Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\win.ini
- %WINDIR%\system.ini
Changes the following executable system files:
- %WINDIR%\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\System.Runtime.Remoting.dll
- %WINDIR%\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- %WINDIR%\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\System.Management.dll
- %WINDIR%\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\System.Messaging.dll
- %WINDIR%\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
- %WINDIR%\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- %WINDIR%\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\System.Security.dll
- %WINDIR%\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- %WINDIR%\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Design.dll
- %WINDIR%\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- %WINDIR%\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\System.Data.dll
- %WINDIR%\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\System.Data.OracleClient.dll
- %WINDIR%\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- %WINDIR%\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.Thunk.dll
- %WINDIR%\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.dll
- %WINDIR%\assembly\GAC\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
- %WINDIR%\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
- %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
- %WINDIR%\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll
- %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
- %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
- %WINDIR%\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
- %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
- %WINDIR%\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\System.Printing.dll
- %WINDIR%\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\System.Windows.Forms.dll
- %WINDIR%\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\System.Xml.dll
- %WINDIR%\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
- %WINDIR%\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Services.dll
- %WINDIR%\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll
- %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
- %WINDIR%\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- %WINDIR%\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
- %WINDIR%\assembly\GAC\System.Configuration.Install\1.0.5000.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
- %WINDIR%\$NtUninstallWIC$\spuninst\updspapi.dll
- %WINDIR%\AppPatch\AcLayers.dll
- %WINDIR%\$NtUninstallKB942288-v3$\spuninst\updspapi.dll
- %WINDIR%\$NtUninstallWIC$\spuninst\spuninst.exe
- %WINDIR%\AppPatch\AcXtrnal.dll
- %WINDIR%\assembly\GAC\Accessibility\1.0.5000.0__b03f5f7f11d50a3a\Accessibility.dll
- %WINDIR%\AppPatch\AcLua.dll
- %WINDIR%\AppPatch\AcSpecfc.dll
- %WINDIR%\$NtUninstallKB942288-v3$\msi.dll
- %WINDIR%\$NtUninstallKB942288-v3$\msiexec.exe
- %WINDIR%\twain_32.dll
- %WINDIR%\vmmreg32.dll
- %WINDIR%\$NtUninstallKB942288-v3$\msisip.dll
- %WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.exe
- %WINDIR%\$NtUninstallKB942288-v3$\msihnd.dll
- %WINDIR%\$NtUninstallKB942288-v3$\msimsg.dll
- %WINDIR%\assembly\GAC\Microsoft.Vsa\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- %WINDIR%\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- %WINDIR%\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- %WINDIR%\assembly\GAC\Microsoft.VisualC\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualC.dll
- %WINDIR%\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\RegCode.dll
- %WINDIR%\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
- %WINDIR%\assembly\GAC\Microsoft_VsaVb\7.0.5000.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- %WINDIR%\assembly\GAC\mscorcfg\1.0.5000.0__b03f5f7f11d50a3a\mscorcfg.dll
- %WINDIR%\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\IEExecRemote.dll
- %WINDIR%\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\IEHost.dll
- %WINDIR%\assembly\GAC\cscompmgd\7.0.5000.0__b03f5f7f11d50a3a\cscompmgd.dll
- %WINDIR%\assembly\GAC\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- %WINDIR%\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
- %WINDIR%\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- %WINDIR%\assembly\GAC\IIEHost\1.0.5000.0__b03f5f7f11d50a3a\IIEHost.dll
- %WINDIR%\assembly\GAC\ISymWrapper\1.0.5000.0__b03f5f7f11d50a3a\ISymWrapper.dll
Substitutes the following executable system files:
- %WINDIR%\TASKMAN.EXE with %WINDIR%\TASKMAN.EXE
- %WINDIR%\sleep.exe with %WINDIR%\sleep.exe
- %WINDIR%\winhlp32.exe with %WINDIR%\winhlp32.exe
- %WINDIR%\twunk_32.exe with %WINDIR%\twunk_32.exe
- %WINDIR%\sfk.exe with %WINDIR%\sfk.exe
- %WINDIR%\hh.exe with %WINDIR%\hh.exe
- %WINDIR%\explorer.exe with %WINDIR%\explorer.exe
- %WINDIR%\regedit.exe with %WINDIR%\regedit.exe
