Trojan.Click2.60533

Technical Information

To ensure autorun and distribution:

Infects the following executable system files:

<SYSTEM32>\ntlanui.dll
<SYSTEM32>\ntlanui2.dll
<SYSTEM32>\ntdsbcli.dll
<SYSTEM32>\ntkrnlpa.exe
<SYSTEM32>\ntmsapi.dll
<SYSTEM32>\ntmsmgr.dll
<SYSTEM32>\ntmssvc.dll
<SYSTEM32>\ntmsdba.dll
<SYSTEM32>\ntmsevt.dll
<SYSTEM32>\ntbackup.exe
<SYSTEM32>\newdev.dll
<SYSTEM32>\nlhtml.dll
<SYSTEM32>\netsh.exe
<SYSTEM32>\netstat.exe
<SYSTEM32>\nmevtmsg.dll
<SYSTEM32>\npptools.dll
<SYSTEM32>\nslookup.exe
<SYSTEM32>\nmmkcert.dll
<SYSTEM32>\notepad.exe
<SYSTEM32>\ntoskrnl.exe
<SYSTEM32>\objsel.dll
<SYSTEM32>\occache.dll
<SYSTEM32>\nwscript.exe
<SYSTEM32>\nwwks.dll
<SYSTEM32>\ocmanage.dll
<SYSTEM32>\odbcbcp.dll
<SYSTEM32>\odbcconf.dll
<SYSTEM32>\odbc32gt.dll
<SYSTEM32>\odbcad32.exe
<SYSTEM32>\nwprovau.dll
<SYSTEM32>\ntsdexts.dll
<SYSTEM32>\nusrmgr.cpl
<SYSTEM32>\ntprint.dll
<SYSTEM32>\ntsd.exe
<SYSTEM32>\nwapi16.dll
<SYSTEM32>\nwcfg.dll
<SYSTEM32>\nwevent.dll
<SYSTEM32>\nwapi32.dll
<SYSTEM32>\nwc.cpl
<SYSTEM32>\msxml6.dll
<SYSTEM32>\msxml6r.dll
<SYSTEM32>\msxml3.dll
<SYSTEM32>\msxml3r.dll
<SYSTEM32>\msxmlr.dll
<SYSTEM32>\mtxex.dll
<SYSTEM32>\mtxlegih.dll
<SYSTEM32>\msyuv.dll
<SYSTEM32>\mtxdm.dll
<SYSTEM32>\msxml2r.dll
<SYSTEM32>\mswdat10.dll
<SYSTEM32>\mswebdvd.dll
<SYSTEM32>\msvidctl.dll
<SYSTEM32>\msw3prt.dll
<SYSTEM32>\mswmdm.dll
<SYSTEM32>\msxml.dll
<SYSTEM32>\msxml2.dll
<SYSTEM32>\mswstr10.dll
<SYSTEM32>\msxbde40.dll
<SYSTEM32>\mtxoci.dll
<SYSTEM32>\netevent.dll
<SYSTEM32>\netfxperf.dll
<SYSTEM32>\net1.exe
<SYSTEM32>\netdde.exe
<SYSTEM32>\neth.dll
<SYSTEM32>\netsetup.cpl
<SYSTEM32>\netsetup.exe
<SYSTEM32>\netid.dll
<SYSTEM32>\netplwiz.dll
<SYSTEM32>\net.exe
<SYSTEM32>\narrator.exe
<SYSTEM32>\narrhook.dll
<SYSTEM32>\mycomput.dll
<SYSTEM32>\mydocs.dll
<SYSTEM32>\nbtstat.exe
<SYSTEM32>\nddeapir.exe
<SYSTEM32>\nddenb32.dll
<SYSTEM32>\ncpa.cpl
<SYSTEM32>\ncxpnt.dll
<SYSTEM32>\plugin.ocx
<SYSTEM32>\plustab.dll
<SYSTEM32>\ping.exe
<SYSTEM32>\ping6.exe
<SYSTEM32>\pngfilt.dll
<SYSTEM32>\powercfg.cpl
<SYSTEM32>\powercfg.exe
<SYSTEM32>\pnrpnsp.dll
<SYSTEM32>\polstore.dll
<SYSTEM32>\pifmgr.dll
<SYSTEM32>\perfnw.dll
<SYSTEM32>\perfos.dll
<SYSTEM32>\perfmon.exe
<SYSTEM32>\perfnet.dll
<SYSTEM32>\perfproc.dll
<SYSTEM32>\pid.dll
<SYSTEM32>\pidgen.dll
<SYSTEM32>\perfts.dll
<SYSTEM32>\photowiz.dll
<SYSTEM32>\PresentationCFFRasterizerNative_v0300.dll
<SYSTEM32>\psnppagn.dll
<SYSTEM32>\pstorec.dll
<SYSTEM32>\proxycfg.exe
<SYSTEM32>\pschdprf.dll
<SYSTEM32>\qappsrv.exe
<SYSTEM32>\qdv.dll
<SYSTEM32>\qdvd.dll
<SYSTEM32>\qasf.dll
<SYSTEM32>\qcap.dll
<SYSTEM32>\proquota.exe
<SYSTEM32>\PresentationNative_v0300.dll
<SYSTEM32>\prflbmsg.dll
<SYSTEM32>\PresentationHost.exe
<SYSTEM32>\PresentationHostProxy.dll
<SYSTEM32>\print.exe
<SYSTEM32>\proctexe.ocx
<SYSTEM32>\progman.exe
<SYSTEM32>\printui.dll
<SYSTEM32>\prntvpt.dll
<SYSTEM32>\odpdx32.dll
<SYSTEM32>\odtext32.dll
<SYSTEM32>\odexl32.dll
<SYSTEM32>\odfox32.dll
<SYSTEM32>\offfilt.dll
<SYSTEM32>\oledlg.dll
<SYSTEM32>\oleprn.dll
<SYSTEM32>\oleacc.dll
<SYSTEM32>\oleaccrc.dll
<SYSTEM32>\oddbse32.dll
<SYSTEM32>\odbccp32.dll
<SYSTEM32>\odbccr32.dll
<SYSTEM32>\odbcconf.exe
<SYSTEM32>\odbccp32.cpl
<SYSTEM32>\odbccu32.dll
<SYSTEM32>\odbcp32r.dll
<SYSTEM32>\odbctrac.dll
<SYSTEM32>\odbcji32.dll
<SYSTEM32>\odbcjt32.dll
<SYSTEM32>\olepro32.dll
<SYSTEM32>\paqsp.dll
<SYSTEM32>\pathping.exe
<SYSTEM32>\packager.exe
<SYSTEM32>\panmap.dll
<SYSTEM32>\pautoenr.dll
<SYSTEM32>\perfctrs.dll
<SYSTEM32>\perfdisk.dll
<SYSTEM32>\pdh.dll
<SYSTEM32>\pentnt.exe
<SYSTEM32>\p2psvc.dll
<SYSTEM32>\osk.exe
<SYSTEM32>\osuninst.dll
<SYSTEM32>\openfiles.exe
<SYSTEM32>\opengl32.dll
<SYSTEM32>\osuninst.exe
<SYSTEM32>\p2pgraph.dll
<SYSTEM32>\p2pnetsh.dll
<SYSTEM32>\p2p.dll
<SYSTEM32>\p2pgasvc.dll
<SYSTEM32>\msvidc32.dll
<SYSTEM32>\mscms.dll
<SYSTEM32>\msconf.dll
<SYSTEM32>\msaudite.dll
<SYSTEM32>\mscat32.dll
<SYSTEM32>\mscoree.dll
<SYSTEM32>\mscpx32r.dLL
<SYSTEM32>\mscpxl32.dLL
<SYSTEM32>\mscorier.dll
<SYSTEM32>\mscories.dll
<SYSTEM32>\msaud32.acm
<SYSTEM32>\mrinfo.exe
<SYSTEM32>\msaatext.dll
<SYSTEM32>\mqupgrd.dll
<SYSTEM32>\mqutil.dll
<SYSTEM32>\msacm32.drv
<SYSTEM32>\msafd.dll
<SYSTEM32>\msapsspc.dll
<SYSTEM32>\msadds32.ax
<SYSTEM32>\msadp32.acm
<SYSTEM32>\MSCTFIME.IME
<SYSTEM32>\msencode.dll
<SYSTEM32>\msexch40.dll
<SYSTEM32>\msdxm.ocx
<SYSTEM32>\msdxmlc.dll
<SYSTEM32>\msexcl40.dll
<SYSTEM32>\msg711.acm
<SYSTEM32>\msg723.acm
<SYSTEM32>\msftedit.dll
<SYSTEM32>\msg.exe
<SYSTEM32>\msdtcuiu.dll
<SYSTEM32>\msdart.dll
<SYSTEM32>\msdatsrc.tlb
<SYSTEM32>\MSCTFP.dll
<SYSTEM32>\msdadiag.dll
<SYSTEM32>\msdmo.dll
<SYSTEM32>\msdtcprx.dll
<SYSTEM32>\msdtctm.dll
<SYSTEM32>\msdtc.exe
<SYSTEM32>\msdtclog.dll
<SYSTEM32>\mpg4dmod.dll
<SYSTEM32>\mpg4ds32.ax
<SYSTEM32>\mpeg2data.ax
<SYSTEM32>\mpg2splt.ax
<SYSTEM32>\mplay32.exe
<SYSTEM32>\mprdim.dll
<SYSTEM32>\mprmsg.dll
<SYSTEM32>\mpnotify.exe
<SYSTEM32>\mprddm.dll
<SYSTEM32>\mp4sdmod.dll
<SYSTEM32>\mode.com
<SYSTEM32>\modemui.dll
<SYSTEM32>\mobsync.dll
<SYSTEM32>\mobsync.exe
<SYSTEM32>\modex.dll
<SYSTEM32>\mountvol.exe
<SYSTEM32>\mp43dmod.dll
<SYSTEM32>\more.com
<SYSTEM32>\moricons.dll
<SYSTEM32>\mqad.dll
<SYSTEM32>\mqrt.dll
<SYSTEM32>\mqrtdep.dll
<SYSTEM32>\mqperf.dll
<SYSTEM32>\mqqm.dll
<SYSTEM32>\mqsec.dll
<SYSTEM32>\mqtgsvc.exe
<SYSTEM32>\mqtrig.dll
<SYSTEM32>\mqsnap.dll
<SYSTEM32>\mqsvc.exe
<SYSTEM32>\mqoa20.tlb
<SYSTEM32>\mqdscli.dll
<SYSTEM32>\mqgentr.dll
<SYSTEM32>\mqbkup.exe
<SYSTEM32>\mqcertui.dll
<SYSTEM32>\mqise.dll
<SYSTEM32>\mqoa.tlb
<SYSTEM32>\mqoa10.tlb
<SYSTEM32>\mqlogmgr.dll
<SYSTEM32>\mqoa.dll
<SYSTEM32>\msscp.dll
<SYSTEM32>\msscript.ocx
<SYSTEM32>\mssap.dll
<SYSTEM32>\msscds32.ax
<SYSTEM32>\mssign32.dll
<SYSTEM32>\msswchx.exe
<SYSTEM32>\mstask.dll
<SYSTEM32>\mssip32.dll
<SYSTEM32>\msswch.dll
<SYSTEM32>\msrle32.dll
<SYSTEM32>\msratelc.dll
<SYSTEM32>\msrating.dll
<SYSTEM32>\msr2c.dll
<SYSTEM32>\msr2cenu.dll
<SYSTEM32>\msrclr40.dll
<SYSTEM32>\msrecr40.dll
<SYSTEM32>\msrepl40.dll
<SYSTEM32>\msrd2x40.dll
<SYSTEM32>\msrd3x40.dll
<SYSTEM32>\mstext40.dll
<SYSTEM32>\msvcr100d.dll
<SYSTEM32>\msvcr100_clr0400.dll
<SYSTEM32>\msvcp71.dll
<SYSTEM32>\msvcr100.dll
<SYSTEM32>\msvcr70.dll
<SYSTEM32>\msvcrt40.dll
<SYSTEM32>\msvfw32.dll
<SYSTEM32>\msvcr71.dll
<SYSTEM32>\msvcrt20.dll
<SYSTEM32>\msvcp50.dll
<SYSTEM32>\mstsc.exe
<SYSTEM32>\mstscax.dll
<SYSTEM32>\mstime.dll
<SYSTEM32>\mstinit.exe
<SYSTEM32>\msvbvm50.dll
<SYSTEM32>\msvcp100.dll
<SYSTEM32>\msvcp100d.dll
<SYSTEM32>\msvbvm60.dll
<SYSTEM32>\msvcirt.dll
<SYSTEM32>\msieftp.dll
<SYSTEM32>\msiexec.exe
<SYSTEM32>\msident.dll
<SYSTEM32>\msidntld.dll
<SYSTEM32>\msihnd.dll
<SYSTEM32>\msisip.dll
<SYSTEM32>\msjet40.dll
<SYSTEM32>\msimsg.dll
<SYSTEM32>\MSIMTF.dll
<SYSTEM32>\mshtmler.dll
<SYSTEM32>\msh261.drv
<SYSTEM32>\msh263.drv
<SYSTEM32>\msgsm32.acm
<SYSTEM32>\msgsvc.dll
<SYSTEM32>\mshearts.exe
<SYSTEM32>\mshtml.tlb
<SYSTEM32>\mshtmled.dll
<SYSTEM32>\mshta.exe
<SYSTEM32>\mshtml.dll
<SYSTEM32>\msjetoledb40.dll
<SYSTEM32>\msorcl32.dll
<SYSTEM32>\mspaint.exe
<SYSTEM32>\msoert2.dll
<SYSTEM32>\msorc32r.dll
<SYSTEM32>\mspatcha.dll
<SYSTEM32>\mspmsp.dll
<SYSTEM32>\msports.dll
<SYSTEM32>\mspbde40.dll
<SYSTEM32>\mspmsnsv.dll
<SYSTEM32>\msoeacct.dll
<SYSTEM32>\msjtes40.dll
