マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Trojan.MulDrop8.24164

Added to the Dr.Web virus database: 2018-05-23

Virus description added:

Technical Information

Modifies file system:
Creates the following files:
  • %TEMP%\7zS1.tmp\Windows\INF\AER_1025.ADM
  • %TEMP%\7zS1.tmp\Program Files\Common Files\Microsoft Shared\DW\3082\DWINTL20.DLL
  • %TEMP%\7zS1.tmp\Program Files\Common Files\Microsoft Shared\DW\1036\DWINTL20.DLL
  • %TEMP%\7zS1.tmp\Program Files\Common Files\Microsoft Shared\DW\1040\DWINTL20.DLL
  • %TEMP%\7zS1.tmp\Program Files\Common Files\Microsoft Shared\DW\1042\DWINTL20.DLL
  • %TEMP%\7zS1.tmp\Program Files\Common Files\Microsoft Shared\DW\1028\DWINTL20.DLL
  • %TEMP%\7zS1.tmp\Program Files\Common Files\Microsoft Shared\DW\1031\DWINTL20.DLL
  • %TEMP%\7zS1.tmp\Program Files\Common Files\Microsoft Shared\DW\1041\DWINTL20.DLL
  • %TEMP%\7zS1.tmp\Program Files\Common Files\Microsoft Shared\DW\2052\DWINTL20.DLL
  • %TEMP%\7zS1.tmp\Program Files\Common Files\Microsoft Shared\DW\1033\DWINTL20.DLL
  • %TEMP%\7zS1.tmp\Program Files\Common Files\Microsoft Shared\DW\DWDCW20.DLL
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\diasymreader.dll
  • %TEMP%\7zS1.tmp\Win\System\MUI\0409\mscorees.dll
  • %TEMP%\7zS1.tmp\Win\System\dfshim.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\1033\CvtResUI.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CustomMarshalers.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Culture.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\1033\cscompui.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\cscompmgd.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\cscomp.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CORPerfMonExt.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\aspnet_rc.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Aspnet_perf.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\aspnet_isapi.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\aspnet_filter.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\dfdll.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\AspNetMMCExt.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\1033\alinkui.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\gdiplus.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\EventLogMessages.dll
  • %TEMP%\7zS1.tmp\Win\System\mscoree.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\mscordbi.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\mscordbc.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\mscordacwks.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\MmcAspExt.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Microsoft_VsaVb.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Microsoft.Vsa.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Microsoft.VisualC.Dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Microsoft.VisualBasic.Vsa.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\fusion.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Microsoft.VisualBasic.dll
  • %TEMP%\7zS1.tmp\Program Files\Common Files\Microsoft Shared\DW\1025\DWINTL20.DLL
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Microsoft.JScript.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Microsoft.Build.Utilities.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Microsoft.Build.Tasks.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Microsoft.Build.Framework.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Microsoft.Build.Engine.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ISymWrapper.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\InstallUtilLib.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\IIEHost.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\IEHost.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\IEExecRemote.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Microsoft.VisualBasic.Compatibility.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Internals.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Microsoft.VisualBasic.Compatibility.Data.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\mscorlib.tlb
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\UninstallPersistSqlState.sql
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\UninstallMembership.sql
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\UninstallCommon.sql
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\InstallWebEventSqlProvider.sql
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\InstallSqlStateTemplate.sql
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\InstallSqlState.sql
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\InstallRoles.sql
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\InstallProfile.SQL
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\InstallPersonalization.sql
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\InstallPersistSqlState.sql
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\InstallMembership.sql
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Accessibility.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\InstallCommon.sql
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\MSBuild.rsp
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\csc.rsp
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardProviderInfo.ascx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardPermission.ascx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardInit.ascx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardFinish.ascx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardCreateRoles.ascx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardAuthentication.ascx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardAddUser.ascx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizard.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Security.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\vbc.rsp
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\alink.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\AdoNetDiag.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\UninstallSqlState.sql
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\UnInstallProfile.SQL
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Microsoft.Build.xsd
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\MSBuild\Microsoft.Build.Core.xsd
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\MSBuild\Microsoft.Build.Commontypes.xsd
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\App_Data\GroupedProviders.xml
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\RedistList\FrameworkList.xml
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CLR.mof.uninstall
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\aspnet.mof.uninstall
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Windows.Forms.tlb
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Web.tlb
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.tlb
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\UninstallRoles.sql
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.EnterpriseServices.tlb
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\UninstallPersonalization.sql
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\mscoree.tlb
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Microsoft.Vsa.Vb.CodeDOMProcessor.tlb
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Microsoft.Vsa.tlb
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Microsoft.JScript.tlb
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Microsoft.Common.Tasks
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Microsoft.VisualBasic.targets
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Microsoft.CSharp.targets
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Microsoft.Common.targets
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\UninstallWebEventSqlProvider.sql
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\UninstallSqlStateTemplate.sql
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Drawing.tlb
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Provider.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\mscorie.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\mscortim.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\WMINet_Utils.dll
  • %TEMP%\7zS1.tmp\Win\System\WBEM\Wmidcad.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\webengine.dll
  • %TEMP%\7zS1.tmp\Win\System\WBEM\wbemDC.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\1033\Vsavb7rtUI.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\VsaVb7rt.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\1033\vbc7ui.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\TLBREF.DLL
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.XML.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Windows.Forms.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Web.Services.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Drawing.Design.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Web.RegularExpressions.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Web.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Transactions.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.ServiceProcess.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Security.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Runtime.Serialization.Formatters.Soap.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Runtime.Remoting.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Messaging.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Management.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.EnterpriseServices.Wrapper.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.EnterpriseServices.Thunk.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.EnterpriseServices.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Web.Mobile.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Drawing.dll
  • %TEMP%\7zS1.tmp\Win\System\WBEM\wmiutils.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\IEExec.exe
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\vbc.exe
  • %TEMP%\7zS1.tmp\RunHiddenConsole.exe
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\regtlibv12.exe
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\RegSvcs.exe
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\RegAsm.exe
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ngen.exe
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\NETFXSBS10.exe
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\mscorsvw.exe
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\MSBuild.exe
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\jsc.exe
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\InstallUtil.exe
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\aspnet_compiler.exe
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\AppLaunch.exe
  • %TEMP%\7zS1.tmp\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE
  • %TEMP%\7zS1.tmp\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\dfsvc.exe
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\cvtres.exe
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\csc.exe
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CasPol.exe
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\aspnet_wp.exe
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\aspnet_state.exe
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\aspnet_regsql.exe
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\aspnet_regiis.exe
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\aspnet_regbrowsers.exe
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ilasm.exe
  • %TEMP%\7zS1.tmp\Win\System\mscorier.dll
  • %TEMP%\7zS1.tmp\Program Files\Internet Explorer\MUI\0409\mscorier.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.DirectoryServices.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\mscorwks.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\PerfCounter.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\normalization.dll
  • %TEMP%\7zS1.tmp\Win\System\netfxperf.dll
  • %TEMP%\7zS1.tmp\Win\RegisteredPackages\{D5D40355-5FB0-48fb-A231-CDC637FA16E0}\NETFXMigration.dll
  • %TEMP%\7zS1.tmp\Windows\winsxs\92rg91xw.1p4\msvcr80.dll
  • %TEMP%\7zS1.tmp\Windows\system32\msvcr80.dll
  • %TEMP%\7zS1.tmp\Windows\winsxs\92rg91xw.1p4\msvcp80.dll
  • %TEMP%\7zS1.tmp\Windows\system32\msvcp80.dll
  • %TEMP%\7zS1.tmp\Windows\winsxs\92rg91xw.1p4\msvcm80.dll
  • %TEMP%\7zS1.tmp\Windows\system32\msvcm80.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\peverify.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\sbscmp10.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.DirectoryServices.Protocols.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\mscorsn.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\MUI\0409\mscorsecr.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\mscorsec.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\mscorrc.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\mscorpe.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\mscorlib.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\mscorld.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\mscorjit.dll
  • %TEMP%\7zS1.tmp\Win\System\mscories.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\mscorsvc.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\sbscmp20_mscorlib.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\sbs_wminet_utils.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\SharedReg12.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Deployment.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Data.SqlXml.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Data.OracleClient.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Data.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Configuration.Install.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.configuration.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\sysglobl.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\SOS.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ShFusRes.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\shfusion.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\System.Design.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\sbscmp20_mscorwks.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\sbscmp20_perfcounter.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\sbs_system.enterpriseservices.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\sbs_system.data.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\sbs_system.configuration.install.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\sbs_mscorsec.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\sbs_mscorrc.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\sbs_mscordbi.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\sbs_microsoft.vsa.vb.codedomprocessor.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\sbs_microsoft.jscript.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\sbs_iehost.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\sbs_diasymreader.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\sbs_VsaVb7rt.dll
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp_Application.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\App_LocalResources\WebAdminHelp.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\SmtpSettings.aspx.resx
  • %TEMP%\7zS1.tmp\Windows\winsxs\Policies\uxgs54we.kj4\8.0.50727.1433.cat
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\xiino.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\winwap.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\webtv.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\pie.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\panasonic.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\palm.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\opera.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\openwave.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\nokia.browser
  • %TEMP%\7zS1.tmp\Windows\winsxs\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2.cat
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\netscape.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\MME.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\legend.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\jphone.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\Jataayu.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\ie.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\goAmerica.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\generic.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\gateway.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\EZWap.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\ericsson.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\docomo.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\mozilla.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\Default.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\web_minimaltrust.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\cassio.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\web_mediumtrust.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\web_lowtrust.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\web_hightrust.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\web.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\web.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\vbc.exe.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\v1.0.3705\regsvcs.exe.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\regsvcs.exe.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\v1.1.4322\regsvcs.exe.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\regasm.exe.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\msbuild.exe.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\dv_aspnetmmc.chm
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\v1.0.3705\mscormmc.cfg
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\v1.0.3705\installutil.exe.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ilasm.exe.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ieexec.exe.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\v1.1.4322\gacutil.exe.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\csc.exe.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\caspol.exe.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Aspnet_regsql.exe.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\Aspnet.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\web.config.comments
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\machine.config.comments
  • %TEMP%\7zS1.tmp\Install.cmd
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\jsc.exe.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\shfusion.chm
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\machine.config
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Wizard\wizard.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Providers\ManageProviders.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Providers\chooseProviderManagement.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\AppConfig\AppConfigHome.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Users\addUser.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Wizard\wizardProviderInfo.ascx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Wizard\wizardPermission.ascx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Wizard\wizardInit.ascx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Wizard\wizardFinish.ascx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Wizard\wizardCreateRoles.ascx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Wizard\wizardAuthentication.ascx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Wizard\wizardAddUser.ascx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Permissions\createPermission.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Providers\ProviderList.ascx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Wizard\confirmation.ascx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\AppConfig\AppSetting.ascx
  • %TEMP%\7zS1.tmp\Windows\INF\AER_3082.ADM
  • %TEMP%\7zS1.tmp\Windows\INF\AER_2052.ADM
  • %TEMP%\7zS1.tmp\Windows\INF\AER_1042.ADM
  • %TEMP%\7zS1.tmp\Windows\INF\AER_1041.ADM
  • %TEMP%\7zS1.tmp\Windows\INF\AER_1040.ADM
  • %TEMP%\7zS1.tmp\Windows\INF\AER_1036.ADM
  • %TEMP%\7zS1.tmp\Windows\INF\AER_1033.ADM
  • %TEMP%\7zS1.tmp\Windows\INF\AER_1031.ADM
  • %TEMP%\7zS1.tmp\Windows\INF\AER_1028.ADM
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\navigationBar.ascx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\Browsers\avantgo.browser
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\App_Code\ApplicationConfigurationPage.cs
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\AppConfig\CreateAppSetting.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\WebAdminHelp_Security.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\WebAdminHelp_Provider.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\WebAdminHelp_Internals.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\WebAdminHelp_Application.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\WebAdminHelp.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\AppConfig\SmtpSettings.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\setUpAuthentication.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\security0.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\security.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Users\manageUsers.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Roles\manageSingleRole.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\default.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\AppConfig\DebugAndTrace.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Providers\ManageConsolidatedProviders.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\AppConfig\ManageAppSettings.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Roles\manageAllRoles.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\home2.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\home1.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\home0.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Users\findUsers.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\error.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Users\editUser.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\AppConfig\EditAppSetting.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\AppConfig\DefineErrorPage.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Permissions\managePermissions.aspx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\DefaultWsdlHelpGenerator.aspx
  • %TEMP%\7zS1.tmp\Win\RegisteredPackages\{D5D40355-5FB0-48fb-A231-CDC637FA16E0}\NETFXUSA.CAT
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\App_Code\NavigationBar.cs
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\AppConfigHome.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\normnfkc.nlp
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\App_GlobalResources\AppConfigCommon.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\addUser.aspx.resx
  • %TEMP%\7zS1.tmp\Windows\winsxs\Policies\uxgs54we.kj4\8.0.50727.1433.policy
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\vsavb7.olb
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\xjis.nlp
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\sorttbls.nlp
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\sortkey.nlp
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\prcp.nlp
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\prc.nlp
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\normnfkd.nlp
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\webAdminButtonRow.master
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\AppSetting.ascx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\webAdminNoNavBar.master
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\normidna.nlp
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ksc.nlp
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\bopomofo.nlp
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\big5.nlp
  • %TEMP%\7zS1.tmp\Netfx20a_x86.msi
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CLR.mof
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\aspnet.mof
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\adonetdiag.mof
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\WebAdminWithConfirmationNoButtonRow.master
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\WebAdminWithConfirmation.master
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\normnfc.nlp
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\normnfd.nlp
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Providers\App_LocalResources\chooseProviderManagement.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\App_LocalResources\home2.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\manageAllRoles.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\App_LocalResources\security0.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\App_LocalResources\security.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Providers\App_LocalResources\providerList.ascx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\App_LocalResources\navigationBar.ascx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\manageUsers.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\manageSingleRole.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Providers\App_LocalResources\manageProviders.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Permissions\App_LocalResources\managePermissions.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Providers\App_LocalResources\manageconsolidatedProviders.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\ManageAppSettings.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\App_LocalResources\setUpAuthentication.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\confirmation.ascx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\CreateAppSetting.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\App_LocalResources\home0.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\App_GlobalResources\GlobalResources.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\findUsers.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\App_LocalResources\error.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Users\App_LocalResources\editUser.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\EditAppSetting.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\DefineErrorPage.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\App_LocalResources\default.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\DebugAndTrace.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Security\Permissions\App_LocalResources\createPermission.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\App_LocalResources\home1.aspx.resx
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\webAdminNoButtonRow.master
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\webAdmin.master
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\App_Code\PasswordValueTextBox.cs
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\requiredBang.gif
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\image2.gif
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\image1.gif
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\folder.gif
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\branding_Full2.gif
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\aspx_file.gif
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\web_minimaltrust.config.default
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\web_mediumtrust.config.default
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\web_lowtrust.config.default
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\web_hightrust.config.default
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\web.config.default
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CONFIG\machine.config.default
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\WebAdminStyles.css
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\App_Code\WizardPage.cs
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\App_Code\WebAdminPage.cs
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\App_Code\SecurityPage.cs
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\App_Code\ProvidersPage.cs
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\alert_lrg.gif
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\selectedTab_1x1.gif
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\XPThemes.manifest
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\aspnet_state_perf.ini
  • %TEMP%\7zS1.tmp\Windows\winsxs\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2.manifest
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\security_watermark.jpg
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\help.jpg
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\_Networkingperfcounters.ini
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\_dataperfcounters_shared12_neutral.ini
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\_DataPerfCounters.ini
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\_DataOracleClientPerfCounters_shared12_neutral.ini
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\corperfmonsymbols.ini
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\aspnet_perf2.ini
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\aspnet_perf.ini
  • %TEMP%\7zS1.tmp\Win\RegisteredPackages\{D5D40355-5FB0-48fb-A231-CDC637FA16E0}\NETFXUSA.INF
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\netfxsbs12.hkf
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\_NetworkingPerfCounters.h
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\_dataperfcounters_shared12_neutral.h
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\_DataPerfCounters.h
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\_DataOracleClientPerfCounters_shared12_neutral.h
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\CORPerfMonSymbols.h
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\aspnet_state_perf.h
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\aspnet_perf.h
  • %TEMP%\7zS1.tmp\Win\Microsoft.NET\Framework\URTInstallPath\ASP.NETWebAdminFiles\Images\yellowCORNER.gif
  • %WINDIR%\Installer\39116.msi
  • %TEMP%\MSI39bf3.LOG
Deletes the following files:
  • %WINDIR%\Installer\39116.msi
Miscellaneous:
Creates and executes the following:
  • '%TEMP%\7zS1.tmp\RunHiddenConsole.exe' /w Install.cmd
Executes the following:
  • '<SYSTEM32>\cmd.exe' /c Install.cmd
  • '<SYSTEM32>\cmd.exe' /c reg query HKLM\SYSTEM\Setup /v SystemSetupInProgress
  • '<SYSTEM32>\reg.exe' query HKLM\SYSTEM\Setup /v SystemSetupInProgress
  • '<SYSTEM32>\msiexec.exe' /i "%TEMP%\7zS1.tmp\Netfx20a_x86.msi" REBOOT=ReallySuppress /qn
  • '<SYSTEM32>\msiexec.exe' /V

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android