- %WINDIR%\NOTEPAD.EXE with %WINDIR%\NOTEPAD.EXE
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Executes the following:
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_SZ /d 1 /f
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\2.bat" <Full path to file>"
Modifies file system:
Creates the following files:
- %WINDIR%\assembly\GAC_MSIL\AspNetMMCExt\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\cscompmgd\<File name>.exe
- %WINDIR%\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\Accessibility\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\IEExecRemote\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Engine\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\IEHost\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\IIEHost\<File name>.exe
- %WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\<File name>.exe
- %WINDIR%\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\<File name>.exe
- %WINDIR%\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\<File name>.exe
- %WINDIR%\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\<File name>.exe
- %WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\<File name>.exe
- %WINDIR%\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\<File name>.exe
- %WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\Microsoft.VisualC\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\Microsoft.Vsa\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\PresentationBuildTasks\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\PresentationCFFRasterizer\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\Microsoft_VsaVb\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Utilities\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Framework\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Tasks\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\Microsoft.JScript\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\<File name>.exe
- <SYSTEM32>\dllcache\apph_sp.sdb.new
- <SYSTEM32>\dllcache\drvmain.sdb.new
- <SYSTEM32>\dllcache\apphelp.sdb.new
- %WINDIR%\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\<File name>.exe
- <SYSTEM32>\dllcache\msimain.sdb.new
- %WINDIR%\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- <SYSTEM32>\dllcache\sysmain.sdb.new
- %WINDIR%\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- <SYSTEM32>\dllcache\aclayers.dll.new
- %WINDIR%\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- <SYSTEM32>\dllcache\acxtrnal.dll.new
- <SYSTEM32>\dllcache\aclua.dll.new
- <SYSTEM32>\dllcache\acspecfc.dll.new
- %WINDIR%\assembly\GAC_32\System.Data\<File name>.exe
- %WINDIR%\assembly\GAC_32\System.Data.OracleClient\<File name>.exe
- %WINDIR%\assembly\GAC_32\mscorlib\<File name>.exe
- %WINDIR%\assembly\GAC_32\PresentationCore\<File name>.exe
- %WINDIR%\assembly\GAC_32\System.EnterpriseServices\<File name>.exe
- %WINDIR%\assembly\GAC_32\System.Web\<File name>.exe
- %WINDIR%\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC_32\System.Printing\<File name>.exe
- %WINDIR%\assembly\GAC_32\System.Transactions\<File name>.exe
- %WINDIR%\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\<File name>.exe
- %WINDIR%\assembly\GAC_32\ISymWrapper\<File name>.exe
- %WINDIR%\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\<File name>.exe
- %WINDIR%\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\<File name>.exe
- %WINDIR%\assembly\GAC_32\CustomMarshalers\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\PresentationFontCache\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.ServiceProcess\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Speech\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.ServiceModel.WasHosting\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.ServiceModel.Web\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Web.Abstractions\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Web.Entity\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Web.Entity.Design\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Web.DynamicData\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Web.DynamicData.Design\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Net\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Runtime.Remoting\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Management.Instrumentation\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Messaging\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Runtime.Serialization\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.ServiceModel\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.ServiceModel.Install\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Security\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.WorkflowServices\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Xml\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Workflow.ComponentModel\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Workflow.Runtime\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Xml.Linq\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\UIAutomationProvider\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\UIAutomationTypes\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\UIAutomationClient\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\UIAutomationClientsideProviders\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Web.Mobile\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Web.RegularExpressions\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Web.Extensions\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Web.Extensions.Design\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Web.Routing\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Windows.Presentation\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Workflow.Activities\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Web.Services\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.AddIn\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.AddIn.Contract\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\sysglobl\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Core\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Data.DataSetExtensions\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Configuration\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Configuration.Install\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\PresentationFramework.Classic\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\PresentationFramework.Luna\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\PresentationFramework\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\PresentationFramework.Aero\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\PresentationFramework.Royale\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\Sentinel.v3.5Client\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\SMDiagnostics\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\PresentationUI\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\ReachFramework\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.DirectoryServices.Protocols\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Drawing\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.DirectoryServices\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Drawing.Design\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.IO.Log\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Management\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.IdentityModel\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.IdentityModel.Selectors\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Data.Linq\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Data.Services\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Data.Entity\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Data.Entity.Design\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Data.Services.Client\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Deployment\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Design\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Data.Services.Design\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\System.Data.SqlXml\<File name>.exe
- %WINDIR%\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\Resources\<File name>.exe
- %WINDIR%\River
- %WINDIR%\Registration\<File name>.exe
- %WINDIR%\repair\<File name>.exe
- %WINDIR%\Santa
- %WINDIR%\SoftwareDistribution\<File name>.exe
- %WINDIR%\srchasst\<File name>.exe
- %WINDIR%\security\<File name>.exe
- %WINDIR%\Soap
- %WINDIR%\Offline
- %WINDIR%\pchealth\<File name>.exe
- %WINDIR%\mui\<File name>.exe
- %WINDIR%\ocx\<File name>.exe
- %WINDIR%\PeerNet\<File name>.exe
- %WINDIR%\Provisioning\<File name>.exe
- %WINDIR%\pss\<File name>.exe
- %WINDIR%\Prairie
- %WINDIR%\Prefetch\<File name>.exe
- %WINDIR%\vmmreg32.dll.new
- %WINDIR%\$NtUninstallWIC$\spuninst\<File name>.exe
- %WINDIR%\twain_32.dll.new
- %WINDIR%\$NtUninstallKB942288-v3$\spuninst\<File name>.exe
- %WINDIR%\assembly\GAC\<File name>.exe
- %WINDIR%\assembly\NativeImages1_v1.1.4322\<File name>.exe
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\<File name>.exe
- %WINDIR%\assembly\GAC_32\<File name>.exe
- %WINDIR%\assembly\GAC_MSIL\<File name>.exe
- <ANALYSE_DIR>\<File name>.exe
- %WINDIR%\Temp\<File name>.exe
- %WINDIR%\system\<File name>.exe
- <SYSTEM32>\<File name>.exe
- %WINDIR%\twain_32\<File name>.exe
- %WINDIR%\XXInstall\<File name>.exe
- %WINDIR%\twain.dll.new
- %WINDIR%\Web\<File name>.exe
- %WINDIR%\WinSxS\<File name>.exe
- <SYSTEM32>\dllcache\taskman.exe.new
- <SYSTEM32>\dllcache\hh.exe.new
- %WINDIR%\winhlp32.exe.new
- <SYSTEM32>\dllcache\notepad.exe.new
- <SYSTEM32>\dllcache\regedit.exe.new
- <SYSTEM32>\dllcache\winhelp.exe.new
- <SYSTEM32>\dllcache\winhlp32.exe.new
- <SYSTEM32>\dllcache\twunk_16.exe.new
- <SYSTEM32>\dllcache\twunk_32.exe.new
- %WINDIR%\notepad.exe.new
- %WINDIR%\taskman.exe.new
- %TEMP%\1.tmp\2.bat
- %WINDIR%\PathHost
- %WINDIR%\hh.exe.new
- %WINDIR%\twunk_32.exe.new
- %WINDIR%\winhelp.exe.new
- %WINDIR%\regedit.exe.new
- %WINDIR%\twunk_16.exe.new
- %WINDIR%\Help\<File name>.exe
- %WINDIR%\ime\<File name>.exe
- %WINDIR%\ehome\<File name>.exe
- %WINDIR%\Gone
- %WINDIR%\java\<File name>.exe
- %WINDIR%\msagent\<File name>.exe
- %WINDIR%\msapps\<File name>.exe
- %WINDIR%\Media\<File name>.exe
- %WINDIR%\Microsoft.NET\<File name>.exe
- %WINDIR%\Blue
- %WINDIR%\Coffee
- %WINDIR%\addins\<File name>.exe
- %WINDIR%\AppPatch\<File name>.exe
- %WINDIR%\Config\<File name>.exe
- %WINDIR%\Debug\<File name>.exe
- %WINDIR%\Driver
- %WINDIR%\Connection
- %WINDIR%\Cursors\<File name>.exe
- %WINDIR%\assembly\NativeImages_v4.0.30319_32\<File name>.exe
- %WINDIR%\AppPatch\aclua.dll.new
- %WINDIR%\AppPatch\acspecfc.dll.new
- %WINDIR%\AppPatch\aclayers.dll.new
- %WINDIR%\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\AppPatch\acxtrnal.dll.new
- %WINDIR%\AppPatch\apph_sp.sdb.new
- %WINDIR%\AppPatch\drvmain.sdb.new
- %WINDIR%\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\AppPatch\apphelp.sdb.new
- <SYSTEM32>\dllcache\twain.dll.new
- %WINDIR%\assembly\GAC\System.Xml\<File name>.exe
- %WINDIR%\assembly\GAC\System.Web.Services\<File name>.exe
- %WINDIR%\assembly\GAC\System.Windows.Forms\<File name>.exe
- %WINDIR%\assembly\GAC\Accessibility\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- <SYSTEM32>\dllcache\vmmreg32.dll.new
- %WINDIR%\assembly\GAC\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- <SYSTEM32>\dllcache\twain_32.dll.new
- %WINDIR%\assembly\GAC\cscompmgd\7.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC\mscorcfg\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\7.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC\Microsoft_VsaVb\7.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\<File name>.exe
- %WINDIR%\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\<File name>.exe
- %WINDIR%\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC\System.Configuration.Install\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\<File name>.exe
- %WINDIR%\assembly\GAC\ISymWrapper\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\AppPatch\sysmain.sdb.new
- %WINDIR%\assembly\GAC\IIEHost\1.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\AppPatch\msimain.sdb.new
- %WINDIR%\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC\Microsoft.VisualC\7.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC\Microsoft.Vsa\7.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.5000.0__b03f5f7f11d50a3a\<File name>.exe
- %WINDIR%\assembly\GAC\Microsoft.VisualBasic.Vsa\<File name>.exe
- %WINDIR%\assembly\GAC\Microsoft.VisualC\<File name>.exe
- %WINDIR%\assembly\GAC\Microsoft.JScript\<File name>.exe
- %WINDIR%\assembly\GAC\Microsoft.VisualBasic\<File name>.exe
- %WINDIR%\assembly\GAC\Microsoft.Vsa\<File name>.exe
- %WINDIR%\assembly\GAC\mscorcfg\<File name>.exe
- %WINDIR%\assembly\GAC\Regcode\<File name>.exe
- %WINDIR%\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\<File name>.exe
- %WINDIR%\assembly\GAC\Microsoft_VsaVb\<File name>.exe
- %WINDIR%\assembly\GAC\Accessibility\<File name>.exe
- %WINDIR%\assembly\GAC\cscompmgd\<File name>.exe
- %WINDIR%\assembly\temp\<File name>.exe
- %WINDIR%\assembly\tmp\<File name>.exe
- %WINDIR%\assembly\GAC\CustomMarshalers\<File name>.exe
- %WINDIR%\assembly\GAC\IIEHost\<File name>.exe
- %WINDIR%\assembly\GAC\ISymWrapper\<File name>.exe
- %WINDIR%\assembly\GAC\IEExecRemote\<File name>.exe
- %WINDIR%\assembly\GAC\IEHost\<File name>.exe
- %WINDIR%\assembly\GAC\System.Runtime.Remoting\<File name>.exe
- %WINDIR%\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\<File name>.exe
- %WINDIR%\assembly\GAC\System.Management\<File name>.exe
- %WINDIR%\assembly\GAC\System.Messaging\<File name>.exe
- %WINDIR%\assembly\GAC\System.Security\<File name>.exe
- %WINDIR%\assembly\GAC\System.Web.Mobile\<File name>.exe
- %WINDIR%\assembly\GAC\System.Web.RegularExpressions\<File name>.exe
- %WINDIR%\assembly\GAC\System.ServiceProcess\<File name>.exe
- %WINDIR%\assembly\GAC\System.Web\<File name>.exe
- %WINDIR%\assembly\GAC\System.Data\<File name>.exe
- %WINDIR%\assembly\GAC\System.Data.OracleClient\<File name>.exe
- %WINDIR%\assembly\GAC\System\<File name>.exe
- %WINDIR%\assembly\GAC\System.Configuration.Install\<File name>.exe
- %WINDIR%\assembly\GAC\System.Design\<File name>.exe
- %WINDIR%\assembly\GAC\System.Drawing.Design\<File name>.exe
- %WINDIR%\assembly\GAC\System.EnterpriseServices\<File name>.exe
- %WINDIR%\assembly\GAC\System.DirectoryServices\<File name>.exe
- %WINDIR%\assembly\GAC\System.Drawing\<File name>.exe
Moves the following system files:
- from %WINDIR%\setuplog.txt to %WINDIR%\setuplog.exe
- from %WINDIR%\OEWABLog.txt to %WINDIR%\OEWABLog.exe