<SYSTEM32>\mslbui.dll
<SYSTEM32>\msjint40.dll
<SYSTEM32>\msjter40.dll
<SYSTEM32>\msls31.dll
<SYSTEM32>\msnsspc.dll
<SYSTEM32>\msobjs.dll
<SYSTEM32>\msltus40.dll
<SYSTEM32>\msnetobj.dll
<SYSTEM32>\termmgr.dll
<SYSTEM32>\tftp.exe
<SYSTEM32>\telephon.cpl
<SYSTEM32>\telnet.exe
<SYSTEM32>\timedate.cpl
<SYSTEM32>\tlntsvr.exe
<SYSTEM32>\tlntsvrp.dll
<SYSTEM32>\tlntadmn.exe
<SYSTEM32>\tlntsess.exe
<SYSTEM32>\tdc.ocx
<SYSTEM32>\tasklist.exe
<SYSTEM32>\taskman.exe
<SYSTEM32>\tapiui.dll
<SYSTEM32>\taskkill.exe
<SYSTEM32>\taskmgr.exe
<SYSTEM32>\tcpmonui.dll
<SYSTEM32>\tcpsvcs.exe
<SYSTEM32>\tcmsetup.exe
<SYSTEM32>\tcpmib.dll
<SYSTEM32>\tourstart.exe
<SYSTEM32>\tsdiscon.exe
<SYSTEM32>\tskill.exe
<SYSTEM32>\tsd32.dll
<SYSTEM32>\tsddd.dll
<SYSTEM32>\tsshutdn.exe
<SYSTEM32>\twext.dll
<SYSTEM32>\txflog.dll
<SYSTEM32>\tssoft32.acm
<SYSTEM32>\TsWpfWrp.exe
<SYSTEM32>\tscupgrd.exe
<SYSTEM32>\tracert6.exe
<SYSTEM32>\traffic.dll
<SYSTEM32>\tracerpt.exe
<SYSTEM32>\tracert.exe
<SYSTEM32>\tree.com
<SYSTEM32>\tscfgwmi.dll
<SYSTEM32>\tscon.exe
<SYSTEM32>\tsappcmp.dll
<SYSTEM32>\tsbyuv.dll
<SYSTEM32>\stclient.dll
<SYSTEM32>\stdole2.tlb
<SYSTEM32>\ssstars.scr
<SYSTEM32>\sstext3d.scr
<SYSTEM32>\stdole32.tlb
<SYSTEM32>\sti_ci.dll
<SYSTEM32>\storprop.dll
<SYSTEM32>\sti.dll
<SYSTEM32>\stimon.exe
<SYSTEM32>\sspipes.scr
<SYSTEM32>\srrstr.dll
<SYSTEM32>\ss3dfo.scr
<SYSTEM32>\sqlwoa.dll
<SYSTEM32>\srclient.dll
<SYSTEM32>\ssbezier.scr
<SYSTEM32>\ssmypics.scr
<SYSTEM32>\ssmyst.scr
<SYSTEM32>\ssflwbox.scr
<SYSTEM32>\ssmarque.scr
<SYSTEM32>\streamci.dll
<SYSTEM32>\sysocmgr.exe
<SYSTEM32>\syssetup.dll
<SYSTEM32>\syskey.exe
<SYSTEM32>\sysmon.ocx
<SYSTEM32>\systeminfo.exe
<SYSTEM32>\tapi3.dll
<SYSTEM32>\tapiperf.dll
<SYSTEM32>\systray.exe
<SYSTEM32>\t2embed.dll
<SYSTEM32>\sysinv.dll
<SYSTEM32>\subst.exe
<SYSTEM32>\svcpack.dll
<SYSTEM32>\strmdll.dll
<SYSTEM32>\strmfilt.dll
<SYSTEM32>\swprv.dll
<SYSTEM32>\syncui.dll
<SYSTEM32>\sysdm.cpl
<SYSTEM32>\syncapp.exe
<SYSTEM32>\synceng.dll
<SYSTEM32>\vfp9r.dll
<SYSTEM32>\vfp9renu.dll
<SYSTEM32>\verifier.dll
<SYSTEM32>\verifier.exe
<SYSTEM32>\vfp9rrus.dll
<SYSTEM32>\vga256.dll
<SYSTEM32>\vga64k.dll
<SYSTEM32>\vfp9t.dll
<SYSTEM32>\vfpodbc.dll
<SYSTEM32>\vdmredir.dll
<SYSTEM32>\vcl120.bpl
<SYSTEM32>\vcl60.bpl
<SYSTEM32>\vcdex.dll
<SYSTEM32>\vcl100.bpl
<SYSTEM32>\vcl70.bpl
<SYSTEM32>\vcomp100.dll
<SYSTEM32>\vdmdbg.dll
<SYSTEM32>\vcl90.bpl
<SYSTEM32>\vclx60.bpl
<SYSTEM32>\vjoy.dll
<SYSTEM32>\wextract.exe
<SYSTEM32>\wiaacmgr.exe
<SYSTEM32>\webhits.dll
<SYSTEM32>\webvw.dll
<SYSTEM32>\wiadefui.dll
<SYSTEM32>\wiaservc.dll
<SYSTEM32>\wiasf.ax
<SYSTEM32>\wiadss.dll
<SYSTEM32>\wiascr.dll
<SYSTEM32>\wdmaud.drv
<SYSTEM32>\vss_ps.dll
<SYSTEM32>\vwipxspx.dll
<SYSTEM32>\vssadmin.exe
<SYSTEM32>\vssvc.exe
<SYSTEM32>\w32tm.exe
<SYSTEM32>\watchdog.sys
<SYSTEM32>\wavemsp.dll
<SYSTEM32>\w32topl.dll
<SYSTEM32>\w3ssl.dll
<SYSTEM32>\upnpui.dll
<SYSTEM32>\ups.exe
<SYSTEM32>\upnpcont.exe
<SYSTEM32>\upnphost.dll
<SYSTEM32>\ureg.dll
<SYSTEM32>\usrcntra.dll
<SYSTEM32>\usrcoina.dll
<SYSTEM32>\userinit.exe
<SYSTEM32>\usp10.dll
<SYSTEM32>\untfs.dll
<SYSTEM32>\ufat.dll
<SYSTEM32>\UIAutomationCore.dll
<SYSTEM32>\typeperf.exe
<SYSTEM32>\udhisapi.dll
<SYSTEM32>\ulib.dll
<SYSTEM32>\unimdmat.dll
<SYSTEM32>\unlodctr.exe
<SYSTEM32>\umandlg.dll
<SYSTEM32>\umdmxfrm.dll
<SYSTEM32>\usrdpa.dll
<SYSTEM32>\usrvpa.dll
<SYSTEM32>\ut.dll
<SYSTEM32>\usrv80a.dll
<SYSTEM32>\usrvoica.dll
<SYSTEM32>\utildll.dll
<SYSTEM32>\vbicodec.ax
<SYSTEM32>\vbisurf.ax
<SYSTEM32>\utilman.exe
<SYSTEM32>\vbajet32.dll
<SYSTEM32>\usrv42a.dll
<SYSTEM32>\usrlbva.dll
<SYSTEM32>\usrmlnka.exe
<SYSTEM32>\usrdtea.dll
<SYSTEM32>\usrfaxa.dll
<SYSTEM32>\usrprbda.exe
<SYSTEM32>\usrshuta.exe
<SYSTEM32>\usrsvpia.dll
<SYSTEM32>\usrrtosa.dll
<SYSTEM32>\usrsdpia.dll
<SYSTEM32>\sqlwid.dll
<SYSTEM32>\rpcns4.dll
<SYSTEM32>\rsfsaps.dll
<SYSTEM32>\routemon.exe
<SYSTEM32>\routetab.dll
<SYSTEM32>\rsh.exe
<SYSTEM32>\rsmps.dll
<SYSTEM32>\rsmsink.exe
<SYSTEM32>\rshx32.dll
<SYSTEM32>\rsm.exe
<SYSTEM32>\route.exe
<SYSTEM32>\remotesp.tsp
<SYSTEM32>\rend.dll
<SYSTEM32>\relog.exe
<SYSTEM32>\remotepg.dll
<SYSTEM32>\replace.exe
<SYSTEM32>\rgb9rast_2.dll
<SYSTEM32>\rnr20.dll
<SYSTEM32>\reset.exe
<SYSTEM32>\rexec.exe
<SYSTEM32>\rsmui.exe
<SYSTEM32>\rtl90.bpl
<SYSTEM32>\rtm.dll
<SYSTEM32>\rtl60.bpl
<SYSTEM32>\rtl70.bpl
<SYSTEM32>\runas.exe
<SYSTEM32>\rwinsta.exe
<SYSTEM32>\safrcdlg.dll
<SYSTEM32>\rundll32.exe
<SYSTEM32>\runonce.exe
<SYSTEM32>\rtl120.bpl
<SYSTEM32>\rsvp.exe
<SYSTEM32>\rsvpmsg.dll
<SYSTEM32>\rsnotify.exe
<SYSTEM32>\rsopprov.exe
<SYSTEM32>\rsvpperf.dll
<SYSTEM32>\rtipxmib.dll
<SYSTEM32>\rtl100.bpl
<SYSTEM32>\rsvpsp.dll
<SYSTEM32>\rtcshare.exe
<SYSTEM32>\rasautou.exe
<SYSTEM32>\rasctrs.dll
<SYSTEM32>\racpldlg.dll
<SYSTEM32>\rasauto.dll
<SYSTEM32>\rasdial.exe
<SYSTEM32>\rasphone.exe
<SYSTEM32>\rasrad.dll
<SYSTEM32>\rasmontr.dll
<SYSTEM32>\rasmxs.dll
<SYSTEM32>\qwinsta.exe
<SYSTEM32>\qmgr.dll
<SYSTEM32>\qmgrprxy.dll
<SYSTEM32>\qedit.dll
<SYSTEM32>\qedwipes.dll
<SYSTEM32>\qosname.dll
<SYSTEM32>\quartz.dll
<SYSTEM32>\query.dll
<SYSTEM32>\qprocess.exe
<SYSTEM32>\qr.dll
<SYSTEM32>\rassapi.dll
<SYSTEM32>\recover.exe
<SYSTEM32>\reg.exe
<SYSTEM32>\rdsaddin.exe
<SYSTEM32>\rdshost.exe
<SYSTEM32>\regedt32.exe
<SYSTEM32>\regwiz.exe
<SYSTEM32>\regwizc.dll
<SYSTEM32>\regini.exe
<SYSTEM32>\regsvr32.exe
<SYSTEM32>\rdpwsx.dll
<SYSTEM32>\rcimlby.exe
<SYSTEM32>\rcp.exe
<SYSTEM32>\rasser.dll
<SYSTEM32>\rcbdyctl.dll
<SYSTEM32>\rdchost.dll
<SYSTEM32>\rdpdd.dll
<SYSTEM32>\rdpsnd.dll
<SYSTEM32>\rdpcfgex.dll
<SYSTEM32>\rdpclip.exe
<SYSTEM32>\slayerxp.dll
<SYSTEM32>\slbcsp.dll
<SYSTEM32>\skdll.dll
<SYSTEM32>\skeys.exe
<SYSTEM32>\slbiop.dll
<SYSTEM32>\smbinst.exe
<SYSTEM32>\smlogcfg.dll
<SYSTEM32>\slbrccsp.dll
<SYSTEM32>\sl_anet.acm
<SYSTEM32>\sisbkup.dll
<SYSTEM32>\shmgrate.exe
<SYSTEM32>\shrpubw.exe
<SYSTEM32>\shimgvw.dll
<SYSTEM32>\shmedia.dll
<SYSTEM32>\shscrap.dll
<SYSTEM32>\sigverif.exe
<SYSTEM32>\simpdata.tlb
<SYSTEM32>\shutdown.exe
<SYSTEM32>\sigtab.dll
<SYSTEM32>\smlogsvc.exe
<SYSTEM32>\sprio600.dll
<SYSTEM32>\sprio800.dll
<SYSTEM32>\spnpinst.exe
<SYSTEM32>\sprestrt.exe
<SYSTEM32>\spupdsvc.exe
<SYSTEM32>\sqlsrv32.rll
<SYSTEM32>\sqlunirl.dll
<SYSTEM32>\spxcoins.dll
<SYSTEM32>\sqlsrv32.dll
<SYSTEM32>\spnike.dll
<SYSTEM32>\snmpapi.dll
<SYSTEM32>\snmpsnap.dll
<SYSTEM32>\sndrec32.exe
<SYSTEM32>\sndvol32.exe
<SYSTEM32>\softpub.dll
<SYSTEM32>\spider.exe
<SYSTEM32>\spiisupd.exe
<SYSTEM32>\sol.exe
<SYSTEM32>\sort.exe
<SYSTEM32>\sclgntfy.dll
<SYSTEM32>\scredir.dll
<SYSTEM32>\sccsccp.dll
<SYSTEM32>\schtasks.exe
<SYSTEM32>\scriptpw.dll
<SYSTEM32>\sdhcinst.dll
<SYSTEM32>\sdpblb.dll
<SYSTEM32>\scrnsave.scr
<SYSTEM32>\sdbinst.exe
<SYSTEM32>\sccbase.dll
<SYSTEM32>\savedump.exe
<SYSTEM32>\sbe.dll
<SYSTEM32>\safrdm.dll
<SYSTEM32>\safrslv.dll
<SYSTEM32>\sbeio.dll
<SYSTEM32>\scardssp.dll
<SYSTEM32>\scardsvr.exe
<SYSTEM32>\sc.exe
<SYSTEM32>\scarddlg.dll
<SYSTEM32>\secedit.exe
<SYSTEM32>\sfc.exe
<SYSTEM32>\sfcfiles.dll
<SYSTEM32>\setup.exe
<SYSTEM32>\setupdll.dll
<SYSTEM32>\sfmapi.dll
<SYSTEM32>\shfolder.dll
<SYSTEM32>\shgina.dll
<SYSTEM32>\shadow.exe
<SYSTEM32>\shellstyle.dll
<SYSTEM32>\sethc.exe
<SYSTEM32>\sendmail.dll
<SYSTEM32>\sensapi.dll
<SYSTEM32>\security.dll
<SYSTEM32>\sendcmsg.dll
<SYSTEM32>\senscfg.dll
<SYSTEM32>\serwvdrv.dll
<SYSTEM32>\sessmgr.exe
<SYSTEM32>\serialui.dll
<SYSTEM32>\servdeps.dll
<SYSTEM32>\dinput8.dll
<SYSTEM32>\diskcomp.com
<SYSTEM32>\dimap.dll
<SYSTEM32>\dinput.dll
<SYSTEM32>\diskcopy.com
<SYSTEM32>\diskperf.exe
<SYSTEM32>\dispex.dll
<SYSTEM32>\diskcopy.dll
<SYSTEM32>\diskpart.exe
<SYSTEM32>\digest.dll
<SYSTEM32>\dgnet.dll
<SYSTEM32>\dgrpsetu.dll
<SYSTEM32>\dfshim.dll
<SYSTEM32>\dfsshlex.dll
<SYSTEM32>\dgsetup.dll
<SYSTEM32>\diactfrm.dll
<SYSTEM32>\diantz.exe
<SYSTEM32>\dhcpmon.dll
<SYSTEM32>\dhcpsapi.dll
<SYSTEM32>\dllhost.exe
<SYSTEM32>\dmremote.exe
<SYSTEM32>\dmscript.dll
<SYSTEM32>\dmloader.dll
<SYSTEM32>\dmocx.dll
<SYSTEM32>\dmstyle.dll
<SYSTEM32>\dmutil.dll
<SYSTEM32>\dmview.ocx
<SYSTEM32>\dmsynth.dll
<SYSTEM32>\dmusic.dll
<SYSTEM32>\dmintf.dll
<SYSTEM32>\dmband.dll
<SYSTEM32>\dmcompos.dll
<SYSTEM32>\dllhst3g.exe
<SYSTEM32>\dmadmin.exe
<SYSTEM32>\dmconfig.dll
<SYSTEM32>\dmdskres.dll
<SYSTEM32>\dmime.dll
<SYSTEM32>\dmdlgs.dll
<SYSTEM32>\dmdskmgr.dll
<SYSTEM32>\d3dxof.dll
<SYSTEM32>\danim.dll
<SYSTEM32>\d3dramp.dll
<SYSTEM32>\d3drm.dll
<SYSTEM32>\dataclen.dll
<SYSTEM32>\dbgeng.dll
<SYSTEM32>\dbghelp.dll
<SYSTEM32>\datime.dll
<SYSTEM32>\daxctle.ocx
<SYSTEM32>\d3dpmesh.dll
<SYSTEM32>\ctl3d32.dll
<SYSTEM32>\cygwin1.dll
<SYSTEM32>\cryptnet.dll
<SYSTEM32>\csseqchk.dll
<SYSTEM32>\d3d8.dll
<SYSTEM32>\d3dim.dll
<SYSTEM32>\d3dim700.dll
<SYSTEM32>\d3d8thk.dll
<SYSTEM32>\d3d9.dll
<SYSTEM32>\dbmsrpcn.dll
<SYSTEM32>\devenum.dll
<SYSTEM32>\devmgr.dll
<SYSTEM32>\deskmon.dll
<SYSTEM32>\deskperf.dll
<SYSTEM32>\dfrgfat.exe
<SYSTEM32>\dfrgsnap.dll
<SYSTEM32>\dfrgui.dll
<SYSTEM32>\dfrgntfs.exe
<SYSTEM32>\dfrgres.dll
<SYSTEM32>\deskadp.dll
<SYSTEM32>\dciman32.dll
<SYSTEM32>\dcomcnfg.exe
<SYSTEM32>\dbnetlib.dll
<SYSTEM32>\dbnmpntw.dll
<SYSTEM32>\ddeshare.exe
<SYSTEM32>\defrag.exe
<SYSTEM32>\desk.cpl
<SYSTEM32>\ddraw.dll
<SYSTEM32>\ddrawex.dll
<SYSTEM32>\dxmasf.dll
<SYSTEM32>\dxtmsft.dll
<SYSTEM32>\dxdiag.exe
<SYSTEM32>\dxdiagn.dll
<SYSTEM32>\dxtrans.dll
<SYSTEM32>\els.dll
<SYSTEM32>\encapi.dll
<SYSTEM32>\dxva2.dll
<SYSTEM32>\efsadu.dll
<SYSTEM32>\dx8vb.dll
<SYSTEM32>\dswave.dll
<SYSTEM32>\dumprep.exe
<SYSTEM32>\dssec.dll
<SYSTEM32>\dsuiext.dll
<SYSTEM32>\duser.dll
<SYSTEM32>\dwwin.exe
<SYSTEM32>\dx7vb.dll
<SYSTEM32>\dvdplay.exe
<SYSTEM32>\dvdupgrd.exe
<SYSTEM32>\encdec.dll
<SYSTEM32>\extmgr.dll
<SYSTEM32>\extrac32.exe
<SYSTEM32>\expand.exe
<SYSTEM32>\expsrv.dll
<SYSTEM32>\exts.dll
<SYSTEM32>\fde.dll
<SYSTEM32>\fdeploy.dll
<SYSTEM32>\faultrep.dll
<SYSTEM32>\fc.exe
<SYSTEM32>\evr.dll
<SYSTEM32>\esentprf.dll
<SYSTEM32>\esentutl.exe
<SYSTEM32>\EqnClass.Dll
<SYSTEM32>\esent97.dll
<SYSTEM32>\eudcedit.exe
<SYSTEM32>\eventtriggers.exe
<SYSTEM32>\eventvwr.exe
<SYSTEM32>\eventcls.dll
<SYSTEM32>\eventcreate.exe
<SYSTEM32>\dpnlobby.dll
<SYSTEM32>\dpnmodem.dll
<SYSTEM32>\dpnhpast.dll
<SYSTEM32>\dpnhupnp.dll
<SYSTEM32>\dpnsvr.exe
<SYSTEM32>\dpvacm.dll
<SYSTEM32>\dpvoice.dll
<SYSTEM32>\dpnwsock.dll
<SYSTEM32>\dpserial.dll
<SYSTEM32>\dpnet.dll
<SYSTEM32>\doskey.exe
<SYSTEM32>\dpcdll.dll
<SYSTEM32>\docprop.dll
<SYSTEM32>\docprop2.dll
<SYSTEM32>\dplay.dll
<SYSTEM32>\dpmodemx.dll
<SYSTEM32>\dpnaddr.dll
<SYSTEM32>\dplaysvr.exe
<SYSTEM32>\dplayx.dll
<SYSTEM32>\dpvsetup.exe
<SYSTEM32>\dskquota.dll
<SYSTEM32>\dskquoui.dll
<SYSTEM32>\dsdmo.dll
<SYSTEM32>\dsdmoprp.dll
<SYSTEM32>\dsound.dll
<SYSTEM32>\dsprpres.dll
<SYSTEM32>\dsquery.dll
<SYSTEM32>\dsound3d.dll
<SYSTEM32>\dsprop.dll
<SYSTEM32>\dsauth.dll
<SYSTEM32>\dpwsockx.dll
<SYSTEM32>\driverquery.exe
<SYSTEM32>\dpvvox.dll
<SYSTEM32>\dpwsock.dll
<SYSTEM32>\drmclien.dll
<SYSTEM32>\drwtsn32.exe
<SYSTEM32>\ds32gt.dll
<SYSTEM32>\drmstor.dll
<SYSTEM32>\drmv2clt.dll
<SYSTEM32>\cryptext.dll
<SYSTEM32>\attrib.exe
<SYSTEM32>\audiosrv.dll
<SYSTEM32>\atmpvcno.dll
<SYSTEM32>\atrace.dll
<SYSTEM32>\auditusr.exe
<SYSTEM32>\autodisc.dll
<SYSTEM32>\autofmt.exe
<SYSTEM32>\autochk.exe
<SYSTEM32>\autoconv.exe
<SYSTEM32>\atmlib.dll
<SYSTEM32>\asr_ldm.exe
<SYSTEM32>\asr_pfu.exe
<SYSTEM32>\aspnet_counters.dll
<SYSTEM32>\asr_fmt.exe
<SYSTEM32>\asycfilt.dll
<SYSTEM32>\atl100.dll
<SYSTEM32>\atmadm.exe
<SYSTEM32>\at.exe
<SYSTEM32>\atkctrs.dll
<SYSTEM32>\autolfn.exe
<SYSTEM32>\bootok.exe
<SYSTEM32>\bootvid.dll
<SYSTEM32>\blastcln.exe
<SYSTEM32>\bootcfg.exe
<SYSTEM32>\bootvrfy.exe
<SYSTEM32>\browsewm.dll
<SYSTEM32>\bthci.dll
<SYSTEM32>\borlndmm.dll
<SYSTEM32>\browselc.dll
<SYSTEM32>\blackbox.dll
<SYSTEM32>\avmeter.dll
<SYSTEM32>\avtapi.dll
<SYSTEM32>\avicap32.dll
<SYSTEM32>\avifil32.dll
<SYSTEM32>\avwav.dll
<SYSTEM32>\bitsprx2.dll
<SYSTEM32>\bitsprx3.dll
<SYSTEM32>\batt.dll
<SYSTEM32>\bidispl.dll
<SYSTEM32>\aaaamon.dll
<SYSTEM32>\access.cpl
%WINDIR%\system\WINSPOOL.DRV
<SYSTEM32>\6to4svc.dll
<SYSTEM32>\acctres.dll
<SYSTEM32>\acledit.dll
<SYSTEM32>\aclui.dll
<SYSTEM32>\accwiz.exe
<SYSTEM32>\acelpdec.ax
%WINDIR%\winhlp32.exe
%WINDIR%\regedit.exe
%WINDIR%\sfk.exe
%WINDIR%\hh.exe
%WINDIR%\NOTEPAD.EXE
%WINDIR%\sleep.exe
%WINDIR%\twunk_32.exe
%WINDIR%\vmmreg32.dll
%WINDIR%\TASKMAN.EXE
%WINDIR%\twain_32.dll
<SYSTEM32>\activeds.tlb
<SYSTEM32>\apcups.dll
<SYSTEM32>\appmgmts.dll
<SYSTEM32>\alrsvc.dll
<SYSTEM32>\amstream.dll
<SYSTEM32>\appmgr.dll
<SYSTEM32>\asctrls.ocx
<SYSTEM32>\asferror.dll
<SYSTEM32>\appwiz.cpl
<SYSTEM32>\arp.exe
<SYSTEM32>\ahui.exe
<SYSTEM32>\adptif.dll
<SYSTEM32>\adsldp.dll
<SYSTEM32>\actmovie.exe
<SYSTEM32>\admparse.dll
<SYSTEM32>\adsmsext.dll
<SYSTEM32>\adsnw.dll
<SYSTEM32>\advpack.dll
<SYSTEM32>\adsnds.dll
<SYSTEM32>\adsnt.dll
<SYSTEM32>\cmdial32.dll
<SYSTEM32>\cmdl32.exe
<SYSTEM32>\clipsrv.exe
<SYSTEM32>\cmcfg32.dll
<SYSTEM32>\cmmon32.exe
<SYSTEM32>\cmsetACL.dll
<SYSTEM32>\cmstp.exe
<SYSTEM32>\cmpbk32.dll
<SYSTEM32>\cmprops.dll
<SYSTEM32>\clipbrd.exe
<SYSTEM32>\ckcnv.exe
<SYSTEM32>\clb.dll
<SYSTEM32>\cipher.exe
<SYSTEM32>\cisvc.exe
<SYSTEM32>\clbcatex.dll
<SYSTEM32>\cliconfg.exe
<SYSTEM32>\cliconfg.rll
<SYSTEM32>\cleanmgr.exe
<SYSTEM32>\cliconfg.dll
<SYSTEM32>\cmutil.dll
<SYSTEM32>\conime.exe
<SYSTEM32>\console.dll
<SYSTEM32>\comuid.dll
<SYSTEM32>\confmsp.dll
<SYSTEM32>\control.exe
<SYSTEM32>\crtdll.dll
<SYSTEM32>\cryptdlg.dll
<SYSTEM32>\convert.exe
<SYSTEM32>\corpol.dll
<SYSTEM32>\comsnap.dll
<SYSTEM32>\comaddin.dll
<SYSTEM32>\comcat.dll
<SYSTEM32>\cnetcfg.dll
<SYSTEM32>\cnvfat.dll
<SYSTEM32>\comp.exe
<SYSTEM32>\compstui.dll
<SYSTEM32>\comrepl.dll
<SYSTEM32>\compact.exe
<SYSTEM32>\compatUI.dll
<SYSTEM32>\cc3250.dll
<SYSTEM32>\cc3250mt.dll
<SYSTEM32>\catsrvps.dll
<SYSTEM32>\catsrvut.dll
<SYSTEM32>\cc3260.dll
<SYSTEM32>\cc3270mt.dll
<SYSTEM32>\cc3280.dll
<SYSTEM32>\cc3260mt.dll
<SYSTEM32>\cc3270.dll
<SYSTEM32>\catsrv.dll
<SYSTEM32>\btpanui.dll
<SYSTEM32>\cabview.dll
<SYSTEM32>\bthprops.cpl
<SYSTEM32>\bthserv.dll
<SYSTEM32>\cacls.exe
<SYSTEM32>\capesnpn.dll
<SYSTEM32>\cards.dll
<SYSTEM32>\calc.exe
<SYSTEM32>\camocx.dll
<SYSTEM32>\cc3280mt.dll
<SYSTEM32>\chcp.com
<SYSTEM32>\chkdsk.exe
<SYSTEM32>\cfgmgr32.dll
<SYSTEM32>\charmap.exe
<SYSTEM32>\chkntfs.exe
<SYSTEM32>\cidaemon.exe
<SYSTEM32>\ciodm.dll
<SYSTEM32>\ciadmin.dll
<SYSTEM32>\cic.dll
<SYSTEM32>\cfgbkend.dll
<SYSTEM32>\ccfgnt.dll
<SYSTEM32>\cdfview.dll
<SYSTEM32>\cc3290.dll
<SYSTEM32>\cc3290mt.dll
<SYSTEM32>\cdm.dll
<SYSTEM32>\certmgr.dll
<SYSTEM32>\cewmdm.dll
<SYSTEM32>\cdmodem.dll
<SYSTEM32>\cdosys.dll
<SYSTEM32>\langwrbk.dll
<SYSTEM32>\laprxy.dll
<SYSTEM32>\l3codecx.ax
<SYSTEM32>\label.exe
<SYSTEM32>\libdns.dll
<SYSTEM32>\libgnarl-2009.dll
<SYSTEM32>\libgnat-2009.dll
<SYSTEM32>\libeay32.dll
<SYSTEM32>\libgcc_s.dll
<SYSTEM32>\l3codeca.acm
<SYSTEM32>\kbdus.dll
<SYSTEM32>\kbdusl.dll
<SYSTEM32>\kbduk.dll
<SYSTEM32>\kbdukx.dll
<SYSTEM32>\kbdusr.dll
<SYSTEM32>\kdcom.dll
<SYSTEM32>\keymgr.dll
<SYSTEM32>\kbdusx.dll
<SYSTEM32>\kd1394.dll
<SYSTEM32>\libiconv-2.dll
<SYSTEM32>\licwmi.dll
<SYSTEM32>\lights.exe
<SYSTEM32>\licdll.dll
<SYSTEM32>\licmgr10.dll
<SYSTEM32>\lmrt.dll
<SYSTEM32>\localsec.dll
<SYSTEM32>\localui.dll
<SYSTEM32>\lnkstub.exe
<SYSTEM32>\loadperf.dll
<SYSTEM32>\libxml2.dll
<SYSTEM32>\libintl3.dll
<SYSTEM32>\libisc.dll
<SYSTEM32>\libiconv2.dll
<SYSTEM32>\libintl-2.dll
<SYSTEM32>\libisccc.dll
<SYSTEM32>\libmysql.dll
<SYSTEM32>\libpq82.dll
<SYSTEM32>\libisccfg.dll
<SYSTEM32>\liblwres.dll
<SYSTEM32>\kbdfr.dll
<SYSTEM32>\kbdgae.dll
<SYSTEM32>\kbdfi1.dll
<SYSTEM32>\kbdfo.dll
<SYSTEM32>\kbdgr.dll
<SYSTEM32>\kbdinbe1.dll
<SYSTEM32>\kbdinben.dll
<SYSTEM32>\kbdgr1.dll
<SYSTEM32>\kbdic.dll
<SYSTEM32>\kbdfi.dll
<SYSTEM32>\kbdbr.dll
<SYSTEM32>\kbdca.dll
<SYSTEM32>\kbdbe.dll
<SYSTEM32>\kbdbene.dll
<SYSTEM32>\kbdcan.dll
<SYSTEM32>\kbdes.dll
<SYSTEM32>\kbdfc.dll
<SYSTEM32>\kbdda.dll
<SYSTEM32>\kbddv.dll
<SYSTEM32>\kbdinmal.dll
<SYSTEM32>\kbdpo.dll
<SYSTEM32>\kbdsf.dll
<SYSTEM32>\kbdno.dll
<SYSTEM32>\kbdno1.dll
<SYSTEM32>\kbdsg.dll
<SYSTEM32>\kbdsp.dll
<SYSTEM32>\kbdsw.dll
<SYSTEM32>\kbdsmsfi.dll
<SYSTEM32>\kbdsmsno.dll
<SYSTEM32>\kbdnec.dll
<SYSTEM32>\kbdit142.dll
<SYSTEM32>\kbdla.dll
<SYSTEM32>\kbdir.dll
<SYSTEM32>\kbdit.dll
<SYSTEM32>\kbdmac.dll
<SYSTEM32>\kbdmlt48.dll
<SYSTEM32>\kbdne.dll
<SYSTEM32>\kbdmaori.dll
<SYSTEM32>\kbdmlt47.dll
<SYSTEM32>\mfc71u.dll
<SYSTEM32>\mfcm100.dll
<SYSTEM32>\mfc42u.dll
<SYSTEM32>\mfc71.dll
<SYSTEM32>\mfcm100d.dll
<SYSTEM32>\mfcsubs.dll
<SYSTEM32>\mgmtapi.dll
<SYSTEM32>\mfcm100u.dll
<SYSTEM32>\mfcm100ud.dll
<SYSTEM32>\mfc40u.dll
<SYSTEM32>\mfc100ita.dll
<SYSTEM32>\mfc100jpn.dll
<SYSTEM32>\mfc100esn.dll
<SYSTEM32>\mfc100fra.dll
<SYSTEM32>\mfc100kor.dll
<SYSTEM32>\mfc100ud.dll
<SYSTEM32>\mfc40.dll
<SYSTEM32>\mfc100rus.dll
<SYSTEM32>\mfc100u.dll
<SYSTEM32>\midimap.dll
<SYSTEM32>\mmcshext.dll
<SYSTEM32>\mmdrv.dll
<SYSTEM32>\mmcbase.dll
<SYSTEM32>\mmcndmgr.dll
<SYSTEM32>\mmfutil.dll
<SYSTEM32>\mnmdd.dll
<SYSTEM32>\mnmsrvc.exe
<SYSTEM32>\mmsys.cpl
<SYSTEM32>\mmutilse.dll
<SYSTEM32>\mmc.exe
<SYSTEM32>\milcore.dll
<SYSTEM32>\mimefilt.dll
<SYSTEM32>\miglibnt.dll
<SYSTEM32>\migpwd.exe
<SYSTEM32>\mingwm10.dll
<SYSTEM32>\mll_mtf.dll
<SYSTEM32>\mll_qic.dll
<SYSTEM32>\mlang.dll
<SYSTEM32>\mll_hp.dll
<SYSTEM32>\lprmonui.dll
<SYSTEM32>\magnify.exe
<SYSTEM32>\lpr.exe
<SYSTEM32>\lprhelp.dll
<SYSTEM32>\mag_hook.dll
<SYSTEM32>\mapi32.dll
<SYSTEM32>\mapistub.dll
<SYSTEM32>\main.cpl
<SYSTEM32>\makecab.exe
<SYSTEM32>\lpq.exe
<SYSTEM32>\logagent.exe
<SYSTEM32>\loghours.dll
<SYSTEM32>\locator.exe
<SYSTEM32>\lodctr.exe
<SYSTEM32>\logman.exe
<SYSTEM32>\logonui.exe
<SYSTEM32>\lpk.dll
<SYSTEM32>\logoff.exe
<SYSTEM32>\logon.scr
<SYSTEM32>\mcastmib.dll
<SYSTEM32>\mf3216.dll
<SYSTEM32>\mfc100.dll
<SYSTEM32>\mdminst.dll
<SYSTEM32>\mdwmdmsp.dll
<SYSTEM32>\mfc100chs.dll
<SYSTEM32>\mfc100deu.dll
<SYSTEM32>\mfc100enu.dll
<SYSTEM32>\mfc100cht.dll
<SYSTEM32>\mfc100d.dll
<SYSTEM32>\mdhcp.dll
<SYSTEM32>\mchgrcoi.dll
<SYSTEM32>\mciavi32.dll
<SYSTEM32>\mcd32.dll
<SYSTEM32>\mcdsrv32.dll
<SYSTEM32>\mcicda.dll
<SYSTEM32>\mciseq.dll
<SYSTEM32>\mciwave.dll
<SYSTEM32>\mciole32.dll
<SYSTEM32>\mciqtz32.dll
<SYSTEM32>\jsproxy.dll
<SYSTEM32>\html.iec
<SYSTEM32>\httpapi.dll
<SYSTEM32>\hotplug.dll
<SYSTEM32>\hticons.dll
<SYSTEM32>\htui.dll
<SYSTEM32>\iasacct.dll
<SYSTEM32>\iasads.dll
<SYSTEM32>\hypertrm.dll
<SYSTEM32>\iac25_32.ax
<SYSTEM32>\hostname.exe
<SYSTEM32>\hdwwiz.cpl
<SYSTEM32>\help.exe
<SYSTEM32>\h323msp.dll
<SYSTEM32>\hal.dll
<SYSTEM32>\hhctrl.ocx
<SYSTEM32>\hnetmon.dll
<SYSTEM32>\hnetwiz.dll
<SYSTEM32>\hhsetup.dll
<SYSTEM32>\hlink.dll
<SYSTEM32>\iashlpr.dll
<SYSTEM32>\icm32.dll
<SYSTEM32>\icmp.dll
<SYSTEM32>\iccvid.dll
<SYSTEM32>\icfgnt5.dll
<SYSTEM32>\icmui.dll
<SYSTEM32>\idq.dll
<SYSTEM32>\ie4uinit.exe
<SYSTEM32>\icwdial.dll
<SYSTEM32>\icwphbk.dll
<SYSTEM32>\icardres.dll.mui
<SYSTEM32>\iasrad.dll
<SYSTEM32>\iasrecst.dll
<SYSTEM32>\iasnap.dll
<SYSTEM32>\iaspolcy.dll
<SYSTEM32>\iassam.dll
<SYSTEM32>\icardagt.exe
<SYSTEM32>\icardres.dll
<SYSTEM32>\iassdo.dll
<SYSTEM32>\iassvcs.dll
<SYSTEM32>\fontsub.dll
<SYSTEM32>\fontview.exe
<SYSTEM32>\fmifs.dll
<SYSTEM32>\fontext.dll
<SYSTEM32>\forcedos.exe
<SYSTEM32>\freecell.exe
<SYSTEM32>\fsquirt.exe
<SYSTEM32>\format.com
<SYSTEM32>\framebuf.dll
<SYSTEM32>\fltMc.exe
<SYSTEM32>\find.exe
<SYSTEM32>\findstr.exe
<SYSTEM32>\feclient.dll
<SYSTEM32>\filemgmt.dll
<SYSTEM32>\finger.exe
<SYSTEM32>\fldrclnr.dll
<SYSTEM32>\fltlib.dll
<SYSTEM32>\firewall.cpl
<SYSTEM32>\fixmapi.exe
<SYSTEM32>\fsusd.dll
<SYSTEM32>\gpkcsp.dll
<SYSTEM32>\gpkrsrc.dll
<SYSTEM32>\glu32.dll
<SYSTEM32>\gpedit.dll
<SYSTEM32>\gpresult.exe
<SYSTEM32>\graftabl.com
<SYSTEM32>\grpconv.exe
<SYSTEM32>\gptext.dll
<SYSTEM32>\gpupdate.exe
<SYSTEM32>\glmf32.dll
<SYSTEM32>\ftsrch.dll
<SYSTEM32>\fwcfg.dll
<SYSTEM32>\fsutil.exe
<SYSTEM32>\ftp.exe
<SYSTEM32>\g711codc.ax
<SYSTEM32>\getmac.exe
<SYSTEM32>\getuname.dll
<SYSTEM32>\gcdef.dll
<SYSTEM32>\gdiplus.dll
<SYSTEM32>\ir32_32.dll
<SYSTEM32>\ir41_32.ax
<SYSTEM32>\ipxsap.dll
<SYSTEM32>\ipxwan.dll
<SYSTEM32>\ir41_qc.dll
<SYSTEM32>\ir50_qc.dll
<SYSTEM32>\ir50_qcx.dll
<SYSTEM32>\ir41_qcx.dll
<SYSTEM32>\ir50_32.dll
<SYSTEM32>\ipxrtmgr.dll
<SYSTEM32>\ipsmsnap.dll
<SYSTEM32>\ipv6.exe
<SYSTEM32>\ipsec6.exe
<SYSTEM32>\ipsecsnp.dll
<SYSTEM32>\ipv6mon.dll
<SYSTEM32>\ipxrip.dll
<SYSTEM32>\ipxroute.exe
<SYSTEM32>\ipxmontr.dll
<SYSTEM32>\ipxpromn.dll
<SYSTEM32>\irclass.dll
<SYSTEM32>\jgmd400.dll
<SYSTEM32>\jgpl400.dll
<SYSTEM32>\jgaw400.dll
<SYSTEM32>\jgdw400.dll
<SYSTEM32>\jgsd400.dll
<SYSTEM32>\joy.cpl
<SYSTEM32>\jscript.dll
<SYSTEM32>\jgsh400.dll
<SYSTEM32>\jobexec.dll
<SYSTEM32>\jet500.dll
<SYSTEM32>\isrdbg32.dll
<SYSTEM32>\itircl.dll
<SYSTEM32>\irprops.cpl
<SYSTEM32>\isign32.dll
<SYSTEM32>\itss.dll
<SYSTEM32>\ixsso.dll
<SYSTEM32>\iyuv_32.dll
<SYSTEM32>\iuengine.dll
<SYSTEM32>\ivfsrc.ax
<SYSTEM32>\iissuba.dll
<SYSTEM32>\ils.dll
<SYSTEM32>\ifsutil.dll
<SYSTEM32>\igmpagnt.dll
<SYSTEM32>\imaadp32.acm
<SYSTEM32>\imgutil.dll
<SYSTEM32>\inetcfg.dll
<SYSTEM32>\imapi.exe
<SYSTEM32>\imeshare.dll
<SYSTEM32>\ifmon.dll
<SYSTEM32>\ieakui.dll
<SYSTEM32>\iedkcs32.dll
<SYSTEM32>\ieakeng.dll
<SYSTEM32>\ieaksie.dll
<SYSTEM32>\ieencode.dll
<SYSTEM32>\iesetup.dll
<SYSTEM32>\iexpress.exe
<SYSTEM32>\iepeers.dll
<SYSTEM32>\iernonce.dll
<SYSTEM32>\inetcomm.dll
<SYSTEM32>\iologmsg.dll
<SYSTEM32>\ipconfig.exe
<SYSTEM32>\inseng.dll
<SYSTEM32>\intl.cpl
<SYSTEM32>\ipmontr.dll
<SYSTEM32>\iprtprio.dll
<SYSTEM32>\iprtrmgr.dll
<SYSTEM32>\ippromon.dll
<SYSTEM32>\iprop.dll
<SYSTEM32>\input.dll
<SYSTEM32>\inetmib1.dll
<SYSTEM32>\inetppui.dll
<SYSTEM32>\inetcpl.cpl
<SYSTEM32>\inetcplc.dll
<SYSTEM32>\inetres.dll
<SYSTEM32>\infosoft.dll
<SYSTEM32>\initpki.dll
<SYSTEM32>\infocardapi.dll
<SYSTEM32>\infocardcpl.cpl

Substitutes the following executable system files:

<SYSTEM32>\dmocx.dll with <SYSTEM32>\dmocx.dll.new
<SYSTEM32>\dmremote.exe with <SYSTEM32>\dmremote.exe.new
<SYSTEM32>\dllcache\avwav.dll with <SYSTEM32>\dllcache\avwav.dll.new
<SYSTEM32>\dmintf.dll with <SYSTEM32>\dmintf.dll.new
<SYSTEM32>\dllcache\avtapi.dll with <SYSTEM32>\dllcache\avtapi.dll.new
<SYSTEM32>\dmloader.dll with <SYSTEM32>\dmloader.dll.new
<SYSTEM32>\dmsynth.dll with <SYSTEM32>\dmsynth.dll.new
<SYSTEM32>\dmusic.dll with <SYSTEM32>\dmusic.dll.new
<SYSTEM32>\dllcache\bidispl.dll with <SYSTEM32>\dllcache\bidispl.dll.new
<SYSTEM32>\dmscript.dll with <SYSTEM32>\dmscript.dll.new
<SYSTEM32>\dmstyle.dll with <SYSTEM32>\dmstyle.dll.new
<SYSTEM32>\dllcache\batt.dll with <SYSTEM32>\dllcache\batt.dll.new
<SYSTEM32>\dllcache\avifil32.dll with <SYSTEM32>\dllcache\avifil32.dll.new
<SYSTEM32>\dmband.dll with <SYSTEM32>\dmband.dll.new
<SYSTEM32>\dmcompos.dll with <SYSTEM32>\dmcompos.dll.new
<SYSTEM32>\dllhost.exe with <SYSTEM32>\dllhost.exe.new
<SYSTEM32>\dllhst3g.exe with <SYSTEM32>\dllhst3g.exe.new
<SYSTEM32>\dmadmin.exe with <SYSTEM32>\dmadmin.exe.new
<SYSTEM32>\dmdskmgr.dll with <SYSTEM32>\dmdskmgr.dll.new
<SYSTEM32>\dmdskres.dll with <SYSTEM32>\dmdskres.dll.new
<SYSTEM32>\dmime.dll with <SYSTEM32>\dmime.dll.new
<SYSTEM32>\dmconfig.dll with <SYSTEM32>\dmconfig.dll.new
<SYSTEM32>\dmdlgs.dll with <SYSTEM32>\dmdlgs.dll.new
<SYSTEM32>\dllcache\avmeter.dll with <SYSTEM32>\dllcache\avmeter.dll.new
<SYSTEM32>\dpnhupnp.dll with <SYSTEM32>\dpnhupnp.dll.new
<SYSTEM32>\dpnlobby.dll with <SYSTEM32>\dpnlobby.dll.new
<SYSTEM32>\dpnmodem.dll with <SYSTEM32>\dpnmodem.dll.new
<SYSTEM32>\dpnet.dll with <SYSTEM32>\dpnet.dll.new
<SYSTEM32>\dpnhpast.dll with <SYSTEM32>\dpnhpast.dll.new
<SYSTEM32>\dllcache\blackbox.dll with <SYSTEM32>\dllcache\blackbox.dll.new
<SYSTEM32>\dpserial.dll with <SYSTEM32>\dpserial.dll.new
<SYSTEM32>\dpvacm.dll with <SYSTEM32>\dpvacm.dll.new
<SYSTEM32>\dllcache\bootcfg.exe with <SYSTEM32>\dllcache\bootcfg.exe.new
<SYSTEM32>\dllcache\blastcln.exe with <SYSTEM32>\dllcache\blastcln.exe.new
<SYSTEM32>\dpnsvr.exe with <SYSTEM32>\dpnsvr.exe.new
<SYSTEM32>\dpnwsock.dll with <SYSTEM32>\dpnwsock.dll.new
<SYSTEM32>\doskey.exe with <SYSTEM32>\doskey.exe.new
<SYSTEM32>\dllcache\bitsprx2.dll with <SYSTEM32>\dllcache\bitsprx2.dll.new
<SYSTEM32>\dpcdll.dll with <SYSTEM32>\dpcdll.dll.new
<SYSTEM32>\dmview.ocx with <SYSTEM32>\dmview.ocx.new
<SYSTEM32>\docprop.dll with <SYSTEM32>\docprop.dll.new
<SYSTEM32>\docprop2.dll with <SYSTEM32>\docprop2.dll.new
<SYSTEM32>\dplayx.dll with <SYSTEM32>\dplayx.dll.new
<SYSTEM32>\dpmodemx.dll with <SYSTEM32>\dpmodemx.dll.new
<SYSTEM32>\dpnaddr.dll with <SYSTEM32>\dpnaddr.dll.new
<SYSTEM32>\dllcache\bitsprx3.dll with <SYSTEM32>\dllcache\bitsprx3.dll.new
<SYSTEM32>\dplay.dll with <SYSTEM32>\dplay.dll.new
<SYSTEM32>\dplaysvr.exe with <SYSTEM32>\dplaysvr.exe.new
<SYSTEM32>\devenum.dll with <SYSTEM32>\devenum.dll.new
<SYSTEM32>\devmgr.dll with <SYSTEM32>\devmgr.dll.new
<SYSTEM32>\dllcache\atrace.dll with <SYSTEM32>\dllcache\atrace.dll.new
<SYSTEM32>\deskmon.dll with <SYSTEM32>\deskmon.dll.new
<SYSTEM32>\deskperf.dll with <SYSTEM32>\deskperf.dll.new
<SYSTEM32>\dllcache\atmpvcno.dll with <SYSTEM32>\dllcache\atmpvcno.dll.new
<SYSTEM32>\dllcache\attrib.exe with <SYSTEM32>\dllcache\attrib.exe.new
<SYSTEM32>\dfrgsnap.dll with <SYSTEM32>\dfrgsnap.dll.new
<SYSTEM32>\dfrgui.dll with <SYSTEM32>\dfrgui.dll.new
<SYSTEM32>\dfrgfat.exe with <SYSTEM32>\dfrgfat.exe.new
<SYSTEM32>\dfrgntfs.exe with <SYSTEM32>\dfrgntfs.exe.new
<SYSTEM32>\dfrgres.dll with <SYSTEM32>\dfrgres.dll.new
<SYSTEM32>\ddeshare.exe with <SYSTEM32>\ddeshare.exe.new
<SYSTEM32>\dllcache\atkctrs.dll with <SYSTEM32>\dllcache\atkctrs.dll.new
<SYSTEM32>\ddraw.dll with <SYSTEM32>\ddraw.dll.new
<SYSTEM32>\dciman32.dll with <SYSTEM32>\dciman32.dll.new
<SYSTEM32>\dllcache\at.exe with <SYSTEM32>\dllcache\at.exe.new
<SYSTEM32>\dcomcnfg.exe with <SYSTEM32>\dcomcnfg.exe.new
<SYSTEM32>\desk.cpl with <SYSTEM32>\desk.cpl.new
<SYSTEM32>\deskadp.dll with <SYSTEM32>\deskadp.dll.new
<SYSTEM32>\dllcache\atmlib.dll with <SYSTEM32>\dllcache\atmlib.dll.new
<SYSTEM32>\ddrawex.dll with <SYSTEM32>\ddrawex.dll.new
<SYSTEM32>\dllcache\atmadm.exe with <SYSTEM32>\dllcache\atmadm.exe.new
<SYSTEM32>\defrag.exe with <SYSTEM32>\defrag.exe.new
<SYSTEM32>\dinput.dll with <SYSTEM32>\dinput.dll.new
<SYSTEM32>\dinput8.dll with <SYSTEM32>\dinput8.dll.new
<SYSTEM32>\dllcache\autofmt.exe with <SYSTEM32>\dllcache\autofmt.exe.new
<SYSTEM32>\digest.dll with <SYSTEM32>\digest.dll.new
<SYSTEM32>\dllcache\autodisc.dll with <SYSTEM32>\dllcache\autodisc.dll.new
<SYSTEM32>\dimap.dll with <SYSTEM32>\dimap.dll.new
<SYSTEM32>\diskperf.exe with <SYSTEM32>\diskperf.exe.new
<SYSTEM32>\dllcache\avicap32.dll with <SYSTEM32>\dllcache\avicap32.dll.new
<SYSTEM32>\dispex.dll with <SYSTEM32>\dispex.dll.new
<SYSTEM32>\dllcache\autolfn.exe with <SYSTEM32>\dllcache\autolfn.exe.new
<SYSTEM32>\diskcopy.dll with <SYSTEM32>\diskcopy.dll.new
<SYSTEM32>\diskpart.exe with <SYSTEM32>\diskpart.exe.new
<SYSTEM32>\dgnet.dll with <SYSTEM32>\dgnet.dll.new
<SYSTEM32>\dgrpsetu.dll with <SYSTEM32>\dgrpsetu.dll.new
<SYSTEM32>\dllcache\autochk.exe with <SYSTEM32>\dllcache\autochk.exe.new
<SYSTEM32>\dllcache\audiosrv.dll with <SYSTEM32>\dllcache\audiosrv.dll.new
<SYSTEM32>\dllcache\auditusr.exe with <SYSTEM32>\dllcache\auditusr.exe.new
<SYSTEM32>\dfsshlex.dll with <SYSTEM32>\dfsshlex.dll.new
<SYSTEM32>\dllcache\autoconv.exe with <SYSTEM32>\dllcache\autoconv.exe.new
<SYSTEM32>\diactfrm.dll with <SYSTEM32>\diactfrm.dll.new
<SYSTEM32>\diantz.exe with <SYSTEM32>\diantz.exe.new
<SYSTEM32>\dgsetup.dll with <SYSTEM32>\dgsetup.dll.new
<SYSTEM32>\dhcpmon.dll with <SYSTEM32>\dhcpmon.dll.new
<SYSTEM32>\dhcpsapi.dll with <SYSTEM32>\dhcpsapi.dll.new
<SYSTEM32>\dpvoice.dll with <SYSTEM32>\dpvoice.dll.new
<SYSTEM32>\expsrv.dll with <SYSTEM32>\expsrv.dll.new
<SYSTEM32>\extmgr.dll with <SYSTEM32>\extmgr.dll.new
<SYSTEM32>\extrac32.exe with <SYSTEM32>\extrac32.exe.new
<SYSTEM32>\dllcache\catsrvps.dll with <SYSTEM32>\dllcache\catsrvps.dll.new
<SYSTEM32>\dllcache\catsrvut.dll with <SYSTEM32>\dllcache\catsrvut.dll.new
<SYSTEM32>\expand.exe with <SYSTEM32>\expand.exe.new
<SYSTEM32>\fde.dll with <SYSTEM32>\fde.dll.new
<SYSTEM32>\fdeploy.dll with <SYSTEM32>\fdeploy.dll.new
<SYSTEM32>\feclient.dll with <SYSTEM32>\feclient.dll.new
<SYSTEM32>\exts.dll with <SYSTEM32>\exts.dll.new
<SYSTEM32>\faultrep.dll with <SYSTEM32>\faultrep.dll.new
<SYSTEM32>\fc.exe with <SYSTEM32>\fc.exe.new
<SYSTEM32>\esentprf.dll with <SYSTEM32>\esentprf.dll.new
<SYSTEM32>\dllcache\cards.dll with <SYSTEM32>\dllcache\cards.dll.new
<SYSTEM32>\dllcache\catsrv.dll with <SYSTEM32>\dllcache\catsrv.dll.new
<SYSTEM32>\EqnClass.Dll with <SYSTEM32>\eqnclass.dll.new
<SYSTEM32>\dllcache\capesnpn.dll with <SYSTEM32>\dllcache\capesnpn.dll.new
<SYSTEM32>\esent97.dll with <SYSTEM32>\esent97.dll.new
<SYSTEM32>\eventcreate.exe with <SYSTEM32>\eventcreate.exe.new
<SYSTEM32>\eventtriggers.exe with <SYSTEM32>\eventtriggers.exe.new
<SYSTEM32>\eventvwr.exe with <SYSTEM32>\eventvwr.exe.new
<SYSTEM32>\esentutl.exe with <SYSTEM32>\esentutl.exe.new
<SYSTEM32>\eudcedit.exe with <SYSTEM32>\eudcedit.exe.new
<SYSTEM32>\eventcls.dll with <SYSTEM32>\eventcls.dll.new
<SYSTEM32>\freecell.exe with <SYSTEM32>\freecell.exe.new
<SYSTEM32>\fsusd.dll with <SYSTEM32>\fsusd.dll.new
<SYSTEM32>\fsutil.exe with <SYSTEM32>\fsutil.exe.new
<SYSTEM32>\fontview.exe with <SYSTEM32>\fontview.exe.new
<SYSTEM32>\forcedos.exe with <SYSTEM32>\forcedos.exe.new
<SYSTEM32>\framebuf.dll with <SYSTEM32>\framebuf.dll.new
<SYSTEM32>\g711codc.ax with <SYSTEM32>\g711codc.ax.new
<SYSTEM32>\gcdef.dll with <SYSTEM32>\gcdef.dll.new
<SYSTEM32>\getmac.exe with <SYSTEM32>\getmac.exe.new
<SYSTEM32>\ftp.exe with <SYSTEM32>\ftp.exe.new
<SYSTEM32>\ftsrch.dll with <SYSTEM32>\ftsrch.dll.new
<SYSTEM32>\fwcfg.dll with <SYSTEM32>\fwcfg.dll.new
<SYSTEM32>\finger.exe with <SYSTEM32>\finger.exe.new
<SYSTEM32>\firewall.cpl with <SYSTEM32>\firewall.cpl.new
<SYSTEM32>\fixmapi.exe with <SYSTEM32>\fixmapi.exe.new
<SYSTEM32>\filemgmt.dll with <SYSTEM32>\filemgmt.dll.new
<SYSTEM32>\find.exe with <SYSTEM32>\find.exe.new
<SYSTEM32>\findstr.exe with <SYSTEM32>\findstr.exe.new
<SYSTEM32>\fmifs.dll with <SYSTEM32>\fmifs.dll.new
<SYSTEM32>\fontext.dll with <SYSTEM32>\fontext.dll.new
<SYSTEM32>\fontsub.dll with <SYSTEM32>\fontsub.dll.new
<SYSTEM32>\fldrclnr.dll with <SYSTEM32>\fldrclnr.dll.new
<SYSTEM32>\fltlib.dll with <SYSTEM32>\fltlib.dll.new
<SYSTEM32>\fltMc.exe with <SYSTEM32>\fltmc.exe.new
<SYSTEM32>\dsdmoprp.dll with <SYSTEM32>\dsdmoprp.dll.new
<SYSTEM32>\dskquota.dll with <SYSTEM32>\dskquota.dll.new
<SYSTEM32>\dskquoui.dll with <SYSTEM32>\dskquoui.dll.new
<SYSTEM32>\dsauth.dll with <SYSTEM32>\dsauth.dll.new
<SYSTEM32>\dsdmo.dll with <SYSTEM32>\dsdmo.dll.new
<SYSTEM32>\dllcache\bootvrfy.exe with <SYSTEM32>\dllcache\bootvrfy.exe.new
<SYSTEM32>\dsprop.dll with <SYSTEM32>\dsprop.dll.new
<SYSTEM32>\dsprpres.dll with <SYSTEM32>\dsprpres.dll.new
<SYSTEM32>\dsquery.dll with <SYSTEM32>\dsquery.dll.new
<SYSTEM32>\dsound.dll with <SYSTEM32>\dsound.dll.new
<SYSTEM32>\dllcache\browselc.dll with <SYSTEM32>\dllcache\browselc.dll.new
<SYSTEM32>\dsound3d.dll with <SYSTEM32>\dsound3d.dll.new
<SYSTEM32>\dpwsockx.dll with <SYSTEM32>\dpwsockx.dll.new
<SYSTEM32>\driverquery.exe with <SYSTEM32>\driverquery.exe.new
<SYSTEM32>\drmclien.dll with <SYSTEM32>\drmclien.dll.new
<SYSTEM32>\dpvsetup.exe with <SYSTEM32>\dpvsetup.exe.new
<SYSTEM32>\dpvvox.dll with <SYSTEM32>\dpvvox.dll.new
<SYSTEM32>\dpwsock.dll with <SYSTEM32>\dpwsock.dll.new
<SYSTEM32>\drwtsn32.exe with <SYSTEM32>\drwtsn32.exe.new
<SYSTEM32>\ds32gt.dll with <SYSTEM32>\ds32gt.dll.new
<SYSTEM32>\dllcache\bootvid.dll with <SYSTEM32>\dllcache\bootvid.dll.new
<SYSTEM32>\drmstor.dll with <SYSTEM32>\drmstor.dll.new
<SYSTEM32>\drmv2clt.dll with <SYSTEM32>\drmv2clt.dll.new
<SYSTEM32>\dllcache\bootok.exe with <SYSTEM32>\dllcache\bootok.exe.new
<SYSTEM32>\dxmasf.dll with <SYSTEM32>\dxmasf.dll.new
<SYSTEM32>\dxtmsft.dll with <SYSTEM32>\dxtmsft.dll.new
<SYSTEM32>\dxtrans.dll with <SYSTEM32>\dxtrans.dll.new
<SYSTEM32>\dllcache\cabview.dll with <SYSTEM32>\dllcache\cabview.dll.new
<SYSTEM32>\dxdiagn.dll with <SYSTEM32>\dxdiagn.dll.new
<SYSTEM32>\dllcache\cacls.exe with <SYSTEM32>\dllcache\cacls.exe.new
<SYSTEM32>\dllcache\camocx.dll with <SYSTEM32>\dllcache\camocx.dll.new
<SYSTEM32>\encapi.dll with <SYSTEM32>\encapi.dll.new
<SYSTEM32>\encdec.dll with <SYSTEM32>\encdec.dll.new
<SYSTEM32>\dllcache\calc.exe with <SYSTEM32>\dllcache\calc.exe.new
<SYSTEM32>\efsadu.dll with <SYSTEM32>\efsadu.dll.new
<SYSTEM32>\els.dll with <SYSTEM32>\els.dll.new
<SYSTEM32>\dumprep.exe with <SYSTEM32>\dumprep.exe.new
<SYSTEM32>\dllcache\browsewm.dll with <SYSTEM32>\dllcache\browsewm.dll.new
<SYSTEM32>\duser.dll with <SYSTEM32>\duser.dll.new
<SYSTEM32>\dssec.dll with <SYSTEM32>\dssec.dll.new
<SYSTEM32>\dsuiext.dll with <SYSTEM32>\dsuiext.dll.new
<SYSTEM32>\dswave.dll with <SYSTEM32>\dswave.dll.new
<SYSTEM32>\dx8vb.dll with <SYSTEM32>\dx8vb.dll.new
<SYSTEM32>\dllcache\btpanui.dll with <SYSTEM32>\dllcache\btpanui.dll.new
<SYSTEM32>\dxdiag.exe with <SYSTEM32>\dxdiag.exe.new
<SYSTEM32>\dvdupgrd.exe with <SYSTEM32>\dvdupgrd.exe.new
<SYSTEM32>\dwwin.exe with <SYSTEM32>\dwwin.exe.new
<SYSTEM32>\dx7vb.dll with <SYSTEM32>\dx7vb.dll.new
<SYSTEM32>\dllcache\hh.exe with <SYSTEM32>\dllcache\hh.exe.new
<SYSTEM32>\blackbox.dll with <SYSTEM32>\blackbox.dll.new
<SYSTEM32>\blastcln.exe with <SYSTEM32>\blastcln.exe.new
<SYSTEM32>\bidispl.dll with <SYSTEM32>\bidispl.dll.new
<SYSTEM32>\bitsprx2.dll with <SYSTEM32>\bitsprx2.dll.new
<SYSTEM32>\bitsprx3.dll with <SYSTEM32>\bitsprx3.dll.new
<SYSTEM32>\bootvid.dll with <SYSTEM32>\bootvid.dll.new
<SYSTEM32>\bootvrfy.exe with <SYSTEM32>\bootvrfy.exe.new
<SYSTEM32>\dllcache\regedit.exe with <SYSTEM32>\dllcache\regedit.exe.new
<SYSTEM32>\bootcfg.exe with <SYSTEM32>\bootcfg.exe.new
<SYSTEM32>\dllcache\notepad.exe with <SYSTEM32>\dllcache\notepad.exe.new
<SYSTEM32>\bootok.exe with <SYSTEM32>\bootok.exe.new
<SYSTEM32>\autodisc.dll with <SYSTEM32>\autodisc.dll.new
<SYSTEM32>\autofmt.exe with <SYSTEM32>\autofmt.exe.new
<SYSTEM32>\autolfn.exe with <SYSTEM32>\autolfn.exe.new
<SYSTEM32>\auditusr.exe with <SYSTEM32>\auditusr.exe.new
<SYSTEM32>\autochk.exe with <SYSTEM32>\autochk.exe.new
<SYSTEM32>\autoconv.exe with <SYSTEM32>\autoconv.exe.new
<SYSTEM32>\avtapi.dll with <SYSTEM32>\avtapi.dll.new
<SYSTEM32>\avwav.dll with <SYSTEM32>\avwav.dll.new
<SYSTEM32>\batt.dll with <SYSTEM32>\batt.dll.new
<SYSTEM32>\avicap32.dll with <SYSTEM32>\avicap32.dll.new
<SYSTEM32>\avifil32.dll with <SYSTEM32>\avifil32.dll.new
<SYSTEM32>\avmeter.dll with <SYSTEM32>\avmeter.dll.new
<SYSTEM32>\catsrvut.dll with <SYSTEM32>\catsrvut.dll.new
<SYSTEM32>\dllcache\winhlp32.exe with <SYSTEM32>\dllcache\winhlp32.exe.new
<SYSTEM32>\ccfgnt.dll with <SYSTEM32>\ccfgnt.dll.new
<SYSTEM32>\catsrv.dll with <SYSTEM32>\catsrv.dll.new
<SYSTEM32>\dllcache\vmmreg32.dll with <SYSTEM32>\dllcache\vmmreg32.dll.new
<SYSTEM32>\catsrvps.dll with <SYSTEM32>\catsrvps.dll.new
<SYSTEM32>\cdosys.dll with <SYSTEM32>\cdosys.dll.new
<SYSTEM32>\certmgr.dll with <SYSTEM32>\certmgr.dll.new
<SYSTEM32>\cewmdm.dll with <SYSTEM32>\cewmdm.dll.new
<SYSTEM32>\cdfview.dll with <SYSTEM32>\cdfview.dll.new
<SYSTEM32>\cdm.dll with <SYSTEM32>\cdm.dll.new
<SYSTEM32>\cdmodem.dll with <SYSTEM32>\cdmodem.dll.new
<SYSTEM32>\btpanui.dll with <SYSTEM32>\btpanui.dll.new
<SYSTEM32>\cabview.dll with <SYSTEM32>\cabview.dll.new
<SYSTEM32>\dllcache\twain_32.dll with <SYSTEM32>\dllcache\twain_32.dll.new
<SYSTEM32>\browselc.dll with <SYSTEM32>\browselc.dll.new
<SYSTEM32>\dllcache\taskman.exe with <SYSTEM32>\dllcache\taskman.exe.new
<SYSTEM32>\browsewm.dll with <SYSTEM32>\browsewm.dll.new
<SYSTEM32>\capesnpn.dll with <SYSTEM32>\capesnpn.dll.new
<SYSTEM32>\dllcache\twunk_32.exe with <SYSTEM32>\dllcache\twunk_32.exe.new
<SYSTEM32>\cards.dll with <SYSTEM32>\cards.dll.new
<SYSTEM32>\cacls.exe with <SYSTEM32>\cacls.exe.new
<SYSTEM32>\calc.exe with <SYSTEM32>\calc.exe.new
<SYSTEM32>\camocx.dll with <SYSTEM32>\camocx.dll.new
<SYSTEM32>\aclui.dll with <SYSTEM32>\aclui.dll.new
<SYSTEM32>\activeds.tlb with <SYSTEM32>\activeds.tlb.new
<SYSTEM32>\actmovie.exe with <SYSTEM32>\actmovie.exe.new
<SYSTEM32>\acctres.dll with <SYSTEM32>\acctres.dll.new
<SYSTEM32>\accwiz.exe with <SYSTEM32>\accwiz.exe.new
<SYSTEM32>\acledit.dll with <SYSTEM32>\acledit.dll.new
<SYSTEM32>\adsmsext.dll with <SYSTEM32>\adsmsext.dll.new
<SYSTEM32>\adsnds.dll with <SYSTEM32>\adsnds.dll.new
<SYSTEM32>\adsnt.dll with <SYSTEM32>\adsnt.dll.new
<SYSTEM32>\admparse.dll with <SYSTEM32>\admparse.dll.new
<SYSTEM32>\adptif.dll with <SYSTEM32>\adptif.dll.new
<SYSTEM32>\adsldp.dll with <SYSTEM32>\adsldp.dll.new
%WINDIR%\TASKMAN.EXE with %WINDIR%\taskman.exe.new
%WINDIR%\twain_32.dll with %WINDIR%\twain_32.dll.new
%WINDIR%\twunk_32.exe with %WINDIR%\twunk_32.exe.new
%WINDIR%\hh.exe with %WINDIR%\hh.exe.new
%WINDIR%\NOTEPAD.EXE with %WINDIR%\notepad.exe.new
%WINDIR%\regedit.exe with %WINDIR%\regedit.exe.new
<SYSTEM32>\6to4svc.dll with <SYSTEM32>\6to4svc.dll.new
<SYSTEM32>\aaaamon.dll with <SYSTEM32>\aaaamon.dll.new
<SYSTEM32>\access.cpl with <SYSTEM32>\access.cpl.new
%WINDIR%\vmmreg32.dll with %WINDIR%\vmmreg32.dll.new
%WINDIR%\winhlp32.exe with %WINDIR%\winhlp32.exe.new
%WINDIR%\system\WINSPOOL.DRV with %WINDIR%\system\winspool.drv.new
<SYSTEM32>\asycfilt.dll with <SYSTEM32>\asycfilt.dll.new
<SYSTEM32>\at.exe with <SYSTEM32>\at.exe.new
<SYSTEM32>\atkctrs.dll with <SYSTEM32>\atkctrs.dll.new
<SYSTEM32>\asr_fmt.exe with <SYSTEM32>\asr_fmt.exe.new
<SYSTEM32>\asr_ldm.exe with <SYSTEM32>\asr_ldm.exe.new
<SYSTEM32>\asr_pfu.exe with <SYSTEM32>\asr_pfu.exe.new
<SYSTEM32>\atrace.dll with <SYSTEM32>\atrace.dll.new
<SYSTEM32>\attrib.exe with <SYSTEM32>\attrib.exe.new
<SYSTEM32>\audiosrv.dll with <SYSTEM32>\audiosrv.dll.new
<SYSTEM32>\atmadm.exe with <SYSTEM32>\atmadm.exe.new
<SYSTEM32>\atmlib.dll with <SYSTEM32>\atmlib.dll.new
<SYSTEM32>\atmpvcno.dll with <SYSTEM32>\atmpvcno.dll.new
<SYSTEM32>\alrsvc.dll with <SYSTEM32>\alrsvc.dll.new
<SYSTEM32>\amstream.dll with <SYSTEM32>\amstream.dll.new
<SYSTEM32>\apcups.dll with <SYSTEM32>\apcups.dll.new
<SYSTEM32>\adsnw.dll with <SYSTEM32>\adsnw.dll.new
<SYSTEM32>\advpack.dll with <SYSTEM32>\advpack.dll.new
<SYSTEM32>\ahui.exe with <SYSTEM32>\ahui.exe.new
<SYSTEM32>\arp.exe with <SYSTEM32>\arp.exe.new
<SYSTEM32>\asctrls.ocx with <SYSTEM32>\asctrls.ocx.new
<SYSTEM32>\asferror.dll with <SYSTEM32>\asferror.dll.new
<SYSTEM32>\appmgmts.dll with <SYSTEM32>\appmgmts.dll.new
<SYSTEM32>\appmgr.dll with <SYSTEM32>\appmgr.dll.new
<SYSTEM32>\appwiz.cpl with <SYSTEM32>\appwiz.cpl.new
<SYSTEM32>\cfgbkend.dll with <SYSTEM32>\cfgbkend.dll.new
<SYSTEM32>\dllcache\adsnt.dll with <SYSTEM32>\dllcache\adsnt.dll.new
<SYSTEM32>\dllcache\adsnw.dll with <SYSTEM32>\dllcache\adsnw.dll.new
<SYSTEM32>\dllcache\advpack.dll with <SYSTEM32>\dllcache\advpack.dll.new
<SYSTEM32>\dllcache\adsldp.dll with <SYSTEM32>\dllcache\adsldp.dll.new
<SYSTEM32>\dllcache\adsmsext.dll with <SYSTEM32>\dllcache\adsmsext.dll.new
<SYSTEM32>\dllcache\adsnds.dll with <SYSTEM32>\dllcache\adsnds.dll.new
<SYSTEM32>\dllcache\apcups.dll with <SYSTEM32>\dllcache\apcups.dll.new
<SYSTEM32>\dllcache\appmgmts.dll with <SYSTEM32>\dllcache\appmgmts.dll.new
<SYSTEM32>\d3d8.dll with <SYSTEM32>\d3d8.dll.new
<SYSTEM32>\dllcache\ahui.exe with <SYSTEM32>\dllcache\ahui.exe.new
<SYSTEM32>\dllcache\alrsvc.dll with <SYSTEM32>\dllcache\alrsvc.dll.new
<SYSTEM32>\dllcache\amstream.dll with <SYSTEM32>\dllcache\amstream.dll.new
<SYSTEM32>\dllcache\activeds.tlb with <SYSTEM32>\dllcache\activeds.tlb.new
<SYSTEM32>\cryptdlg.dll with <SYSTEM32>\cryptdlg.dll.new
<SYSTEM32>\cryptext.dll with <SYSTEM32>\cryptext.dll.new
<SYSTEM32>\corpol.dll with <SYSTEM32>\corpol.dll.new
<SYSTEM32>\dllcache\aclui.dll with <SYSTEM32>\dllcache\aclui.dll.new
<SYSTEM32>\crtdll.dll with <SYSTEM32>\crtdll.dll.new
<SYSTEM32>\dllcache\admparse.dll with <SYSTEM32>\dllcache\admparse.dll.new
<SYSTEM32>\ctl3d32.dll with <SYSTEM32>\ctl3d32.dll.new
<SYSTEM32>\dllcache\adptif.dll with <SYSTEM32>\dllcache\adptif.dll.new
<SYSTEM32>\dllcache\actmovie.exe with <SYSTEM32>\dllcache\actmovie.exe.new
<SYSTEM32>\cryptnet.dll with <SYSTEM32>\cryptnet.dll.new
<SYSTEM32>\csseqchk.dll with <SYSTEM32>\csseqchk.dll.new
<SYSTEM32>\dataclen.dll with <SYSTEM32>\dataclen.dll.new
<SYSTEM32>\datime.dll with <SYSTEM32>\datime.dll.new
<SYSTEM32>\dllcache\asr_ldm.exe with <SYSTEM32>\dllcache\asr_ldm.exe.new
<SYSTEM32>\d3dxof.dll with <SYSTEM32>\d3dxof.dll.new
<SYSTEM32>\danim.dll with <SYSTEM32>\danim.dll.new
<SYSTEM32>\dllcache\asr_fmt.exe with <SYSTEM32>\dllcache\asr_fmt.exe.new
<SYSTEM32>\dbghelp.dll with <SYSTEM32>\dbghelp.dll.new
<SYSTEM32>\dllcache\asycfilt.dll with <SYSTEM32>\dllcache\asycfilt.dll.new
<SYSTEM32>\dbnetlib.dll with <SYSTEM32>\dbnetlib.dll.new
<SYSTEM32>\daxctle.ocx with <SYSTEM32>\daxctle.ocx.new
<SYSTEM32>\dbgeng.dll with <SYSTEM32>\dbgeng.dll.new
<SYSTEM32>\dllcache\asr_pfu.exe with <SYSTEM32>\dllcache\asr_pfu.exe.new
<SYSTEM32>\dllcache\appwiz.cpl with <SYSTEM32>\dllcache\appwiz.cpl.new
<SYSTEM32>\d3dim.dll with <SYSTEM32>\d3dim.dll.new
<SYSTEM32>\dllcache\arp.exe with <SYSTEM32>\dllcache\arp.exe.new
<SYSTEM32>\dllcache\appmgr.dll with <SYSTEM32>\dllcache\appmgr.dll.new
<SYSTEM32>\d3d8thk.dll with <SYSTEM32>\d3d8thk.dll.new
<SYSTEM32>\d3d9.dll with <SYSTEM32>\d3d9.dll.new
<SYSTEM32>\d3dramp.dll with <SYSTEM32>\d3dramp.dll.new
<SYSTEM32>\d3drm.dll with <SYSTEM32>\d3drm.dll.new
<SYSTEM32>\dllcache\asferror.dll with <SYSTEM32>\dllcache\asferror.dll.new
<SYSTEM32>\d3dim700.dll with <SYSTEM32>\d3dim700.dll.new
<SYSTEM32>\d3dpmesh.dll with <SYSTEM32>\d3dpmesh.dll.new
<SYSTEM32>\dllcache\asctrls.ocx with <SYSTEM32>\dllcache\asctrls.ocx.new
<SYSTEM32>\clipsrv.exe with <SYSTEM32>\clipsrv.exe.new
<SYSTEM32>\cmcfg32.dll with <SYSTEM32>\cmcfg32.dll.new
<SYSTEM32>\cmdial32.dll with <SYSTEM32>\cmdial32.dll.new
<SYSTEM32>\clbcatex.dll with <SYSTEM32>\clbcatex.dll.new
<SYSTEM32>\cleanmgr.exe with <SYSTEM32>\cleanmgr.exe.new
<SYSTEM32>\clipbrd.exe with <SYSTEM32>\clipbrd.exe.new
<SYSTEM32>\cmprops.dll with <SYSTEM32>\cmprops.dll.new
<SYSTEM32>\cmsetACL.dll with <SYSTEM32>\cmsetacl.dll.new
<SYSTEM32>\cmstp.exe with <SYSTEM32>\cmstp.exe.new
<SYSTEM32>\cmdl32.exe with <SYSTEM32>\cmdl32.exe.new
<SYSTEM32>\cmmon32.exe with <SYSTEM32>\cmmon32.exe.new
<SYSTEM32>\cmpbk32.dll with <SYSTEM32>\cmpbk32.dll.new
<SYSTEM32>\chkntfs.exe with <SYSTEM32>\chkntfs.exe.new
<SYSTEM32>\ciadmin.dll with <SYSTEM32>\ciadmin.dll.new
<SYSTEM32>\cic.dll with <SYSTEM32>\cic.dll.new
<SYSTEM32>\cfgmgr32.dll with <SYSTEM32>\cfgmgr32.dll.new
<SYSTEM32>\charmap.exe with <SYSTEM32>\charmap.exe.new
<SYSTEM32>\chkdsk.exe with <SYSTEM32>\chkdsk.exe.new
<SYSTEM32>\cisvc.exe with <SYSTEM32>\cisvc.exe.new
<SYSTEM32>\ckcnv.exe with <SYSTEM32>\ckcnv.exe.new
<SYSTEM32>\clb.dll with <SYSTEM32>\clb.dll.new
<SYSTEM32>\cidaemon.exe with <SYSTEM32>\cidaemon.exe.new
<SYSTEM32>\ciodm.dll with <SYSTEM32>\ciodm.dll.new
<SYSTEM32>\cipher.exe with <SYSTEM32>\cipher.exe.new
<SYSTEM32>\dllcache\acctres.dll with <SYSTEM32>\dllcache\acctres.dll.new
<SYSTEM32>\comuid.dll with <SYSTEM32>\comuid.dll.new
<SYSTEM32>\dllcache\accwiz.exe with <SYSTEM32>\dllcache\accwiz.exe.new
<SYSTEM32>\dllcache\access.cpl with <SYSTEM32>\dllcache\access.cpl.new
<SYSTEM32>\comrepl.dll with <SYSTEM32>\comrepl.dll.new
<SYSTEM32>\comsnap.dll with <SYSTEM32>\comsnap.dll.new
<SYSTEM32>\console.dll with <SYSTEM32>\console.dll.new
<SYSTEM32>\control.exe with <SYSTEM32>\control.exe.new
<SYSTEM32>\convert.exe with <SYSTEM32>\convert.exe.new
<SYSTEM32>\confmsp.dll with <SYSTEM32>\confmsp.dll.new
<SYSTEM32>\conime.exe with <SYSTEM32>\conime.exe.new
<SYSTEM32>\dllcache\acledit.dll with <SYSTEM32>\dllcache\acledit.dll.new
<SYSTEM32>\cnvfat.dll with <SYSTEM32>\cnvfat.dll.new
<SYSTEM32>\comaddin.dll with <SYSTEM32>\comaddin.dll.new
<SYSTEM32>\comcat.dll with <SYSTEM32>\comcat.dll.new
<SYSTEM32>\dllcache\winspool.drv with <SYSTEM32>\dllcache\winspool.drv.new
<SYSTEM32>\cmutil.dll with <SYSTEM32>\cmutil.dll.new
<SYSTEM32>\cnetcfg.dll with <SYSTEM32>\cnetcfg.dll.new
<SYSTEM32>\compatUI.dll with <SYSTEM32>\compatui.dll.new
<SYSTEM32>\dllcache\aaaamon.dll with <SYSTEM32>\dllcache\aaaamon.dll.new
<SYSTEM32>\compstui.dll with <SYSTEM32>\compstui.dll.new
<SYSTEM32>\dllcache\6to4svc.dll with <SYSTEM32>\dllcache\6to4svc.dll.new
<SYSTEM32>\comp.exe with <SYSTEM32>\comp.exe.new
<SYSTEM32>\compact.exe with <SYSTEM32>\compact.exe.new

Malicious functions:

Executes the following:

'<SYSTEM32>\ntvdm.exe' -f -i1

Modifies file system :

Creates the following files:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\freeav[1]
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\RestorePointSize
C:\exc.exe
%WINDIR%\Temp\scs1.tmp
%WINDIR%\Temp\scs2.tmp

Deletes the following files:

<SYSTEM32>\browselc.dll.tmp
%WINDIR%\Temp\scs2.tmp
%WINDIR%\Temp\scs1.tmp

Moves the following files:

from <SYSTEM32>\dllcache\shell.dll.new to <SYSTEM32>\dllcache\shell.dll
from <SYSTEM32>\dllcache\sound.drv.new to <SYSTEM32>\dllcache\sound.drv
from <SYSTEM32>\dllcache\system.drv.new to <SYSTEM32>\dllcache\system.drv
from <SYSTEM32>\dllcache\msvideo.dll.new to <SYSTEM32>\dllcache\msvideo.dll
from <SYSTEM32>\dllcache\olecli.dll.new to <SYSTEM32>\dllcache\olecli.dll
from <SYSTEM32>\dllcache\olesvr.dll.new to <SYSTEM32>\dllcache\olesvr.dll
from <SYSTEM32>\dllcache\tapi.dll.new to <SYSTEM32>\dllcache\tapi.dll
from <SYSTEM32>\dllcache\wfwnet.drv.new to <SYSTEM32>\dllcache\wfwnet.drv
from <SYSTEM32>\dllcache\winspool.drv.new to <SYSTEM32>\dllcache\winspool.drv
from <SYSTEM32>\dllcache\browselc.dll.new to <SYSTEM32>\dllcache\browselc.dll
from <SYSTEM32>\dllcache\timer.drv.new to <SYSTEM32>\dllcache\timer.drv
from <SYSTEM32>\dllcache\ver.dll.new to <SYSTEM32>\dllcache\ver.dll
from <SYSTEM32>\dllcache\vga.drv.new to <SYSTEM32>\dllcache\vga.drv
from <SYSTEM32>\dllcache\mouse.drv.new to <SYSTEM32>\dllcache\mouse.drv
from <SYSTEM32>\dllcache\avicap.dll.new to <SYSTEM32>\dllcache\avicap.dll
from <SYSTEM32>\dllcache\avifile.dll.new to <SYSTEM32>\dllcache\avifile.dll
from <SYSTEM32>\dllcache\commdlg.dll.new to <SYSTEM32>\dllcache\commdlg.dll
from <SYSTEM32>\dllcache\notepad.exe.new to <SYSTEM32>\dllcache\notepad.exe
from <SYSTEM32>\browselc.dll to <SYSTEM32>\browselc.dll.tmp
from <SYSTEM32>\dllcache\taskman.exe.new to <SYSTEM32>\dllcache\taskman.exe
from <SYSTEM32>\dllcache\keyboard.drv.new to <SYSTEM32>\dllcache\keyboard.drv
from <SYSTEM32>\dllcache\mciwave.drv.new to <SYSTEM32>\dllcache\mciwave.drv
from <SYSTEM32>\dllcache\mmsystem.dll.new to <SYSTEM32>\dllcache\mmsystem.dll
from <SYSTEM32>\dllcache\mmtask.tsk.new to <SYSTEM32>\dllcache\mmtask.tsk
from <SYSTEM32>\dllcache\lzexpand.dll.new to <SYSTEM32>\dllcache\lzexpand.dll
from <SYSTEM32>\dllcache\mciavi.drv.new to <SYSTEM32>\dllcache\mciavi.drv
from <SYSTEM32>\dllcache\mciseq.drv.new to <SYSTEM32>\dllcache\mciseq.drv

Network activity:

Connects to:

'www.fr##av.com':80
'localhost':1035

TCP:

HTTP GET requests:

www.fr##av.com/

UDP:

DNS ASK www.fr##av.com

Miscellaneous:

Searches for the following windows:

ClassName: 'IEFrame' WindowName: '(null)'
ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-afc.b00.380001'
ClassName: '' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial