Substitutes the following executable system files:
<SYSTEM32>\dllcache\notepad.exe with <SYSTEM32>\dllcache\notepad.exe.new
<SYSTEM32>\dllcache\hh.exe with <SYSTEM32>\dllcache\hh.exe.new
<SYSTEM32>\dllcache\regedit.exe with <SYSTEM32>\dllcache\regedit.exe.new
<SYSTEM32>\dllcache\twunk_32.exe with <SYSTEM32>\dllcache\twunk_32.exe.new
<SYSTEM32>\dllcache\taskman.exe with <SYSTEM32>\dllcache\taskman.exe.new
%WINDIR%\NOTEPAD.EXE with %WINDIR%\notepad.exe.new
%WINDIR%\hh.exe with %WINDIR%\hh.exe.new
%WINDIR%\regedit.exe with %WINDIR%\regedit.exe.new
%WINDIR%\twunk_32.exe with %WINDIR%\twunk_32.exe.new
%WINDIR%\TASKMAN.EXE with %WINDIR%\taskman.exe.new
Modifies file system :
Creates the following files:
%WINDIR%\twunk_16.exe.new
%WINDIR%\twunk_32.exe.new
%WINDIR%\winhelp.exe.new
%WINDIR%\notepad.exe.new
%WINDIR%\regedit.exe.new
%WINDIR%\taskman.exe.new
<SYSTEM32>\dllcache\hh.exe.new
<SYSTEM32>\dllcache\twunk_16.exe.new
<SYSTEM32>\dllcache\twunk_32.exe.new
<SYSTEM32>\dllcache\winhelp.exe.new
<SYSTEM32>\dllcache\notepad.exe.new
<SYSTEM32>\dllcache\regedit.exe.new
<SYSTEM32>\dllcache\taskman.exe.new
%WINDIR%\hh.exe.new
%WINDIR%\explorer.ZMX
%WINDIR%\hh.ZMX
%WINDIR%\NOTEPAD.ZMX
C:\SysBoot.EXE
C:\AUTORUN.INF
%WINDIR%\SYSTRA.EXE
%WINDIR%\regedit.ZMX
%WINDIR%\twunk_16.ZMX
%WINDIR%\twunk_32.ZMX
%WINDIR%\winhelp.ZMX
%WINDIR%\sfk.ZMX
%WINDIR%\sleep.ZMX
%WINDIR%\TASKMAN.ZMX
Sets the 'hidden' attribute to the following files:
%WINDIR%\TASKMAN.ZMX
%WINDIR%\sleep.ZMX
%WINDIR%\sfk.ZMX
%WINDIR%\winhelp.ZMX
%WINDIR%\twunk_32.ZMX
%WINDIR%\twunk_16.ZMX
%WINDIR%\explorer.ZMX
C:\AUTORUN.INF
C:\SysBoot.EXE
%WINDIR%\regedit.ZMX
%WINDIR%\NOTEPAD.ZMX
%WINDIR%\hh.ZMX
Download Dr.Web for Android
Free three-month trial
All protection features available
Renew your trial license in AppGallery/on Google Pay
By continuing to use this website, you are consenting to Doctor Web’s use of cookies and other technologies related to the collection of visitor statistics. Learn more