Trojan.KillFiles.61467

Technical Information

To ensure autorun and distribution:

Substitutes the following executable system files:

%WINDIR%\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\WindowsBase.dll with %WINDIR%\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\is-MH86U.tmp
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll with %WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\is-DBU22.tmp

Malicious functions:

Creates and executes the following:

'%TEMP%\is-8RLGT.tmp\~necgzoy.tmp' /SL5="$100E0,26056604,154112,%CommonProgramFiles%\~necgzoy.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%CommonProgramFiles%\~necgzoy.tmp' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Modifies file system:

Creates the following files:

%ProgramFiles%\Wondershare\Data Recovery\Views\Raw\is-AGC7L.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-FF8HD.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\is-VIFNF.tmp
%ProgramFiles%\Wondershare\Data Recovery\Views\7Z\is-7LIPO.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-06SBV.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-9CG3V.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-81857.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\is-3GNFS.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\is-AH5K8.tmp
%ProgramFiles%\Wondershare\Data Recovery\Skin\Default\is-NEH6F.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\is-8DJ8E.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\is-7BS01.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\is-PBAU5.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\is-36LL0.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-45IF5.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-3IJAE.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-U5FM2.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-NIUEU.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-C3A46.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-SOG8M.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-VE1MB.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-GLJOT.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-O29ET.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-HT4F7.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-7RKQB.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-67U0F.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-J0G5Q.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-OI7MM.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-EEB5G.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-MPP4V.tmp
%WINDIR%\Fonts\is-UKOGJ.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-EMUQL.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-U19UA.tmp
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\is-DBU22.tmp
%WINDIR%\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\is-MH86U.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Wondershare\Data Recovery\HomePage.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Wondershare\Data Recovery\Order Online.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Wondershare\Data Recovery\How to use.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Wondershare\Data Recovery\Uninstall Wondershare Data Recovery.lnk
%WINDIR%\Fonts\is-7QSHV.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-24ST3.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Wondershare\Data Recovery\Wondershare Data Recovery.lnk
%ProgramFiles%\Wondershare\Data Recovery\Skin\Default\is-9TCLF.tmp
%ProgramFiles%\Wondershare\Data Recovery\Skin\Default\is-Q0TN2.tmp
%ProgramFiles%\Wondershare\Data Recovery\Skin\Default\is-JE8M6.tmp
%ProgramFiles%\Wondershare\Data Recovery\Skin\Default\is-7BK1J.tmp
%ProgramFiles%\Wondershare\Data Recovery\Skin\Default\is-EDBER.tmp
%ProgramFiles%\Wondershare\Data Recovery\Skin\Default\is-IOOQU.tmp
%ProgramFiles%\Wondershare\Data Recovery\Skin\Default\is-GIM2M.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-9U9IA.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-PGFDA.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-KP73E.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-K82NP.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-VQK64.tmp
%ProgramFiles%\Wondershare\Data Recovery\Views\Raw\is-D4SR1.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-PR2FH.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-7DBSI.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\is-LHU4K.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\is-CCFC3.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\is-VHCDK.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\is-ACB9C.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-PH9R2.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-DA0L8.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-51KOC.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\is-3ARFU.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\is-9L6BA.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\Update\is-2OCBG.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\is-CTKGG.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\is-BF82I.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\is-FKEDF.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\is-H82F8.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-UO991.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-6C9FJ.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-5EB2N.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-KCA75.tmp
%TEMP%\aut1.tmp
%CommonProgramFiles%\~necgzoy.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-L13SE.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-A7MHV.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-80ML2.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-69QPM.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-9FFV0.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-K8TTH.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-Q2QBR.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-BT7SL.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-SCID2.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-M0376.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-4COA6.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-DBRI2.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-60EJS.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-Q93IA.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-AUQEN.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-APUI7.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-CQBJN.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-AFK6F.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-S365I.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-PBEQD.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-5B8HO.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-4NV5M.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\Update\is-IF125.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\Update\is-FVTM9.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\Update\is-F32H2.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\Update\is-NMO1J.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\Update\is-QL10O.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\Update\is-501G8.tmp
%ProgramFiles%\Wondershare\Data Recovery\Languages\Update\is-9F9NU.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-GE028.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-P3JRD.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-8UH2E.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-0DEOF.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-JQF68.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-HCSSF.tmp
%ProgramFiles%\Wondershare\Data Recovery\is-1GH8O.tmp

Sets the 'hidden' attribute to the following files:

%CommonProgramFiles%\~necgzoy.tmp

Deletes the following files:

%ProgramFiles%\Wondershare\Data Recovery\WSUtilities.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
%WINDIR%\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\WindowsBase.dll
%ProgramFiles%\Wondershare\Data Recovery\Views\Raw\dcraw.exe
%TEMP%\aut1.tmp
%ProgramFiles%\Wondershare\Data Recovery\WS_Log.dll
%ProgramFiles%\Wondershare\Data Recovery\Languages\MulLanage.xml

Moves the following files:

from %ProgramFiles%\Wondershare\Data Recovery\is-GLJOT.tmp to %ProgramFiles%\Wondershare\Data Recovery\SevenZipSharp.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-O29ET.tmp to %ProgramFiles%\Wondershare\Data Recovery\TorrentParser.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-HT4F7.tmp to %ProgramFiles%\Wondershare\Data Recovery\UniversalFileOpener.Views.Core.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-J0G5Q.tmp to %ProgramFiles%\Wondershare\Data Recovery\O2S.Components.PDFView4NET.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-OI7MM.tmp to %ProgramFiles%\Wondershare\Data Recovery\ObjectManager.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-7RKQB.tmp to %ProgramFiles%\Wondershare\Data Recovery\PresentationCore.dll
from %ProgramFiles%\Wondershare\Data Recovery\Views\7Z\is-7LIPO.tmp to %ProgramFiles%\Wondershare\Data Recovery\Views\7Z\7z.dll
from %ProgramFiles%\Wondershare\Data Recovery\Views\Raw\is-AGC7L.tmp to %ProgramFiles%\Wondershare\Data Recovery\Views\Raw\dcraw.exe
from %ProgramFiles%\Wondershare\Data Recovery\Languages\is-VIFNF.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\bugreport_cn.qm
from %ProgramFiles%\Wondershare\Data Recovery\is-06SBV.tmp to %ProgramFiles%\Wondershare\Data Recovery\UniversalFileOpener.Views.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-9CG3V.tmp to %ProgramFiles%\Wondershare\Data Recovery\UniversalFileOpener.Views.Pdf.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-81857.tmp to %ProgramFiles%\Wondershare\Data Recovery\Word.Resources.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-67U0F.tmp to %ProgramFiles%\Wondershare\Data Recovery\O2S.Components.PDFRender4NET.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-AFK6F.tmp to %ProgramFiles%\Wondershare\Data Recovery\filehint.xml
from %ProgramFiles%\Wondershare\Data Recovery\is-7DBSI.tmp to %ProgramFiles%\Wondershare\Data Recovery\PreViewDocument.exe
from %ProgramFiles%\Wondershare\Data Recovery\is-C3A46.tmp to %ProgramFiles%\Wondershare\Data Recovery\log_config.ini
from %ProgramFiles%\Wondershare\Data Recovery\is-S365I.tmp to %ProgramFiles%\Wondershare\Data Recovery\QtXml4.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-APUI7.tmp to %ProgramFiles%\Wondershare\Data Recovery\Register.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-CQBJN.tmp to %ProgramFiles%\Wondershare\Data Recovery\WsDataRecoveryLib.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-45IF5.tmp to %ProgramFiles%\Wondershare\Data Recovery\FlexCel.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-3IJAE.tmp to %ProgramFiles%\Wondershare\Data Recovery\FlexCelWinforms.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-U5FM2.tmp to %ProgramFiles%\Wondershare\Data Recovery\ICSharpCode.SharpZipLib.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-SOG8M.tmp to %ProgramFiles%\Wondershare\Data Recovery\Aspose.Slides.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-VE1MB.tmp to %ProgramFiles%\Wondershare\Data Recovery\Aspose.Words.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-NIUEU.tmp to %ProgramFiles%\Wondershare\Data Recovery\ComponentFactory.Krypton.Toolkit.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-9U9IA.tmp to %ProgramFiles%\Wondershare\Data Recovery\Wondershare Helper Compact.exe
