Technical Information
- %TEMP%\RarSFX0\cfg\hwdect1.dat
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\508-d5118bf9-5992a293-ab.ich
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\416-e6c18963-5992a2a1-119.ich
- %TEMP%\RarSFX0\config.ini
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\3-fd3c6fd8-5992a292-da.ich
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\3-fd3c6fd8-5992a292-271.ich
- %TEMP%\RarSFX0\ksoft\KInfocCommon.dat
- [<HKLM>\SYSTEM\ControlSet001\Services\wdcservice] 'ImagePath' = '%TEMP%\RarSFX0\wdcservice.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\wdcservice] 'Start' = '00000002'
- '%TEMP%\RarSFX0\wdcservice.exe' /run
- '%TEMP%\RarSFX0\wdcservice.exe'
- '%TEMP%\RarSFX0\WiseDriverCare.exe'
- '%TEMP%\RarSFX0\wdcservice.exe' /Service
- '<SYSTEM32>\locator.exe'
- %TEMP%\RarSFX0\res\string_NL_NL.xml
- %TEMP%\RarSFX0\res\string_PL_PL.xml
- %TEMP%\RarSFX0\res\string_KO_KR.xml
- %TEMP%\RarSFX0\res\string_HU_HU.xml
- %TEMP%\RarSFX0\res\string_IT_IT.xml
- %TEMP%\RarSFX0\res\string_SL_SI.xml
- %TEMP%\RarSFX0\res\string_SV_SE.xml
- %TEMP%\RarSFX0\res\string_RU_RU.xml
- %TEMP%\RarSFX0\res\string_PT_BR.xml
- %TEMP%\RarSFX0\res\string_PT_PT.xml
- %TEMP%\RarSFX0\res\string_DA_DK.xml
- %TEMP%\RarSFX0\res\string_DE_DE.xml
- %TEMP%\RarSFX0\res\string_CA_ES.xml
- %TEMP%\RarSFX0\ksoft\msvcr80.dll
- %TEMP%\RarSFX0\res\string.xml
- %TEMP%\RarSFX0\res\string_FI_FI.xml
- %TEMP%\RarSFX0\res\string_FR_FR.xml
- %TEMP%\RarSFX0\res\string_ES_ES.xml
- %TEMP%\RarSFX0\res\string_EL_GR.xml
- %TEMP%\RarSFX0\res\string_EN_US.xml
- %TEMP%\RarSFX0\res\string_TR_TR.xml
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\29FDI4GE\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\C8IJ284W\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\SPP1UL11\desktop.ini
- %TEMP%\RarSFX0\cfg\dectcomp.dat
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\index.dat
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\365-35cffff-5992a284-157.ich
- %TEMP%\RarSFX0\cfg\hdinfo.ini
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\OPARST6R\desktop.ini
- C:\Documents and Settings\NetworkService\Cookies\index.dat
- %TEMP%\RarSFX0\7z.exe
- %TEMP%\RarSFX0\cactus.dll
- %TEMP%\RarSFX0\7z.dll
- %TEMP%\RarSFX0\res\string_UK_UA.xml
- %TEMP%\RarSFX0\res\string_ZH_CN.xml
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\416-a8f0e92a-5992a25b-38a.ich
- %ALLUSERSPROFILE%\Application Data\Kingsoft\KIS\kich7\416-d89759b-5992a25b-1f.ich
- %TEMP%\RarSFX0\cfg\u.ini
- %TEMP%\RarSFX0\dgqsc.dll
- %TEMP%\RarSFX0\config.ini
- %TEMP%\RarSFX0\ksoft\msvcp80.dll
- %TEMP%\RarSFX0\pnpsup.dll
- %TEMP%\RarSFX0\readme.txt
- %TEMP%\RarSFX0\patchcore.dll
- %TEMP%\RarSFX0\NetHelper.exe
- %TEMP%\RarSFX0\nic.db
- %TEMP%\RarSFX0\tinyxml.dll
- %TEMP%\RarSFX0\uplive.svr
- %TEMP%\RarSFX0\support.dll
- %TEMP%\RarSFX0\soundtool.exe
- %TEMP%\RarSFX0\sqlite3.dll
- %TEMP%\RarSFX0\kszzdl.dll
- %TEMP%\RarSFX0\libcurl.dll
- %TEMP%\RarSFX0\duilib.dll
- %TEMP%\RarSFX0\archnet.url
- %TEMP%\RarSFX0\drvinst64.exe
- %TEMP%\RarSFX0\msvcp80.dll
- %TEMP%\RarSFX0\msvcr80.dll
- %TEMP%\RarSFX0\microsoft.vc80.mfc.manifest
- %TEMP%\RarSFX0\License.txt
- %TEMP%\RarSFX0\microsoft.vc80.crt.manifest
- %TEMP%\RarSFX0\wdcbase.dll
- %TEMP%\RarSFX0\data\EnglishUpdatePao.zip
- %TEMP%\RarSFX0\data\systemdrv.dat
- %TEMP%\RarSFX0\zlib.dll
- %TEMP%\RarSFX0\wdcver.dll
- %TEMP%\RarSFX0\WiseDriverCare.exe
- %TEMP%\RarSFX0\ksoft\microsoft.vc80.crt.manifest
- %TEMP%\RarSFX0\ksoft\microsoft.vc80.mfc.manifest
- %TEMP%\RarSFX0\ksoft\kinfoc.dll
- %TEMP%\RarSFX0\ksoft\kctrl.dat
- %TEMP%\RarSFX0\ksoft\kfmt.dat
- %TEMP%\RarSFX0\wdchelper.dll
- %TEMP%\RarSFX0\wdcpatchcore.dll
- %TEMP%\RarSFX0\wdcctrl.dll
- %TEMP%\RarSFX0\wdccomponent.dll
- %TEMP%\RarSFX0\wdccore.dll
- %TEMP%\RarSFX0\wdcservice.exe
- %TEMP%\RarSFX0\wdcupdate.exe
- %TEMP%\RarSFX0\wdcres.dll
- %TEMP%\RarSFX0\wdcpnp.exe
- %TEMP%\RarSFX0\wdcpnpsup.dll
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\C8IJ284W\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\OPARST6R\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\SPP1UL11\desktop.ini
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\29FDI4GE\desktop.ini
- 'www.wi###leaner.net':80
- '12#.#25.114.144':80
- http://www.wi###leaner.net/wisecleaner_feedback/index.php?to#################################################################
- http://www.ba##u.com/ via 12#.#25.114.144
- DNS ASK li#######e51.drivergenius.com
- DNS ASK li#######e6.drivergenius.com
- DNS ASK in###2.duba.net
- DNS ASK li#######e8.drivergenius.com
- DNS ASK www.ba##u.com
- DNS ASK www.wi###leaner.net
- DNS ASK li#######e5.drivergenius.com
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: 'FolderView'
- ClassName: 'Progman' WindowName: 'Program Manager'
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''