Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'servrakex' = '<SYSTEM32>\CMD.EXE /C START "" "%HOMEPATH%\My Documents\wlrmdr.exe"'
- %HOMEPATH%\Start Menu\Programs\Startup\!RecoveR!-rakex++.PNG
- %HOMEPATH%\Start Menu\Programs\Startup\!RecoveR!-rakex++.TXT
- %HOMEPATH%\Start Menu\Programs\Startup\!RecoveR!-rakex++.HTML
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\!RecoveR!-rakex++.HTML
- '<SYSTEM32>\cmd.exe' /c DEL <Full path to virus> >> NUL
- '%HOMEPATH%\My Documents\wlrmdr.exe'
- <SYSTEM32>\cmd.exe
- ecmd.exe
- %APPDATA%\Microsoft\Windows\Themes\!RecoveR!-rakex++.PNG
- %APPDATA%\Microsoft\SystemCertificates\!RecoveR!-rakex++.HTML
- %APPDATA%\Microsoft\Windows\Themes\!RecoveR!-rakex++.HTML
- %APPDATA%\Microsoft\Windows\Themes\!RecoveR!-rakex++.TXT
- %APPDATA%\Microsoft\SystemCertificates\!RecoveR!-rakex++.TXT
- %APPDATA%\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.TXT
- %APPDATA%\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.PNG
- %APPDATA%\Microsoft\SystemCertificates\!RecoveR!-rakex++.PNG
- %APPDATA%\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.HTML
- %APPDATA%\Mozilla\Extensions\!RecoveR!-rakex++.PNG
- %APPDATA%\Microsoft\!RecoveR!-rakex++.HTML
- %APPDATA%\Mozilla\Extensions\!RecoveR!-rakex++.HTML
- %APPDATA%\Mozilla\Extensions\!RecoveR!-rakex++.TXT
- %APPDATA%\Microsoft\!RecoveR!-rakex++.TXT
- %APPDATA%\Microsoft\Windows\!RecoveR!-rakex++.TXT
- %APPDATA%\Microsoft\Windows\!RecoveR!-rakex++.PNG
- %APPDATA%\Microsoft\!RecoveR!-rakex++.PNG
- %APPDATA%\Microsoft\Windows\!RecoveR!-rakex++.HTML
- %APPDATA%\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.HTML
- %APPDATA%\Microsoft\Media Player\!RecoveR!-rakex++.HTML
- %APPDATA%\Microsoft\Media Player\!RecoveR!-rakex++.TXT
- %APPDATA%\Microsoft\MMC\!RecoveR!-rakex++.TXT
- %APPDATA%\Microsoft\MMC\!RecoveR!-rakex++.PNG
- %APPDATA%\Microsoft\Media Player\!RecoveR!-rakex++.PNG
- %APPDATA%\Microsoft\Internet Explorer\!RecoveR!-rakex++.PNG
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\!RecoveR!-rakex++.HTML
- %APPDATA%\Microsoft\Internet Explorer\!RecoveR!-rakex++.HTML
- %APPDATA%\Microsoft\Internet Explorer\!RecoveR!-rakex++.TXT
- %APPDATA%\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.HTML
- %APPDATA%\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.TXT
- %APPDATA%\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.TXT
- %APPDATA%\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.PNG
- %APPDATA%\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.PNG
- %APPDATA%\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.PNG
- %APPDATA%\Microsoft\MMC\!RecoveR!-rakex++.HTML
- %APPDATA%\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.HTML
- %APPDATA%\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.TXT
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\!RecoveR!-rakex++.PNG
- %HOMEPATH%\Favorites\Links\!RecoveR!-rakex++.HTML
- %HOMEPATH%\Favorites\Links\!RecoveR!-rakex++.TXT
- %HOMEPATH%\Favorites\!RecoveR!-rakex++.TXT
- %HOMEPATH%\Favorites\!RecoveR!-rakex++.PNG
- %HOMEPATH%\Favorites\Links\!RecoveR!-rakex++.PNG
- %HOMEPATH%\Cookies\!RecoveR!-rakex++.PNG
- %APPDATA%\!RecoveR!-rakex++.HTML
- %HOMEPATH%\Cookies\!RecoveR!-rakex++.HTML
- %HOMEPATH%\Cookies\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\!RecoveR!-rakex++.PNG
- %HOMEPATH%\Favorites\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\!RecoveR!-rakex++.TXT
- %APPDATA%\!RecoveR!-rakex++.TXT
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\!RecoveR!-rakex++.TXT
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\!RecoveR!-rakex++.PNG
- %APPDATA%\Mozilla\Firefox\Profiles\!RecoveR!-rakex++.PNG
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\!RecoveR!-rakex++.HTML
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\!RecoveR!-rakex++.HTML
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\!RecoveR!-rakex++.HTML
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\!RecoveR!-rakex++.TXT
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\!RecoveR!-rakex++.TXT
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\!RecoveR!-rakex++.PNG
- %APPDATA%\Mozilla\!RecoveR!-rakex++.TXT
- %APPDATA%\Mozilla\!RecoveR!-rakex++.PNG
- %APPDATA%\!RecoveR!-rakex++.PNG
- %APPDATA%\Mozilla\!RecoveR!-rakex++.HTML
- %APPDATA%\Mozilla\Firefox\!RecoveR!-rakex++.HTML
- %APPDATA%\Mozilla\Firefox\Profiles\!RecoveR!-rakex++.HTML
- %APPDATA%\Mozilla\Firefox\Profiles\!RecoveR!-rakex++.TXT
- %APPDATA%\Mozilla\Firefox\!RecoveR!-rakex++.TXT
- %APPDATA%\Mozilla\Firefox\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Local Settings\Temp\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Local Settings\Temp\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Local Settings\History\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Local Settings\History\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Local Settings\Temp\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Local Settings\History\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Application Data\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Application Data\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Cookies\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Cookies\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Application Data\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Cookies\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\!RecoveR!-rakex++.PNG
- %APPDATA%\Identities\!RecoveR!-rakex++.HTML
- %APPDATA%\Identities\!RecoveR!-rakex++.TXT
- %APPDATA%\Microsoft\Address Book\!RecoveR!-rakex++.TXT
- %APPDATA%\Microsoft\Address Book\!RecoveR!-rakex++.PNG
- %APPDATA%\Identities\!RecoveR!-rakex++.PNG
- %APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\!RecoveR!-rakex++.HTML
- %APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\!RecoveR!-rakex++.HTML
- %APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\!RecoveR!-rakex++.TXT
- %APPDATA%\Microsoft\Credentials\!RecoveR!-rakex++.HTML
- %APPDATA%\Microsoft\Credentials\!RecoveR!-rakex++.TXT
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\!RecoveR!-rakex++.TXT
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\!RecoveR!-rakex++.PNG
- %APPDATA%\Microsoft\Credentials\!RecoveR!-rakex++.PNG
- %APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\!RecoveR!-rakex++.PNG
- %APPDATA%\Microsoft\Address Book\!RecoveR!-rakex++.HTML
- %APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\!RecoveR!-rakex++.HTML
- %APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Local Settings\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Local Settings\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Local Settings\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\!RecoveR!-rakex++.PNG
- %HOMEPATH%\Local Settings\History\History.IE5\!RecoveR!-rakex++.PNG
- %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\!RecoveR!-rakex++.HTML
- %HOMEPATH%\Local Settings\History\History.IE5\!RecoveR!-rakex++.HTML
- %HOMEPATH%\Local Settings\History\History.IE5\!RecoveR!-rakex++.TXT
- %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\!RecoveR!-rakex++.PNG
- %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\!RecoveR!-rakex++.HTML
- %HOMEPATH%\Local Settings\!RecoveR!-rakex++.PNG
- %TEMP%\!RecoveR!-rakex++.HTML
- %HOMEPATH%\Local Settings\!RecoveR!-rakex++.HTML
- %HOMEPATH%\Local Settings\!RecoveR!-rakex++.TXT
- %TEMP%\!RecoveR!-rakex++.TXT
- %HOMEPATH%\Local Settings\History\!RecoveR!-rakex++.TXT
- %HOMEPATH%\Local Settings\History\!RecoveR!-rakex++.PNG
- %TEMP%\!RecoveR!-rakex++.PNG
- %HOMEPATH%\Local Settings\History\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\VMware\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Mozilla\Firefox\Profiles\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Mozilla\Firefox\Profiles\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Mozilla\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\VMware\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\VMware\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\Firefox\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\Firefox\Profiles\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\!RecoveR!-rakex++.TXT
- %HOMEPATH%\My Documents\Downloads\!RecoveR!-rakex++.PNG
- %HOMEPATH%\SendTo\!RecoveR!-rakex++.HTML
- %HOMEPATH%\SendTo\!RecoveR!-rakex++.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\!RecoveR!-rakex++.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\!RecoveR!-rakex++.PNG
- %HOMEPATH%\SendTo\!RecoveR!-rakex++.PNG
- %HOMEPATH%\Recent\!RecoveR!-rakex++.PNG
- %HOMEPATH%\PrintHood\!RecoveR!-rakex++.HTML
- %HOMEPATH%\Recent\!RecoveR!-rakex++.HTML
- %HOMEPATH%\Recent\!RecoveR!-rakex++.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\!RecoveR!-rakex++.HTML
- %HOMEPATH%\Start Menu\Programs\Accessories\!RecoveR!-rakex++.TXT
- %HOMEPATH%\Start Menu\Programs\!RecoveR!-rakex++.TXT
- %HOMEPATH%\Start Menu\Programs\!RecoveR!-rakex++.PNG
- %HOMEPATH%\Start Menu\Programs\Accessories\!RecoveR!-rakex++.PNG
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\!RecoveR!-rakex++.PNG
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\!RecoveR!-rakex++.HTML
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\!RecoveR!-rakex++.HTML
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\!RecoveR!-rakex++.TXT
- %HOMEPATH%\PrintHood\!RecoveR!-rakex++.TXT
- %HOMEPATH%\My Documents\My Pictures\!RecoveR!-rakex++.TXT
- %HOMEPATH%\My Documents\My Pictures\!RecoveR!-rakex++.PNG
- %HOMEPATH%\My Documents\My Received Files\!RecoveR!-rakex++.PNG
- %HOMEPATH%\My Documents\My Pictures\!RecoveR!-rakex++.HTML
- %HOMEPATH%\My Documents\My Music\!RecoveR!-rakex++.HTML
- %HOMEPATH%\My Documents\Downloads\!RecoveR!-rakex++.HTML
- %HOMEPATH%\My Documents\Downloads\!RecoveR!-rakex++.TXT
- %HOMEPATH%\My Documents\My Music\!RecoveR!-rakex++.TXT
- %HOMEPATH%\My Documents\My Music\!RecoveR!-rakex++.PNG
- %HOMEPATH%\NetHood\!RecoveR!-rakex++.TXT
- %HOMEPATH%\NetHood\!RecoveR!-rakex++.PNG
- %HOMEPATH%\PrintHood\!RecoveR!-rakex++.PNG
- %HOMEPATH%\NetHood\!RecoveR!-rakex++.HTML
- %HOMEPATH%\My Documents\!RecoveR!-rakex++.HTML
- %HOMEPATH%\My Documents\My Received Files\!RecoveR!-rakex++.HTML
- %HOMEPATH%\My Documents\My Received Files\!RecoveR!-rakex++.TXT
- %HOMEPATH%\My Documents\!RecoveR!-rakex++.TXT
- %HOMEPATH%\My Documents\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Microsoft\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Microsoft\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Microsoft\Windows Media\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Microsoft\Windows Media\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Microsoft\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Microsoft\Windows Media\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Microsoft\Windows Media\9.0\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Microsoft\Credentials\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Microsoft\Credentials\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Identities\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Identities\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Identities\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Microsoft\Windows\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Microsoft\Windows\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Microsoft\Windows Media\9.0\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Microsoft\Windows Media\9.0\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Microsoft\Windows\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Microsoft\Media Player\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Microsoft\Credentials\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Microsoft\Media Player\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Microsoft\Media Player\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\!RecoveR!-rakex++.PNG
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\!RecoveR!-rakex++.HTML
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\!RecoveR!-rakex++.TXT
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Cookies\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Application Data\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Cookies\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Cookies\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Application Data\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Application Data\Microsoft\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Application Data\Microsoft\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Application Data\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Application Data\Microsoft\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Favorites\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Favorites\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Favorites\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Local Settings\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Local Settings\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Local Settings\Application Data\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Local Settings\Application Data\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Local Settings\Application Data\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Local Settings\Temp\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Local Settings\Temp\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Local Settings\Temp\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Local Settings\History\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Local Settings\History\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Local Settings\History\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Documents\My Pictures\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\!RecoveR!-rakex++.HTML
- %ALLUSERSPROFILE%\Documents\My Pictures\!RecoveR!-rakex++.HTML
- %ALLUSERSPROFILE%\Documents\My Pictures\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\Documents\My Music\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\Documents\My Music\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Documents\My Music\!RecoveR!-rakex++.HTML
- %ALLUSERSPROFILE%\DRM\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Documents\!RecoveR!-rakex++.HTML
- %ALLUSERSPROFILE%\DRM\!RecoveR!-rakex++.HTML
- %ALLUSERSPROFILE%\DRM\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\Documents\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\Documents\My Videos\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\Documents\My Videos\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Documents\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Documents\My Videos\!RecoveR!-rakex++.HTML
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\!RecoveR!-rakex++.HTML
- %ALLUSERSPROFILE%\Documents\My Music\My Playlists\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\Documents\My Music\My Playlists\!RecoveR!-rakex++.PNG
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\_ini[1].htm
- %ALLUSERSPROFILE%\Documents\My Music\My Playlists\!RecoveR!-rakex++.HTML
- <Current directory>\!RecoveR!-rakex++.HTML
- %HOMEPATH%\My Documents\-!recover!-!file!-.txt
- %HOMEPATH%\My Documents\wlrmdr.exe
- <Current directory>\!RecoveR!-rakex++.TXT
- <Current directory>\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\!RecoveR!-rakex++.HTML
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\phpinc[1].htm
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\!RecoveR!-rakex++.HTML
- %ALLUSERSPROFILE%\Favorites\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Start Menu\Programs\!RecoveR!-rakex++.HTML
- %ALLUSERSPROFILE%\Start Menu\Programs\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\Start Menu\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\Start Menu\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Start Menu\Programs\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\!RecoveR!-rakex++.HTML
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\!RecoveR!-rakex++.HTML
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\!RecoveR!-rakex++.HTML
- %ALLUSERSPROFILE%\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Templates\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Start Menu\!RecoveR!-rakex++.HTML
- %ALLUSERSPROFILE%\Templates\!RecoveR!-rakex++.HTML
- %ALLUSERSPROFILE%\Templates\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\!RecoveR!-rakex++.HTML
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\!RecoveR!-rakex++.HTML
- %ALLUSERSPROFILE%\Favorites\!RecoveR!-rakex++.HTML
- %ALLUSERSPROFILE%\Favorites\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\!RecoveR!-rakex++.PNG
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\!RecoveR!-rakex++.HTML
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\!RecoveR!-rakex++.HTML
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\!RecoveR!-rakex++.HTML
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\!RecoveR!-rakex++.TXT
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Local Settings\Temp\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Local Settings\Temp\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Local Settings\History\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Local Settings\History\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Local Settings\Temp\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Local Settings\History\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Cookies\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Local Settings\Application Data\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Local Settings\Application Data\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Local Settings\Application Data\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Local Settings\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Local Settings\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Local Settings\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Templates\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Start Menu\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Templates\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Templates\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Start Menu\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Start Menu\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Start Menu\Programs\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\NetHood\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\NetHood\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\PrintHood\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\PrintHood\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\NetHood\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\My Documents\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Local Settings\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\My Documents\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\My Documents\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\SendTo\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\SendTo\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\SendTo\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\Recent\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\Default User\PrintHood\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Recent\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\Recent\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\Default User\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Application Data\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Application Data\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Cookies\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Cookies\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Application Data\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Application Data\Microsoft\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Application Data\Microsoft\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Application Data\Microsoft\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\Default User\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.PNG
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\!RecoveR!-rakex++.HTML
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.TXT
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.PNG
- %HOMEPATH%\My Documents\wlrmdr.exe
- 'hy#####seyourself.co.uk':80
- 'la####inique.com.mx':80
- 'gm##ae.com':80
- 'www.te####rassist.info':80
- 'be###nghana.com':80
- 'fa#####ike.makkie.com':80
- http://hy#####seyourself.co.uk/_ini.php
- http://la####inique.com.mx/_ini.php
- http://gm##ae.com/phpinc.php
- http://www.te####rassist.info/_ini.php
- http://be###nghana.com/wp-content/plugins/_ini.php
- http://fa#####ike.makkie.com/tmp/yoo_master2_j32/warp/systems/joomla/config/layouts/fields/_ini.php
- DNS ASK hy#####seyourself.co.uk
- DNS ASK la####inique.com.mx
- DNS ASK gm##ae.com
- DNS ASK www.te####rassist.info
- DNS ASK be###nghana.com
- DNS ASK fa#####ike.makkie.com
- ClassName: 'Indicator' WindowName: ''