from %ProgramFiles%\Wondershare\Data Recovery\is-PGFDA.tmp to %ProgramFiles%\Wondershare\Data Recovery\CBSProductClient.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-U19UA.tmp to %ProgramFiles%\Wondershare\Data Recovery\Customization.xml
from %ProgramFiles%\Wondershare\Data Recovery\is-VQK64.tmp to %ProgramFiles%\Wondershare\Data Recovery\LiveUpdate.exe
from %ProgramFiles%\Wondershare\Data Recovery\is-PR2FH.tmp to %ProgramFiles%\Wondershare\Data Recovery\WSOverlay.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-K82NP.tmp to %ProgramFiles%\Wondershare\Data Recovery\WSUtilities.dll
from %WINDIR%\Fonts\is-UKOGJ.tmp to %WINDIR%\Fonts\NotoSans-Regular.ttf
from %WINDIR%\Fonts\is-7QSHV.tmp to %WINDIR%\Fonts\NotoSans-Bold.ttf
from %ProgramFiles%\Wondershare\Data Recovery\is-24ST3.tmp to %ProgramFiles%\Wondershare\Data Recovery\ganalystic.exe
from %ProgramFiles%\Wondershare\Data Recovery\is-EMUQL.tmp to %ProgramFiles%\Wondershare\Data Recovery\BsSndRpt.exe
from %ProgramFiles%\Wondershare\Data Recovery\is-EEB5G.tmp to %ProgramFiles%\Wondershare\Data Recovery\BugSplat.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-MPP4V.tmp to %ProgramFiles%\Wondershare\Data Recovery\BugSplatRc.dll
from %ProgramFiles%\Wondershare\Data Recovery\Skin\Default\is-JE8M6.tmp to %ProgramFiles%\Wondershare\Data Recovery\Skin\Default\UpdateControls.xml
from %ProgramFiles%\Wondershare\Data Recovery\Languages\is-8DJ8E.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\bugreport_ja.qm
from %ProgramFiles%\Wondershare\Data Recovery\Languages\is-3GNFS.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\bugreport_pt.qm
from %ProgramFiles%\Wondershare\Data Recovery\Skin\Default\is-NEH6F.tmp to %ProgramFiles%\Wondershare\Data Recovery\Skin\Default\Controls.png
from %ProgramFiles%\Wondershare\Data Recovery\Languages\is-7BS01.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\bugreport_de.qm
from %ProgramFiles%\Wondershare\Data Recovery\Languages\is-PBAU5.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\bugreport_es.qm
from %ProgramFiles%\Wondershare\Data Recovery\Languages\is-36LL0.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\bugreport_fr.qm
from %ProgramFiles%\Wondershare\Data Recovery\Skin\Default\is-7BK1J.tmp to %ProgramFiles%\Wondershare\Data Recovery\Skin\Default\MainForm.png
from %ProgramFiles%\Wondershare\Data Recovery\Skin\Default\is-9TCLF.tmp to %ProgramFiles%\Wondershare\Data Recovery\Skin\Default\slice.png
from %ProgramFiles%\Wondershare\Data Recovery\Skin\Default\is-Q0TN2.tmp to %ProgramFiles%\Wondershare\Data Recovery\Skin\Default\Thumbs.db
from %ProgramFiles%\Wondershare\Data Recovery\Skin\Default\is-EDBER.tmp to %ProgramFiles%\Wondershare\Data Recovery\Skin\Default\Controls.xml
from %ProgramFiles%\Wondershare\Data Recovery\Skin\Default\is-IOOQU.tmp to %ProgramFiles%\Wondershare\Data Recovery\Skin\Default\Icons.xml
from %ProgramFiles%\Wondershare\Data Recovery\Skin\Default\is-GIM2M.tmp to %ProgramFiles%\Wondershare\Data Recovery\Skin\Default\logo.png
from %ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\is-LHU4K.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\Franch.xml
from %ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\is-CCFC3.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\Japan.xml
from %ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\is-VHCDK.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\Chinese.xml
from %ProgramFiles%\Wondershare\Data Recovery\is-DA0L8.tmp to %ProgramFiles%\Wondershare\Data Recovery\WSUtilities.dll.config
from %ProgramFiles%\Wondershare\Data Recovery\is-51KOC.tmp to %ProgramFiles%\Wondershare\Data Recovery\Wondershare Helper Compact.exe.config
from %ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\is-ACB9C.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\English.xml
from %ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\is-CTKGG.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\Spanish.xml
from %ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\is-3ARFU.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\Arab.xml
from %ProgramFiles%\Wondershare\Data Recovery\Languages\is-9L6BA.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\MulLanage.xml
from %ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\is-BF82I.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\German.xml
from %ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\is-FKEDF.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\Portuguese.xml
from %ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\is-H82F8.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\Innosetup\Italiano.xml
from %ProgramFiles%\Wondershare\Data Recovery\is-PH9R2.tmp to %ProgramFiles%\Wondershare\Data Recovery\WSOverlay.dll.config
from %ProgramFiles%\Wondershare\Data Recovery\is-6C9FJ.tmp to %ProgramFiles%\Wondershare\Data Recovery\O2S.Components.PDFRender4NET.dll.config
from %ProgramFiles%\Wondershare\Data Recovery\is-5EB2N.tmp to %ProgramFiles%\Wondershare\Data Recovery\O2S.Components.PDFView4NET.dll.config
from %ProgramFiles%\Wondershare\Data Recovery\is-K8TTH.tmp to %ProgramFiles%\Wondershare\Data Recovery\PreViewDocument.exe.config
from %ProgramFiles%\Wondershare\Data Recovery\is-L13SE.tmp to %ProgramFiles%\Wondershare\Data Recovery\unins000.exe
from %ProgramFiles%\Wondershare\Data Recovery\is-KCA75.tmp to %ProgramFiles%\Wondershare\Data Recovery\bugreport.exe
from %ProgramFiles%\Wondershare\Data Recovery\is-UO991.tmp to %ProgramFiles%\Wondershare\Data Recovery\WSDataRecovery.exe.config
from %ProgramFiles%\Wondershare\Data Recovery\is-A7MHV.tmp to %ProgramFiles%\Wondershare\Data Recovery\UniversalFileOpener.Views.Pdf.dll.config
from %ProgramFiles%\Wondershare\Data Recovery\is-80ML2.tmp to %ProgramFiles%\Wondershare\Data Recovery\Word.Resources.dll.config
from %ProgramFiles%\Wondershare\Data Recovery\is-69QPM.tmp to %ProgramFiles%\Wondershare\Data Recovery\WsDataRecoveryLib.dll.config
from %ProgramFiles%\Wondershare\Data Recovery\is-Q2QBR.tmp to %ProgramFiles%\Wondershare\Data Recovery\ShareModule.dll.config
from %ProgramFiles%\Wondershare\Data Recovery\is-BT7SL.tmp to %ProgramFiles%\Wondershare\Data Recovery\UniversalFileOpener.Views.Core.dll.config
from %ProgramFiles%\Wondershare\Data Recovery\is-9FFV0.tmp to %ProgramFiles%\Wondershare\Data Recovery\UniversalFileOpener.Views.dll.config
from %ProgramFiles%\Wondershare\Data Recovery\is-Q93IA.tmp to %ProgramFiles%\Wondershare\Data Recovery\msvcp90.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-AUQEN.tmp to %ProgramFiles%\Wondershare\Data Recovery\msvcr90.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-DBRI2.tmp to %ProgramFiles%\Wondershare\Data Recovery\msvcp100.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-P3JRD.tmp to %ProgramFiles%\Wondershare\Data Recovery\Microsoft.VC90.CRT.manifest
from %ProgramFiles%\Wondershare\Data Recovery\is-8UH2E.tmp to %ProgramFiles%\Wondershare\Data Recovery\Mutex.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-60EJS.tmp to %ProgramFiles%\Wondershare\Data Recovery\msvcm90.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-PBEQD.tmp to %ProgramFiles%\Wondershare\Data Recovery\qgif4.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-5B8HO.tmp to %ProgramFiles%\Wondershare\Data Recovery\qjpeg4.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-4NV5M.tmp to %ProgramFiles%\Wondershare\Data Recovery\qtiff4.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-SCID2.tmp to %ProgramFiles%\Wondershare\Data Recovery\msvcr100.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-M0376.tmp to %ProgramFiles%\Wondershare\Data Recovery\QtCore4.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-4COA6.tmp to %ProgramFiles%\Wondershare\Data Recovery\QtGui4.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-GE028.tmp to %ProgramFiles%\Wondershare\Data Recovery\WSDataRecovery.ini
from %ProgramFiles%\Wondershare\Data Recovery\Languages\Update\is-9F9NU.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\Update\French.dat
from %ProgramFiles%\Wondershare\Data Recovery\Languages\Update\is-NMO1J.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\Update\Japanese.dat
from %ProgramFiles%\Wondershare\Data Recovery\Languages\Update\is-IF125.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\Update\Portuguese.dat
from %ProgramFiles%\Wondershare\Data Recovery\Languages\Update\is-2OCBG.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\Update\Chinese(T).dat
from %ProgramFiles%\Wondershare\Data Recovery\Languages\Update\is-QL10O.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\Update\Deutsch.dat
from %ProgramFiles%\Wondershare\Data Recovery\Languages\Update\is-501G8.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\Update\English.dat
from %ProgramFiles%\Wondershare\Data Recovery\is-HCSSF.tmp to %ProgramFiles%\Wondershare\Data Recovery\WS_Log.dll
from %ProgramFiles%\Wondershare\Data Recovery\is-1GH8O.tmp to %ProgramFiles%\Wondershare\Data Recovery\WSDataRecovery.exe
from %ProgramFiles%\Wondershare\Data Recovery\is-0DEOF.tmp to %ProgramFiles%\Wondershare\Data Recovery\LiveUpdate.ini
from %ProgramFiles%\Wondershare\Data Recovery\Languages\Update\is-FVTM9.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\Update\Italiano.dat
from %ProgramFiles%\Wondershare\Data Recovery\Languages\Update\is-F32H2.tmp to %ProgramFiles%\Wondershare\Data Recovery\Languages\Update\Spanish.dat
from %ProgramFiles%\Wondershare\Data Recovery\is-JQF68.tmp to %ProgramFiles%\Wondershare\Data Recovery\VanMail.dll

Substitutes the following files:

%ProgramFiles%\Wondershare\Data Recovery\Views\Raw\dcraw.exe
%ProgramFiles%\Wondershare\Data Recovery\WSUtilities.dll
%ProgramFiles%\Wondershare\Data Recovery\WS_Log.dll
%ProgramFiles%\Wondershare\Data Recovery\Languages\MulLanage.xml

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial