Trojan.DownLoader25.63324

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\M2.Skin\shell\open\command] '' = '"%ProgramFiles%\Maxthon2\Maxthon.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\Max2.Association.HTML\shell\open\command] '' = '"%ProgramFiles%\Maxthon2\Maxthon.exe" "%1"'
[<HKLM>\SOFTWARE\Clients\StartMenuInternet\Maxthon2\Shell\open\command] '' = '%ProgramFiles%\Maxthon2\Maxthon.exe'
[<HKLM>\SOFTWARE\Classes\M2.Plugin\shell\open\command] '' = '"%ProgramFiles%\Maxthon2\Maxthon.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\M2.Filter\shell\open\command] '' = '"%ProgramFiles%\Maxthon2\Maxthon.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\M2.Language\shell\open\command] '' = '"%ProgramFiles%\Maxthon2\Maxthon.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\M2.Layout\shell\open\command] '' = '"%ProgramFiles%\Maxthon2\Maxthon.exe" "%1"'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\Kingsoft Antivirus WebShield Service] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\Kingsoft Antivirus WebShield Service] 'ImagePath' = '%ProgramFiles%\Maxthon2\Modules\MxKWS\KSWebShield.exe'

Malicious functions:

Creates and executes the following:

'%ProgramFiles%\Maxthon2\Modules\MxKWS\kwstray.exe' /install
'%ProgramFiles%\Maxthon2\Modules\MxKWS\kwsmain.exe' /install
'%ProgramFiles%\Maxthon2\Modules\MxKWS\KSWebShield.exe' -install
'%TEMP%\nsx3.tmp\install_data\MxInstall.exe' "/S "
'%ProgramFiles%\Maxthon2\Maxthon.exe' -SetDefault
'%ProgramFiles%\Maxthon2\Modules\MxKWS\kwsinst.exe' /s /i /vt 6 /mchnl 6 /schnl 0

Modifies file system:

Creates the following files:

%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\icob3_hover.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\icob3_normal.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\jiankong_bg.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\icob3_down.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\icob2_down.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\icob2_hover.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\icob2_normal.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\mingdan_normal.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\mingdan_on.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\rz_table_bg.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\mingdan_hover.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\jiankong_hover.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\jiankong_normal.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\jiankong_on.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\chakan_on.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\fankui_hover.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\fankui_normal.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\chakan_normal.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\button03_hover.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\button03_normal.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\chakan_hover.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\icob1_down.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\icob1_hover.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\icob1_normal.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\go_normal.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\fengxian.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\go_down.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\go_hover.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\add.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\addbl.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\base\bg_btn.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\replace\div_bg.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\option\option_bg.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\replace\bg_replace.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\replace\btn.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\base\bg_input_btn.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\base\bg_input_btn_hover.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\base\bg_input_text.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\base\bg_header.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\base\bg_btn_active.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\base\bg_btn_bg.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\base\bg_btn_hover.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\shezhi_ico02.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\shezhi_normal.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\shezhi_on.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\shezhi_hover.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\rz_table_line.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\shezhi_12.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\shezhi_12_2.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\wd_bg_bata.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\newtip\Tooltipbackimage.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\newtip\TooltipIcon.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\table_button_right.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\shezhi_table_bj.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\table_button_left.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\table_button_middle.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\button03_down.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\Update.CFG
%ProgramFiles%\Maxthon2\Modules\MxKWS\ver.dat
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\Icon\bfbg.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\kxestat.dll
%ProgramFiles%\Maxthon2\Modules\MxKWS\kwsui.dll
%ProgramFiles%\Maxthon2\Modules\MxKWS\KWSUpd.exe
%ProgramFiles%\Maxthon2\Modules\MxKWS\KWSUpreport.exe
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\Icon\kws_Adult.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\Icon\kws_Adult_no.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\Icon\kws_danger.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\Icon\CommentBt.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\Icon\BfSet.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\Icon\bg.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\Icon\CommentBg.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\KSWebShield.exe
%ProgramFiles%\Maxthon2\Modules\MxKWS\kuientry.dll
%ProgramFiles%\Maxthon2\Modules\MxKWS\kws.ini
%ProgramFiles%\Maxthon2\Modules\MxKWS\kswebshield.dll
%ProgramFiles%\Maxthon2\Modules\MxKWS\kavifr.dll
%ProgramFiles%\Maxthon2\Modules\MxKWS\ksais.dat
%ProgramFiles%\Maxthon2\Modules\MxKWS\KSWBC.dll
%ProgramFiles%\Maxthon2\Modules\MxKWS\kwssp.dll
%ProgramFiles%\Maxthon2\Modules\MxKWS\kwstray.exe
%ProgramFiles%\Maxthon2\Modules\MxKWS\kwsu.dat
%ProgramFiles%\Maxthon2\Modules\MxKWS\KWSReUpd.exe
%ProgramFiles%\Maxthon2\Modules\MxKWS\kwsinst.exe
%ProgramFiles%\Maxthon2\Modules\MxKWS\kwsmain.exe
%ProgramFiles%\Maxthon2\Modules\MxKWS\kwspop.dll
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\alert\ico1.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\alert\ico2.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\alert\logo.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\alert\close_normal.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\alert\btn_normal.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\alert\close_down.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\alert\close_hover.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\button02_down.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\button02_hover.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\button02_normal.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\button01_normal.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\anquan.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\button01_down.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\index\button01_hover.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\Icon\kws_unknown_no.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\about.html
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\alert.html
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\Icon\kws_unknown.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\Icon\kws_danger_no.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\Icon\kws_safe.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\Icon\kws_safe_no.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\alert\btn_disabled.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\alert\btn_down.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\alert\btn_hover.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\alert\bg.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\feedback.html
