マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Trojan.MulDrop5.33899

Added to the Dr.Web virus database: 2014-06-28

Virus description added:

Technical Information

Malicious functions:
Executes the following:
  • '<SYSTEM32>\rundll32.exe' dfdts.dll,DfdGetDefaultPolicyAndSMART
Modifies file system :
Creates the following files:
  • %TEMP%\zkgpbah.html
  • %HOMEPATH%\Documents\DecryptAllFiles.txt
  • %HOMEPATH%\Documents\AllFilesAreLocked.bmp
  • C:\ProgramData\Microsoft\dqxlgtk
  • %TEMP%\xubcgfd.exe
  • <SYSTEM32>\Tasks\jjfqvej
Moves the following system files:
  • from <SYSTEM32>\pt-BR\Licenses\OEM\HomePremiumN\license.rtf to <SYSTEM32>\pt-BR\Licenses\OEM\HomePremiumN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\OEM\HomePremiumE\license.rtf to <SYSTEM32>\pt-BR\Licenses\OEM\HomePremiumE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\OEM\HomePremium\license.rtf to <SYSTEM32>\pt-BR\Licenses\OEM\HomePremium\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\OEM\Professional\license.rtf to <SYSTEM32>\pt-BR\Licenses\OEM\Professional\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\OEM\Starter\license.rtf to <SYSTEM32>\pt-BR\Licenses\OEM\Starter\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\OEM\ProfessionalN\license.rtf to <SYSTEM32>\pt-BR\Licenses\OEM\ProfessionalN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\OEM\ProfessionalE\license.rtf to <SYSTEM32>\pt-BR\Licenses\OEM\ProfessionalE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\OEM\HomeBasicN\license.rtf to <SYSTEM32>\pt-BR\Licenses\OEM\HomeBasicN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\OEM\Enterprise\license.rtf to <SYSTEM32>\pt-BR\Licenses\OEM\Enterprise\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\eval\UltimateN\license.rtf to <SYSTEM32>\pt-BR\Licenses\eval\UltimateN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\eval\UltimateE\license.rtf to <SYSTEM32>\pt-BR\Licenses\eval\UltimateE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\OEM\EnterpriseE\license.rtf to <SYSTEM32>\pt-BR\Licenses\OEM\EnterpriseE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\OEM\HomeBasicE\license.rtf to <SYSTEM32>\pt-BR\Licenses\OEM\HomeBasicE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\OEM\HomeBasic\license.rtf to <SYSTEM32>\pt-BR\Licenses\OEM\HomeBasic\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\OEM\EnterpriseN\license.rtf to <SYSTEM32>\pt-BR\Licenses\OEM\EnterpriseN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\OEM\StarterE\license.rtf to <SYSTEM32>\pt-BR\Licenses\OEM\StarterE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\_Default\HomePremium\license.rtf to <SYSTEM32>\pt-BR\Licenses\_Default\HomePremium\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\_Default\HomeBasicN\license.rtf to <SYSTEM32>\pt-BR\Licenses\_Default\HomeBasicN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\_Default\HomeBasicE\license.rtf to <SYSTEM32>\pt-BR\Licenses\_Default\HomeBasicE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\_Default\HomePremiumE\license.rtf to <SYSTEM32>\pt-BR\Licenses\_Default\HomePremiumE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\_Default\ProfessionalE\license.rtf to <SYSTEM32>\pt-BR\Licenses\_Default\ProfessionalE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\_Default\Professional\license.rtf to <SYSTEM32>\pt-BR\Licenses\_Default\Professional\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\_Default\HomePremiumN\license.rtf to <SYSTEM32>\pt-BR\Licenses\_Default\HomePremiumN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\_Default\HomeBasic\license.rtf to <SYSTEM32>\pt-BR\Licenses\_Default\HomeBasic\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\OEM\UltimateE\license.rtf to <SYSTEM32>\pt-BR\Licenses\OEM\UltimateE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\OEM\Ultimate\license.rtf to <SYSTEM32>\pt-BR\Licenses\OEM\Ultimate\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\OEM\StarterN\license.rtf to <SYSTEM32>\pt-BR\Licenses\OEM\StarterN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\OEM\UltimateN\license.rtf to <SYSTEM32>\pt-BR\Licenses\OEM\UltimateN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\_Default\EnterpriseN\license.rtf to <SYSTEM32>\pt-BR\Licenses\_Default\EnterpriseN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\_Default\EnterpriseE\license.rtf to <SYSTEM32>\pt-BR\Licenses\_Default\EnterpriseE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\_Default\Enterprise\license.rtf to <SYSTEM32>\pt-BR\Licenses\_Default\Enterprise\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\eval\Ultimate\license.rtf to <SYSTEM32>\pt-BR\Licenses\eval\Ultimate\license.rtf.ctbl.tmp
  • from <SYSTEM32>\oobe\pt-PT\OOBE_HELP_Change_Computer_Name.rtf to <SYSTEM32>\oobe\pt-PT\OOBE_HELP_Change_Computer_Name.rtf.ctbl.tmp
  • from <SYSTEM32>\oobe\pt-PT\HELP_What_is_Activation.rtf to <SYSTEM32>\oobe\pt-PT\HELP_What_is_Activation.rtf.ctbl.tmp
  • from <SYSTEM32>\oobe\pt-BR\vofflps.rtf to <SYSTEM32>\oobe\pt-BR\vofflps.rtf.ctbl.tmp
  • from <SYSTEM32>\oobe\pt-PT\OOBE_HELP_Opt_in_Details.rtf to <SYSTEM32>\oobe\pt-PT\OOBE_HELP_Opt_in_Details.rtf.ctbl.tmp
  • from <SYSTEM32>\oobe\pt-PT\privacy.rtf to <SYSTEM32>\oobe\pt-PT\privacy.rtf.ctbl.tmp
  • from <SYSTEM32>\oobe\pt-PT\OOBE_HELP_What_is_User_Account.rtf to <SYSTEM32>\oobe\pt-PT\OOBE_HELP_What_is_User_Account.rtf.ctbl.tmp
  • from <SYSTEM32>\oobe\pt-PT\OOBE_HELP_What_is_HomeGroup.rtf to <SYSTEM32>\oobe\pt-PT\OOBE_HELP_What_is_HomeGroup.rtf.ctbl.tmp
  • from <SYSTEM32>\oobe\pt-BR\privacy.rtf to <SYSTEM32>\oobe\pt-BR\privacy.rtf.ctbl.tmp
  • from <SYSTEM32>\oobe\pt-BR\HELP_What_is_Activation.rtf to <SYSTEM32>\oobe\pt-BR\HELP_What_is_Activation.rtf.ctbl.tmp
  • from <SYSTEM32>\license.rtf.ctbl.tmp to <SYSTEM32>\license.rtf.ctbl
  • from <SYSTEM32>\license.rtf to <SYSTEM32>\license.rtf.ctbl.tmp
  • from <SYSTEM32>\oobe\pt-BR\OOBE_HELP_Change_Computer_Name.rtf to <SYSTEM32>\oobe\pt-BR\OOBE_HELP_Change_Computer_Name.rtf.ctbl.tmp
  • from <SYSTEM32>\oobe\pt-BR\OOBE_HELP_What_is_User_Account.rtf to <SYSTEM32>\oobe\pt-BR\OOBE_HELP_What_is_User_Account.rtf.ctbl.tmp
  • from <SYSTEM32>\oobe\pt-BR\OOBE_HELP_What_is_HomeGroup.rtf to <SYSTEM32>\oobe\pt-BR\OOBE_HELP_What_is_HomeGroup.rtf.ctbl.tmp
  • from <SYSTEM32>\oobe\pt-BR\OOBE_HELP_Opt_in_Details.rtf to <SYSTEM32>\oobe\pt-BR\OOBE_HELP_Opt_in_Details.rtf.ctbl.tmp
  • from <SYSTEM32>\oobe\pt-PT\vofflps.rtf to <SYSTEM32>\oobe\pt-PT\vofflps.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\eval\ProfessionalE\license.rtf to <SYSTEM32>\pt-BR\Licenses\eval\ProfessionalE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\eval\Professional\license.rtf to <SYSTEM32>\pt-BR\Licenses\eval\Professional\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\eval\HomePremiumN\license.rtf to <SYSTEM32>\pt-BR\Licenses\eval\HomePremiumN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\eval\ProfessionalN\license.rtf to <SYSTEM32>\pt-BR\Licenses\eval\ProfessionalN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\eval\StarterN\license.rtf to <SYSTEM32>\pt-BR\Licenses\eval\StarterN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\eval\StarterE\license.rtf to <SYSTEM32>\pt-BR\Licenses\eval\StarterE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\eval\Starter\license.rtf to <SYSTEM32>\pt-BR\Licenses\eval\Starter\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\eval\HomePremiumE\license.rtf to <SYSTEM32>\pt-BR\Licenses\eval\HomePremiumE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\eval\EnterpriseN\license.rtf to <SYSTEM32>\pt-BR\Licenses\eval\EnterpriseN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\eval\EnterpriseE\license.rtf to <SYSTEM32>\pt-BR\Licenses\eval\EnterpriseE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\eval\Enterprise\license.rtf to <SYSTEM32>\pt-BR\Licenses\eval\Enterprise\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\eval\HomeBasic\license.rtf to <SYSTEM32>\pt-BR\Licenses\eval\HomeBasic\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\eval\HomePremium\license.rtf to <SYSTEM32>\pt-BR\Licenses\eval\HomePremium\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\eval\HomeBasicN\license.rtf to <SYSTEM32>\pt-BR\Licenses\eval\HomeBasicN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\eval\HomeBasicE\license.rtf to <SYSTEM32>\pt-BR\Licenses\eval\HomeBasicE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\OEM\UltimateN\license.rtf to <SYSTEM32>\pt-PT\Licenses\OEM\UltimateN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\OEM\UltimateE\license.rtf to <SYSTEM32>\pt-PT\Licenses\OEM\UltimateE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\OEM\Ultimate\license.rtf to <SYSTEM32>\pt-PT\Licenses\OEM\Ultimate\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\_Default\Enterprise\license.rtf to <SYSTEM32>\pt-PT\Licenses\_Default\Enterprise\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\_Default\HomeBasic\license.rtf to <SYSTEM32>\pt-PT\Licenses\_Default\HomeBasic\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\_Default\EnterpriseN\license.rtf to <SYSTEM32>\pt-PT\Licenses\_Default\EnterpriseN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\_Default\EnterpriseE\license.rtf to <SYSTEM32>\pt-PT\Licenses\_Default\EnterpriseE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\OEM\StarterN\license.rtf to <SYSTEM32>\pt-PT\Licenses\OEM\StarterN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\OEM\Professional\license.rtf to <SYSTEM32>\pt-PT\Licenses\OEM\Professional\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\OEM\HomePremiumN\license.rtf to <SYSTEM32>\pt-PT\Licenses\OEM\HomePremiumN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\OEM\HomePremiumE\license.rtf to <SYSTEM32>\pt-PT\Licenses\OEM\HomePremiumE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\OEM\ProfessionalE\license.rtf to <SYSTEM32>\pt-PT\Licenses\OEM\ProfessionalE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\OEM\StarterE\license.rtf to <SYSTEM32>\pt-PT\Licenses\OEM\StarterE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\OEM\Starter\license.rtf to <SYSTEM32>\pt-PT\Licenses\OEM\Starter\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\OEM\ProfessionalN\license.rtf to <SYSTEM32>\pt-PT\Licenses\OEM\ProfessionalN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\_Default\HomeBasicE\license.rtf to <SYSTEM32>\pt-PT\Licenses\_Default\HomeBasicE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\_Default\Ultimate\license.rtf to <SYSTEM32>\pt-PT\Licenses\_Default\Ultimate\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\_Default\StarterN\license.rtf to <SYSTEM32>\pt-PT\Licenses\_Default\StarterN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\_Default\StarterE\license.rtf to <SYSTEM32>\pt-PT\Licenses\_Default\StarterE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\_Default\UltimateE\license.rtf to <SYSTEM32>\pt-PT\Licenses\_Default\UltimateE\license.rtf.ctbl.tmp
  • from <Auxiliary element> to <Auxiliary element>
  • from <SYSTEM32>\pt-PT\Licenses\_Default\UltimateN\license.rtf to <SYSTEM32>\pt-PT\Licenses\_Default\UltimateN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\restore\MachineGuid.txt to <SYSTEM32>\restore\MachineGuid.txt.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\_Default\Starter\license.rtf to <SYSTEM32>\pt-PT\Licenses\_Default\Starter\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\_Default\HomePremiumE\license.rtf to <SYSTEM32>\pt-PT\Licenses\_Default\HomePremiumE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\_Default\HomePremium\license.rtf to <SYSTEM32>\pt-PT\Licenses\_Default\HomePremium\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\_Default\HomeBasicN\license.rtf to <SYSTEM32>\pt-PT\Licenses\_Default\HomeBasicN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\_Default\HomePremiumN\license.rtf to <SYSTEM32>\pt-PT\Licenses\_Default\HomePremiumN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\_Default\ProfessionalN\license.rtf to <SYSTEM32>\pt-PT\Licenses\_Default\ProfessionalN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\_Default\ProfessionalE\license.rtf to <SYSTEM32>\pt-PT\Licenses\_Default\ProfessionalE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\_Default\Professional\license.rtf to <SYSTEM32>\pt-PT\Licenses\_Default\Professional\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\OEM\HomePremium\license.rtf to <SYSTEM32>\pt-PT\Licenses\OEM\HomePremium\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\eval\HomeBasic\license.rtf to <SYSTEM32>\pt-PT\Licenses\eval\HomeBasic\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\eval\EnterpriseN\license.rtf to <SYSTEM32>\pt-PT\Licenses\eval\EnterpriseN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\eval\EnterpriseE\license.rtf to <SYSTEM32>\pt-PT\Licenses\eval\EnterpriseE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\eval\HomeBasicE\license.rtf to <SYSTEM32>\pt-PT\Licenses\eval\HomeBasicE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\eval\HomePremiumE\license.rtf to <SYSTEM32>\pt-PT\Licenses\eval\HomePremiumE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\eval\HomePremium\license.rtf to <SYSTEM32>\pt-PT\Licenses\eval\HomePremium\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\eval\HomeBasicN\license.rtf to <SYSTEM32>\pt-PT\Licenses\eval\HomeBasicN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\eval\Enterprise\license.rtf to <SYSTEM32>\pt-PT\Licenses\eval\Enterprise\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\_Default\StarterE\license.rtf to <SYSTEM32>\pt-BR\Licenses\_Default\StarterE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\_Default\Starter\license.rtf to <SYSTEM32>\pt-BR\Licenses\_Default\Starter\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\_Default\ProfessionalN\license.rtf to <SYSTEM32>\pt-BR\Licenses\_Default\ProfessionalN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\_Default\StarterN\license.rtf to <SYSTEM32>\pt-BR\Licenses\_Default\StarterN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\_Default\UltimateN\license.rtf to <SYSTEM32>\pt-BR\Licenses\_Default\UltimateN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\_Default\UltimateE\license.rtf to <SYSTEM32>\pt-BR\Licenses\_Default\UltimateE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-BR\Licenses\_Default\Ultimate\license.rtf to <SYSTEM32>\pt-BR\Licenses\_Default\Ultimate\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\eval\HomePremiumN\license.rtf to <SYSTEM32>\pt-PT\Licenses\eval\HomePremiumN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\OEM\EnterpriseE\license.rtf to <SYSTEM32>\pt-PT\Licenses\OEM\EnterpriseE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\OEM\Enterprise\license.rtf to <SYSTEM32>\pt-PT\Licenses\OEM\Enterprise\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\eval\UltimateN\license.rtf to <SYSTEM32>\pt-PT\Licenses\eval\UltimateN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\OEM\EnterpriseN\license.rtf to <SYSTEM32>\pt-PT\Licenses\OEM\EnterpriseN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\OEM\HomeBasicN\license.rtf to <SYSTEM32>\pt-PT\Licenses\OEM\HomeBasicN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\OEM\HomeBasicE\license.rtf to <SYSTEM32>\pt-PT\Licenses\OEM\HomeBasicE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\OEM\HomeBasic\license.rtf to <SYSTEM32>\pt-PT\Licenses\OEM\HomeBasic\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\eval\UltimateE\license.rtf to <SYSTEM32>\pt-PT\Licenses\eval\UltimateE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\eval\ProfessionalN\license.rtf to <SYSTEM32>\pt-PT\Licenses\eval\ProfessionalN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\eval\ProfessionalE\license.rtf to <SYSTEM32>\pt-PT\Licenses\eval\ProfessionalE\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\eval\Professional\license.rtf to <SYSTEM32>\pt-PT\Licenses\eval\Professional\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\eval\Starter\license.rtf to <SYSTEM32>\pt-PT\Licenses\eval\Starter\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\eval\Ultimate\license.rtf to <SYSTEM32>\pt-PT\Licenses\eval\Ultimate\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\eval\StarterN\license.rtf to <SYSTEM32>\pt-PT\Licenses\eval\StarterN\license.rtf.ctbl.tmp
  • from <SYSTEM32>\pt-PT\Licenses\eval\StarterE\license.rtf to <SYSTEM32>\pt-PT\Licenses\eval\StarterE\license.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\eula.rtf.ctbl.tmp
  • from %WINDIR%\Installer\$PatchCache$\Managed\FCDAC0A0AD874C333A05DC1548B97920\CacheSize.txt to %WINDIR%\Installer\$PatchCache$\Managed\FCDAC0A0AD874C333A05DC1548B97920\CacheSize.txt.ctbl.tmp
  • from %WINDIR%\Installer\$PatchCache$\Managed\5C1093C35543A0E32A41B090A305076A\CacheSize.txt to %WINDIR%\Installer\$PatchCache$\Managed\5C1093C35543A0E32A41B090A305076A\CacheSize.txt.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.ctbl
  • from %WINDIR%\SoftwareDistribution\SelfUpdate\wuident.txt to %WINDIR%\SoftwareDistribution\SelfUpdate\wuident.txt.ctbl.tmp
  • from <SYSTEM32>\catroot2\dberr.txt.ctbl.tmp to <SYSTEM32>\catroot2\dberr.txt.ctbl
  • from <SYSTEM32>\catroot2\dberr.txt to <SYSTEM32>\catroot2\dberr.txt.ctbl.tmp
  • from %WINDIR%\SoftwareDistribution\SelfUpdate\wuident.txt.ctbl.tmp to %WINDIR%\SoftwareDistribution\SelfUpdate\wuident.txt.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\eula.rtf.ctbl
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\eula.rtf.ctbl.tmp
  • from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\eula.rtf.ctbl.tmp to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\eula.rtf.ctbl
Miscellaneous:
Searches for the following windows:
  • ClassName: 'MS_WebCheckMonitor' WindowName: '(null)'
  • ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
  • ClassName: 'SystemTray_Main' WindowName: '(null)'

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android