winmsd.exe with <SYSTEM32>\winmsd.exe.new
  • <SYSTEM32>\winver.exe with <SYSTEM32>\winver.exe.new
  • <SYSTEM32>\winlogon.exe with <SYSTEM32>\winlogon.exe.new
  • <SYSTEM32>\winmine.exe with <SYSTEM32>\winmine.exe.new
  • <SYSTEM32>\oobe\oobebaln.exe with <SYSTEM32>\oobe\oobebaln.exe.new
  • <SYSTEM32>\dllcache\diskperf.exe with <SYSTEM32>\dllcache\diskperf.exe.new
  • <SYSTEM32>\npp\nppagent.exe with <SYSTEM32>\npp\nppagent.exe.new
  • <SYSTEM32>\oobe\msoobe.exe with <SYSTEM32>\oobe\msoobe.exe.new
  • <SYSTEM32>\dllcache\dllhost.exe with <SYSTEM32>\dllcache\dllhost.exe.new
  • <SYSTEM32>\Restore\srdiag.exe with <SYSTEM32>\Restore\srdiag.exe.new
  • <SYSTEM32>\dllcache\dmadmin.exe with <SYSTEM32>\dllcache\dmadmin.exe.new
  • <SYSTEM32>\Restore\rstrui.exe with <SYSTEM32>\Restore\rstrui.exe.new
  • <SYSTEM32>\dllcache\dllhst3g.exe with <SYSTEM32>\dllcache\dllhst3g.exe.new
  • <SYSTEM32>\Com\comrepl.exe with <SYSTEM32>\Com\comrepl.exe.new
  • <SYSTEM32>\dllcache\defrag.exe with <SYSTEM32>\dllcache\defrag.exe.new
  • <SYSTEM32>\wupdmgr.exe with <SYSTEM32>\wupdmgr.exe.new
  • <SYSTEM32>\xcopy.exe with <SYSTEM32>\xcopy.exe.new
  • <SYSTEM32>\Com\comrereg.exe with <SYSTEM32>\Com\comrereg.exe.new
  • <SYSTEM32>\dllcache\diantz.exe with <SYSTEM32>\dllcache\diantz.exe.new
  • <SYSTEM32>\dllcache\diskpart.exe with <SYSTEM32>\dllcache\diskpart.exe.new
  • <SYSTEM32>\dllcache\dfrgfat.exe with <SYSTEM32>\dllcache\dfrgfat.exe.new
  • <SYSTEM32>\dllcache\dfrgntfs.exe with <SYSTEM32>\dllcache\dfrgntfs.exe.new
  • <SYSTEM32>\dllcache\narrator.exe with <SYSTEM32>\dllcache\narrator.exe.new
  • <SYSTEM32>\dllcache\nbtstat.exe with <SYSTEM32>\dllcache\nbtstat.exe.new
  • <SYSTEM32>\dllcache\mstinit.exe with <SYSTEM32>\dllcache\mstinit.exe.new
  • <SYSTEM32>\dllcache\mstsc.exe with <SYSTEM32>\dllcache\mstsc.exe.new
  • <SYSTEM32>\dllcache\nddeapir.exe with <SYSTEM32>\dllcache\nddeapir.exe.new
  • <SYSTEM32>\dllcache\netdde.exe with <SYSTEM32>\dllcache\netdde.exe.new
  • <SYSTEM32>\dllcache\netsetup.exe with <SYSTEM32>\dllcache\netsetup.exe.new
  • <SYSTEM32>\dllcache\net.exe with <SYSTEM32>\dllcache\net.exe.new
  • <SYSTEM32>\dllcache\net1.exe with <SYSTEM32>\dllcache\net1.exe.new
  • <SYSTEM32>\dllcache\mrinfo.exe with <SYSTEM32>\dllcache\mrinfo.exe.new
  • <SYSTEM32>\dllcache\msdtc.exe with <SYSTEM32>\dllcache\msdtc.exe.new
  • <SYSTEM32>\dllcache\mqsvc.exe with <SYSTEM32>\dllcache\mqsvc.exe.new
  • <SYSTEM32>\dllcache\mqtgsvc.exe with <SYSTEM32>\dllcache\mqtgsvc.exe.new
  • <SYSTEM32>\dllcache\msg.exe with <SYSTEM32>\dllcache\msg.exe.new
  • <SYSTEM32>\dllcache\msiexec.exe with <SYSTEM32>\dllcache\msiexec.exe.new
  • <SYSTEM32>\dllcache\msswchx.exe with <SYSTEM32>\dllcache\msswchx.exe.new
  • <SYSTEM32>\dllcache\mshearts.exe with <SYSTEM32>\dllcache\mshearts.exe.new
  • <SYSTEM32>\dllcache\mshta.exe with <SYSTEM32>\dllcache\mshta.exe.new
  • <SYSTEM32>\dllcache\osk.exe with <SYSTEM32>\dllcache\osk.exe.new
  • <SYSTEM32>\dllcache\osuninst.exe with <SYSTEM32>\dllcache\osuninst.exe.new
  • <SYSTEM32>\dllcache\odbcconf.exe with <SYSTEM32>\dllcache\odbcconf.exe.new
  • <SYSTEM32>\dllcache\opnfiles.exe with <SYSTEM32>\dllcache\opnfiles.exe.new
  • <SYSTEM32>\dllcache\packager.exe with <SYSTEM32>\dllcache\packager.exe.new
  • <SYSTEM32>\dllcache\perfmon.exe with <SYSTEM32>\dllcache\perfmon.exe.new
  • <SYSTEM32>\dllcache\ping.exe with <SYSTEM32>\dllcache\ping.exe.new
  • <SYSTEM32>\dllcache\pathping.exe with <SYSTEM32>\dllcache\pathping.exe.new
  • <SYSTEM32>\dllcache\pentnt.exe with <SYSTEM32>\dllcache\pentnt.exe.new
  • <SYSTEM32>\dllcache\nslookup.exe with <SYSTEM32>\dllcache\nslookup.exe.new
  • <SYSTEM32>\dllcache\ntbackup.exe with <SYSTEM32>\dllcache\ntbackup.exe.new
  • <SYSTEM32>\dllcache\netsh.exe with <SYSTEM32>\dllcache\netsh.exe.new
  • <SYSTEM32>\dllcache\netstat.exe with <SYSTEM32>\dllcache\netstat.exe.new
  • <SYSTEM32>\dllcache\ntsd.exe with <SYSTEM32>\dllcache\ntsd.exe.new
  • <SYSTEM32>\dllcache\nwscript.exe with <SYSTEM32>\dllcache\nwscript.exe.new
  • <SYSTEM32>\dllcache\odbcad32.exe with <SYSTEM32>\dllcache\odbcad32.exe.new
  • <SYSTEM32>\dllcache\ntvdm.exe with <SYSTEM32>\dllcache\ntvdm.exe.new
  • <SYSTEM32>\dllcache\arp.exe with <SYSTEM32>\dllcache\arp.exe.new
  • <SYSTEM32>\dllcache\mqbkup.exe with <SYSTEM32>\dllcache\mqbkup.exe.new
  • <SYSTEM32>\dllcache\iexpress.exe with <SYSTEM32>\dllcache\iexpress.exe.new
  • <SYSTEM32>\dllcache\imapi.exe with <SYSTEM32>\dllcache\imapi.exe.new
  • <SYSTEM32>\dllcache\hostname.exe with <SYSTEM32>\dllcache\hostname.exe.new
  • <SYSTEM32>\dllcache\ie4uinit.exe with <SYSTEM32>\dllcache\ie4uinit.exe.new
  • <SYSTEM32>\dllcache\ipconfig.exe with <SYSTEM32>\dllcache\ipconfig.exe.new
  • <SYSTEM32>\dllcache\ipxroute.exe with <SYSTEM32>\dllcache\ipxroute.exe.new
  • <SYSTEM32>\dllcache\label.exe with <SYSTEM32>\dllcache\label.exe.new
  • <SYSTEM32>\dllcache\ipsec6.exe with <SYSTEM32>\dllcache\ipsec6.exe.new
  • <SYSTEM32>\dllcache\ipv6.exe with <SYSTEM32>\dllcache\ipv6.exe.new
  • <SYSTEM32>\dllcache\fsutil.exe with <SYSTEM32>\dllcache\fsutil.exe.new
  • <SYSTEM32>\dllcache\ftp.exe with <SYSTEM32>\dllcache\ftp.exe.new
  • <SYSTEM32>\dllcache\forcedos.exe with <SYSTEM32>\dllcache\forcedos.exe.new
  • <SYSTEM32>\dllcache\freecell.exe with <SYSTEM32>\dllcache\freecell.exe.new
  • <SYSTEM32>\dllcache\getmac.exe with <SYSTEM32>\dllcache\getmac.exe.new
  • <SYSTEM32>\dllcache\grpconv.exe with <SYSTEM32>\dllcache\grpconv.exe.new
  • <SYSTEM32>\dllcache\help.exe with <SYSTEM32>\dllcache\help.exe.new
  • <SYSTEM32>\dllcache\gprslt.exe with <SYSTEM32>\dllcache\gprslt.exe.new
  • <SYSTEM32>\dllcache\gpupdate.exe with <SYSTEM32>\dllcache\gpupdate.exe.new
  • <SYSTEM32>\dllcache\makecab.exe with <SYSTEM32>\dllcache\makecab.exe.new
  • <SYSTEM32>\dllcache\mmc.exe with <SYSTEM32>\dllcache\mmc.exe.new
  • <SYSTEM32>\dllcache\lpr.exe with <SYSTEM32>\dllcache\lpr.exe.new
  • <SYSTEM32>\dllcache\magnify.exe with <SYSTEM32>\dllcache\magnify.exe.new
  • <SYSTEM32>\dllcache\mnmsrvc.exe with <SYSTEM32>\dllcache\mnmsrvc.exe.new
  • <SYSTEM32>\dllcache\mplay32.exe with <SYSTEM32>\dllcache\mplay32.exe.new
  • <SYSTEM32>\dllcache\mpnotify.exe with <SYSTEM32>\dllcache\mpnotify.exe.new
  • <SYSTEM32>\dllcache\mobsync.exe with <SYSTEM32>\dllcache\mobsync.exe.new
  • <SYSTEM32>\dllcache\mountvol.exe with <SYSTEM32>\dllcache\mountvol.exe.new
  • <SYSTEM32>\dllcache\locator.exe with <SYSTEM32>\dllcache\locator.exe.new
  • <SYSTEM32>\dllcache\lodctr.exe with <SYSTEM32>\dllcache\lodctr.exe.new
  • <SYSTEM32>\dllcache\lights.exe with <SYSTEM32>\dllcache\lights.exe.new
  • <SYSTEM32>\dllcache\lnkstub.exe with <SYSTEM32>\dllcache\lnkstub.exe.new
  • <SYSTEM32>\dllcache\logagent.exe with <SYSTEM32>\dllcache\logagent.exe.new
  • <SYSTEM32>\dllcache\logonui.exe with <SYSTEM32>\dllcache\logonui.exe.new
  • <SYSTEM32>\dllcache\lpq.exe with <SYSTEM32>\dllcache\lpq.exe.new
  • <SYSTEM32>\dllcache\logman.exe with <SYSTEM32>\dllcache\logman.exe.new
  • <SYSTEM32>\dllcache\logoff.exe with <SYSTEM32>\dllcache\logoff.exe.new
  • <SYSTEM32>\bad164 with <SYSTEM32>\wpnpinst.exe
  • <SYSTEM32>\compact.exe with <SYSTEM32>\compact.exe
  • <SYSTEM32>\conime.exe with <SYSTEM32>\conime.exe
  • <SYSTEM32>\cmstp.exe with <SYSTEM32>\cmstp.exe
  • <SYSTEM32>\comp.exe with <SYSTEM32>\comp.exe
  • <SYSTEM32>\bad125 with <SYSTEM32>\control.exe
  • <SYSTEM32>\convert.exe with <SYSTEM32>\convert.exe
  • <SYSTEM32>\csrss.exe with <SYSTEM32>\csrss.exe
  • <SYSTEM32>\control.exe with <SYSTEM32>\control.exe
  • <SYSTEM32>\dllcache\taskman.exe with <SYSTEM32>\dllcache\taskman.exe.new
  • <SYSTEM32>\cliconfg.exe with <SYSTEM32>\cliconfg.exe
  • <SYSTEM32>\clipbrd.exe with <SYSTEM32>\clipbrd.exe
  • <SYSTEM32>\ckcnv.exe with <SYSTEM32>\ckcnv.exe
  • <SYSTEM32>\cleanmgr.exe with <SYSTEM32>\cleanmgr.exe
  • <SYSTEM32>\clipsrv.exe with <SYSTEM32>\clipsrv.exe
  • <SYSTEM32>\cmdl32.exe with <SYSTEM32>\cmdl32.exe
  • <SYSTEM32>\cmmon32.exe with <SYSTEM32>\cmmon32.exe
  • <SYSTEM32>\dllcache\regedit.exe with <SYSTEM32>\dllcache\regedit.exe.new
  • <SYSTEM32>\cmd.exe with <SYSTEM32>\cmd.exe
  • <SYSTEM32>\dllhost.exe with <SYSTEM32>\dllhost.exe
  • <SYSTEM32>\dllhst3g.exe with <SYSTEM32>\dllhst3g.exe
  • <SYSTEM32>\diskpart.exe with <SYSTEM32>\diskpart.exe
  • <SYSTEM32>\diskperf.exe with <SYSTEM32>\diskperf.exe
  • <SYSTEM32>\dmadmin.exe with <SYSTEM32>\dmadmin.exe
  • <SYSTEM32>\bad174 with <SYSTEM32>\dosx.exe
  • <SYSTEM32>\dllcache\twunk_32.exe with <SYSTEM32>\dllcache\twunk_32.exe.new
  • <SYSTEM32>\dmremote.exe with <SYSTEM32>\dmremote.exe
  • <SYSTEM32>\doskey.exe with <SYSTEM32>\doskey.exe
  • <SYSTEM32>\bad31 with <SYSTEM32>\ddeshare.exe
  • <SYSTEM32>\ddeshare.exe with <SYSTEM32>\ddeshare.exe
  • <SYSTEM32>\ctfmon.exe with <SYSTEM32>\ctfmon.exe
  • <SYSTEM32>\dcomcnfg.exe with <SYSTEM32>\dcomcnfg.exe
  • <SYSTEM32>\defrag.exe with <SYSTEM32>\defrag.exe
  • <SYSTEM32>\dfrgntfs.exe with <SYSTEM32>\dfrgntfs.exe
  • <SYSTEM32>\diantz.exe with <SYSTEM32>\diantz.exe
  • <SYSTEM32>\dfrgfat.exe with <SYSTEM32>\dfrgfat.exe
  • <SYSTEM32>\bad59 with <SYSTEM32>\dfrgntfs.exe
  • <SYSTEM32>\cisvc.exe with <SYSTEM32>\cisvc.exe
  • <SYSTEM32>\alg.exe with <SYSTEM32>\alg.exe
  • <SYSTEM32>\arp.exe with <SYSTEM32>\arp.exe
  • <SYSTEM32>\actmovie.exe with <SYSTEM32>\actmovie.exe
  • <SYSTEM32>\ahui.exe with <SYSTEM32>\ahui.exe
  • <SYSTEM32>\asr_fmt.exe with <SYSTEM32>\asr_fmt.exe
  • <SYSTEM32>\asr_pfu.exe with <SYSTEM32>\asr_pfu.exe
  • <SYSTEM32>\at.exe with <SYSTEM32>\at.exe
  • <SYSTEM32>\dllcache\wordpad.exe with <SYSTEM32>\dllcache\wordpad.exe.new
  • <SYSTEM32>\asr_ldm.exe with <SYSTEM32>\asr_ldm.exe
  • %WINDIR%\pchealth\helpctr\binaries\notiflag.exe with %WINDIR%\pchealth\helpctr\binaries\notiflag.exe
  • <SYSTEM32>\dllcache\mplayer2.exe with <SYSTEM32>\dllcache\mplayer2.exe.new
  • %WINDIR%\pchealth\helpctr\binaries\msconfig.exe with %WINDIR%\pchealth\helpctr\binaries\msconfig.exe
  • %WINDIR%\pchealth\helpctr\binaries\bad149 with %WINDIR%\pchealth\helpctr\binaries\notiflag.exe
  • <SYSTEM32>\dllcache\setup_wm.exe with <SYSTEM32>\dllcache\setup_wm.exe.new
  • <SYSTEM32>\dllcache\dialer.exe with <SYSTEM32>\dllcache\dialer.exe.new
  • <SYSTEM32>\accwiz.exe with <SYSTEM32>\accwiz.exe
  • %WINDIR%\pchealth\UploadLB\Binaries\UploadM.exe with %WINDIR%\pchealth\UploadLB\Binaries\UploadM.exe
  • <SYSTEM32>\dllcache\wmplayer.exe with <SYSTEM32>\dllcache\wmplayer.exe.new
  • <SYSTEM32>\calc.exe with <SYSTEM32>\calc.exe
  • <SYSTEM32>\charmap.exe with <SYSTEM32>\charmap.exe
  • <SYSTEM32>\blastcln.exe with <SYSTEM32>\blastcln.exe
  • <SYSTEM32>\bad113 with <SYSTEM32>\cacls.exe
  • <SYSTEM32>\dllcache\notepad.exe with <SYSTEM32>\dllcache\notepad.exe.new
  • <SYSTEM32>\cidaemon.exe with <SYSTEM32>\cidaemon.exe
  • <SYSTEM32>\cipher.exe with <SYSTEM32>\cipher.exe
  • <SYSTEM32>\chkdsk.exe with <SYSTEM32>\chkdsk.exe
  • <SYSTEM32>\chkntfs.exe with <SYSTEM32>\chkntfs.exe
  • <SYSTEM32>\auditusr.exe with <SYSTEM32>\auditusr.exe
  • <SYSTEM32>\autochk.exe with <SYSTEM32>\autochk.exe
  • <SYSTEM32>\atmadm.exe with <SYSTEM32>\atmadm.exe
  • <SYSTEM32>\attrib.exe with <SYSTEM32>\attrib.exe
  • <SYSTEM32>\dllcache\pinball.exe with <SYSTEM32>\dllcache\pinball.exe.new
  • <SYSTEM32>\dllcache\hh.exe with <SYSTEM32>\dllcache\hh.exe.new
  • <SYSTEM32>\autolfn.exe with <SYSTEM32>\autolfn.exe
  • <SYSTEM32>\autoconv.exe with <SYSTEM32>\autoconv.exe
  • <SYSTEM32>\autofmt.exe with <SYSTEM32>\autofmt.exe
  • <SYSTEM32>\ie4uinit.exe with <SYSTEM32>\ie4uinit.exe
  • <SYSTEM32>\bad193 with <SYSTEM32>\iexpress.exe
  • <SYSTEM32>\icardagt.exe with <SYSTEM32>\icardagt.exe
  • <SYSTEM32>\dllcache\tourW.exe with <SYSTEM32>\dllcache\tourW.exe.new
  • <SYSTEM32>\iexpress.exe with <SYSTEM32>\iexpress.exe
  • <SYSTEM32>\ipconfig.exe with <SYSTEM32>\ipconfig.exe
  • <SYSTEM32>\ipsec6.exe with <SYSTEM32>\ipsec6.exe
  • <SYSTEM32>\imapi.exe with <SYSTEM32>\imapi.exe
  • <SYSTEM32>\bad190 with <SYSTEM32>\ipconfig.exe
  • <SYSTEM32>\gpresult.exe with <SYSTEM32>\gpresult.exe
  • <SYSTEM32>\bad7 with <SYSTEM32>\gpupdate.exe
  • <SYSTEM32>\ftp.exe with <SYSTEM32>\ftp.exe
  • <SYSTEM32>\getmac.exe with <SYSTEM32>\getmac.exe
  • <SYSTEM32>\gpupdate.exe with <SYSTEM32>\gpupdate.exe
  • <SYSTEM32>\hostname.exe with <SYSTEM32>\hostname.exe
  • <SYSTEM32>\bad128 with <SYSTEM32>\icardagt.exe
  • <SYSTEM32>\grpconv.exe with <SYSTEM32>\grpconv.exe
  • <SYSTEM32>\help.exe with <SYSTEM32>\help.exe
  • <SYSTEM32>\lodctr.exe with <SYSTEM32>\lodctr.exe
  • <SYSTEM32>\logagent.exe with <SYSTEM32>\logagent.exe
  • %WINDIR%\mui\muisetup.exe with %WINDIR%\mui\muisetup.exe.new
  • <SYSTEM32>\locator.exe with <SYSTEM32>\locator.exe
  • <SYSTEM32>\bad105 with <SYSTEM32>\logman.exe
  • <SYSTEM32>\logoff.exe with <SYSTEM32>\logoff.exe
  • <SYSTEM32>\logonui.exe with <SYSTEM32>\logonui.exe
  • <SYSTEM32>\logman.exe with <SYSTEM32>\logman.exe
  • <SYSTEM32>\bad54 with <SYSTEM32>\logoff.exe
  • <SYSTEM32>\bad168 with <SYSTEM32>\ipxroute.exe
  • <SYSTEM32>\ipxroute.exe with <SYSTEM32>\ipxroute.exe
  • <SYSTEM32>\bad22 with <SYSTEM32>\ipv6.exe
  • <SYSTEM32>\ipv6.exe with <SYSTEM32>\ipv6.exe
  • %WINDIR%\msagent\agentsvr.exe with %WINDIR%\msagent\agentsvr.exe.new
  • <SYSTEM32>\lights.exe with <SYSTEM32>\lights.exe
  • <SYSTEM32>\lnkstub.exe with <SYSTEM32>\lnkstub.exe
  • <SYSTEM32>\label.exe with <SYSTEM32>\label.exe
  • <SYSTEM32>\bad89 with <SYSTEM32>\lights.exe
  • <SYSTEM32>\fsutil.exe with <SYSTEM32>\fsutil.exe
  • <SYSTEM32>\dvdupgrd.exe with <SYSTEM32>\dvdupgrd.exe
  • <SYSTEM32>\dwwin.exe with <SYSTEM32>\dwwin.exe
  • <SYSTEM32>\bad57 with <SYSTEM32>\dvdplay.exe
  • <SYSTEM32>\dvdplay.exe with <SYSTEM32>\dvdplay.exe
  • <SYSTEM32>\dxdiag.exe with <SYSTEM32>\dxdiag.exe
  • <SYSTEM32>\eudcedit.exe with <SYSTEM32>\eudcedit.exe
  • <SYSTEM32>\eventcreate.exe with <SYSTEM32>\eventcreate.exe
  • <SYSTEM32>\bad36 with <SYSTEM32>\esentutl.exe
  • <SYSTEM32>\esentutl.exe with <SYSTEM32>\esentutl.exe
  • <SYSTEM32>\dpnsvr.exe with <SYSTEM32>\dpnsvr.exe
  • <SYSTEM32>\dpvsetup.exe with <SYSTEM32>\dpvsetup.exe
  • <SYSTEM32>\dplaysvr.exe with <SYSTEM32>\dplaysvr.exe
  • <SYSTEM32>\bad146 with <SYSTEM32>\dpnsvr.exe
  • <SYSTEM32>\bad132 with <SYSTEM32>\driverquery.exe
  • <SYSTEM32>\drwtsn32.exe with <SYSTEM32>\drwtsn32.exe
  • <SYSTEM32>\dumprep.exe with <SYSTEM32>\dumprep.exe
  • <SYSTEM32>\driverquery.exe with <SYSTEM32>\driverquery.exe
  • <SYSTEM32>\bad41 with <SYSTEM32>\drwatson.exe
  • <SYSTEM32>\fixmapi.exe with <SYSTEM32>\fixmapi.exe
  • <SYSTEM32>\fltMc.exe with <SYSTEM32>\fltMc.exe
  • <SYSTEM32>\bad15 with <SYSTEM32>\finger.exe
  • <SYSTEM32>\finger.exe with <SYSTEM32>\finger.exe
  • <SYSTEM32>\fontview.exe with <SYSTEM32>\fontview.exe
  • <SYSTEM32>\freecell.exe with <SYSTEM32>\freecell.exe
  • <SYSTEM32>\fsquirt.exe with <SYSTEM32>\fsquirt.exe
  • <SYSTEM32>\bad63 with <SYSTEM32>\forcedos.exe
  • <SYSTEM32>\forcedos.exe with <SYSTEM32>\forcedos.exe
  • <SYSTEM32>\dllcache\winhlp32.exe with <SYSTEM32>\dllcache\winhlp32.exe.new
  • <SYSTEM32>\eventvwr.exe with <SYSTEM32>\eventvwr.exe
  • <SYSTEM32>\eventtriggers.exe with <SYSTEM32>\eventtriggers.exe
  • <SYSTEM32>\bad97 with <SYSTEM32>\eventvwr.exe
  • <SYSTEM32>\expand.exe with <SYSTEM32>\expand.exe
  • <SYSTEM32>\find.exe with <SYSTEM32>\find.exe
  • <SYSTEM32>\findstr.exe with <SYSTEM32>\findstr.exe
  • <SYSTEM32>\extrac32.exe with <SYSTEM32>\extrac32.exe
  • <SYSTEM32>\fc.exe with <SYSTEM32>\fc.exe
  • <SYSTEM32>\dllcache\migrate.exe with <SYSTEM32>\dllcache\migrate.exe.new
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CasPol.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\jsc.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\jsc.exe
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\IEExec.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ilasm.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\vbc.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\vbc.exe
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegAsm.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegAsm.exe
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
  • %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe with %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe
  • %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe with %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  • <SYSTEM32>\dllcache\hrtzzm.exe with <SYSTEM32>\dllcache\hrtzzm.exe.new
  • %WINDIR%\hh.exe with %WINDIR%\hh.exe.new
  • %WINDIR%\NOTEPAD.EXE with %WINDIR%\notepad.exe.new
  • %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe with %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe
  • %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe with %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe
  • %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe with %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen.exe
  • <SYSTEM32>\dllcache\bckgzm.exe with <SYSTEM32>\dllcache\bckgzm.exe.new
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad100 with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  • <SYSTEM32>\dllcache\chkrzm.exe with <SYSTEM32>\dllcache\chkrzm.exe.new
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ngen.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ngen.exe
  • %WINDIR%\sleep.exe with %WINDIR%\sleep.exe
  • <SYSTEM32>\dllcache\icwtutor.exe with <SYSTEM32>\dllcache\icwtutor.exe.new
  • %WINDIR%\regedit.exe with %WINDIR%\regedit.exe
  • %WINDIR%\sfk.exe with %WINDIR%\sfk.exe
  • %WINDIR%\TASKMAN.EXE with %WINDIR%\TASKMAN.EXE
  • %WINDIR%\Help\Tours\mmTour\tour.exe with %WINDIR%\Help\Tours\mmTour\tour.exe
  • <SYSTEM32>\dllcache\inetwiz.exe with <SYSTEM32>\dllcache\inetwiz.exe.new
  • %WINDIR%\twunk_32.exe with %WINDIR%\twunk_32.exe
  • %WINDIR%\winhlp32.exe with %WINDIR%\winhlp32.exe
  • <SYSTEM32>\dllcache\iedw.exe with <SYSTEM32>\dllcache\iedw.exe.new
  • <SYSTEM32>\dllcache\iexplore.exe with <SYSTEM32>\dllcache\iexplore.exe.new
  • <SYSTEM32>\dllcache\msinfo32.exe with <SYSTEM32>\dllcache\msinfo32.exe.new
  • <SYSTEM32>\dllcache\sapisvr.exe with <SYSTEM32>\dllcache\sapisvr.exe.new
  • <SYSTEM32>\dllcache\icwconn1.exe with <SYSTEM32>\dllcache\icwconn1.exe.new
  • %WINDIR%\hh.exe with %WINDIR%\hh.exe
  • %WINDIR%\NOTEPAD.EXE with %WINDIR%\NOTEPAD.EXE
  • <SYSTEM32>\dllcache\icwconn2.exe with <SYSTEM32>\dllcache\icwconn2.exe.new
  • <SYSTEM32>\dllcache\icwrmind.exe with <SYSTEM32>\dllcache\icwrmind.exe.new
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\cvtres.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\cvtres.exe
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\IEExec.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\IEExec.exe
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\csc.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\csc.exe
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ilasm.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ilasm.exe
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPol.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPol.exe
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\InstallUtil.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\InstallUtil.exe
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\jsc.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\jsc.exe
  • %WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\Microsoft.Workflow.Compiler.exe with %WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\Microsoft.Workflow.Compiler.exe
  • <SYSTEM32>\dllcache\moviemk.exe with <SYSTEM32>\dllcache\moviemk.exe.new
  • %WINDIR%\Microsoft.NET\NETFXRepair.exe with %WINDIR%\Microsoft.NET\NETFXRepair.exe
  • <SYSTEM32>\dllcache\isignup.exe with <SYSTEM32>\dllcache\isignup.exe.new
  • %WINDIR%\Microsoft.NET\Framework\NETFXSBS10.exe with %WINDIR%\Microsoft.NET\Framework\NETFXSBS10.exe
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CasPol.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CasPol.exe
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad199 with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\vbc.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  • <SYSTEM32>\dllcache\conf.exe with <SYSTEM32>\dllcache\conf.exe.new
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ilasm.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\jsc.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe
  • %WINDIR%\mui\muisetup.exe with %WINDIR%\mui\muisetup.exe
  • <SYSTEM32>\dllcache\wab.exe with <SYSTEM32>\dllcache\wab.exe.new
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
  • %WINDIR%\msagent\agentsvr.exe with %WINDIR%\msagent\agentsvr.exe
  • %WINDIR%\pchealth\helpctr\binaries\HelpCtr.exe with %WINDIR%\pchealth\helpctr\binaries\HelpCtr.exe
  • %WINDIR%\pchealth\helpctr\binaries\HelpSvc.exe with %WINDIR%\pchealth\helpctr\binaries\HelpSvc.exe
  • %WINDIR%\pchealth\helpctr\binaries\HscUpd.exe with %WINDIR%\pchealth\helpctr\binaries\HscUpd.exe
  • %WINDIR%\pchealth\helpctr\binaries\HelpHost.exe with %WINDIR%\pchealth\helpctr\binaries\HelpHost.exe
  • <SYSTEM32>\dllcache\wabmig.exe with <SYSTEM32>\dllcache\wabmig.exe.new
  • <SYSTEM32>\dllcache\msimn.exe with <SYSTEM32>\dllcache\msimn.exe.new
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe
  • <SYSTEM32>\dllcache\wb32.exe with <SYSTEM32>\dllcache\wb32.exe.new
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SetupUtility.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SetupUtility.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SetupUtility.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SetupUtility.exe
  • <SYSTEM32>\dllcache\setup50.exe with <SYSTEM32>\dllcache\setup50.exe.new
  • <SYSTEM32>\dllcache\oemig50.exe with <SYSTEM32>\dllcache\oemig50.exe.new
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Setup.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Setup.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  • %WINDIR%\Microsoft.NET\Framework\v3.5\EdmGen.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\EdmGen.exe
  • %WINDIR%\Microsoft.NET\Framework\v3.5\MSBuild.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\MSBuild.exe
  • %WINDIR%\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe
  • %WINDIR%\TASKMAN.EXE with %WINDIR%\taskman.exe.new
  • %WINDIR%\twunk_32.exe with %WINDIR%\twunk_32.exe.new
  • %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\DeleteTemp.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\DeleteTemp.exe
  • %WINDIR%\winhlp32.exe with %WINDIR%\winhlp32.exe.new
  • %WINDIR%\Microsoft.NET\Framework\v3.5\vbc.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\vbc.exe
  • %WINDIR%\Microsoft.NET\Framework\v3.5\WFServicesReg.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\WFServicesReg.exe
  • %WINDIR%\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe with %WINDIR%\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
  • %WINDIR%\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe with %WINDIR%\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe
  • %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\PerformanceCounterInstaller.exe with %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\PerformanceCounterInstaller.exe
  • %WINDIR%\regedit.exe with %WINDIR%\regedit.exe.new
  • <SYSTEM32>\dllcache\rvsezm.exe with <SYSTEM32>\dllcache\rvsezm.exe.new
  • %WINDIR%\Microsoft.NET\Framework\v3.5\AddInUtil.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\AddInUtil.exe
  • %WINDIR%\Microsoft.NET\Framework\v3.5\csc.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\csc.exe
  • %WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess.exe
  • %WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess32.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess32.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CasPol.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  • %WINDIR%\Help\Tours\mmTour\tour.exe with %WINDIR%\Help\Tours\mmTour\tour.exe.new
  • <SYSTEM32>\dllcache\cb32.exe with <SYSTEM32>\dllcache\cb32.exe.new
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  • %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
  • <SYSTEM32>\dllcache\shvlzm.exe with <SYSTEM32>\dllcache\shvlzm.exe.new
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe
  • <SYSTEM32>\dllcache\zclientm.exe with <SYSTEM32>\dllcache\zclientm.exe.new
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  • <SYSTEM32>\chkntfs.exe with <SYSTEM32>\chkntfs.exe.new
  • <SYSTEM32>\spider.exe with <SYSTEM32>\spider.exe
  • <SYSTEM32>\sort.exe with <SYSTEM32>\sort.exe
  • <SYSTEM32>\bad26 with <SYSTEM32>\spider.exe
  • <SYSTEM32>\spiisupd.exe with <SYSTEM32>\spiisupd.exe
  • <SYSTEM32>\bad25 with <SYSTEM32>\spoolsv.exe
  • <SYSTEM32>\cidaemon.exe with <SYSTEM32>\cidaemon.exe.new
  • <SYSTEM32>\bad195 with <SYSTEM32>\spnpinst.exe
  • <SYSTEM32>\spnpinst.exe with <SYSTEM32>\spnpinst.exe
  • <SYSTEM32>\smlogsvc.exe with <SYSTEM32>\smlogsvc.exe
  • <SYSTEM32>\smss.exe with <SYSTEM32>\smss.exe
  • <SYSTEM32>\smbinst.exe with <SYSTEM32>\smbinst.exe
  • <SYSTEM32>\charmap.exe with <SYSTEM32>\charmap.exe.new
  • <SYSTEM32>\sndrec32.exe with <SYSTEM32>\sndrec32.exe
  • <SYSTEM32>\sol.exe with <SYSTEM32>\sol.exe
  • <SYSTEM32>\bad27 with <SYSTEM32>\sort.exe
  • <SYSTEM32>\sndvol32.exe with <SYSTEM32>\sndvol32.exe
  • <SYSTEM32>\chkdsk.exe with <SYSTEM32>\chkdsk.exe.new
  • <SYSTEM32>\cisvc.exe with <SYSTEM32>\cisvc.exe.new
  • <SYSTEM32>\sysocmgr.exe with <SYSTEM32>\sysocmgr.exe
  • <SYSTEM32>\syncapp.exe with <SYSTEM32>\syncapp.exe
  • <SYSTEM32>\syskey.exe with <SYSTEM32>\syskey.exe
  • <SYSTEM32>\bad146 with <SYSTEM32>\systeminfo.exe
  • <SYSTEM32>\systray.exe with <SYSTEM32>\systray.exe
  • <SYSTEM32>\taskkill.exe with <SYSTEM32>\taskkill.exe
  • <SYSTEM32>\systeminfo.exe with <SYSTEM32>\systeminfo.exe
  • <SYSTEM32>\bad122 with <SYSTEM32>\systray.exe
  • <SYSTEM32>\bad189 with <SYSTEM32>\spupdsvc.exe
  • <SYSTEM32>\spupdsvc.exe with <SYSTEM32>\spupdsvc.exe
  • <SYSTEM32>\spoolsv.exe with <SYSTEM32>\spoolsv.exe
  • <SYSTEM32>\sprestrt.exe with <SYSTEM32>\sprestrt.exe
  • <SYSTEM32>\bad168 with <SYSTEM32>\stimon.exe
  • <SYSTEM32>\bad35 with <SYSTEM32>\subst.exe
  • <SYSTEM32>\subst.exe with <SYSTEM32>\subst.exe
  • <SYSTEM32>\stimon.exe with <SYSTEM32>\stimon.exe
  • <SYSTEM32>\cipher.exe with <SYSTEM32>\cipher.exe.new
  • <SYSTEM32>\skeys.exe with <SYSTEM32>\skeys.exe
  • <SYSTEM32>\sc.exe with <SYSTEM32>\sc.exe
  • <SYSTEM32>\bad96 with <SYSTEM32>\scardsvr.exe
  • <SYSTEM32>\savedump.exe with <SYSTEM32>\savedump.exe
  • <SYSTEM32>\bad141 with <SYSTEM32>\sc.exe
  • <SYSTEM32>\scardsvr.exe with <SYSTEM32>\scardsvr.exe
  • <SYSTEM32>\schtasks.exe with <SYSTEM32>\schtasks.exe
  • <SYSTEM32>\bad180 with <SYSTEM32>\sdbinst.exe
  • <SYSTEM32>\bad34 with <SYSTEM32>\schtasks.exe
  • <SYSTEM32>\blastcln.exe with <SYSTEM32>\blastcln.exe.new
  • <SYSTEM32>\bad121 with <SYSTEM32>\rundll32.exe
  • <SYSTEM32>\rundll32.exe with <SYSTEM32>\rundll32.exe
  • <SYSTEM32>\runas.exe with <SYSTEM32>\runas.exe
  • <SYSTEM32>\autofmt.exe with <SYSTEM32>\autofmt.exe.new
  • <SYSTEM32>\runonce.exe with <SYSTEM32>\runonce.exe
  • <SYSTEM32>\autolfn.exe with <SYSTEM32>\autolfn.exe.new
  • <SYSTEM32>\bad37 with <SYSTEM32>\savedump.exe
  • <SYSTEM32>\bad16 with <SYSTEM32>\rwinsta.exe
  • <SYSTEM32>\rwinsta.exe with <SYSTEM32>\rwinsta.exe
  • <SYSTEM32>\bad33 with <SYSTEM32>\shadow.exe
  • <SYSTEM32>\shadow.exe with <SYSTEM32>\shadow.exe
  • <SYSTEM32>\calc.exe with <SYSTEM32>\calc.exe.new
  • <SYSTEM32>\bad76 with <SYSTEM32>\sfc.exe
  • <SYSTEM32>\shmgrate.exe with <SYSTEM32>\shmgrate.exe
  • <SYSTEM32>\sigverif.exe with <SYSTEM32>\sigverif.exe
  • <SYSTEM32>\bad21 with <SYSTEM32>\skeys.exe
  • <SYSTEM32>\shrpubw.exe with <SYSTEM32>\shrpubw.exe
  • <SYSTEM32>\shutdown.exe with <SYSTEM32>\shutdown.exe
  • <SYSTEM32>\secedit.exe with <SYSTEM32>\secedit.exe
  • <SYSTEM32>\services.exe with <SYSTEM32>\services.exe
  • <SYSTEM32>\sdbinst.exe with <SYSTEM32>\sdbinst.exe
  • <SYSTEM32>\bad12 with <SYSTEM32>\secedit.exe
  • <SYSTEM32>\bad146 with <SYSTEM32>\sessmgr.exe
  • <SYSTEM32>\sethc.exe with <SYSTEM32>\sethc.exe
  • <SYSTEM32>\setup.exe with <SYSTEM32>\setup.exe
  • <SYSTEM32>\sessmgr.exe with <SYSTEM32>\sessmgr.exe
  • <SYSTEM32>\bad117 with <SYSTEM32>\sethc.exe
  • <SYSTEM32>\utilman.exe with <SYSTEM32>\utilman.exe
  • <SYSTEM32>\bad118 with <SYSTEM32>\verifier.exe
  • <SYSTEM32>\bad194 with <SYSTEM32>\utilman.exe
  • <SYSTEM32>\comp.exe with <SYSTEM32>\comp.exe.new
  • <SYSTEM32>\verifier.exe with <SYSTEM32>\verifier.exe
  • <SYSTEM32>\vssvc.exe with <SYSTEM32>\vssvc.exe
  • <SYSTEM32>\bad71 with <SYSTEM32>\w32tm.exe
  • <SYSTEM32>\vssadmin.exe with <SYSTEM32>\vssadmin.exe
  • <SYSTEM32>\compact.exe with <SYSTEM32>\compact.exe.new
  • <SYSTEM32>\userinit.exe with <SYSTEM32>\userinit.exe
  • <SYSTEM32>\cmstp.exe with <SYSTEM32>\cmstp.exe.new
  • <SYSTEM32>\upnpcont.exe with <SYSTEM32>\upnpcont.exe
  • <SYSTEM32>\ups.exe with <SYSTEM32>\ups.exe
  • <SYSTEM32>\bad22 with <SYSTEM32>\usrmlnka.exe
  • <SYSTEM32>\bad175 with <SYSTEM32>\usrshuta.exe
  • <SYSTEM32>\usrshuta.exe with <SYSTEM32>\usrshuta.exe
  • <SYSTEM32>\usrmlnka.exe with <SYSTEM32>\usrmlnka.exe
  • <SYSTEM32>\usrprbda.exe with <SYSTEM32>\usrprbda.exe
  • <SYSTEM32>\winmine.exe with <SYSTEM32>\winmine.exe
  • <SYSTEM32>\winmsd.exe with <SYSTEM32>\winmsd.exe
  • <SYSTEM32>\winlogon.exe with <SYSTEM32>\winlogon.exe
  • <SYSTEM32>\bad195 with <SYSTEM32>\winmine.exe
  • <SYSTEM32>\bad76 with <SYSTEM32>\winspool.exe
  • <SYSTEM32>\convert.exe with <SYSTEM32>\convert.exe.new
  • <SYSTEM32>\wpabaln.exe with <SYSTEM32>\wpabaln.exe
  • <SYSTEM32>\bad143 with <SYSTEM32>\winver.exe
  • <SYSTEM32>\winver.exe with <SYSTEM32>\winver.exe
  • <SYSTEM32>\wextract.exe with <SYSTEM32>\wextract.exe
  • <SYSTEM32>\bad171 with <SYSTEM32>\wiaacmgr.exe
  • <SYSTEM32>\w32tm.exe with <SYSTEM32>\w32tm.exe
  • <SYSTEM32>\bad100 with <SYSTEM32>\wextract.exe
  • <SYSTEM32>\conime.exe with <SYSTEM32>\conime.exe.new
  • <SYSTEM32>\winhlp32.exe with <SYSTEM32>\winhlp32.exe
  • <SYSTEM32>\control.exe with <SYSTEM32>\control.exe.new
  • <SYSTEM32>\wiaacmgr.exe with <SYSTEM32>\wiaacmgr.exe
  • <SYSTEM32>\winchat.exe with <SYSTEM32>\winchat.exe
  • <SYSTEM32>\unlodctr.exe with <SYSTEM32>\unlodctr.exe
  • <SYSTEM32>\tftp.exe with <SYSTEM32>\tftp.exe
  • <SYSTEM32>\tlntadmn.exe with <SYSTEM32>\tlntadmn.exe
  • <SYSTEM32>\telnet.exe with <SYSTEM32>\telnet.exe
  • <SYSTEM32>\clipbrd.exe with <SYSTEM32>\clipbrd.exe.new
  • <SYSTEM32>\tlntsess.exe with <SYSTEM32>\tlntsess.exe
  • <SYSTEM32>\tourstart.exe with <SYSTEM32>\tourstart.exe
  • <SYSTEM32>\tracerpt.exe with <SYSTEM32>\tracerpt.exe
  • <SYSTEM32>\clipsrv.exe with <SYSTEM32>\clipsrv.exe.new
  • <SYSTEM32>\tlntsvr.exe with <SYSTEM32>\tlntsvr.exe
  • <SYSTEM32>\taskman.exe with <SYSTEM32>\taskman.exe
  • <SYSTEM32>\taskmgr.exe with <SYSTEM32>\taskmgr.exe
  • <SYSTEM32>\ckcnv.exe with <SYSTEM32>\ckcnv.exe.new
  • <SYSTEM32>\tasklist.exe with <SYSTEM32>\tasklist.exe
  • <SYSTEM32>\cleanmgr.exe with <SYSTEM32>\cleanmgr.exe.new
  • <SYSTEM32>\tcpsvcs.exe with <SYSTEM32>\tcpsvcs.exe
  • <SYSTEM32>\bad29 with <SYSTEM32>\telnet.exe
  • <SYSTEM32>\bad69 with <SYSTEM32>\tcmsetup.exe
  • <SYSTEM32>\tcmsetup.exe with <SYSTEM32>\tcmsetup.exe
  • <SYSTEM32>\tskill.exe with <SYSTEM32>\tskill.exe
  • <SYSTEM32>\bad94 with <SYSTEM32>\tsshutdn.exe
  • <SYSTEM32>\tsdiscon.exe with <SYSTEM32>\tsdiscon.exe
  • <SYSTEM32>\bad103 with <SYSTEM32>\tskill.exe
  • <SYSTEM32>\tsshutdn.exe with <SYSTEM32>\tsshutdn.exe
  • <SYSTEM32>\typeperf.exe with <SYSTEM32>\typeperf.exe
  • <SYSTEM32>\cmmon32.exe with <SYSTEM32>\cmmon32.exe.new
  • <SYSTEM32>\TsWpfWrp.exe with <SYSTEM32>\TsWpfWrp.exe
  • <SYSTEM32>\bad138 with <SYSTEM32>\typeperf.exe
  • <SYSTEM32>\tracert.exe with <SYSTEM32>\tracert.exe
  • <SYSTEM32>\bad48 with <SYSTEM32>\tracert6.exe
  • <SYSTEM32>\cmd.exe with <SYSTEM32>\cmd.exe.new
  • <SYSTEM32>\bad14 with <SYSTEM32>\tracert.exe
  • <SYSTEM32>\tracert6.exe with <SYSTEM32>\tracert6.exe
  • <SYSTEM32>\cmdl32.exe with <SYSTEM32>\cmdl32.exe.new
  • <SYSTEM32>\tscupgrd.exe with <SYSTEM32>\tscupgrd.exe
  • <SYSTEM32>\bad165 with <SYSTEM32>\tscon.exe
  • <SYSTEM32>\tscon.exe with <SYSTEM32>\tscon.exe
  • <SYSTEM32>\rtcshare.exe with <SYSTEM32>\rtcshare.exe
  • <SYSTEM32>\bad181 with <SYSTEM32>\netsh.exe
  • <SYSTEM32>\netsh.exe with <SYSTEM32>\netsh.exe
  • <SYSTEM32>\bad137 with <SYSTEM32>\netsetup.exe
  • <SYSTEM32>\netsetup.exe with <SYSTEM32>\netsetup.exe
  • <SYSTEM32>\bad167 with <SYSTEM32>\netstat.exe
  • <SYSTEM32>\bad59 with <SYSTEM32>\nlsfunc.exe
  • <SYSTEM32>\bad140 with <SYSTEM32>\notepad.exe
  • <SYSTEM32>\netstat.exe with <SYSTEM32>\netstat.exe
  • %WINDIR%\pchealth\UploadLB\Binaries\UploadM.exe with %WINDIR%\pchealth\UploadLB\Binaries\uploadm.exe.new
  • <SYSTEM32>\bad28 with <SYSTEM32>\nddeapir.exe
  • <SYSTEM32>\nddeapir.exe with <SYSTEM32>\nddeapir.exe
  • <SYSTEM32>\narrator.exe with <SYSTEM32>\narrator.exe
  • <SYSTEM32>\nbtstat.exe with <SYSTEM32>\nbtstat.exe
  • <SYSTEM32>\net.exe with <SYSTEM32>\net.exe
  • %WINDIR%\pchealth\helpctr\binaries\notiflag.exe with %WINDIR%\pchealth\helpctr\binaries\notiflag.exe.new
  • <SYSTEM32>\netdde.exe with <SYSTEM32>\netdde.exe
  • <SYSTEM32>\bad147 with <SYSTEM32>\net1.exe
  • <SYSTEM32>\net1.exe with <SYSTEM32>\net1.exe
  • <SYSTEM32>\ntsd.exe with <SYSTEM32>\ntsd.exe
  • <SYSTEM32>\ntvdm.exe with <SYSTEM32>\ntvdm.exe
  • <SYSTEM32>\ntoskrnl.exe with <SYSTEM32>\ntoskrnl.exe
  • <SYSTEM32>\ahui.exe with <SYSTEM32>\ahui.exe.new
  • <SYSTEM32>\bad176 with <SYSTEM32>\nw16.exe
  • <SYSTEM32>\nwscript.exe with <SYSTEM32>\nwscript.exe
  • <SYSTEM32>\odbcad32.exe with <SYSTEM32>\odbcad32.exe
  • <SYSTEM32>\arp.exe with <SYSTEM32>\arp.exe.new
  • <SYSTEM32>\bad29 with <SYSTEM32>\nwscript.exe
  • <SYSTEM32>\bad3 with <SYSTEM32>\ntbackup.exe
  • <SYSTEM32>\ntbackup.exe with <SYSTEM32>\ntbackup.exe
  • <SYSTEM32>\notepad.exe with <SYSTEM32>\notepad.exe
  • <SYSTEM32>\nslookup.exe with <SYSTEM32>\nslookup.exe
  • <SYSTEM32>\accwiz.exe with <SYSTEM32>\accwiz.exe.new
  • <SYSTEM32>\actmovie.exe with <SYSTEM32>\actmovie.exe.new
  • <SYSTEM32>\bad166 with <SYSTEM32>\ntoskrnl.exe
  • <SYSTEM32>\bad1 with <SYSTEM32>\ntkrnlpa.exe
  • <SYSTEM32>\ntkrnlpa.exe with <SYSTEM32>\ntkrnlpa.exe
  • %WINDIR%\pchealth\helpctr\binaries\msconfig.exe with %WINDIR%\pchealth\helpctr\binaries\msconfig.exe.new
  • %WINDIR%\pchealth\helpctr\binaries\HelpHost.exe with %WINDIR%\pchealth\helpctr\binaries\helphost.exe.new
  • <SYSTEM32>\mnmsrvc.exe with <SYSTEM32>\mnmsrvc.exe
  • <SYSTEM32>\bad197 with <SYSTEM32>\mmc.exe
  • <SYSTEM32>\mmc.exe with <SYSTEM32>\mmc.exe
  • <SYSTEM32>\mobsync.exe with <SYSTEM32>\mobsync.exe
  • <SYSTEM32>\mpnotify.exe with <SYSTEM32>\mpnotify.exe
  • <SYSTEM32>\mqbkup.exe with <SYSTEM32>\mqbkup.exe
  • <SYSTEM32>\mountvol.exe with <SYSTEM32>\mountvol.exe
  • <SYSTEM32>\mplay32.exe with <SYSTEM32>\mplay32.exe
  • <SYSTEM32>\lpr.exe with <SYSTEM32>\lpr.exe
  • <SYSTEM32>\lsass.exe with <SYSTEM32>\lsass.exe
  • <SYSTEM32>\lpq.exe with <SYSTEM32>\lpq.exe
  • <SYSTEM32>\bad123 with <SYSTEM32>\lpr.exe
  • <SYSTEM32>\magnify.exe with <SYSTEM32>\magnify.exe
  • <SYSTEM32>\bad132 with <SYSTEM32>\migpwd.exe
  • <SYSTEM32>\migpwd.exe with <SYSTEM32>\migpwd.exe
  • <SYSTEM32>\makecab.exe with <SYSTEM32>\makecab.exe
  • %WINDIR%\pchealth\helpctr\binaries\HelpCtr.exe with %WINDIR%\pchealth\helpctr\binaries\helpctr.exe.new
  • <SYSTEM32>\msiexec.exe with <SYSTEM32>\msiexec.exe
  • %WINDIR%\pchealth\helpctr\binaries\HscUpd.exe with %WINDIR%\pchealth\helpctr\binaries\hscupd.exe.new
  • <SYSTEM32>\bad184 with <SYSTEM32>\mshta.exe
  • <SYSTEM32>\mshta.exe with <SYSTEM32>\mshta.exe
  • <SYSTEM32>\bad47 with <SYSTEM32>\mspaint.exe
  • <SYSTEM32>\mstinit.exe with <SYSTEM32>\mstinit.exe
  • <SYSTEM32>\mstsc.exe with <SYSTEM32>\mstsc.exe
  • <SYSTEM32>\bad192 with <SYSTEM32>\msswchx.exe
  • <SYSTEM32>\msswchx.exe with <SYSTEM32>\msswchx.exe
  • <SYSTEM32>\mqtgsvc.exe with <SYSTEM32>\mqtgsvc.exe
  • <SYSTEM32>\mrinfo.exe with <SYSTEM32>\mrinfo.exe
  • <SYSTEM32>\bad78 with <SYSTEM32>\mqsvc.exe
  • <SYSTEM32>\mqsvc.exe with <SYSTEM32>\mqsvc.exe
  • <SYSTEM32>\bad165 with <SYSTEM32>\mscdexnt.exe
  • %WINDIR%\pchealth\helpctr\binaries\HelpSvc.exe with %WINDIR%\pchealth\helpctr\binaries\helpsvc.exe.new
  • <SYSTEM32>\mshearts.exe with <SYSTEM32>\mshearts.exe
  • <SYSTEM32>\msdtc.exe with <SYSTEM32>\msdtc.exe
  • <SYSTEM32>\msg.exe with <SYSTEM32>\msg.exe
  • <SYSTEM32>\regsvr32.exe with <SYSTEM32>\regsvr32.exe
  • <SYSTEM32>\regwiz.exe with <SYSTEM32>\regwiz.exe
  • <SYSTEM32>\bad124 with <SYSTEM32>\regini.exe
  • <SYSTEM32>\regini.exe with <SYSTEM32>\regini.exe
  • <SYSTEM32>\autochk.exe with <SYSTEM32>\autochk.exe.new
  • <SYSTEM32>\replace.exe with <SYSTEM32>\replace.exe
  • <SYSTEM32>\reset.exe with <SYSTEM32>\reset.exe
  • <SYSTEM32>\relog.exe with <SYSTEM32>\relog.exe
  • <SYSTEM32>\bad18 with <SYSTEM32>\replace.exe
  • <SYSTEM32>\bad45 with <SYSTEM32>\rdsaddin.exe
  • <SYSTEM32>\rdsaddin.exe with <SYSTEM32>\rdsaddin.exe
  • <SYSTEM32>\auditusr.exe with <SYSTEM32>\auditusr.exe.new
  • <SYSTEM32>\rdpclip.exe with <SYSTEM32>\rdpclip.exe
  • <SYSTEM32>\rdshost.exe with <SYSTEM32>\rdshost.exe
  • <SYSTEM32>\reg.exe with <SYSTEM32>\reg.exe
  • <SYSTEM32>\regedt32.exe with <SYSTEM32>\regedt32.exe
  • <SYSTEM32>\recover.exe with <SYSTEM32>\recover.exe
  • <SYSTEM32>\bad74 with <SYSTEM32>\redir.exe
  • <SYSTEM32>\bad83 with <SYSTEM32>\rsnotify.exe
  • <SYSTEM32>\rsnotify.exe with <SYSTEM32>\rsnotify.exe
  • <SYSTEM32>\bad58 with <SYSTEM32>\rsmui.exe
  • <SYSTEM32>\rsmui.exe with <SYSTEM32>\rsmui.exe
  • <SYSTEM32>\bad182 with <SYSTEM32>\rsopprov.exe
  • <SYSTEM32>\rsvp.exe with <SYSTEM32>\rsvp.exe
  • <SYSTEM32>\bad44 with <SYSTEM32>\rtcshare.exe
  • <SYSTEM32>\rsopprov.exe with <SYSTEM32>\rsopprov.exe
  • <SYSTEM32>\bad75 with <SYSTEM32>\rsvp.exe
  • <SYSTEM32>\autoconv.exe with <SYSTEM32>\autoconv.exe.new
  • <SYSTEM32>\bad134 with <SYSTEM32>\routemon.exe
  • <SYSTEM32>\rexec.exe with <SYSTEM32>\rexec.exe
  • <SYSTEM32>\route.exe with <SYSTEM32>\route.exe
  • <SYSTEM32>\routemon.exe with <SYSTEM32>\routemon.exe
  • <SYSTEM32>\bad145 with <SYSTEM32>\rsmsink.exe
  • <SYSTEM32>\rsmsink.exe with <SYSTEM32>\rsmsink.exe
  • <SYSTEM32>\rsh.exe with <SYSTEM32>\rsh.exe
  • <SYSTEM32>\rsm.exe with <SYSTEM32>\rsm.exe
  • <SYSTEM32>\rcp.exe with <SYSTEM32>\rcp.exe
  • <SYSTEM32>\pathping.exe with <SYSTEM32>\pathping.exe
  • <SYSTEM32>\pentnt.exe with <SYSTEM32>\pentnt.exe
  • <SYSTEM32>\packager.exe with <SYSTEM32>\packager.exe
  • <SYSTEM32>\asr_ldm.exe with <SYSTEM32>\asr_ldm.exe.new
  • <SYSTEM32>\bad153 with <SYSTEM32>\perfmon.exe
  • <SYSTEM32>\ping.exe with <SYSTEM32>\ping.exe
  • <SYSTEM32>\ping6.exe with <SYSTEM32>\ping6.exe
  • <SYSTEM32>\perfmon.exe with <SYSTEM32>\perfmon.exe
  • <SYSTEM32>\asr_pfu.exe with <SYSTEM32>\asr_pfu.exe.new
  • <SYSTEM32>\bad175 with <SYSTEM32>\openfiles.exe
  • <SYSTEM32>\asr_fmt.exe with <SYSTEM32>\asr_fmt.exe.new
  • <SYSTEM32>\bad123 with <SYSTEM32>\odbcconf.exe
  • <SYSTEM32>\odbcconf.exe with <SYSTEM32>\odbcconf.exe
  • <SYSTEM32>\openfiles.exe with <SYSTEM32>\openfiles.exe
  • <SYSTEM32>\bad9 with <SYSTEM32>\osuninst.exe
  • <SYSTEM32>\osuninst.exe with <SYSTEM32>\osuninst.exe
  • <SYSTEM32>\bad38 with <SYSTEM32>\osk.exe
  • <SYSTEM32>\osk.exe with <SYSTEM32>\osk.exe
  • <SYSTEM32>\attrib.exe with <SYSTEM32>\attrib.exe.new
  • <SYSTEM32>\qwinsta.exe with <SYSTEM32>\qwinsta.exe
  • <SYSTEM32>\qappsrv.exe with <SYSTEM32>\qappsrv.exe
  • <SYSTEM32>\qprocess.exe with <SYSTEM32>\qprocess.exe
  • <SYSTEM32>\rasautou.exe with <SYSTEM32>\rasautou.exe
  • <SYSTEM32>\bad161 with <SYSTEM32>\rcimlby.exe
  • <SYSTEM32>\rcimlby.exe with <SYSTEM32>\rcimlby.exe
  • <SYSTEM32>\rasdial.exe with <SYSTEM32>\rasdial.exe
  • <SYSTEM32>\rasphone.exe with <SYSTEM32>\rasphone.exe
  • <SYSTEM32>\PresentationHost.exe with <SYSTEM32>\PresentationHost.exe
  • <SYSTEM32>\print.exe with <SYSTEM32>\print.exe
  • <SYSTEM32>\powercfg.exe with <SYSTEM32>\powercfg.exe
  • <SYSTEM32>\at.exe with <SYSTEM32>\at.exe.new
  • <SYSTEM32>\bad74 with <SYSTEM32>\progman.exe
  • <SYSTEM32>\proxycfg.exe with <SYSTEM32>\proxycfg.exe
  • <SYSTEM32>\bad75 with <SYSTEM32>\qappsrv.exe
  • <SYSTEM32>\proquota.exe with <SYSTEM32>\proquota.exe
  • <SYSTEM32>\atmadm.exe with <SYSTEM32>\atmadm.exe.new
Malicious functions:
Creates and executes the following:
  • <Auxiliary element>
  • C:\boot00.exe
  • <Full path to virus>.exe
  • C:\boot00.exe (downloaded from the Internet)
Modifies file system :
Creates the following files:
  • <Auxiliary name>
  • <PATH_<Auxiliary name>.EXE>
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\rp.log
  • <PATH_<Auxiliary name>.EXE>_
  • %WINDIR%\taskman.exe
  • %WINDIR%\twunk_16.exe
  • %WINDIR%\regedit.exe
  • %WINDIR%\hh.exe
  • %WINDIR%\notepad.exe
  • %PROGRAM_FILES%\Windows Media Player\setup_wm.exe
  • %PROGRAM_FILES%\Windows Media Player\wmplayer.exe
  • %PROGRAM_FILES%\Windows Media Player\mplayer2.exe
  • %PROGRAM_FILES%\Outlook Express\wabmig.exe
  • %PROGRAM_FILES%\Windows Media Player\migrate.exe
  • %PROGRAM_FILES%\Windows NT\dialer.exe
  • <Auxiliary element>
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\RestorePointSize
  • %PROGRAM_FILES%\Windows NT\Pinball\PINBALL.EXE
  • %PROGRAM_FILES%\Windows NT\hypertrm.exe
  • %PROGRAM_FILES%\Windows NT\Accessories\wordpad.exe
  • <SYSTEM32>\actmovie.exe
  • <SYSTEM32>\ahui.exe
  • <SYSTEM32>\accwiz.exe
  • %WINDIR%\pchealth\helpctr\binaries\notiflag.exe
  • %WINDIR%\pchealth\UploadLB\Binaries\uploadm.exe
  • <SYSTEM32>\append.exe
  • <SYSTEM32>\SET4.tmp
  • <SYSTEM32>\dllcache\dvdplay.exe.new
  • %WINDIR%\LastGood\TMP2.tmp
  • <SYSTEM32>\arp.exe.new
  • <SYSTEM32>\SET1.tmp
  • %WINDIR%\Help\Tours\mmTour\tour.exe
  • %WINDIR%\msagent\agentsvr.exe
  • %WINDIR%\winhlp32.exe
  • %WINDIR%\twunk_32.exe
  • %WINDIR%\winhelp.exe
  • %WINDIR%\mui\muisetup.exe
  • %WINDIR%\pchealth\helpctr\binaries\hscupd.exe
  • %WINDIR%\pchealth\helpctr\binaries\msconfig.exe
  • %WINDIR%\pchealth\helpctr\binaries\helpsvc.exe
  • %WINDIR%\pchealth\helpctr\binaries\helpctr.exe
  • %WINDIR%\pchealth\helpctr\binaries\helphost.exe
  • %PROGRAM_FILES%\Outlook Express\wab.exe
  • %PROGRAM_FILES%\FireFox\xpcshell.exe
  • %PROGRAM_FILES%\FireFox\xpidl.exe
  • %PROGRAM_FILES%\FireFox\updater.exe
  • %PROGRAM_FILES%\FireFox\plugin-container.exe
  • %PROGRAM_FILES%\FireFox\shlibsign.exe
  • %PROGRAM_FILES%\FireFox\xpt_dump.exe
  • %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE
  • %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn1.exe
  • %PROGRAM_FILES%\Internet Explorer\iedw.exe
  • %PROGRAM_FILES%\FireFox\xpt_link.exe
  • %PROGRAM_FILES%\FireFox\uninstall\helper.exe
  • %CommonProgramFiles%\Microsoft Shared\DW\DWTRIG20.EXE
  • %CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe
  • %CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE
  • C:\boot00.exe
  • C:\Far2\Far.exe
  • %CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe
  • %PROGRAM_FILES%\FireFox\mangle.exe
  • %PROGRAM_FILES%\FireFox\nsinstall.exe
  • %PROGRAM_FILES%\FireFox\js.exe
  • %PROGRAM_FILES%\FireFox\crashreporter.exe
  • %PROGRAM_FILES%\FireFox\firefox.exe
  • %PROGRAM_FILES%\MSN Gaming Zone\Windows\shvlzm.exe
  • %PROGRAM_FILES%\MSN Gaming Zone\Windows\zClientm.exe
  • %PROGRAM_FILES%\MSN Gaming Zone\Windows\Rvsezm.exe
  • %PROGRAM_FILES%\MSN Gaming Zone\Windows\chkrzm.exe
  • %PROGRAM_FILES%\MSN Gaming Zone\Windows\hrtzzm.exe
  • %PROGRAM_FILES%\NetMeeting\cb32.exe
  • %PROGRAM_FILES%\Outlook Express\oemig50.exe
  • %PROGRAM_FILES%\Outlook Express\setup50.exe
  • %PROGRAM_FILES%\Outlook Express\msimn.exe
  • %PROGRAM_FILES%\NetMeeting\conf.exe
  • %PROGRAM_FILES%\NetMeeting\wb32.exe
  • %PROGRAM_FILES%\Internet Explorer\Connection Wizard\inetwiz.exe
  • %PROGRAM_FILES%\Internet Explorer\Connection Wizard\isignup.exe
  • %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwtutor.exe
  • %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn2.exe
  • %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwrmind.exe
  • %PROGRAM_FILES%\Messenger\msmsgs.exe
  • %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\Msncli.exe
  • %PROGRAM_FILES%\MSN Gaming Zone\Windows\bckgzm.exe
  • %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\Digcore.exe
  • %PROGRAM_FILES%\Movie Maker\moviemk.exe
  • %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\msnsusii.exe
Sets the 'hidden' attribute to the following files:
  • %WINDIR%\bad66
  • %WINDIR%\bad51
  • %WINDIR%\bad186
  • %WINDIR%\bad117
  • %WINDIR%\bad93
  • %WINDIR%\bad80
  • %WINDIR%\bad62
  • %PROGRAM_FILES%\Windows NT\bad147
  • %PROGRAM_FILES%\Windows Media Player\bad41
  • %PROGRAM_FILES%\Windows Media Player\bad169
  • %WINDIR%\bad115
  • %PROGRAM_FILES%\Windows NT\Pinball\bad82
  • %PROGRAM_FILES%\Windows NT\Accessories\bad116
  • %WINDIR%\Help\Tours\mmTour\bad175
  • <SYSTEM32>\bad92
  • %WINDIR%\pchealth\UploadLB\Binaries\bad133
  • %WINDIR%\pchealth\helpctr\binaries\bad148
  • <SYSTEM32>\bad24
  • <SYSTEM32>\bad40
  • <SYSTEM32>\bad181
  • %WINDIR%\pchealth\helpctr\binaries\bad52
  • %WINDIR%\pchealth\helpctr\binaries\bad71
  • %WINDIR%\mui\bad110
  • %WINDIR%\msagent\bad191
  • %WINDIR%\pchealth\helpctr\binaries\bad87
  • %WINDIR%\pchealth\helpctr\binaries\bad113
  • %WINDIR%\pchealth\helpctr\binaries\bad154
  • %PROGRAM_FILES%\Windows Media Player\bad0
  • %PROGRAM_FILES%\Internet Explorer\Connection Wizard\bad186
  • %PROGRAM_FILES%\Internet Explorer\Connection Wizard\bad196
  • %PROGRAM_FILES%\Internet Explorer\Connection Wizard\bad47
  • %PROGRAM_FILES%\Movie Maker\bad193
  • %PROGRAM_FILES%\Internet Explorer\Connection Wizard\bad64
  • %PROGRAM_FILES%\Internet Explorer\Connection Wizard\bad165
  • %PROGRAM_FILES%\Internet Explorer\Connection Wizard\bad106
  • %CommonProgramFiles%\Microsoft Shared\MSInfo\bad126
  • <Current directory>\bad40
  • C:\boot00.exe
  • %PROGRAM_FILES%\Internet Explorer\bad163
  • %PROGRAM_FILES%\Internet Explorer\bad27
  • %CommonProgramFiles%\Microsoft Shared\Speech\bad147
  • %PROGRAM_FILES%\MSN Gaming Zone\Windows\bad161
  • %PROGRAM_FILES%\Outlook Express\bad69
  • %PROGRAM_FILES%\Outlook Express\bad131
  • %PROGRAM_FILES%\Outlook Express\bad126
  • %PROGRAM_FILES%\Windows Media Player\bad199
  • %PROGRAM_FILES%\Outlook Express\bad112
  • %PROGRAM_FILES%\Outlook Express\bad86
  • %PROGRAM_FILES%\NetMeeting\bad56
  • %PROGRAM_FILES%\MSN Gaming Zone\Windows\bad105
  • %PROGRAM_FILES%\MSN Gaming Zone\Windows\bad174
  • %PROGRAM_FILES%\MSN Gaming Zone\Windows\bad70
  • %PROGRAM_FILES%\NetMeeting\bad16
  • %PROGRAM_FILES%\NetMeeting\bad15
  • %PROGRAM_FILES%\MSN Gaming Zone\Windows\bad171
Deletes the following files:
  • <SYSTEM32>\bad177
  • <SYSTEM32>\bad71
  • <SYSTEM32>\bad12
  • <SYSTEM32>\bad86
  • <SYSTEM32>\bad103
  • <SYSTEM32>\bad115
  • <SYSTEM32>\bad21
  • <SYSTEM32>\bad159
  • <SYSTEM32>\bad83
  • <SYSTEM32>\bad72
  • <SYSTEM32>\bad8
  • <SYSTEM32>\bad51
  • <SYSTEM32>\bad124
  • <SYSTEM32>\bad187
  • <SYSTEM32>\bad176
  • <SYSTEM32>\bad185
  • <SYSTEM32>\bad116
  • <SYSTEM32>\bad18
  • <SYSTEM32>\bad126
  • <SYSTEM32>\bad171
  • <SYSTEM32>\bad94
  • <SYSTEM32>\bad98
  • <SYSTEM32>\bad48
  • <SYSTEM32>\bad150
  • <SYSTEM32>\bad135
  • <SYSTEM32>\bad170
  • <SYSTEM32>\bad178
  • <SYSTEM32>\bad154
  • <SYSTEM32>\bad91
  • <SYSTEM32>\bad114
  • <SYSTEM32>\bad82
  • <SYSTEM32>\bad143
  • <SYSTEM32>\bad44
  • <SYSTEM32>\bad141
  • <SYSTEM32>\bad42
  • <SYSTEM32>\bad58
  • <SYSTEM32>\bad33
  • <SYSTEM32>\bad100
  • <SYSTEM32>\bad65
  • <SYSTEM32>\bad25
  • <SYSTEM32>\bad122
  • <SYSTEM32>\bad49
  • <SYSTEM32>\bad69
  • <SYSTEM32>\bad182
  • <SYSTEM32>\bad152
  • <SYSTEM32>\bad118
  • <SYSTEM32>\bad158
  • <SYSTEM32>\bad35
  • <SYSTEM32>\bad166
  • <SYSTEM32>\bad28
  • <SYSTEM32>\bad9
  • <SYSTEM32>\bad109
  • <SYSTEM32>\bad197
  • <SYSTEM32>\bad62
  • <SYSTEM32>\bad195
  • <SYSTEM32>\bad101
  • <SYSTEM32>\bad117
  • <SYSTEM32>\bad13
  • <SYSTEM32>\bad193
  • <SYSTEM32>\bad145
  • <SYSTEM32>\bad134
  • <SYSTEM32>\bad6
  • <SYSTEM32>\bad120
  • <SYSTEM32>\bad32
  • <SYSTEM32>\bad14
  • <SYSTEM32>\bad140
  • <SYSTEM32>\bad160
  • <SYSTEM32>\bad198
  • <SYSTEM32>\bad139
  • <SYSTEM32>\bad189
  • <SYSTEM32>\bad192
  • <SYSTEM32>\bad2
  • <SYSTEM32>\bad29
  • <SYSTEM32>\bad181
  • <SYSTEM32>\bad73
  • <SYSTEM32>\bad84
  • <SYSTEM32>\bad119
  • <SYSTEM32>\bad175
  • <SYSTEM32>\bad56
  • <SYSTEM32>\bad0
  • <SYSTEM32>\bad194
  • <SYSTEM32>\bad34
  • <SYSTEM32>\bad123
  • <SYSTEM32>\bad26
  • <SYSTEM32>\bad4
  • %PROGRAM_FILES%\Outlook Express\bad86
  • %PROGRAM_FILES%\Outlook Express\bad112
  • %PROGRAM_FILES%\Outlook Express\bad69
  • %PROGRAM_FILES%\Outlook Express\bad126
  • %PROGRAM_FILES%\Outlook Express\bad131
  • %PROGRAM_FILES%\Windows Media Player\bad41
  • %PROGRAM_FILES%\Windows NT\bad147
  • %PROGRAM_FILES%\Windows Media Player\bad169
  • %PROGRAM_FILES%\Windows Media Player\bad199
  • %PROGRAM_FILES%\Windows Media Player\bad0
  • %PROGRAM_FILES%\NetMeeting\bad56
  • %PROGRAM_FILES%\MSN Gaming Zone\Windows\bad161
  • %PROGRAM_FILES%\MSN Gaming Zone\Windows\bad70
  • %PROGRAM_FILES%\Movie Maker\bad193
  • %PROGRAM_FILES%\Internet Explorer\Connection Wizard\bad165
  • %PROGRAM_FILES%\Internet Explorer\Connection Wizard\bad64
  • %PROGRAM_FILES%\NetMeeting\bad15
  • %PROGRAM_FILES%\NetMeeting\bad16
  • %PROGRAM_FILES%\MSN Gaming Zone\Windows\bad171
  • %PROGRAM_FILES%\MSN Gaming Zone\Windows\bad174
  • %PROGRAM_FILES%\MSN Gaming Zone\Windows\bad105
  • %WINDIR%\pchealth\helpctr\binaries\bad87
  • %WINDIR%\pchealth\helpctr\binaries\bad52
  • %WINDIR%\pchealth\helpctr\binaries\bad113
  • %WINDIR%\pchealth\helpctr\binaries\bad71
  • %WINDIR%\pchealth\helpctr\binaries\bad154
  • <SYSTEM32>\bad40
  • <SYSTEM32>\SET1.tmp
  • <SYSTEM32>\bad92
  • %WINDIR%\pchealth\helpctr\binaries\bad148
  • %WINDIR%\pchealth\UploadLB\Binaries\bad133
  • %WINDIR%\mui\bad110
  • %WINDIR%\bad62
  • %WINDIR%\bad186
  • %WINDIR%\bad115
  • %PROGRAM_FILES%\Windows NT\Accessories\bad116
  • %PROGRAM_FILES%\Windows NT\Pinball\bad82
  • %WINDIR%\Help\Tours\mmTour\bad175
  • %WINDIR%\msagent\bad191
  • %WINDIR%\bad117
  • %WINDIR%\bad66
  • %WINDIR%\bad93
  • <SYSTEM32>\oobe\bad186
  • <SYSTEM32>\oobe\bad1
  • <SYSTEM32>\npp\bad110
  • <SYSTEM32>\Com\bad178
  • <SYSTEM32>\Com\bad20
  • <SYSTEM32>\URTTEMP\bad195
  • <SYSTEM32>\usmt\bad84
  • <SYSTEM32>\spool\prtprocs\w32x86\bad180
  • <SYSTEM32>\Restore\bad188
  • <SYSTEM32>\Restore\bad98
  • <SYSTEM32>\bad163
  • <SYSTEM32>\bad55
  • <SYSTEM32>\bad142
  • <SYSTEM32>\bad60
  • <SYSTEM32>\bad52
  • <SYSTEM32>\bad70
  • <SYSTEM32>\bad162
  • <SYSTEM32>\bad93
  • <SYSTEM32>\bad127
  • <SYSTEM32>\bad199
  • <SYSTEM32>\bad131
  • %CommonProgramFiles%\Microsoft Shared\Speech\bad147
  • %PROGRAM_FILES%\Internet Explorer\bad27
  • %CommonProgramFiles%\Microsoft Shared\MSInfo\bad126
  • <SYSTEM32>\XPSViewer\bad81
  • <Auxiliary element>
  • %PROGRAM_FILES%\Internet Explorer\Connection Wizard\bad196
  • %PROGRAM_FILES%\Internet Explorer\Connection Wizard\bad186
  • %PROGRAM_FILES%\Internet Explorer\Connection Wizard\bad47
  • %PROGRAM_FILES%\Internet Explorer\bad163
  • %PROGRAM_FILES%\Internet Explorer\Connection Wizard\bad106
  • <SYSTEM32>\wbem\bad197
  • <SYSTEM32>\wbem\bad72
  • <SYSTEM32>\wbem\bad78
  • <SYSTEM32>\wbem\bad20
  • <SYSTEM32>\usmt\bad109
  • <SYSTEM32>\usmt\bad101
  • <SYSTEM32>\wbem\bad81
  • <SYSTEM32>\wbem\bad149
  • <SYSTEM32>\wbem\bad67
  • <SYSTEM32>\wbem\bad192
  • <SYSTEM32>\wbem\bad1
  • %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\bad197
  • %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\bad49
  • %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\bad159
  • %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\bad34
  • %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\bad41
  • %WINDIR%\Microsoft.NET\Framework\v3.5\bad28
  • %WINDIR%\Microsoft.NET\Framework\v3.5\bad87
  • %WINDIR%\Microsoft.NET\Framework\v3.5\bad142
  • %WINDIR%\Microsoft.NET\Framework\v3.0\WPF\bad33
  • %WINDIR%\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\bad183
  • %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\bad28
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad155
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad76
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad146
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad156
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad103
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad129
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad97
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad198
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad11
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad109
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad69
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad137
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad87
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad186
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad48
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad177
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad79
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad46
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad182
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad132
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad195
  • %WINDIR%\Microsoft.NET\Framework\v3.5\bad45
  • %WINDIR%\Microsoft.NET\Framework\v3.5\bad31
  • %WINDIR%\Microsoft.NET\Framework\v3.5\bad108
  • %WINDIR%\Microsoft.NET\Framework\v3.5\bad92
  • %WINDIR%\Microsoft.NET\Framework\v3.5\bad128
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad25
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad118
  • %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\bad17
  • %WINDIR%\Microsoft.NET\Framework\v3.5\bad102
  • %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\bad144
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad113
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad132
  • %WINDIR%\Microsoft.NET\Framework\bad77
  • %WINDIR%\Microsoft.NET\bad67
  • %WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\bad107
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad135
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad126
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad151
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad32
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad89
  • %WINDIR%\Help\Tours\mmTour\bad69
  • %WINDIR%\bad176
  • %WINDIR%\bad31
  • %WINDIR%\bad80
  • %WINDIR%\bad4
  • %WINDIR%\bad17
  • %WINDIR%\bad167
  • %WINDIR%\bad51
  • %WINDIR%\bad159
  • %WINDIR%\bad37
  • %WINDIR%\bad2
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad67
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad98
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad179
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad191
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad118
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad68
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad94
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad157
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad31
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad96
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad100
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad157
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad182
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad64
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad120
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad67
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad85
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad51
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad8
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad125
  • %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad187
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad4
  • <SYSTEM32>\bad80
  • <SYSTEM32>\bad174
  • <SYSTEM32>\bad27
  • <SYSTEM32>\bad128
  • <SYSTEM32>\bad165
  • <SYSTEM32>\bad31
  • <SYSTEM32>\bad168
  • <SYSTEM32>\bad67
  • <SYSTEM32>\bad105
  • <SYSTEM32>\bad54
  • <SYSTEM32>\bad85
  • <SYSTEM32>\bad147
  • <SYSTEM32>\bad24
  • <SYSTEM32>\bad38
  • <SYSTEM32>\bad41
  • <SYSTEM32>\bad81
  • <SYSTEM32>\bad89
  • <SYSTEM32>\bad132
  • <SYSTEM32>\bad30
  • <SYSTEM32>\bad164
  • <SYSTEM32>\bad167
  • <SYSTEM32>\bad45
  • <SYSTEM32>\bad161
  • <SYSTEM32>\bad137
  • <SYSTEM32>\bad57
  • <SYSTEM32>\bad146
  • <SYSTEM32>\bad121
  • <SYSTEM32>\bad87
  • <SYSTEM32>\bad68
  • <SYSTEM32>\bad63
  • <SYSTEM32>\bad36
  • <SYSTEM32>\bad191
  • <SYSTEM32>\bad50
  • <SYSTEM32>\bad15
  • <SYSTEM32>\bad96
  • <SYSTEM32>\bad53
  • <SYSTEM32>\bad153
  • <SYSTEM32>\bad1
  • <SYSTEM32>\bad184
  • <SYSTEM32>\bad138
  • <SYSTEM32>\bad180
  • <SYSTEM32>\bad7
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad127
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad190
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad2
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad42
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad52
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\bad132
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\bad144
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\bad68
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\bad113
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\bad129
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad113
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad36
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad151
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad167
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad57
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad43
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad74
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad16
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad199
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad117
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad5
  • <SYSTEM32>\bad3
  • <SYSTEM32>\bad151
  • <SYSTEM32>\bad78
  • <SYSTEM32>\bad97
  • <SYSTEM32>\bad125
  • <SYSTEM32>\bad144
  • <SYSTEM32>\bad75
  • <SYSTEM32>\bad190
  • <SYSTEM32>\bad22
  • <SYSTEM32>\bad37
  • <SYSTEM32>\bad16
  • %WINDIR%\pchealth\helpctr\binaries\bad170
  • %WINDIR%\pchealth\helpctr\binaries\bad186
  • %WINDIR%\pchealth\helpctr\binaries\bad149
  • %WINDIR%\msagent\bad106
  • %WINDIR%\mui\bad26
  • <SYSTEM32>\bad90
  • <SYSTEM32>\bad59
  • %WINDIR%\pchealth\UploadLB\Binaries\bad178
  • %WINDIR%\pchealth\helpctr\binaries\bad32
  • %WINDIR%\pchealth\helpctr\binaries\bad54
Moves the following system files:
  • from <SYSTEM32>\narrator.exe to <SYSTEM32>\bad51
  • from <SYSTEM32>\nbtstat.exe to <SYSTEM32>\bad124
  • from <SYSTEM32>\mstsc.exe to <SYSTEM32>\bad187
  • from <SYSTEM32>\msiexec.exe to <SYSTEM32>\bad185
  • from <SYSTEM32>\mstinit.exe to <SYSTEM32>\bad54
  • from <SYSTEM32>\ntsd.exe to <SYSTEM32>\bad126
  • from <SYSTEM32>\ntvdm.exe to <SYSTEM32>\bad165
  • from <SYSTEM32>\nslookup.exe to <SYSTEM32>\bad94
  • from <SYSTEM32>\net.exe to <SYSTEM32>\bad171
  • from <SYSTEM32>\netdde.exe to <SYSTEM32>\bad59
  • from <SYSTEM32>\mshearts.exe to <SYSTEM32>\bad176
  • from <SYSTEM32>\mplay32.exe to <SYSTEM32>\bad14
  • from <SYSTEM32>\mpnotify.exe to <SYSTEM32>\bad2
  • from <SYSTEM32>\mountvol.exe to <SYSTEM32>\bad32
  • from <SYSTEM32>\mnmsrvc.exe to <SYSTEM32>\bad198
  • from <SYSTEM32>\mobsync.exe to <SYSTEM32>\bad140
  • from <SYSTEM32>\msdtc.exe to <SYSTEM32>\bad139
  • from <SYSTEM32>\msg.exe to <SYSTEM32>\bad189
  • from <SYSTEM32>\mrinfo.exe to <SYSTEM32>\bad192
  • from <SYSTEM32>\mqbkup.exe to <SYSTEM32>\bad29
  • from <SYSTEM32>\mqtgsvc.exe to <SYSTEM32>\bad123
  • from <SYSTEM32>\rasphone.exe to <SYSTEM32>\bad71
  • from <SYSTEM32>\rcp.exe to <SYSTEM32>\bad29
  • from <SYSTEM32>\rasdial.exe to <SYSTEM32>\bad177
  • from <SYSTEM32>\qwinsta.exe to <SYSTEM32>\bad184
  • from <SYSTEM32>\rasautou.exe to <SYSTEM32>\bad182
  • from <SYSTEM32>\reg.exe to <SYSTEM32>\bad159
  • from <SYSTEM32>\regedt32.exe to <SYSTEM32>\bad115
  • from <SYSTEM32>\recover.exe to <SYSTEM32>\bad41
  • from <SYSTEM32>\rdpclip.exe to <SYSTEM32>\bad83
  • from <SYSTEM32>\rdshost.exe to <SYSTEM32>\bad72
  • from <SYSTEM32>\qprocess.exe to <SYSTEM32>\bad174
  • from <SYSTEM32>\ping.exe to <SYSTEM32>\bad116
  • from <SYSTEM32>\ping6.exe to <SYSTEM32>\bad18
  • from <SYSTEM32>\pentnt.exe to <SYSTEM32>\bad140
  • from <SYSTEM32>\odbcad32.exe to <SYSTEM32>\bad168
  • from <SYSTEM32>\pathping.exe to <SYSTEM32>\bad78
  • from <SYSTEM32>\proquota.exe to <SYSTEM32>\bad103
  • from <SYSTEM32>\proxycfg.exe to <SYSTEM32>\bad12
  • from <SYSTEM32>\print.exe to <SYSTEM32>\bad63
  • from <SYSTEM32>\powercfg.exe to <SYSTEM32>\bad8
  • from <SYSTEM32>\PresentationHost.exe to <SYSTEM32>\bad86
  • from <SYSTEM32>\findstr.exe to <SYSTEM32>\bad193
  • from <SYSTEM32>\fixmapi.exe to <SYSTEM32>\bad145
  • from <SYSTEM32>\find.exe to <SYSTEM32>\bad134
  • from <SYSTEM32>\fastopen.exe to <SYSTEM32>\bad6
  • from <SYSTEM32>\fc.exe to <SYSTEM32>\bad120
  • from <SYSTEM32>\fsquirt.exe to <SYSTEM32>\bad158
  • from <SYSTEM32>\fsutil.exe to <SYSTEM32>\bad152
  • from <SYSTEM32>\freecell.exe to <SYSTEM32>\bad118
  • from <SYSTEM32>\fltMc.exe to <SYSTEM32>\bad197
  • from <SYSTEM32>\fontview.exe to <SYSTEM32>\bad132
  • from <SYSTEM32>\extrac32.exe to <SYSTEM32>\bad195
  • from <SYSTEM32>\dxdiag.exe to <SYSTEM32>\bad121
  • from <SYSTEM32>\edlin.exe to <SYSTEM32>\bad87
  • from <SYSTEM32>\dwwin.exe to <SYSTEM32>\bad68
  • from <SYSTEM32>\dumprep.exe to <SYSTEM32>\bad63
  • from <SYSTEM32>\dvdupgrd.exe to <SYSTEM32>\bad36
  • from <SYSTEM32>\exe2bin.exe to <SYSTEM32>\bad101
  • from <SYSTEM32>\expand.exe to <SYSTEM32>\bad62
  • from <SYSTEM32>\eventtriggers.exe to <SYSTEM32>\bad13
  • from <SYSTEM32>\eudcedit.exe to <SYSTEM32>\bad117
  • from <SYSTEM32>\eventcreate.exe to <SYSTEM32>\bad97
  • from <SYSTEM32>\logagent.exe to <SYSTEM32>\bad146
  • from <SYSTEM32>\logonui.exe to <SYSTEM32>\bad34
  • from <SYSTEM32>\lodctr.exe to <SYSTEM32>\bad26
  • from <SYSTEM32>\lnkstub.exe to <SYSTEM32>\bad84
  • from <SYSTEM32>\locator.exe to <SYSTEM32>\bad123
  • from <SYSTEM32>\makecab.exe to <SYSTEM32>\bad181
  • from <SYSTEM32>\mem.exe to <SYSTEM32>\bad160
  • from <SYSTEM32>\magnify.exe to <SYSTEM32>\bad194
  • from <SYSTEM32>\lpq.exe to <SYSTEM32>\bad0
  • from <SYSTEM32>\lsass.exe to <SYSTEM32>\bad76
  • from <SYSTEM32>\label.exe to <SYSTEM32>\bad73
  • from <SYSTEM32>\gpresult.exe to <SYSTEM32>\bad109
  • from <SYSTEM32>\grpconv.exe to <SYSTEM32>\bad28
  • from <SYSTEM32>\getmac.exe to <SYSTEM32>\bad9
  • from <SYSTEM32>\ftp.exe to <SYSTEM32>\bad69
  • from <SYSTEM32>\gdi.exe to <SYSTEM32>\bad182
  • from <SYSTEM32>\imapi.exe to <SYSTEM32>\bad56
  • from <SYSTEM32>\ipsec6.exe to <SYSTEM32>\bad119
  • from <SYSTEM32>\ie4uinit.exe to <SYSTEM32>\bad175
  • from <SYSTEM32>\help.exe to <SYSTEM32>\bad35
  • from <SYSTEM32>\hostname.exe to <SYSTEM32>\bad166
  • from <SYSTEM32>\wowexec.exe to <SYSTEM32>\bad93
  • from <SYSTEM32>\wpabaln.exe to <SYSTEM32>\bad59
  • from <SYSTEM32>\wowdeb.exe to <SYSTEM32>\bad162
  • from <SYSTEM32>\winlogon.exe to <SYSTEM32>\bad133
  • from <SYSTEM32>\winmsd.exe to <SYSTEM32>\bad16
  • from <SYSTEM32>\Com\comrepl.exe to <SYSTEM32>\Com\bad178
  • from <SYSTEM32>\Com\comrereg.exe to <SYSTEM32>\Com\bad20
  • from <SYSTEM32>\xcopy.exe to <SYSTEM32>\bad132
  • from <SYSTEM32>\write.exe to <SYSTEM32>\bad163
  • from <SYSTEM32>\wuauclt1.exe to <SYSTEM32>\bad143
  • from <SYSTEM32>\winhlp32.exe to <SYSTEM32>\bad127
  • from <SYSTEM32>\user.exe to <SYSTEM32>\bad70
  • from <SYSTEM32>\userinit.exe to <SYSTEM32>\bad60
  • from <SYSTEM32>\ups.exe to <SYSTEM32>\bad52
  • from <SYSTEM32>\unlodctr.exe to <SYSTEM32>\bad4
  • from <SYSTEM32>\upnpcont.exe to <SYSTEM32>\bad176
  • from <SYSTEM32>\vwipxspx.exe to <SYSTEM32>\bad199
  • from <SYSTEM32>\winchat.exe to <SYSTEM32>\bad131
  • from <SYSTEM32>\vssvc.exe to <SYSTEM32>\bad142
  • from <SYSTEM32>\usrprbda.exe to <SYSTEM32>\bad55
  • from <SYSTEM32>\vssadmin.exe to <SYSTEM32>\bad69
  • from <SYSTEM32>\wbem\winmgmt.exe to <SYSTEM32>\wbem\bad1
  • from <SYSTEM32>\wbem\wmiadap.exe to <SYSTEM32>\wbem\bad67
  • from <SYSTEM32>\wbem\wbemtest.exe to <SYSTEM32>\wbem\bad192
  • from <SYSTEM32>\wbem\scrcons.exe to <SYSTEM32>\wbem\bad72
  • from <SYSTEM32>\wbem\unsecapp.exe to <SYSTEM32>\wbem\bad78
  • from <SYSTEM32>\XPSViewer\XPSViewer.exe to <SYSTEM32>\XPSViewer\bad81
  • from <Auxiliary element> to <Auxiliary element>
  • from <SYSTEM32>\wbem\wmiprvse.exe to <SYSTEM32>\wbem\bad197
  • from <SYSTEM32>\wbem\wmiapsrv.exe to <SYSTEM32>\wbem\bad81
  • from <SYSTEM32>\wbem\wmic.exe to <SYSTEM32>\wbem\bad149
  • from <SYSTEM32>\wbem\mofcomp.exe to <SYSTEM32>\wbem\bad20
  • from <SYSTEM32>\Restore\rstrui.exe to <SYSTEM32>\Restore\bad188
  • from <SYSTEM32>\Restore\srdiag.exe to <SYSTEM32>\Restore\bad98
  • from <SYSTEM32>\oobe\oobebaln.exe to <SYSTEM32>\oobe\bad1
  • from <SYSTEM32>\npp\nppagent.exe to <SYSTEM32>\npp\bad110
  • from <SYSTEM32>\oobe\msoobe.exe to <SYSTEM32>\oobe\bad186
  • from <SYSTEM32>\usmt\migwiz.exe to <SYSTEM32>\usmt\bad109
  • from <SYSTEM32>\usmt\migwiz_a.exe to <SYSTEM32>\usmt\bad101
  • from <SYSTEM32>\usmt\migload.exe to <SYSTEM32>\usmt\bad84
  • from <SYSTEM32>\spool\prtprocs\w32x86\printfilterpipelinesvc.exe to <SYSTEM32>\spool\prtprocs\w32x86\bad180
  • from <SYSTEM32>\URTTEMP\regtlib.exe to <SYSTEM32>\URTTEMP\bad195
  • from <SYSTEM32>\shrpubw.exe to <SYSTEM32>\bad100
  • from <SYSTEM32>\shutdown.exe to <SYSTEM32>\bad146
  • from <SYSTEM32>\shmgrate.exe to <SYSTEM32>\bad25
  • from <SYSTEM32>\setver.exe to <SYSTEM32>\bad49
  • from <SYSTEM32>\share.exe to <SYSTEM32>\bad134
  • from <SYSTEM32>\smss.exe to <SYSTEM32>\bad64
  • from <SYSTEM32>\sndrec32.exe to <SYSTEM32>\bad141
  • from <SYSTEM32>\smlogsvc.exe to <SYSTEM32>\bad143
  • from <SYSTEM32>\sigverif.exe to <SYSTEM32>\bad65
  • from <SYSTEM32>\smbinst.exe to <SYSTEM32>\bad180
  • from <SYSTEM32>\setup.exe to <SYSTEM32>\bad122
  • from <SYSTEM32>\reset.exe to <SYSTEM32>\bad58
  • from <SYSTEM32>\rexec.exe to <SYSTEM32>\bad33
  • from <SYSTEM32>\relog.exe to <SYSTEM32>\bad175
  • from <SYSTEM32>\regsvr32.exe to <SYSTEM32>\bad75
  • from <SYSTEM32>\regwiz.exe to <SYSTEM32>\bad21
  • from <SYSTEM32>\runonce.exe to <SYSTEM32>\bad141
  • from <SYSTEM32>\services.exe to <SYSTEM32>\bad147
  • from <SYSTEM32>\runas.exe to <SYSTEM32>\bad182
  • from <SYSTEM32>\rsh.exe to <SYSTEM32>\bad42
  • from <SYSTEM32>\rsm.exe to <SYSTEM32>\bad44
  • from <SYSTEM32>\tlntadmn.exe to <SYSTEM32>\bad82
  • from <SYSTEM32>\tlntsess.exe to <SYSTEM32>\bad122
  • from <SYSTEM32>\tftp.exe to <SYSTEM32>\bad197
  • from <SYSTEM32>\taskmgr.exe to <SYSTEM32>\bad7
  • from <SYSTEM32>\tcpsvcs.exe to <SYSTEM32>\bad114
  • from <SYSTEM32>\tsdiscon.exe to <SYSTEM32>\bad3
  • from <SYSTEM32>\TsWpfWrp.exe to <SYSTEM32>\bad154
  • from <SYSTEM32>\tscupgrd.exe to <SYSTEM32>\bad178
  • from <SYSTEM32>\tourstart.exe to <SYSTEM32>\bad91
  • from <SYSTEM32>\tracerpt.exe to <SYSTEM32>\bad166
  • from <SYSTEM32>\taskman.exe to <SYSTEM32>\bad1
  • from <SYSTEM32>\sprestrt.exe to <SYSTEM32>\bad33
  • from <SYSTEM32>\syncapp.exe to <SYSTEM32>\bad150
  • from <SYSTEM32>\spiisupd.exe to <SYSTEM32>\bad22
  • from <SYSTEM32>\sndvol32.exe to <SYSTEM32>\bad135
  • from <SYSTEM32>\sol.exe to <SYSTEM32>\bad170
  • from <SYSTEM32>\taskkill.exe to <SYSTEM32>\bad189
  • from <SYSTEM32>\tasklist.exe to <SYSTEM32>\bad48
  • from <SYSTEM32>\sysocmgr.exe to <SYSTEM32>\bad98
  • from <SYSTEM32>\sysedit.exe to <SYSTEM32>\bad128
  • from <SYSTEM32>\syskey.exe to <SYSTEM32>\bad195
  • from %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe to %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\bad197
  • from %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\PerformanceCounterInstaller.exe to %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\bad49
  • from %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe to %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\bad159
  • from %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe to %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\bad34
  • from %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe to %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\bad41
  • from %WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess32.exe to %WINDIR%\Microsoft.NET\Framework\v3.5\bad28
  • from %WINDIR%\Microsoft.NET\Framework\v3.5\AddInUtil.exe to %WINDIR%\Microsoft.NET\Framework\v3.5\bad87
  • from %WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess.exe to %WINDIR%\Microsoft.NET\Framework\v3.5\bad142
  • from %WINDIR%\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe to %WINDIR%\Microsoft.NET\Framework\v3.0\WPF\bad33
  • from %WINDIR%\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe to %WINDIR%\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\bad183
  • from %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe to %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\bad28
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\jsc.exe to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad155
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad76
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad146
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\IEExec.exe to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad156
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ilasm.exe to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad103
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad129
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad97
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad198
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad11
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen.exe to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad109
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad69
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad137
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad87
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad186
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad48
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad177
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad79
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CasPol.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad46
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad182
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad132
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad195
  • from %WINDIR%\Microsoft.NET\Framework\v3.5\MSBuild.exe to %WINDIR%\Microsoft.NET\Framework\v3.5\bad45
  • from %WINDIR%\Microsoft.NET\Framework\v3.5\vbc.exe to %WINDIR%\Microsoft.NET\Framework\v3.5\bad31
  • from %WINDIR%\Microsoft.NET\Framework\v3.5\EdmGen.exe to %WINDIR%\Microsoft.NET\Framework\v3.5\bad108
  • from %WINDIR%\Microsoft.NET\Framework\v3.5\csc.exe to %WINDIR%\Microsoft.NET\Framework\v3.5\bad92
  • from %WINDIR%\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe to %WINDIR%\Microsoft.NET\Framework\v3.5\bad128
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad25
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad118
  • from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\bad17
  • from %WINDIR%\Microsoft.NET\Framework\v3.5\WFServicesReg.exe to %WINDIR%\Microsoft.NET\Framework\v3.5\bad102
  • from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\DeleteTemp.exe to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\bad144
  • from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad113
  • from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad132
  • from %WINDIR%\Microsoft.NET\Framework\NETFXSBS10.exe to %WINDIR%\Microsoft.NET\Framework\bad77
  • from %WINDIR%\Microsoft.NET\NETFXRepair.exe to %WINDIR%\Microsoft.NET\bad67
  • from %WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\Microsoft.Workflow.Compiler.exe to %WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\bad107
  • from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\csc.exe to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad135
  • from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\cvtres.exe to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad126
  • from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad151
  • from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad32
  • from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CasPol.exe to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad89
  • from %WINDIR%\Help\Tours\mmTour\tour.exe to %WINDIR%\Help\Tours\mmTour\bad69
  • from %WINDIR%\sfk.exe to %WINDIR%\bad176
  • from %WINDIR%\sleep.exe to %WINDIR%\bad31
  • from %WINDIR%\regedit.exe to %WINDIR%\bad80
  • from %WINDIR%\hh.exe to %WINDIR%\bad4
  • from %WINDIR%\NOTEPAD.EXE to %WINDIR%\bad17
  • from %WINDIR%\winhelp.exe to %WINDIR%\bad167
  • from %WINDIR%\winhlp32.exe to %WINDIR%\bad51
  • from %WINDIR%\twunk_32.exe to %WINDIR%\bad159
  • from %WINDIR%\TASKMAN.EXE to %WINDIR%\bad37
  • from %WINDIR%\twunk_16.exe to %WINDIR%\bad2
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad67
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad98
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad179
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad191
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad118
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad68
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad94
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad157
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad31
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CasPol.exe to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad96
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\bad100
  • from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\jsc.exe to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad157
  • from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPol.exe to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad182
  • from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\InstallUtil.exe to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad64
  • from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\IEExec.exe to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad120
  • from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ilasm.exe to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad67
  • from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad85
  • from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\vbc.exe to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad51
  • from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegAsm.exe to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad8
  • from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad125
  • from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ngen.exe to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\bad187
  • from <SYSTEM32>\cleanmgr.exe to <SYSTEM32>\bad165
  • from <SYSTEM32>\cliconfg.exe to <SYSTEM32>\bad27
  • from <SYSTEM32>\ckcnv.exe to <SYSTEM32>\bad128
  • from <SYSTEM32>\cipher.exe to <SYSTEM32>\bad132
  • from <SYSTEM32>\cisvc.exe to <SYSTEM32>\bad85
  • from <SYSTEM32>\cmdl32.exe to <SYSTEM32>\bad54
  • from <SYSTEM32>\cmmon32.exe to <SYSTEM32>\bad67
  • from <SYSTEM32>\cmd.exe to <SYSTEM32>\bad105
  • from <SYSTEM32>\clipbrd.exe to <SYSTEM32>\bad80
  • from <SYSTEM32>\clipsrv.exe to <SYSTEM32>\bad174
  • from <SYSTEM32>\cidaemon.exe to <SYSTEM32>\bad89
  • from <SYSTEM32>\autofmt.exe to <SYSTEM32>\bad81
  • from <SYSTEM32>\autolfn.exe to <SYSTEM32>\bad38
  • from <SYSTEM32>\autoconv.exe to <SYSTEM32>\bad41
  • from <SYSTEM32>\auditusr.exe to <SYSTEM32>\bad144
  • from <SYSTEM32>\autochk.exe to <SYSTEM32>\bad75
  • from <SYSTEM32>\chkdsk.exe to <SYSTEM32>\bad167
  • from <SYSTEM32>\chkntfs.exe to <SYSTEM32>\bad30
  • from <SYSTEM32>\charmap.exe to <SYSTEM32>\bad164
  • from <SYSTEM32>\blastcln.exe to <SYSTEM32>\bad147
  • from <SYSTEM32>\calc.exe to <SYSTEM32>\bad24
  • from <SYSTEM32>\dllhst3g.exe to <SYSTEM32>\bad184
  • from <SYSTEM32>\dmadmin.exe to <SYSTEM32>\bad191
  • from <SYSTEM32>\dllhost.exe to <SYSTEM32>\bad1
  • from <SYSTEM32>\diskpart.exe to <SYSTEM32>\bad125
  • from <SYSTEM32>\diskperf.exe to <SYSTEM32>\bad138
  • from <SYSTEM32>\dpvsetup.exe to <SYSTEM32>\bad45
  • from <SYSTEM32>\drwtsn32.exe to <SYSTEM32>\bad161
  • from <SYSTEM32>\dplaysvr.exe to <SYSTEM32>\bad137
  • from <SYSTEM32>\dmremote.exe to <SYSTEM32>\bad57
  • from <SYSTEM32>\doskey.exe to <SYSTEM32>\bad146
  • from <SYSTEM32>\diantz.exe to <SYSTEM32>\bad7
  • from <SYSTEM32>\conime.exe to <SYSTEM32>\bad153
  • from <SYSTEM32>\convert.exe to <SYSTEM32>\bad96
  • from <SYSTEM32>\compact.exe to <SYSTEM32>\bad53
  • from <SYSTEM32>\cmstp.exe to <SYSTEM32>\bad31
  • from <SYSTEM32>\comp.exe to <SYSTEM32>\bad168
  • from <SYSTEM32>\defrag.exe to <SYSTEM32>\bad15
  • from <SYSTEM32>\dfrgfat.exe to <SYSTEM32>\bad180
  • from <SYSTEM32>\dcomcnfg.exe to <SYSTEM32>\bad50
  • from <SYSTEM32>\csrss.exe to <SYSTEM32>\bad74
  • from <SYSTEM32>\ctfmon.exe to <SYSTEM32>\bad47
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad2
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\vbc.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad127
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad52
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad113
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad42
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Setup.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\bad68
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SetupUtility.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\bad132
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SetupUtility.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\bad129
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad190
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\bad113
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad16
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad167
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ilasm.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad36
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad43
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad4
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad57
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad199
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad74
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad5
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad151
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\jsc.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\bad117
  • from <SYSTEM32>\arp.exe to <SYSTEM32>\bad125
  • from <SYSTEM32>\asr_fmt.exe to <SYSTEM32>\bad78
  • from <SYSTEM32>\append.exe to <SYSTEM32>\bad97
  • from <SYSTEM32>\ahui.exe to <SYSTEM32>\bad16
  • from <SYSTEM32>\alg.exe to <SYSTEM32>\bad113
  • from <SYSTEM32>\atmadm.exe to <SYSTEM32>\bad37
  • from <SYSTEM32>\attrib.exe to <SYSTEM32>\bad190
  • from <SYSTEM32>\at.exe to <SYSTEM32>\bad22
  • from <SYSTEM32>\asr_ldm.exe to <SYSTEM32>\bad3
  • from <SYSTEM32>\asr_pfu.exe to <SYSTEM32>\bad151
  • from <SYSTEM32>\actmovie.exe to <SYSTEM32>\bad59
  • from %WINDIR%\pchealth\helpctr\binaries\HelpCtr.exe to %WINDIR%\pchealth\helpctr\binaries\bad149
  • from %WINDIR%\pchealth\helpctr\binaries\HelpHost.exe to %WINDIR%\pchealth\helpctr\binaries\bad170
  • from %WINDIR%\mui\muisetup.exe to %WINDIR%\mui\bad26
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\bad144
  • from %WINDIR%\msagent\agentsvr.exe to %WINDIR%\msagent\bad106
  • from %WINDIR%\pchealth\UploadLB\Binaries\UploadM.exe to %WINDIR%\pchealth\UploadLB\Binaries\bad178
  • from <SYSTEM32>\accwiz.exe to <SYSTEM32>\bad90
  • from %WINDIR%\pchealth\helpctr\binaries\msconfig.exe to %WINDIR%\pchealth\helpctr\binaries\bad54
  • from %WINDIR%\pchealth\helpctr\binaries\HelpSvc.exe to %WINDIR%\pchealth\helpctr\binaries\bad186
  • from %WINDIR%\pchealth\helpctr\binaries\HscUpd.exe to %WINDIR%\pchealth\helpctr\binaries\bad32
Moves the following files:
  • from %WINDIR%\winhlp32.exe to %WINDIR%\bad117
  • from %WINDIR%\winhelp.exe to %WINDIR%\bad93
  • from %WINDIR%\Help\Tours\mmTour\tour.exe to %WINDIR%\Help\Tours\mmTour\bad175
  • from <SYSTEM32>\dllcache\hscupd.exe.new to <SYSTEM32>\dllcache\hscupd.exe
  • from <SYSTEM32>\dllcache\helpsvc.exe.new to <SYSTEM32>\dllcache\helpsvc.exe
  • from %WINDIR%\hh.exe to %WINDIR%\bad115
  • from <SYSTEM32>\dllcache\helphost.exe.new to <SYSTEM32>\dllcache\helphost.exe
  • from %WINDIR%\notepad.exe to %WINDIR%\bad62
  • from %WINDIR%\twunk_16.exe to %WINDIR%\bad66
  • from %WINDIR%\regedit.exe to %WINDIR%\bad186
  • from %WINDIR%\pchealth\helpctr\binaries\hscupd.exe to %WINDIR%\pchealth\helpctr\binaries\bad87
  • from %WINDIR%\pchealth\helpctr\binaries\helpsvc.exe to %WINDIR%\pchealth\helpctr\binaries\bad113
  • from %WINDIR%\pchealth\helpctr\binaries\msconfig.exe to %WINDIR%\pchealth\helpctr\binaries\bad52
  • from %WINDIR%\pchealth\UploadLB\Binaries\uploadm.exe to %WINDIR%\pchealth\UploadLB\Binaries\bad133
  • from %WINDIR%\pchealth\helpctr\binaries\notiflag.exe to %WINDIR%\pchealth\helpctr\binaries\bad148
  • from %WINDIR%\msagent\agentsvr.exe to %WINDIR%\msagent\bad191
  • from <SYSTEM32>\dllcache\uploadm.exe.new to <SYSTEM32>\dllcache\uploadm.exe
  • from %WINDIR%\mui\muisetup.exe to %WINDIR%\mui\bad110
  • from %WINDIR%\pchealth\helpctr\binaries\helphost.exe to %WINDIR%\pchealth\helpctr\binaries\bad154
  • from %WINDIR%\pchealth\helpctr\binaries\helpctr.exe to %WINDIR%\pchealth\helpctr\binaries\bad71
  • from <SYSTEM32>\dllcache\helpctr.exe.new to <SYSTEM32>\dllcache\helpctr.exe
  • from %PROGRAM_FILES%\NetMeeting\conf.exe to %PROGRAM_FILES%\NetMeeting\bad16
  • from %PROGRAM_FILES%\NetMeeting\cb32.exe to %PROGRAM_FILES%\NetMeeting\bad15
  • from %PROGRAM_FILES%\NetMeeting\wb32.exe to %PROGRAM_FILES%\NetMeeting\bad56
  • from %PROGRAM_FILES%\Outlook Express\oemig50.exe to %PROGRAM_FILES%\Outlook Express\bad131
  • from %PROGRAM_FILES%\Outlook Express\msimn.exe to %PROGRAM_FILES%\Outlook Express\bad126
  • from %PROGRAM_FILES%\MSN Gaming Zone\Windows\hrtzzm.exe to %PROGRAM_FILES%\MSN Gaming Zone\Windows\bad174
  • from %PROGRAM_FILES%\MSN Gaming Zone\Windows\chkrzm.exe to %PROGRAM_FILES%\MSN Gaming Zone\Windows\bad70
  • from %PROGRAM_FILES%\MSN Gaming Zone\Windows\rvsezm.exe to %PROGRAM_FILES%\MSN Gaming Zone\Windows\bad105
  • from %PROGRAM_FILES%\MSN Gaming Zone\Windows\zclientm.exe to %PROGRAM_FILES%\MSN Gaming Zone\Windows\bad171
  • from %PROGRAM_FILES%\MSN Gaming Zone\Windows\shvlzm.exe to %PROGRAM_FILES%\MSN Gaming Zone\Windows\bad105
  • from %PROGRAM_FILES%\Windows Media Player\wmplayer.exe to %PROGRAM_FILES%\Windows Media Player\bad41
  • from %PROGRAM_FILES%\Windows Media Player\setup_wm.exe to %PROGRAM_FILES%\Windows Media Player\bad169
  • from %PROGRAM_FILES%\Windows NT\dialer.exe to %PROGRAM_FILES%\Windows NT\bad147
  • from %PROGRAM_FILES%\Windows NT\Pinball\pinball.exe to %PROGRAM_FILES%\Windows NT\Pinball\bad82
  • from %PROGRAM_FILES%\Windows NT\Accessories\wordpad.exe to %PROGRAM_FILES%\Windows NT\Accessories\bad116
  • from %PROGRAM_FILES%\Outlook Express\wab.exe to %PROGRAM_FILES%\Outlook Express\bad86
  • from %PROGRAM_FILES%\Outlook Express\setup50.exe to %PROGRAM_FILES%\Outlook Express\bad69
  • from %PROGRAM_FILES%\Outlook Express\wabmig.exe to %PROGRAM_FILES%\Outlook Express\bad112
  • from %PROGRAM_FILES%\Windows Media Player\mplayer2.exe to %PROGRAM_FILES%\Windows Media Player\bad0
  • from %PROGRAM_FILES%\Windows Media Player\migrate.exe to %PROGRAM_FILES%\Windows Media Player\bad199
  • from <SYSTEM32>\accwiz.exe to <SYSTEM32>\bad92
  • from <SYSTEM32>\dllcache\msinfo32.exe.new to <SYSTEM32>\dllcache\msinfo32.exe
  • from <SYSTEM32>\dllcache\arp.exe.new to <SYSTEM32>\dllcache\arp.exe
  • from <SYSTEM32>\dllcache\sapisvr.exe.new to <SYSTEM32>\dllcache\sapisvr.exe
  • from <SYSTEM32>\dllcache\agentsvr.exe.new to <SYSTEM32>\dllcache\agentsvr.exe
  • from <SYSTEM32>\dllcache\tourW.exe.new to <SYSTEM32>\dllcache\tourW.exe
  • from <SYSTEM32>\accwiz.exe.new to <SYSTEM32>\accwiz.exe
  • from %WINDIR%\pchealth\UploadLB\Binaries\uploadm.exe.new to %WINDIR%\pchealth\UploadLB\Binaries\uploadm.exe
  • from <SYSTEM32>\actmovie.exe.new to <SYSTEM32>\actmovie.exe
  • from <SYSTEM32>\append.exe.new to <SYSTEM32>\append.exe
  • from <SYSTEM32>\ahui.exe.new to <SYSTEM32>\ahui.exe
  • from <SYSTEM32>\dllcache\append.exe.new to <SYSTEM32>\dllcache\append.exe
  • from <SYSTEM32>\dllcache\ahui.exe.new to <SYSTEM32>\dllcache\ahui.exe
  • from %WINDIR%\LastGood\TMP2.tmp to %WINDIR%\LastGood\system32\dvdplay.exe
  • from <SYSTEM32>\dllcache\dvdplay.exe.new to <SYSTEM32>\dllcache\dvdplay.exe
  • from <SYSTEM32>\SET4.tmp to <SYSTEM32>\dvdplay.exe
  • from <SYSTEM32>\dllcache\msconfig.exe.new to <SYSTEM32>\dllcache\msconfig.exe
  • from <SYSTEM32>\dllcache\muisetup.exe.new to <SYSTEM32>\dllcache\muisetup.exe
  • from <SYSTEM32>\dllcache\notiflag.exe.new to <SYSTEM32>\dllcache\notiflag.exe
  • from <SYSTEM32>\dllcache\actmovie.exe.new to <SYSTEM32>\dllcache\actmovie.exe
  • from <SYSTEM32>\dllcache\accwiz.exe.new to <SYSTEM32>\dllcache\accwiz.exe
  • from %WINDIR%\pchealth\helpctr\binaries\notiflag.exe.new to %WINDIR%\pchealth\helpctr\binaries\notiflag.exe
  • from %WINDIR%\regedit.exe.new to %WINDIR%\regedit.exe
  • from %WINDIR%\notepad.exe.new to %WINDIR%\notepad.exe
  • from %WINDIR%\taskman.exe.new to %WINDIR%\taskman.exe
  • from %WINDIR%\twunk_32.exe.new to %WINDIR%\twunk_32.exe
  • from %WINDIR%\twunk_16.exe.new to %WINDIR%\twunk_16.exe
  • from <SYSTEM32>\ahui.exe to <SYSTEM32>\bad40
  • from <SYSTEM32>\actmovie.exe to <SYSTEM32>\bad181
  • from <SYSTEM32>\arp.exe.new to <SYSTEM32>\arp.exe
  • from %WINDIR%\hh.exe.new to %WINDIR%\hh.exe
  • from <SYSTEM32>\dllcache\fltmc.exe.new to <SYSTEM32>\dllcache\fltmc.exe
  • from %WINDIR%\pchealth\helpctr\binaries\helphost.exe.new to %WINDIR%\pchealth\helpctr\binaries\helphost.exe
  • from %WINDIR%\pchealth\helpctr\binaries\helpctr.exe.new to %WINDIR%\pchealth\helpctr\binaries\helpctr.exe
  • from %WINDIR%\pchealth\helpctr\binaries\helpsvc.exe.new to %WINDIR%\pchealth\helpctr\binaries\helpsvc.exe
  • from %WINDIR%\pchealth\helpctr\binaries\msconfig.exe.new to %WINDIR%\pchealth\helpctr\binaries\msconfig.exe
  • from %WINDIR%\pchealth\helpctr\binaries\hscupd.exe.new to %WINDIR%\pchealth\helpctr\binaries\hscupd.exe
  • from %WINDIR%\winhlp32.exe.new to %WINDIR%\winhlp32.exe
  • from %WINDIR%\winhelp.exe.new to %WINDIR%\winhelp.exe
  • from %WINDIR%\Help\Tours\mmTour\tour.exe.new to %WINDIR%\Help\Tours\mmTour\tour.exe
  • from %WINDIR%\mui\muisetup.exe.new to %WINDIR%\mui\muisetup.exe
  • from %WINDIR%\msagent\agentsvr.exe.new to %WINDIR%\msagent\agentsvr.exe
  • from <SYSTEM32>\dllcache\isignup.exe.new to <SYSTEM32>\dllcache\isignup.exe
  • from %PROGRAM_FILES%\NetMeeting\conf.exe.new to %PROGRAM_FILES%\NetMeeting\conf.exe
  • from %PROGRAM_FILES%\NetMeeting\wb32.exe.new to %PROGRAM_FILES%\NetMeeting\wb32.exe
  • from %PROGRAM_FILES%\Outlook Express\oemig50.exe.new to %PROGRAM_FILES%\Outlook Express\oemig50.exe
  • from %PROGRAM_FILES%\Outlook Express\msimn.exe.new to %PROGRAM_FILES%\Outlook Express\msimn.exe
  • from %PROGRAM_FILES%\MSN Gaming Zone\Windows\shvlzm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\shvlzm.exe
  • from <SYSTEM32>\dllcache\icwtutor.exe.new to <SYSTEM32>\dllcache\icwtutor.exe
  • from %PROGRAM_FILES%\MSN Gaming Zone\Windows\zclientm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\zclientm.exe
  • from %PROGRAM_FILES%\NetMeeting\cb32.exe.new to %PROGRAM_FILES%\NetMeeting\cb32.exe
  • from <SYSTEM32>\dllcache\inetwiz.exe.new to <SYSTEM32>\dllcache\inetwiz.exe
  • from %PROGRAM_FILES%\Windows Media Player\setup_wm.exe.new to %PROGRAM_FILES%\Windows Media Player\setup_wm.exe
  • from %PROGRAM_FILES%\Windows Media Player\mplayer2.exe.new to %PROGRAM_FILES%\Windows Media Player\mplayer2.exe
  • from %PROGRAM_FILES%\Windows Media Player\wmplayer.exe.new to %PROGRAM_FILES%\Windows Media Player\wmplayer.exe
  • from %PROGRAM_FILES%\Windows NT\Accessories\wordpad.exe.new to %PROGRAM_FILES%\Windows NT\Accessories\wordpad.exe
  • from %PROGRAM_FILES%\Windows NT\dialer.exe.new to %PROGRAM_FILES%\Windows NT\dialer.exe
  • from %PROGRAM_FILES%\Outlook Express\wab.exe.new to %PROGRAM_FILES%\Outlook Express\wab.exe
  • from %PROGRAM_FILES%\Outlook Express\setup50.exe.new to %PROGRAM_FILES%\Outlook Express\setup50.exe
  • from <SYSTEM32>\dllcache\moviemk.exe.new to <SYSTEM32>\dllcache\moviemk.exe
  • from %PROGRAM_FILES%\Windows Media Player\migrate.exe.new to %PROGRAM_FILES%\Windows Media Player\migrate.exe
  • from %PROGRAM_FILES%\Outlook Express\wabmig.exe.new to %PROGRAM_FILES%\Outlook Express\wabmig.exe
  • from %PROGRAM_FILES%\MSN Gaming Zone\Windows\rvsezm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\rvsezm.exe
  • from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn2.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn2.exe
  • from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn1.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn1.exe
  • from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwrmind.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwrmind.exe
  • from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\inetwiz.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\inetwiz.exe
  • from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwtutor.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwtutor.exe
  • from %CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe.new to %CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe
  • from <Full path to virus>.exe to <Current directory>\bad40
  • from %CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe.new to %CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe
  • from %PROGRAM_FILES%\Internet Explorer\iexplore.exe.new to %PROGRAM_FILES%\Internet Explorer\iexplore.exe
  • from %PROGRAM_FILES%\Internet Explorer\iedw.exe.new to %PROGRAM_FILES%\Internet Explorer\iedw.exe
  • from %PROGRAM_FILES%\MSN Gaming Zone\Windows\chkrzm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\chkrzm.exe
  • from %PROGRAM_FILES%\MSN Gaming Zone\Windows\bckgzm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\bckgzm.exe
  • from <SYSTEM32>\dllcache\icwconn2.exe.new to <SYSTEM32>\dllcache\icwconn2.exe
  • from <SYSTEM32>\dllcache\icwrmind.exe.new to <SYSTEM32>\dllcache\icwrmind.exe
  • from %PROGRAM_FILES%\MSN Gaming Zone\Windows\hrtzzm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\hrtzzm.exe
  • from %PROGRAM_FILES%\Movie Maker\moviemk.exe.new to %PROGRAM_FILES%\Movie Maker\moviemk.exe
  • from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\isignup.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\isignup.exe
  • from <SYSTEM32>\dllcache\iedw.exe.new to <SYSTEM32>\dllcache\iedw.exe
  • from <SYSTEM32>\dllcache\icwconn1.exe.new to <SYSTEM32>\dllcache\icwconn1.exe
  • from <SYSTEM32>\dllcache\iexplore.exe.new to <SYSTEM32>\dllcache\iexplore.exe
  • from %PROGRAM_FILES%\Windows NT\Pinball\pinball.exe.new to %PROGRAM_FILES%\Windows NT\Pinball\pinball.exe
  • from <SYSTEM32>\dllcache\winhelp.exe.new to <SYSTEM32>\dllcache\winhelp.exe
  • from <SYSTEM32>\dllcache\twunk_32.exe.new to <SYSTEM32>\dllcache\twunk_32.exe
  • from <SYSTEM32>\dllcache\winhlp32.exe.new to <SYSTEM32>\dllcache\winhlp32.exe
  • from %CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe to %CommonProgramFiles%\Microsoft Shared\Speech\bad147
  • from %CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe to %CommonProgramFiles%\Microsoft Shared\MSInfo\bad126
  • from <SYSTEM32>\dllcache\notepad.exe.new to <SYSTEM32>\dllcache\notepad.exe
  • from <SYSTEM32>\dllcache\hh.exe.new to <SYSTEM32>\dllcache\hh.exe
  • from <SYSTEM32>\dllcache\regedit.exe.new to <SYSTEM32>\dllcache\regedit.exe
  • from <SYSTEM32>\dllcache\twunk_16.exe.new to <SYSTEM32>\dllcache\twunk_16.exe
  • from <SYSTEM32>\dllcache\taskman.exe.new to <SYSTEM32>\dllcache\taskman.exe
  • from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\inetwiz.exe to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\bad165
  • from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwtutor.exe to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\bad186
  • from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\isignup.exe to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\bad64
  • from %PROGRAM_FILES%\MSN Gaming Zone\Windows\bckgzm.exe to %PROGRAM_FILES%\MSN Gaming Zone\Windows\bad161
  • from %PROGRAM_FILES%\Movie Maker\moviemk.exe to %PROGRAM_FILES%\Movie Maker\bad193
  • from %PROGRAM_FILES%\Internet Explorer\iexplore.exe to %PROGRAM_FILES%\Internet Explorer\bad163
  • from %PROGRAM_FILES%\Internet Explorer\iedw.exe to %PROGRAM_FILES%\Internet Explorer\bad27
  • from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn1.exe to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\bad106
  • from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwrmind.exe to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\bad196
  • from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn2.exe to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\bad47
  • from <SYSTEM32>\dllcache\pinball.exe.new to <SYSTEM32>\dllcache\pinball.exe
  • from <SYSTEM32>\dllcache\cb32.exe.new to <SYSTEM32>\dllcache\cb32.exe
  • from <SYSTEM32>\dllcache\zclientm.exe.new to <SYSTEM32>\dllcache\zclientm.exe
  • from <SYSTEM32>\dllcache\conf.exe.new to <SYSTEM32>\dllcache\conf.exe
  • from <SYSTEM32>\dllcache\msimn.exe.new to <SYSTEM32>\dllcache\msimn.exe
  • from <SYSTEM32>\dllcache\wb32.exe.new to <SYSTEM32>\dllcache\wb32.exe
  • from <SYSTEM32>\dllcache\chkrzm.exe.new to <SYSTEM32>\dllcache\chkrzm.exe
  • from <SYSTEM32>\dllcache\bckgzm.exe.new to <SYSTEM32>\dllcache\bckgzm.exe
  • from <SYSTEM32>\dllcache\hrtzzm.exe.new to <SYSTEM32>\dllcache\hrtzzm.exe
  • from <SYSTEM32>\dllcache\shvlzm.exe.new to <SYSTEM32>\dllcache\shvlzm.exe
  • from <SYSTEM32>\dllcache\rvsezm.exe.new to <SYSTEM32>\dllcache\rvsezm.exe
  • from <SYSTEM32>\dllcache\setup_wm.exe.new to <SYSTEM32>\dllcache\setup_wm.exe
  • from <SYSTEM32>\dllcache\mplayer2.exe.new to <SYSTEM32>\dllcache\mplayer2.exe
  • from <SYSTEM32>\dllcache\wmplayer.exe.new to <SYSTEM32>\dllcache\wmplayer.exe
  • from <SYSTEM32>\dllcache\wordpad.exe.new to <SYSTEM32>\dllcache\wordpad.exe
  • from <SYSTEM32>\dllcache\dialer.exe.new to <SYSTEM32>\dllcache\dialer.exe
  • from <SYSTEM32>\dllcache\setup50.exe.new to <SYSTEM32>\dllcache\setup50.exe
  • from <SYSTEM32>\dllcache\oemig50.exe.new to <SYSTEM32>\dllcache\oemig50.exe
  • from <SYSTEM32>\dllcache\wab.exe.new to <SYSTEM32>\dllcache\wab.exe
  • from <SYSTEM32>\dllcache\migrate.exe.new to <SYSTEM32>\dllcache\migrate.exe
  • from <SYSTEM32>\dllcache\wabmig.exe.new to <SYSTEM32>\dllcache\wabmig.exe
Network activity:
Connects to:
  • 'www.vi###192.h18.ru':80
TCP:
HTTP GET requests:
  • www.vi###192.h18.ru/1.exe
UDP:
  • DNS ASK www.vi###192.h18.ru
Miscellaneous:
Searches for the following windows:
  • ClassName: 'Shell_TrayWnd' WindowName: ''

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android