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\about\about_wd.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\about\button.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\base\bg_input_text_hover.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\orange\submit_hover.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\orange\submit_normal.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\red\bg.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\orange\submit_down.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\orange\del_down.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\orange\del_hover.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\orange\del_normal.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\red\close_hover.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\red\close_normal.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\red\del_down.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\red\close_down.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\red\cancel _down.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\red\cancel _hover.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\red\cancel _normal.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\green\submit_down.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\green\submit_hover.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\green\submit_normal.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\green\close_normal.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\green\bg.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\green\close_down.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\green\close_hover.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\orange\close_down.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\orange\close_hover.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\orange\close_normal.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\orange\cancel_normal.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\orange\bg.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\orange\cancel_down.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\orange\cancel_hover.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\public\lib\jquery.js
%ALLUSERSPROFILE%\Application Data\kingsoft\kws\kws.ini
%ALLUSERSPROFILE%\Desktop\Maxthon2.lnk.tmp
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\public\js\kajax.js
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\popo9.htm
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\public\css\common.css
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\public\js\common.js
%ALLUSERSPROFILE%\Start Menu\Programs\Maxthon2\卸载傲游金山网盾.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Maxthon2.lnk
%ProgramFiles%\Maxthon2\Modules\MxKWS\KWSSVC.log
%ALLUSERSPROFILE%\Start Menu\Programs\Maxthon2\Uninstall.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Maxthon2\Maxthon2.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Maxthon2\Maxthon2(SafeMode).lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Maxthon2\EnableLog.lnk
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\red\submit_normal.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\index.htm
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\js\main\js_loader.js
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\red\submit_hover.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\red\del_hover.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\red\del_normal.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\images\red\submit_down.jpg
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\popo6.htm
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\popo7.htm
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\popo8.htm
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\popo2.htm
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\js\main\kwebapp.js
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\popo0.htm
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\popo1.htm
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\css\popo.css
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\open.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\self_prot_prog.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\self_prot_prog_2.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\logo.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\close.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\icon.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\line.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\js\feedback\js_loader.js
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\js\feedback\kwebapp.js
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\js\index\call_back.js
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\js\alert\kwebapp.js
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\warn.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\js\about\js_loader.js
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\js\alert\js_loader.js
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\bg_input_btn.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\bg_input_btn_hover.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\bg_input_text.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\base_set_2.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\base\bg_mid.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\base\bg_shadow.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\base_set.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\btn_close.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\btn_hide_sidebar.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\btn_show_sidebar.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\btn_check_checked.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\bg_input_text_hover.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\btn_apply.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\images\set\btn_check.png
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\set.htm
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\style\about.css
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\style\alert.css
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\replace.htm
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\main.htm
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\newtip.htm
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\option.html
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\style\replace.css
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\style\set.css
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\popo\css\main.css
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\style\option.css
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\style\feedback.css
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\style\index\index.css
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\style\newtip.css
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\js\option\call_back.js
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\js\option\js_loader.js
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\js\option\kwebapp.js
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\js\newtip\newtip.pack.js
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\js\index\getnews.js
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\js\index\js_loader.js
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\js\index\kwebapp.js
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\kwsad\ad_wd.gif
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\kwsad\kwsad.html
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\kwsad\wsad.html
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\js\set\kwebapp.js
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\js\replace\js_loader.js
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\js\replace\kwebapp.js
%ProgramFiles%\Maxthon2\Modules\MxKWS\webui\kwebshield\js\set\js_loader.js
%ProgramFiles%\Maxthon2\template\Options\images\page_nav.png
%ProgramFiles%\Maxthon2\template\Options\images\page_plugin.png
%ProgramFiles%\Maxthon2\template\Options\images\page_safety.png
%ProgramFiles%\Maxthon2\template\Options\images\page_mouse.png
%ProgramFiles%\Maxthon2\template\Options\images\page_general.png
%ProgramFiles%\Maxthon2\template\Options\images\page_key.png
%ProgramFiles%\Maxthon2\template\Options\images\page_kwfw.png
%ProgramFiles%\Maxthon2\template\Options\images\page_tab.png
%ProgramFiles%\Maxthon2\template\Options\index.htm
%ProgramFiles%\Maxthon2\template\Options\maxOptions.config.js
%ProgramFiles%\Maxthon2\template\Options\images\page_startup.png
%ProgramFiles%\Maxthon2\template\Options\images\page_sandbox.png
%ProgramFiles%\Maxthon2\template\Options\images\page_search.png
%ProgramFiles%\Maxthon2\template\Options\images\page_skin.png
%ProgramFiles%\Maxthon2\template\Options\images\defcon_low.png
%ProgramFiles%\Maxthon2\template\Options\images\defcon_med.png
%ProgramFiles%\Maxthon2\template\Options\images\page_adhunter.png
%ProgramFiles%\Maxthon2\template\Options\images\defcon_high.png
%ProgramFiles%\Maxthon2\template\History\maxHistory.js
%ProgramFiles%\Maxthon2\template\Options\css\arrow.png
%ProgramFiles%\Maxthon2\template\Options\css\bg_sidebar.png
%ProgramFiles%\Maxthon2\template\Options\images\page_filter.png
%ProgramFiles%\Maxthon2\template\Options\images\page_floatbutton.png
%ProgramFiles%\Maxthon2\template\Options\images\page_form.png
%ProgramFiles%\Maxthon2\template\Options\images\page_feed.png
%ProgramFiles%\Maxthon2\template\Options\images\page_advanced.png
%ProgramFiles%\Maxthon2\template\Options\images\page_download.png
%ProgramFiles%\Maxthon2\template\Options\images\page_fav.png
%ProgramFiles%\Maxthon2\template\page\404\js\error.js
%ProgramFiles%\Maxthon2\template\page\PrivacyMode\images\blank.gif
%ProgramFiles%\Maxthon2\template\page\PrivacyMode\images\iepngfix.htc
%ProgramFiles%\Maxthon2\template\page\404\images\searchBg.jpg
%ProgramFiles%\Maxthon2\template\page\404\images\otherHeadBg.jpg
%ProgramFiles%\Maxthon2\template\page\404\images\otherHeadBgRepeat.jpg
%ProgramFiles%\Maxthon2\template\page\404\images\point.gif
%ProgramFiles%\Maxthon2\template\page\PrivacyMode\privacy.html
%ProgramFiles%\Maxthon2\template\page\PrivacyMode\privacy.js
%ProgramFiles%\Maxthon2\template\page\unsafe\images\arrow.png
%ProgramFiles%\Maxthon2\template\page\PrivacyMode\images\point.gif
%ProgramFiles%\Maxthon2\template\page\PrivacyMode\images\innerBg.jpg
%ProgramFiles%\Maxthon2\template\page\PrivacyMode\images\logo.png
%ProgramFiles%\Maxthon2\template\page\PrivacyMode\images\pageBg.jpg
%ProgramFiles%\Maxthon2\template\page\404\images\blank.gif
%ProgramFiles%\Maxthon2\template\page\404\images\colFooter.gif
%ProgramFiles%\Maxthon2\template\page\404\images\expFooter.gif
%ProgramFiles%\Maxthon2\template\page\404\css\css.css
%ProgramFiles%\Maxthon2\template\Options\maxOptions.css
%ProgramFiles%\Maxthon2\template\Options\maxOptions.js
%ProgramFiles%\Maxthon2\template\page\404\404.html
%ProgramFiles%\Maxthon2\template\page\404\images\inputBg.jpg
%ProgramFiles%\Maxthon2\template\page\404\images\listStyle.gif
%ProgramFiles%\Maxthon2\template\page\404\images\otherError.jpg
%ProgramFiles%\Maxthon2\template\page\404\images\headBgRepeat.jpg
%ProgramFiles%\Maxthon2\template\page\404\images\favicon.ico
%ProgramFiles%\Maxthon2\template\page\404\images\footerLogo.jpg
%ProgramFiles%\Maxthon2\template\page\404\images\headBg.jpg
%ProgramFiles%\Maxthon2\template\History\maxHistory.css
%ProgramFiles%\Maxthon2\Temp\MxUrlSec\mx_safe_all.list
%ProgramFiles%\Maxthon2\Temp\MxUrlSec\mx_safe_sub.list
%ProgramFiles%\Maxthon2\Temp\MxUrlSec\old_black.list
%ProgramFiles%\Maxthon2\Temp\MxUrlSec\config.ini
%ProgramFiles%\Maxthon2\Temp\AList.xml
%ProgramFiles%\Maxthon2\Temp\MxUrlSec\alipay.list
%ProgramFiles%\Maxthon2\Temp\MxUrlSec\cnnic.list
%ProgramFiles%\Maxthon2\Temp\PList.xml
%ProgramFiles%\Maxthon2\Temp\sdurl.dat
%ProgramFiles%\Maxthon2\Temp\SList.xml
%ProgramFiles%\Maxthon2\Temp\NList.xml
%ProgramFiles%\Maxthon2\Temp\MxUrlSec\taobao.list
%ProgramFiles%\Maxthon2\Temp\MxUrlSec\youa.list
%ProgramFiles%\Maxthon2\Temp\MxVideoPopup\videoUrlRules.ini
%ProgramFiles%\Maxthon2\Default\config\ProxyConfig.xml
%ProgramFiles%\Maxthon2\Default\config\SiteList.xml
%ProgramFiles%\Maxthon2\Default\config\System.dat
%ProgramFiles%\Maxthon2\Default\config\MFA2.dat
%TEMP%\nsx2.tmp
%ProgramFiles%\Maxthon2\Default\config\Config.ini
%ProgramFiles%\Maxthon2\Default\config\dmgr.ini
%ProgramFiles%\Maxthon2\Plugin\AddToKaixin001\plugin.ini
%ProgramFiles%\Maxthon2\Plugin\ІејюЦЖЧчОДµµ.url
%ProgramFiles%\Maxthon2\Skin\Ж¤·фЦЖЧчОДµµ.url
%ProgramFiles%\Maxthon2\Plugin\AddToKaixin001\out.ico
%ProgramFiles%\Maxthon2\Default\Filter\template.xml
%ProgramFiles%\Maxthon2\Default\Filter\template0x0804.xml
%ProgramFiles%\Maxthon2\Plugin\AddToKaixin001\AddToKaixin001.htm
%ProgramFiles%\Maxthon2\template\History\images\arrow.png
%ProgramFiles%\Maxthon2\template\History\images\calendar.png
%ProgramFiles%\Maxthon2\template\History\images\delete.png
%ProgramFiles%\Maxthon2\template\History\images\add.png
%ProgramFiles%\Maxthon2\template\FeedView\feed.xsl
%ProgramFiles%\Maxthon2\template\FeedView\images\feed.png
%ProgramFiles%\Maxthon2\template\FeedView\images\go_top.png
%ProgramFiles%\Maxthon2\template\History\images\search.png
%ProgramFiles%\Maxthon2\template\History\images\website.png
%ProgramFiles%\Maxthon2\template\History\index.htm
%ProgramFiles%\Maxthon2\template\History\images\page.png
%ProgramFiles%\Maxthon2\template\History\images\feed.png
%ProgramFiles%\Maxthon2\template\History\images\keyword.png
%ProgramFiles%\Maxthon2\template\History\images\logo.png
%ProgramFiles%\Maxthon2\template\Download\images\pause.png
%ProgramFiles%\Maxthon2\template\Download\images\reset.png
%ProgramFiles%\Maxthon2\template\Download\images\run.png
%ProgramFiles%\Maxthon2\template\Download\images\logo.png
%ProgramFiles%\Maxthon2\template\Download\images\check.png
%ProgramFiles%\Maxthon2\template\Download\images\done.png
%ProgramFiles%\Maxthon2\template\Download\images\error.png
%ProgramFiles%\Maxthon2\template\Download\maxDownload.js
%ProgramFiles%\Maxthon2\template\FeedView\feed.css
%ProgramFiles%\Maxthon2\template\FeedView\feed.js
%ProgramFiles%\Maxthon2\template\Download\maxDownload.css
%ProgramFiles%\Maxthon2\template\Download\images\search.png
%ProgramFiles%\Maxthon2\template\Download\images\stop.png
%ProgramFiles%\Maxthon2\template\Download\index.htm
%ProgramFiles%\Maxthon2\template\page\unsafe\images\arrowBG.png
%ProgramFiles%\Maxthon2\Modules\MxDownloader\TaskManager.dll
%ProgramFiles%\Maxthon2\Modules\MxHistory\MxHistory.dll
%ProgramFiles%\Maxthon2\Modules\MxMute\MxMute.dll
%ProgramFiles%\Maxthon2\Modules\MxDownloader\MxDownloadServer.exe
%ProgramFiles%\Maxthon2\Modules\MxCapScr\MxCapScr.dll
%ProgramFiles%\Maxthon2\Modules\MxDownloader\asyn_dns.dll
%ProgramFiles%\Maxthon2\Modules\MxDownloader\download_interface.dll
%ProgramFiles%\Maxthon2\Modules\MxSpeedDial\default.zip
%ProgramFiles%\Maxthon2\Modules\MxSpeedDial\MxIeCore.dll
%ProgramFiles%\Maxthon2\Modules\MxSpeedDial\MxSpeedDial.dll
%ProgramFiles%\Maxthon2\Modules\MxSpeedDial\0x0804.zip
%ProgramFiles%\Maxthon2\Modules\MxPageSearch\MxPageSearch.dll
%ProgramFiles%\Maxthon2\Modules\MxSandBox\MxSandBox.zip
%ProgramFiles%\Maxthon2\Modules\MxSandBox\MxSec.dll
%ProgramFiles%\Maxthon2\template\_shared\js\maxTable.js
%ProgramFiles%\Maxthon2\template\_shared\js\maxXmlListParser.js
%ProgramFiles%\Maxthon2\Language\Chinese\language.ini
%ProgramFiles%\Maxthon2\template\_shared\js\maxList.js
%ProgramFiles%\Maxthon2\template\_shared\js\func.js
%ProgramFiles%\Maxthon2\template\_shared\js\maxAjaxManager.js
%ProgramFiles%\Maxthon2\template\_shared\js\maxConfig.js
%ProgramFiles%\Maxthon2\Favicons\EABCDIFOCHACFPCDFLAAGBBDCO.ico
%ProgramFiles%\Maxthon2\Favicons\EABCDIFOHBFOADHNAEELCMBPCN.ico
%ProgramFiles%\Maxthon2\Favicons\FOELCCBBDIBJFICLFJELCMBO.ico
%ProgramFiles%\Maxthon2\Favicons\EABCDIFOCCAMFJCAECELCMBPCN.ico
%ProgramFiles%\Maxthon2\Language\English\Language.ini
%ProgramFiles%\Maxthon2\Language\InstallLang\en.ini
%ProgramFiles%\Maxthon2\Language\InstallLang\zh-cn.ini
%ProgramFiles%\Maxthon2\MxFav.dll
%ProgramFiles%\Maxthon2\MxHttpRq.dll
%ProgramFiles%\Maxthon2\mxpp.dll
%ProgramFiles%\Maxthon2\mxdb.dll
%ProgramFiles%\Maxthon2\MxAccount.dll
%ProgramFiles%\Maxthon2\MxCrashCatch.dll
%ProgramFiles%\Maxthon2\MxCrashReport.exe
%ProgramFiles%\Maxthon2\MxUeip.dll
%ProgramFiles%\Maxthon2\MxUI.dll
%ProgramFiles%\Maxthon2\Modules\MxKWS\index.dat
%ProgramFiles%\Maxthon2\mxtool2.dll
%ProgramFiles%\Maxthon2\MxProxy2.dll
%ProgramFiles%\Maxthon2\MxSk.dll
%ProgramFiles%\Maxthon2\mxtool.dll
%ProgramFiles%\Maxthon2\Modules\MxWin7\MxW7Wg.dll
%ProgramFiles%\Maxthon2\enablelog.reg
%ProgramFiles%\Maxthon2\http.DefaultIcon.imp
%ProgramFiles%\Maxthon2\Modules\MxWebBoost\MxWebBoost.dll
%ProgramFiles%\Maxthon2\Modules\MxUpdate\MxUp.exe
%ProgramFiles%\Maxthon2\Modules\MxUrlSec\mxurlsec.dll
%ProgramFiles%\Maxthon2\Modules\MxVideoPopup\MxVideoPopup.dll
%ProgramFiles%\Maxthon2\Maxthon.exe
%ProgramFiles%\Maxthon2\maxzlib.dll
%ProgramFiles%\Maxthon2\Mx2UnInstall.exe
%ProgramFiles%\Maxthon2\License_cn.txt
%ProgramFiles%\Maxthon2\http.shell.imp
%ProgramFiles%\Maxthon2\https.DefaultIcon.imp
%ProgramFiles%\Maxthon2\https.shell.imp
%ProgramFiles%\Maxthon2\template\_shared\images\prev.png
%ProgramFiles%\Maxthon2\template\_shared\css\base\bg_btn_active.png
%ProgramFiles%\Maxthon2\template\_shared\css\base\bg_btn_hover.png
%ProgramFiles%\Maxthon2\template\_shared\css\base\bg_header.png
%ProgramFiles%\Maxthon2\template\_shared\css\base\bg_btn.png
%ProgramFiles%\Maxthon2\template\ui\pop_siteinfo\images\s.png
%ProgramFiles%\Maxthon2\template\ui\pop_siteinfo\index.htm
%ProgramFiles%\Maxthon2\template\ui\pop_siteinfo\style.css
%ProgramFiles%\Maxthon2\template\_shared\css\base\bg_shadow.png
%ProgramFiles%\Maxthon2\template\_shared\css\base.css
%ProgramFiles%\Maxthon2\template\_shared\favicon.ico
%ProgramFiles%\Maxthon2\template\_shared\css\base\bg_input_text_hover.png
%ProgramFiles%\Maxthon2\template\_shared\css\base\bg_input_btn.png
%ProgramFiles%\Maxthon2\template\_shared\css\base\bg_input_btn_hover.png
%ProgramFiles%\Maxthon2\template\_shared\css\base\bg_input_text.png
%ProgramFiles%\Maxthon2\template\page\unsafe\pg_unsafe.htm
%ProgramFiles%\Maxthon2\template\page\unsafe\pg_unsafe.js
%ProgramFiles%\Maxthon2\template\ResumeSession\images\logo.png
%ProgramFiles%\Maxthon2\template\page\unsafe\pg_unsafe.css
%ProgramFiles%\Maxthon2\template\page\unsafe\images\bodyBG.png
%ProgramFiles%\Maxthon2\template\page\unsafe\images\conBg.png
%ProgramFiles%\Maxthon2\template\page\unsafe\images\goBtn.png
%ProgramFiles%\Maxthon2\template\ui\pop_siteinfo\images\i.png
%ProgramFiles%\Maxthon2\template\ui\pop_siteinfo\images\pb.png
%ProgramFiles%\Maxthon2\template\ui\pop_siteinfo\images\pf.png
%ProgramFiles%\Maxthon2\template\ui\pop_siteinfo\images\d.png
%ProgramFiles%\Maxthon2\template\ResumeSession\index.htm
%ProgramFiles%\Maxthon2\template\ResumeSession\maxResumeSession.css
%ProgramFiles%\Maxthon2\template\ResumeSession\maxResumeSession.js
%ProgramFiles%\Maxthon2\template\_shared\images\direction_u.png
%ProgramFiles%\Maxthon2\template\_shared\images\key.png
%ProgramFiles%\Maxthon2\template\_shared\images\link_out.png
%ProgramFiles%\Maxthon2\template\_shared\images\direction_r.png
%ProgramFiles%\Maxthon2\template\_shared\images\btn_up.png
%ProgramFiles%\Maxthon2\template\_shared\images\direction_d.png
%ProgramFiles%\Maxthon2\template\_shared\images\direction_l.png
%ProgramFiles%\Maxthon2\template\_shared\images\mouse_right.png
%ProgramFiles%\Maxthon2\template\_shared\images\next.png
%ProgramFiles%\Maxthon2\template\_shared\images\page.png
%ProgramFiles%\Maxthon2\template\_shared\images\mouse_mid.png
%ProgramFiles%\Maxthon2\template\_shared\images\mouse.png
%ProgramFiles%\Maxthon2\template\_shared\images\mouse_both.png
%ProgramFiles%\Maxthon2\template\_shared\images\mouse_left.png
%ProgramFiles%\Maxthon2\template\_shared\images\btn_check_checked.png
%ProgramFiles%\Maxthon2\template\_shared\images\btn_close.png
%ProgramFiles%\Maxthon2\template\_shared\images\btn_down.png
%ProgramFiles%\Maxthon2\template\_shared\images\btn_check.png
%ProgramFiles%\Maxthon2\template\_shared\images\btn_apply.png
%ProgramFiles%\Maxthon2\template\_shared\images\btn_autorun.png
%ProgramFiles%\Maxthon2\template\_shared\images\btn_autorun_checked.png
%ProgramFiles%\Maxthon2\template\_shared\images\btn_reset.png
%ProgramFiles%\Maxthon2\template\_shared\images\btn_right.png
%ProgramFiles%\Maxthon2\template\_shared\images\btn_show_sidebar.png
%ProgramFiles%\Maxthon2\template\_shared\images\btn_radio_checked.png
%ProgramFiles%\Maxthon2\template\_shared\images\btn_hide_sidebar.png
%ProgramFiles%\Maxthon2\template\_shared\images\btn_left.png
%ProgramFiles%\Maxthon2\template\_shared\images\btn_radio.png

Deletes the following files:

%TEMP%\nsx3.tmp\mx2_data\Temp\NList.xml
%TEMP%\nsx3.tmp\mx2_data\Temp\PList.xml
%TEMP%\nsx3.tmp\mx2_data\Temp\sdurl.dat
%TEMP%\nsx3.tmp\mx2_data\Temp\MxVideoPopup\videoUrlRules.ini
%TEMP%\nsx3.tmp\mx2_data\Temp\MxUrlSec\old_black.list
%TEMP%\nsx3.tmp\mx2_data\Temp\MxUrlSec\taobao.list
%TEMP%\nsx3.tmp\mx2_data\Temp\MxUrlSec\youa.list
%TEMP%\nsx3.tmp\mx2_data\template\Download\images\logo.png
%TEMP%\nsx3.tmp\mx2_data\template\Download\images\pause.png
%TEMP%\nsx3.tmp\mx2_data\template\Download\images\reset.png
%TEMP%\nsx3.tmp\mx2_data\template\Download\images\error.png
%TEMP%\nsx3.tmp\mx2_data\Temp\SList.xml
%TEMP%\nsx3.tmp\mx2_data\template\Download\images\check.png
%TEMP%\nsx3.tmp\mx2_data\template\Download\images\done.png
%TEMP%\nsx3.tmp\mx2_data\Plugin\AddToKaixin001\out.ico
%TEMP%\nsx3.tmp\mx2_data\Plugin\AddToKaixin001\plugin.ini
%TEMP%\nsx3.tmp\mx2_data\Plugin\ІејюЦЖЧчОДµµ.url
%TEMP%\nsx3.tmp\mx2_data\Plugin\AddToKaixin001\AddToKaixin001.htm
%TEMP%\nsx3.tmp\mx2_data\mxtool2.dll
%TEMP%\nsx3.tmp\mx2_data\MxUeip.dll
%TEMP%\nsx3.tmp\mx2_data\MxUI.dll
%TEMP%\nsx3.tmp\mx2_data\Temp\MxUrlSec\config.ini
%TEMP%\nsx3.tmp\mx2_data\Temp\MxUrlSec\mx_safe_all.list
%TEMP%\nsx3.tmp\mx2_data\Temp\MxUrlSec\mx_safe_sub.list
%TEMP%\nsx3.tmp\mx2_data\Temp\MxUrlSec\cnnic.list
%TEMP%\nsx3.tmp\mx2_data\Skin\Ж¤·фЦЖЧчОДµµ.url
%TEMP%\nsx3.tmp\mx2_data\Temp\AList.xml
%TEMP%\nsx3.tmp\mx2_data\Temp\MxUrlSec\alipay.list
%TEMP%\nsx3.tmp\mx2_data\template\Download\images\run.png
%TEMP%\nsx3.tmp\mx2_data\template\History\images\search.png
%TEMP%\nsx3.tmp\mx2_data\template\History\images\website.png
%TEMP%\nsx3.tmp\mx2_data\template\History\index.htm
%TEMP%\nsx3.tmp\mx2_data\template\History\images\page.png
%TEMP%\nsx3.tmp\mx2_data\template\History\images\feed.png
%TEMP%\nsx3.tmp\mx2_data\template\History\images\keyword.png
%TEMP%\nsx3.tmp\mx2_data\template\History\images\logo.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\defcon_high.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\defcon_low.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\defcon_med.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\css\bg_sidebar.png
%TEMP%\nsx3.tmp\mx2_data\template\History\maxHistory.css
%TEMP%\nsx3.tmp\mx2_data\template\History\maxHistory.js
%TEMP%\nsx3.tmp\mx2_data\template\Options\css\arrow.png
%TEMP%\nsx3.tmp\mx2_data\template\Download\maxDownload.js
%TEMP%\nsx3.tmp\mx2_data\template\FeedView\feed.css
%TEMP%\nsx3.tmp\mx2_data\template\FeedView\feed.js
%TEMP%\nsx3.tmp\mx2_data\template\Download\maxDownload.css
%TEMP%\nsx3.tmp\mx2_data\template\Download\images\search.png
%TEMP%\nsx3.tmp\mx2_data\template\Download\images\stop.png
%TEMP%\nsx3.tmp\mx2_data\template\Download\index.htm
%TEMP%\nsx3.tmp\mx2_data\template\History\images\arrow.png
%TEMP%\nsx3.tmp\mx2_data\template\History\images\calendar.png
%TEMP%\nsx3.tmp\mx2_data\template\History\images\delete.png
%TEMP%\nsx3.tmp\mx2_data\template\History\images\add.png
%TEMP%\nsx3.tmp\mx2_data\template\FeedView\feed.xsl
%TEMP%\nsx3.tmp\mx2_data\template\FeedView\images\feed.png
%TEMP%\nsx3.tmp\mx2_data\template\FeedView\images\go_top.png
%TEMP%\nsx3.tmp\mx2_data\mxtool.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\red\submit_hover.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\red\submit_normal.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\index.htm
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\red\submit_down.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\red\del_down.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\red\del_hover.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\red\del_normal.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\popo2.htm
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\popo6.htm
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\popo7.htm
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\popo1.htm
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\js\main\js_loader.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\js\main\kwebapp.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\popo0.htm
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\orange\submit_down.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\orange\submit_hover.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\orange\submit_normal.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\orange\del_normal.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\orange\close_normal.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\orange\del_down.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\orange\del_hover.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\red\close_down.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\red\close_hover.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\red\close_normal.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\red\cancel _normal.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\red\bg.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\red\cancel _down.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\red\cancel _hover.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\popo8.htm
%TEMP%\nsx3.tmp\mx2_data\Mx2UnInstall.exe
%TEMP%\nsx3.tmp\mx2_data\MxAccount.dll
%TEMP%\nsx3.tmp\mx2_data\MxCrashCatch.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxWin7\MxW7Wg.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxUrlSec\mxurlsec.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxVideoPopup\MxVideoPopup.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxWebBoost\MxWebBoost.dll
%TEMP%\nsx3.tmp\mx2_data\mxpp.dll
%TEMP%\nsx3.tmp\mx2_data\MxProxy2.dll
%TEMP%\nsx3.tmp\mx2_data\MxSk.dll
%TEMP%\nsx3.tmp\mx2_data\MxHttpRq.dll
%TEMP%\nsx3.tmp\mx2_data\MxCrashReport.exe
%TEMP%\nsx3.tmp\mx2_data\mxdb.dll
%TEMP%\nsx3.tmp\mx2_data\MxFav.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\public\lib\jquery.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxMute\MxMute.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxPageSearch\MxPageSearch.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\public\js\kajax.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\popo9.htm
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\public\css\common.css
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\public\js\common.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxSpeedDial\MxIeCore.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxSpeedDial\MxSpeedDial.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxUpdate\MxUp.exe
%TEMP%\nsx3.tmp\mx2_data\Modules\MxSpeedDial\default.zip
%TEMP%\nsx3.tmp\mx2_data\Modules\MxSandBox\MxSandBox.zip
%TEMP%\nsx3.tmp\mx2_data\Modules\MxSandBox\MxSec.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxSpeedDial\0x0804.zip
%TEMP%\nsx3.tmp\mx2_data\template\_shared\css\base\bg_shadow.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\css\base.css
%TEMP%\nsx3.tmp\mx2_data\template\_shared\favicon.ico
%TEMP%\nsx3.tmp\mx2_data\template\_shared\css\base\bg_input_text_hover.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\css\base\bg_input_btn.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\css\base\bg_input_btn_hover.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\css\base\bg_input_text.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\btn_check_checked.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\btn_close.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\btn_down.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\btn_check.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\btn_apply.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\btn_autorun.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\btn_autorun_checked.png
%TEMP%\nsx3.tmp\mx2_data\template\ui\pop_siteinfo\images\i.png
%TEMP%\nsx3.tmp\mx2_data\template\ui\pop_siteinfo\images\pb.png
%TEMP%\nsx3.tmp\mx2_data\template\ui\pop_siteinfo\images\pf.png
%TEMP%\nsx3.tmp\mx2_data\template\ui\pop_siteinfo\images\d.png
%TEMP%\nsx3.tmp\mx2_data\template\ResumeSession\index.htm
%TEMP%\nsx3.tmp\mx2_data\template\ResumeSession\maxResumeSession.css
%TEMP%\nsx3.tmp\mx2_data\template\ResumeSession\maxResumeSession.js
%TEMP%\nsx3.tmp\mx2_data\template\_shared\css\base\bg_btn_active.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\css\base\bg_btn_hover.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\css\base\bg_header.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\css\base\bg_btn.png
%TEMP%\nsx3.tmp\mx2_data\template\ui\pop_siteinfo\images\s.png
%TEMP%\nsx3.tmp\mx2_data\template\ui\pop_siteinfo\index.htm
%TEMP%\nsx3.tmp\mx2_data\template\ui\pop_siteinfo\style.css
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\btn_hide_sidebar.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\next.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\page.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\prev.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\mouse_right.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\mouse_both.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\mouse_left.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\mouse_mid.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\js\maxTable.js
%TEMP%\nsx3.tmp\mx2_data\template\_shared\js\maxXmlListParser.js
%TEMP%\nsx3.tmp\System.dll
%TEMP%\nsx3.tmp\mx2_data\template\_shared\js\maxList.js
%TEMP%\nsx3.tmp\mx2_data\template\_shared\js\func.js
%TEMP%\nsx3.tmp\mx2_data\template\_shared\js\maxAjaxManager.js
%TEMP%\nsx3.tmp\mx2_data\template\_shared\js\maxConfig.js
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\btn_right.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\btn_show_sidebar.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\btn_up.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\btn_reset.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\btn_left.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\btn_radio.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\btn_radio_checked.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\key.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\link_out.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\mouse.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\direction_u.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\direction_d.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\direction_l.png
%TEMP%\nsx3.tmp\mx2_data\template\_shared\images\direction_r.png
%TEMP%\nsx3.tmp\mx2_data\template\ResumeSession\images\logo.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\page_startup.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\page_tab.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\index.htm
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\page_skin.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\page_safety.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\page_sandbox.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\page_search.png
%TEMP%\nsx3.tmp\mx2_data\template\page\404\css\css.css
%TEMP%\nsx3.tmp\mx2_data\template\page\404\images\blank.gif
%TEMP%\nsx3.tmp\mx2_data\template\page\404\images\colFooter.gif
%TEMP%\nsx3.tmp\mx2_data\template\page\404\404.html
%TEMP%\nsx3.tmp\mx2_data\template\Options\maxOptions.config.js
%TEMP%\nsx3.tmp\mx2_data\template\Options\maxOptions.css
%TEMP%\nsx3.tmp\mx2_data\template\Options\maxOptions.js
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\page_feed.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\page_filter.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\page_floatbutton.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\page_fav.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\page_adhunter.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\page_advanced.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\page_download.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\page_mouse.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\page_nav.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\page_plugin.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\page_kwfw.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\page_form.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\page_general.png
%TEMP%\nsx3.tmp\mx2_data\template\Options\images\page_key.png
%TEMP%\nsx3.tmp\mx2_data\template\page\404\images\expFooter.gif
%TEMP%\nsx3.tmp\mx2_data\template\page\PrivacyMode\privacy.html
%TEMP%\nsx3.tmp\mx2_data\template\page\PrivacyMode\privacy.js
%TEMP%\nsx3.tmp\mx2_data\template\page\unsafe\images\arrow.png
%TEMP%\nsx3.tmp\mx2_data\template\page\PrivacyMode\images\point.gif
%TEMP%\nsx3.tmp\mx2_data\template\page\PrivacyMode\images\innerBg.jpg
%TEMP%\nsx3.tmp\mx2_data\template\page\PrivacyMode\images\logo.png
%TEMP%\nsx3.tmp\mx2_data\template\page\PrivacyMode\images\pageBg.jpg
%TEMP%\nsx3.tmp\mx2_data\template\page\unsafe\pg_unsafe.css
%TEMP%\nsx3.tmp\mx2_data\template\page\unsafe\pg_unsafe.htm
%TEMP%\nsx3.tmp\mx2_data\template\page\unsafe\pg_unsafe.js
%TEMP%\nsx3.tmp\mx2_data\template\page\unsafe\images\goBtn.png
%TEMP%\nsx3.tmp\mx2_data\template\page\unsafe\images\arrowBG.png
%TEMP%\nsx3.tmp\mx2_data\template\page\unsafe\images\bodyBG.png
%TEMP%\nsx3.tmp\mx2_data\template\page\unsafe\images\conBg.png
%TEMP%\nsx3.tmp\mx2_data\template\page\404\images\inputBg.jpg
%TEMP%\nsx3.tmp\mx2_data\template\page\404\images\listStyle.gif
%TEMP%\nsx3.tmp\mx2_data\template\page\404\images\otherError.jpg
%TEMP%\nsx3.tmp\mx2_data\template\page\404\images\headBgRepeat.jpg
%TEMP%\nsx3.tmp\mx2_data\template\page\404\images\favicon.ico
%TEMP%\nsx3.tmp\mx2_data\template\page\404\images\footerLogo.jpg
%TEMP%\nsx3.tmp\mx2_data\template\page\404\images\headBg.jpg
%TEMP%\nsx3.tmp\mx2_data\template\page\404\js\error.js
%TEMP%\nsx3.tmp\mx2_data\template\page\PrivacyMode\images\blank.gif
%TEMP%\nsx3.tmp\mx2_data\template\page\PrivacyMode\images\iepngfix.htc
%TEMP%\nsx3.tmp\mx2_data\template\page\404\images\searchBg.jpg
%TEMP%\nsx3.tmp\mx2_data\template\page\404\images\otherHeadBg.jpg
%TEMP%\nsx3.tmp\mx2_data\template\page\404\images\otherHeadBgRepeat.jpg
%TEMP%\nsx3.tmp\mx2_data\template\page\404\images\point.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\orange\close_hover.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\Icon\kws_safe.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\Icon\kws_safe_no.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\Icon\kws_unknown.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\Icon\kws_danger_no.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\Icon\kws_Adult.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\Icon\kws_Adult_no.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\Icon\kws_danger.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\about\about_wd.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\about\button.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\alert\bg.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\feedback.html
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\Icon\kws_unknown_no.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\about.html
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\alert.html
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\KWSUpd.exe
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\KWSUpreport.exe
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\kxestat.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\kwsui.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\kwssp.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\kwstray.exe
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\kwsu.dat
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\Icon\bg.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\Icon\CommentBg.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\Icon\CommentBt.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\Icon\BfSet.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\Update.CFG
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\ver.dat
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\Icon\bfbg.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\alert\btn_disabled.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\button03_normal.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\chakan_hover.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\chakan_normal.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\button03_hover.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\button02_hover.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\button02_normal.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\button03_down.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\go_down.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\go_hover.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\go_normal.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\fengxian.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\chakan_on.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\fankui_hover.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\fankui_normal.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\alert\close_hover.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\alert\close_normal.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\alert\ico1.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\alert\close_down.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\alert\btn_down.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\alert\btn_hover.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\alert\btn_normal.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\button01_hover.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\button01_normal.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\button02_down.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\button01_down.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\alert\ico2.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\alert\logo.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\anquan.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\KWSReUpd.exe
%TEMP%\nsx3.tmp\mx2_data\Default\config\MFA2.dat
%TEMP%\nsx3.tmp\mx2_data\Default\config\ProxyConfig.xml
%TEMP%\nsx3.tmp\mx2_data\Default\config\SiteList.xml
%TEMP%\nsx3.tmp\mx2_data\Default\config\dmgr.ini
%TEMP%\nsx3.tmp\install_data\mxtool.dll
%TEMP%\nsx3.tmp\install_data\MxUI.dll
%TEMP%\nsx3.tmp\mx2_data\Default\config\Config.ini
%TEMP%\nsx3.tmp\mx2_data\Favicons\EABCDIFOCCAMFJCAECELCMBPCN.ico
%TEMP%\nsx3.tmp\mx2_data\Favicons\EABCDIFOCHACFPCDFLAAGBBDCO.ico
%TEMP%\nsx3.tmp\mx2_data\Favicons\EABCDIFOHBFOADHNAEELCMBPCN.ico
%TEMP%\nsx3.tmp\mx2_data\enablelog.reg
%TEMP%\nsx3.tmp\mx2_data\Default\config\System.dat
%TEMP%\nsx3.tmp\mx2_data\Default\Filter\template.xml
%TEMP%\nsx3.tmp\mx2_data\Default\Filter\template0x0804.xml
%TEMP%\nsx3.tmp\FindProcDLL.dll
%TEMP%\nsx3.tmp\install_data\InstallLang\en.ini
%TEMP%\nsx3.tmp\install_data\InstallLang\zh-cn.ini
%ProgramFiles%\Maxthon2\https.shell.imp
%ProgramFiles%\Maxthon2\http.DefaultIcon.imp
%ProgramFiles%\Maxthon2\http.shell.imp
%ProgramFiles%\Maxthon2\https.DefaultIcon.imp
%TEMP%\nsx3.tmp\install_data\Mx2Uninstall.exe
%TEMP%\nsx3.tmp\install_data\MxHttpRq.dll
%TEMP%\nsx3.tmp\install_data\MxInstall.exe
%TEMP%\nsx3.tmp\install_data\module_config.ini
%TEMP%\nsx3.tmp\install_data\License.txt
%TEMP%\nsx3.tmp\install_data\License_cn.txt
%TEMP%\nsx3.tmp\install_data\maxzlib.dll
%TEMP%\nsx3.tmp\mx2_data\Favicons\FOELCCBBDIBJFICLFJELCMBO.ico
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\kavifr.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\ksais.dat
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\KSWBC.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\index.dat
%TEMP%\nsx3.tmp\mx2_data\Modules\MxDownloader\MxDownloadServer.exe
%TEMP%\nsx3.tmp\mx2_data\Modules\MxDownloader\TaskManager.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxHistory\MxHistory.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\kwsinst.exe
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\kwsmain.exe
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\kwspop.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\kws.ini
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\kswebshield.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\KSWebShield.exe
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\kuientry.dll
%TEMP%\nsx3.tmp\mx2_data\Language\Chinese\language.ini
%TEMP%\nsx3.tmp\mx2_data\Language\English\Language.ini
%TEMP%\nsx3.tmp\mx2_data\Language\InstallLang\en.ini
%TEMP%\nsx3.tmp\mx2_data\https.shell.imp
%TEMP%\nsx3.tmp\mx2_data\http.DefaultIcon.imp
%TEMP%\nsx3.tmp\mx2_data\http.shell.imp
%TEMP%\nsx3.tmp\mx2_data\https.DefaultIcon.imp
%TEMP%\nsx3.tmp\mx2_data\Modules\MxCapScr\MxCapScr.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxDownloader\asyn_dns.dll
%TEMP%\nsx3.tmp\mx2_data\Modules\MxDownloader\download_interface.dll
%TEMP%\nsx3.tmp\mx2_data\maxzlib.dll
%TEMP%\nsx3.tmp\mx2_data\Language\InstallLang\zh-cn.ini
%TEMP%\nsx3.tmp\mx2_data\License_cn.txt
%TEMP%\nsx3.tmp\mx2_data\Maxthon.exe
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\js\index\kwebapp.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\js\newtip\newtip.pack.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\js\option\call_back.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\js\index\js_loader.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\js\feedback\kwebapp.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\js\index\call_back.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\js\index\getnews.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\js\set\js_loader.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\js\set\kwebapp.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\kwsad\ad_wd.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\js\replace\kwebapp.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\js\option\js_loader.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\js\option\kwebapp.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\js\replace\js_loader.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\line.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\logo.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\open.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\icon.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\btn_hide_sidebar.png
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\btn_show_sidebar.png
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\close.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\js\alert\js_loader.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\js\alert\kwebapp.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\js\feedback\js_loader.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\js\about\js_loader.js
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\self_prot_prog.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\self_prot_prog_2.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\warn.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\kwsad\kwsad.html
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\green\close_hover.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\green\close_normal.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\green\submit_down.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\green\close_down.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\css\main.css
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\css\popo.css
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\green\bg.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\orange\cancel_hover.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\orange\cancel_normal.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\orange\close_down.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\orange\cancel_down.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\green\submit_hover.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\green\submit_normal.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\popo\images\orange\bg.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\replace.htm
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\set.htm
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\style\about.css
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\option.html
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\kwsad\wsad.html
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\main.htm
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\newtip.htm
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\style\option.css
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\style\replace.css
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\style\set.css
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\style\newtip.css
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\style\alert.css
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\style\feedback.css
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\style\index\index.css
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\btn_close.png
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\shezhi_12.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\shezhi_12_2.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\shezhi_hover.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\rz_table_line.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\mingdan_normal.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\mingdan_on.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\rz_table_bg.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\table_button_left.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\table_button_middle.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\table_button_right.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\shezhi_table_bj.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\shezhi_ico02.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\shezhi_normal.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\shezhi_on.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\icob2_hover.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\icob2_normal.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\icob3_down.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\icob2_down.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\icob1_down.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\icob1_hover.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\icob1_normal.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\jiankong_normal.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\jiankong_on.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\mingdan_hover.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\jiankong_hover.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\icob3_hover.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\icob3_normal.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\jiankong_bg.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\index\wd_bg_bata.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\base\bg_shadow.png
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\base_set.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\base_set_2.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\base\bg_mid.png
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\base\bg_input_btn_hover.png
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\base\bg_input_text.png
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\base\bg_input_text_hover.png
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\btn_apply.png
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\btn_check.png
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\btn_check_checked.png
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\bg_input_text_hover.png
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\bg_input_btn.png
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\bg_input_btn_hover.png
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\bg_input_text.png
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\replace\btn.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\replace\div_bg.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\add.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\replace\bg_replace.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\newtip\Tooltipbackimage.jpg
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\newtip\TooltipIcon.png
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\option\option_bg.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\base\bg_btn_hover.png
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\base\bg_header.png
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\base\bg_input_btn.png
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\base\bg_btn_bg.png
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\addbl.gif
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\base\bg_btn.png
%TEMP%\nsx3.tmp\mx2_data\Modules\MxKWS\webui\kwebshield\images\set\base\bg_btn_active.png

Moves the following files:

from %ALLUSERSPROFILE%\Desktop\Maxthon2.lnk.tmp to %ALLUSERSPROFILE%\Desktop\Maxthon2.lnk

Network activity:

Connects to:

'if#.#uba.net':80
'i2#.#uba.net':80
'kw####a.duba.net':80
'localhost':1036
'st####.maxthon.com':80

TCP:

HTTP GET requests:

http://if#.#uba.net/urlrcv.php?mc#########################################################
http://i2#.#uba.net/urlrcv.php?mc#########################################################
http://st####.maxthon.com/mx2/inst/000000000001/ver=2.5.12.4586,lan=0x1033,lc=1,pn=verycd,reg=0,vrf=ABB421883605F7816663CA5AB4068DB9
http://kw####a.duba.net/wdreporter/Install?uu##################################################################

UDP:

DNS ASK if#.#uba.net
DNS ASK i2#.#uba.net
DNS ASK st####.maxthon.com
DNS ASK kw####a.duba.net

Miscellaneous:

Searches for the following windows:

ClassName: 'Maxthon2_Frame' WindowName: ''

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial