Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen

Support

Ihre Anfragen

Rufen Sie uns an

+7 (495) 789-45-86

Profil

Trojan.Encoder.29718

Added to the Dr.Web virus database: 2019-10-07

Virus description added:

Technical Information

To ensure autorun and distribution
Creates or modifies the following files
  • %ALLUSERSPROFILE%\start menu\programs\startup\_nemty_fbpf6jo_-decrypt.txt
Creates the following files on removable media
  • <Drive name for removable media>:\_nemty_fbpf6jo_-decrypt.txt
  • <Drive name for removable media>:\indogerman2010.pptx
  • <Drive name for removable media>:\samieee_obiee_presentation.pptx
  • <Drive name for removable media>:\gruenspecht_02172016.pptx
  • <Drive name for removable media>:\waterresourcesag.pptx
  • <Drive name for removable media>:\asaprojectcompetition.pptx
  • <Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
  • <Drive name for removable media>:\hanni_umami_chapter.doc
  • <Drive name for removable media>:\cveuropeo.doc
  • <Drive name for removable media>:\sdkfailsafeemulator.cer
  • <Drive name for removable media>:\sdksampleunprivdeveloper.cer
  • <Drive name for removable media>:\middaugh_keynote.pptx
  • <Drive name for removable media>:\sdksampleprivdeveloper.cer
  • <Drive name for removable media>:\pmd.cer
  • <Drive name for removable media>:\contoso_1.cer
  • <Drive name for removable media>:\coffee.bmp
  • <Drive name for removable media>:\tileimage.bmp
  • <Drive name for removable media>:\dialmap.bmp
  • <Drive name for removable media>:\toolbar.bmp
  • <Drive name for removable media>:\dashborder_192.bmp
  • <Drive name for removable media>:\dial.bmp
  • <Drive name for removable media>:\join.avi
  • <Drive name for removable media>:\correct.avi
  • <Drive name for removable media>:\contoso.cer
  • <Drive name for removable media>:\roozenedowebinar.pptx
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Executes the following
  • '<SYSTEM32>\taskkill.exe' /f /im sql.*
  • '<SYSTEM32>\net.exe' stop QBCFMontorService
  • '<SYSTEM32>\net.exe' stop cbVSCService11
  • '<SYSTEM32>\net.exe' stop CobianBackup11
  • '<SYSTEM32>\net.exe' stop SQLBrowser
  • '<SYSTEM32>\net.exe' stop SQLAgent$SQLEXPRESS
  • '<SYSTEM32>\net.exe' stop MongoDB
  • '<SYSTEM32>\net.exe' stop MSSQLServerADHelper100
  • '<SYSTEM32>\net.exe' stop MSSQL$SQLEXPRESS
  • '<SYSTEM32>\net.exe' stop SQLWriter
  • '<SYSTEM32>\net.exe' stop Apache2.4
  • '<SYSTEM32>\net.exe' stop AcronisAgent
  • '<SYSTEM32>\net.exe' stop AcrSch2Svc
  • '<SYSTEM32>\net.exe' stop OracleServiceXE
  • '<SYSTEM32>\net.exe' stop QBVSS
  • '<SYSTEM32>\net.exe' stop DbxSvc
  • '<SYSTEM32>\taskkill.exe' /f /im Flow.*
  • '<SYSTEM32>\taskkill.exe' /f /im Teams.*
  • '<SYSTEM32>\taskkill.exe' /f /im WBGX.*
  • '<SYSTEM32>\taskkill.exe' /f /im QBW32.*
  • '<SYSTEM32>\taskkill.exe' /f /im node.*
  • '<SYSTEM32>\taskkill.exe' /f /im virtualboxvm.*
  • '<SYSTEM32>\taskkill.exe' /f /im onenote.*
  • '<SYSTEM32>\taskkill.exe' /f /im excel.*
  • '<SYSTEM32>\taskkill.exe' /f /im oracle.*
  • '<SYSTEM32>\taskkill.exe' /f /im thunderbird.*
  • '<SYSTEM32>\taskkill.exe' /f /im outlook.*
  • '<SYSTEM32>\taskkill.exe' /f /im wordpad.*
  • '<SYSTEM32>\taskkill.exe' /f /im winword.*
  • '<SYSTEM32>\net.exe' stop OracleXETNSListener
  • '<SYSTEM32>\net.exe' stop
Modifies file system
Creates the following files
  • %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1229272821-842925246-1060284298-1003\650860e5119ec19a8de142e32f03c712_5f9fe710-99e6-4c04-be62-a7f1b8b321d1
  • %HOMEPATH%\.oracle_jre_usage\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\.purple\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\.purple\certificates\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\.purple\certificates\x509\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\.purple\certificates\x509\tls_peers\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\.purple\smileys\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\acrobat\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\acrobat\10.0\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\acrobat\10.0\collab\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\acrobat\10.0\forms\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\can\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\acrobat\10.0\javascripts\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\acrobat\10.0\security\crlcache\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\acrobat\9.0\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\acrobat\9.0\forms\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\acrobat\9.0\javascripts\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\flash player\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\flash player\assetcache\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\flash player\assetcache\mc4yk349\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\headlights\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\linguistics\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\linguistics\dictionaries\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\all\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\z9pmdpek\_nemty_fbpf6jo_-decrypt.txt
  • %HOMEPATH%\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\acrobat\10.0\security\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\brt\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\ee7gwdg8\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\o4q6sqop\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\qiszf4kx\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\application data\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\application data\microsoft\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\application data\microsoft\credentials\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\application data\microsoft\credentials\s-1-5-20\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\application data\microsoft\internet explorer\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\application data\microsoft\media player\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\application data\microsoft\systemcertificates\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\application data\microsoft\systemcertificates\my\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\application data\microsoft\systemcertificates\my\certificates\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\application data\microsoft\systemcertificates\my\crls\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\application data\microsoft\systemcertificates\my\ctls\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\cookies\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\local settings\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\local settings\application data\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\local settings\application data\microsoft\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\local settings\application data\microsoft\credentials\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\local settings\application data\microsoft\credentials\s-1-5-20\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\local settings\history\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\local settings\history\history.ie5\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\local settings\temp\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\local settings\<INETFILES>\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\etuaii8e\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\9stcdn6y\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\networkservice\local settings\<INETFILES>\content.ie5\h8mbgrq8\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\documents\my music\sample playlists\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\linguistics\dictionaries\adobe custom dictionary\eng\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\pt\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\pt\jabber\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\pt\loading\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\ru\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\ru\error\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\ru\jabber\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\ru\loading\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\tr\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\tr\error\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\tr\jabber\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\tr\loading\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\ua\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\ua\error\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\adobe\logtransport2\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\ua\jabber\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\uz\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\uz\error\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\uz\jabber\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\uz\loading\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\skin\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\skin_cache\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\smiles\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\smiles\flash\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\smiles\smiles\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\smiles\smiles\8march\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\smiles\smiles\animated\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\kz\loading\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\kz\jabber\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\pt\error\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\kz\error\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\kz\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icq-profile\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icq-profile\update\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icq-profile\update\splash_banner\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\database\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\dll\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\fonts\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\graphics\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\graphics\phone\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\bg\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\bg\error\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\local settings\<INETFILES>\content.ie5\mqraz07n\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\bg\loading\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\cz\error\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\cz\jabber\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\cz\loading\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\de\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\de\error\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\de\jabber\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\de\loading\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\en\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\en\error\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\en\jabber\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\en\loading\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\bg\jabber\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icq-profile\base\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\cz\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\local settings\<INETFILES>\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\local settings\temp\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\local settings\history\history.ie5\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1040\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1041\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1042\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1046\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1049\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1050\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\2052\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\3082\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\msdn\8.0\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\network\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\network\connections\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\network\connections\cm\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\network\connections\pbk\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\network\downloader\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\office\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\office\data\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\office\groove\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\user account pictures\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\user account pictures\default pictures\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft help\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\oracle\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\oracle\java\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\oracle\java\installcache\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\package cache\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1031\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1036\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1028\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\msdn\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\adobe\setup\{ac76ba86-7ad7-1033-7b44-aa1000000001}\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1229272821-842925246-1060284298-1003\94a9cdfb09e37d01f75d09c2c4488906_5f9fe710-99e6-4c04-be62-a7f1b8b321d1
  • C:\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\_nemty_fbpf6jo_-decrypt.txt
  • D:\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\adobe\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\adobe\acrobat\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\adobe\acrobat\10.0\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\adobe\acrobat\10.0\replicate\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\adobe\acrobat\10.0\replicate\security\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\adobe\arm\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\smiles\smiles\cat\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\adobe\setup\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\crypto\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\crypto\dss\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\crypto\dss\machinekeys\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\dbgclr\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\dbgclr\7.1\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\dbgclr\7.1\1033\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\html help\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\media index\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\media player\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\msdaipp\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\msdaipp\offline\_nemty_fbpf6jo_-decrypt.txt
  • %HOMEPATH%\adobeupdate.exe
  • %ALLUSERSPROFILE%\application data\adobe\updater6\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\html\ua\loading\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\start menu\programs\mirc\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\start menu\programs\qip 2012\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\start menu\programs\steam\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\start menu\programs\winrar\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\templates\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\default user\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\application data\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\application data\microsoft\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\application data\microsoft\credentials\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\application data\microsoft\credentials\s-1-5-19\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\microsoft\msdn\7.0\1033\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\application data\microsoft\internet explorer\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\application data\microsoft\systemcertificates\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\application data\microsoft\systemcertificates\my\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\application data\microsoft\systemcertificates\my\certificates\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\application data\microsoft\systemcertificates\my\crls\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\application data\microsoft\systemcertificates\my\ctls\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\cookies\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\local settings\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\local settings\application data\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\local settings\application data\microsoft\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\local settings\application data\microsoft\credentials\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\local settings\application data\microsoft\credentials\s-1-5-19\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\local settings\history\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\start menu\programs\microsoft .net framework sdk v1.1\_nemty_fbpf6jo_-decrypt.txt
  • C:\documents and settings\localservice\application data\microsoft\media player\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\start menu\programs\microsoft office\microsoft office tools\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\start menu\programs\microsoft office\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\start menu\programs\google chrome\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\start menu\programs\games\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\sun\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\sun\java\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\sun\java\java update\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\desktop\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\documents\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\documents\my music\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\documents\my music\my playlists\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\documents\my music\sample music\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\documents\my music\sample playlists\00107ff6\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\documents\my pictures\sample pictures\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\documents\my videos\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\drm\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\favorites\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\start menu\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\start menu\programs\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\start menu\programs\accessories\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\start menu\programs\accessories\accessibility\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\start menu\programs\accessories\communications\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\start menu\programs\accessories\entertainment\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\start menu\programs\accessories\system tools\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\application data\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\start menu\programs\administrative tools\_nemty_fbpf6jo_-decrypt.txt
  • %ALLUSERSPROFILE%\documents\my pictures\_nemty_fbpf6jo_-decrypt.txt
  • %APPDATA%\icqm\icq\smiles\smiles\emoji\_nemty_fbpf6jo_-decrypt.txt
Sets the 'hidden' attribute to the following files
  • %HOMEPATH%\adobeupdate.exe
Moves the following files
  • from %APPDATA%\.purple\prefs.xml to %APPDATA%\.purple\prefs.xml._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\fool.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\fool.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\facepalm.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\facepalm.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\drinks.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\drinks.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\dirol.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\dirol.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\diablo.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\diablo.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\dance.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\dance.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\crazy.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\crazy.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\cray.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\cray.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\blush.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\blush.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\blum.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\blum.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\44a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\44a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\biggrin.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\biggrin.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\angel.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\angel.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\s008.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\53a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\53a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\52a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\52a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\51a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\51a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\50a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\50a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\49a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\49a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\48a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\48a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\47a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\47a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\46a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\46a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\bad.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\bad.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\45a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\45a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\give_rose.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\give_rose.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\shout.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\shout.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s006.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s006.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s005.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s005.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s004.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s004.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s003.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s003.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s002.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s002.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s001.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s001.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\yahoo.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\yahoo.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\wink.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\wink.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\wacko2.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\wacko2.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\unknw.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\unknw.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\kiss_mini.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\kiss_mini.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\good.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\good.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\shok.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\shok.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\scratch_one-s_head.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\scratch_one-s_head.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\sad.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\rolleyes.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\rolleyes.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\rofl.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\rofl.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\pardon.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\pardon.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\nea.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\nea.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\music.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\music.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\mocking.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\mocking.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\man_in_love.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\man_in_love.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set03\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\set03\smile.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s008.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s007.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s007.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\41b.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\41b.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\01.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\01.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\11a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\11a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\10a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\10a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\09a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\09a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\08a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\08a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\07a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\07a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\06a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\06a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\04b.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\04b.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\03a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\03a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\02.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\02.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\12a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\12a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\13a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\13a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\42a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\42a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\wink.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\wink.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\wacko1.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\wacko1.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\unknown.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\unknown.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\sorry.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\sorry.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\smile.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\shout.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\shout.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\shok.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\shok.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\scratch_one-s_head.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\scratch_one-s_head.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\sad.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\yahoo.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\yahoo.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\43a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\43a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\14a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\14a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\28a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\28a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\29a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\29a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\39a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\39a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\38a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\38a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\37.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\37.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\36a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\36a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\34a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\34a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\33a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\33a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\32a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\32a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\31a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\31a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\30a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\30a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\40a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\40a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\15a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\15a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\16a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\16a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\26a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\26a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\25a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\25a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\24a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\24a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\23a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\23a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\22a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\22a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\21a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\21a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\20a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\20a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\19a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\19a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\17a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\17a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\27a.gif to %APPDATA%\icqm\icq\smiles\smiles\odnoklassniki\27a.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\joy.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\joy.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s009.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s009.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\plug.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\plug.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\hm.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\hm.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\pig.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\pig.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\oo.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\oo.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\ok.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\ok.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\live.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\live.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\laughter.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\laughter.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\kukes.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\kukes.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_right.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_right.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_left.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\koza_left.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\kiss.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\rrr.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\rrr.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\really.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\really.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\blink.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\blink.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\fist.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\fist.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\disappointed.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\disappointed.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\die.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\die.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\devil.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\devil.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\detzl.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\detzl.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\cry.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\cry.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\crocodile.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\crocodile.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\coolguy.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\coolguy.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\bullshit.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\bullshit.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\fuck.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\fuck.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\heart.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\heart.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\shy.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\shy.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\biggrin.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\biggrin.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_offline.ico to %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_offline.ico._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_gray.ico to %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_gray.ico._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_busy.ico to %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_busy.ico._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_away.ico to %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_away.ico._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\valentine\want_you.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\want_you.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\valentine\undress.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\undress.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\valentine\on_wings.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\on_wings.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\valentine\lets_play.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\lets_play.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\valentine\kissed.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\kissed.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\sceptic.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\sceptic.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_online.ico to %APPDATA%\icqm\icq\smiles\statuses\aim\aim_status_online.ico._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\valentine\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\kiss.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\valentine\dont_be_late.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\dont_be_late.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\valentine\broken_heart.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\broken_heart.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\zloradstvo.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\zloradstvo.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\victory.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\victory.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\vampire.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\vampire.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\think.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\think.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\tears.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\tears.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\smile.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\sleepy.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\sleepy.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\valentine\jealousy.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\jealousy.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\valentine\in_love.gif to %APPDATA%\icqm\icq\smiles\smiles\valentine\in_love.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\biganger.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\biganger.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\bee.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\bee.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s016.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s016.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s014.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s014.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s013.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s013.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s012.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s012.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s011.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s011.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s010.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s010.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s009.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s009.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s008.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s007.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s007.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s017.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s017.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s006.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s006.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s004.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s004.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s003.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s003.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s002.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s002.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s001.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s001.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s016.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s016.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s015.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s015.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s014.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s014.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s013.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s013.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s012.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s012.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s011.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s011.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s005.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s005.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s018.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s018.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s019.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s019.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s015.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s015.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set05\s020.gif to %APPDATA%\icqm\icq\smiles\smiles\set05\s020.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\ass.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\ass.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s013.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s013.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\angry.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\angry.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\amazed.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\amazed.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\aaa.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\aaa.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s020.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s020.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s019.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s019.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s018.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s018.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s017.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s017.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s016.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s016.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s015.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s015.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s014.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s014.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s012.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s012.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\smiles\bazilio.gif to %APPDATA%\icqm\icq\smiles\smiles\smiles\bazilio.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s011.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s011.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s010.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s010.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s009.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s009.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s008.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s008.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s006.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s006.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s004.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s004.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s003.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s003.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s002.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s002.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set06\s001.gif to %APPDATA%\icqm\icq\smiles\smiles\set06\s001.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\rofl.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\rofl.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\yes.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\yes.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\pardon.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\pardon.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\nea.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\nea.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\music.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\music.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\kot_wow.swf to %APPDATA%\icqm\icq\smiles\flash\kot_wow.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\rabotaet.swf to %APPDATA%\icqm\icq\smiles\flash\rabotaet.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\missyou.swf to %APPDATA%\icqm\icq\smiles\flash\missyou.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\mad dog.swf to %APPDATA%\icqm\icq\smiles\flash\mad dog.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\love_bear_rose.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_rose.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\love_bear_kiss.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_kiss.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\love_bear_hugs.swf to %APPDATA%\icqm\icq\smiles\flash\love_bear_hugs.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\likeu.swf to %APPDATA%\icqm\icq\smiles\flash\likeu.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\laugh.swf to %APPDATA%\icqm\icq\smiles\flash\laugh.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\krizis.swf to %APPDATA%\icqm\icq\smiles\flash\krizis.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\drako_opyatnica.swf to %APPDATA%\icqm\icq\smiles\flash\drako_opyatnica.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\serdze.swf to %APPDATA%\icqm\icq\smiles\flash\serdze.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\drako_zombie.swf to %APPDATA%\icqm\icq\smiles\flash\drako_zombie.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\kot_nedutza.swf to %APPDATA%\icqm\icq\smiles\flash\kot_nedutza.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\kot_goodbye.swf to %APPDATA%\icqm\icq\smiles\flash\kot_goodbye.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\kot_cool.swf to %APPDATA%\icqm\icq\smiles\flash\kot_cool.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\kisses.swf to %APPDATA%\icqm\icq\smiles\flash\kisses.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\joy.swf to %APPDATA%\icqm\icq\smiles\flash\joy.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\information.swf to %APPDATA%\icqm\icq\smiles\flash\information.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\guby.swf to %APPDATA%\icqm\icq\smiles\flash\guby.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\gangsta.swf to %APPDATA%\icqm\icq\smiles\flash\gangsta.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\duh.swf to %APPDATA%\icqm\icq\smiles\flash\duh.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\kot_obida.swf to %APPDATA%\icqm\icq\smiles\flash\kot_obida.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\kot_spasibo.swf to %APPDATA%\icqm\icq\smiles\flash\kot_spasibo.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\skratch.swf to %APPDATA%\icqm\icq\smiles\flash\skratch.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\mrasmileslang_kz.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_kz.xml._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\mrasmileslang_pt.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_pt.xml._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\doll.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\doll.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\cookie.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\cookie.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\cat.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\cat.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\car.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\car.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\skin.txt to %APPDATA%\icqm\icq\smiles\skin.txt._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\mrasmileslang_uz.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_uz.xml._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\mrasmileslang_ua.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_ua.xml._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\mrasmileslang_tr.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_tr.xml._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\mrasmileslang_ru.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_ru.xml._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\drink.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\drink.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\smeh.swf to %APPDATA%\icqm\icq\smiles\flash\smeh.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\sobaka.swf to %APPDATA%\icqm\icq\smiles\flash\sobaka.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\mrasmileslang_de.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_de.xml._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\mrasmileslang_cz.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_cz.xml._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\mrasmileslang_bg.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_bg.xml._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\zadolbal.swf to %APPDATA%\icqm\icq\smiles\flash\zadolbal.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\wf_love_srazila.swf to %APPDATA%\icqm\icq\smiles\flash\wf_love_srazila.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\wf_love_sdaus.swf to %APPDATA%\icqm\icq\smiles\flash\wf_love_sdaus.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\tank.swf to %APPDATA%\icqm\icq\smiles\flash\tank.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\sorry.swf to %APPDATA%\icqm\icq\smiles\flash\sorry.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\sobaka_strelyaet.swf to %APPDATA%\icqm\icq\smiles\flash\sobaka_strelyaet.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\mrasmileslang_en.xml to %APPDATA%\icqm\icq\smiles\mrasmileslang_en.xml._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\drako_snegyrka.swf to %APPDATA%\icqm\icq\smiles\flash\drako_snegyrka.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\drako_love.swf to %APPDATA%\icqm\icq\smiles\flash\drako_love.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\flowers.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\flowers.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\database\citylist_en.csv to %APPDATA%\icqm\icq\database\citylist_en.csv._nemty_fbpf6jo_
  • from %APPDATA%\icq-profile\update\languages.hash to %APPDATA%\icq-profile\update\languages.hash._nemty_fbpf6jo_
  • from %APPDATA%\icq-profile\update\languages.dict to %APPDATA%\icq-profile\update\languages.dict._nemty_fbpf6jo_
  • from %APPDATA%\icq-profile\update\languages.aff to %APPDATA%\icq-profile\update\languages.aff._nemty_fbpf6jo_
  • from %APPDATA%\icq-profile\installerlang.xml to %APPDATA%\icq-profile\installerlang.xml._nemty_fbpf6jo_
  • from %APPDATA%\icq-profile\base\mra.dbs to %APPDATA%\icq-profile\base\mra.dbs._nemty_fbpf6jo_
  • from %APPDATA%\adobe\acrobat\9.0\usercache.bin to %APPDATA%\adobe\acrobat\9.0\usercache.bin._nemty_fbpf6jo_
  • from %APPDATA%\adobe\acrobat\9.0\shareddataevents to %APPDATA%\adobe\acrobat\9.0\shareddataevents._nemty_fbpf6jo_
  • from %APPDATA%\adobe\acrobat\9.0\javascripts\glob.settings.js to %APPDATA%\adobe\acrobat\9.0\javascripts\glob.settings.js._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\database\citylist_ru.csv to %APPDATA%\icqm\icq\database\citylist_ru.csv._nemty_fbpf6jo_
  • from %APPDATA%\adobe\acrobat\9.0\javascripts\glob.js to %APPDATA%\adobe\acrobat\9.0\javascripts\glob.js._nemty_fbpf6jo_
  • from %APPDATA%\adobe\acrobat\9.0\adobecmapfnt09.lst to %APPDATA%\adobe\acrobat\9.0\adobecmapfnt09.lst._nemty_fbpf6jo_
  • from %APPDATA%\adobe\acrobat\10.0\tmgrpprm.sav to %APPDATA%\adobe\acrobat\10.0\tmgrpprm.sav._nemty_fbpf6jo_
  • from %APPDATA%\adobe\acrobat\10.0\tmdocs.sav to %APPDATA%\adobe\acrobat\10.0\tmdocs.sav._nemty_fbpf6jo_
  • from %APPDATA%\adobe\acrobat\10.0\security\crlcache\a9b8213768adc68af64fcc6409e8be414726687f.crl to %APPDATA%\adobe\acrobat\10.0\security\crlcache\a9b8213768adc68af64fcc6409e8be414726687f.crl._nemty_fbpf6jo_
  • from %APPDATA%\adobe\acrobat\10.0\security\crlcache\48b76449f3d5fefa1133aa805e420f0fca643651.crl to %APPDATA%\adobe\acrobat\10.0\security\crlcache\48b76449f3d5fefa1133aa805e420f0fca643651.crl._nemty_fbpf6jo_
  • from %APPDATA%\adobe\acrobat\10.0\security\addressbook.acrodata to %APPDATA%\adobe\acrobat\10.0\security\addressbook.acrodata._nemty_fbpf6jo_
  • from %APPDATA%\adobe\acrobat\10.0\readermessages to %APPDATA%\adobe\acrobat\10.0\readermessages._nemty_fbpf6jo_
  • from %APPDATA%\adobe\acrobat\10.0\javascripts\glob.settings.js to %APPDATA%\adobe\acrobat\10.0\javascripts\glob.settings.js._nemty_fbpf6jo_
  • from %APPDATA%\adobe\acrobat\10.0\javascripts\glob.js to %APPDATA%\adobe\acrobat\10.0\javascripts\glob.js._nemty_fbpf6jo_
  • from %APPDATA%\.purple\status.xml to %APPDATA%\.purple\status.xml._nemty_fbpf6jo_
  • from %APPDATA%\adobe\acrobat\9.0\adobesysfnt09.lst to %APPDATA%\adobe\acrobat\9.0\adobesysfnt09.lst._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\database\citylist_tr.csv to %APPDATA%\icqm\icq\database\citylist_tr.csv._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\database\citylist_kz.csv to %APPDATA%\icqm\icq\database\citylist_kz.csv._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\database\citylist_ua.csv to %APPDATA%\icqm\icq\database\citylist_ua.csv._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\drako_koster.swf to %APPDATA%\icqm\icq\smiles\flash\drako_koster.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\akitaka.swf to %APPDATA%\icqm\icq\smiles\flash\akitaka.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.swf to %APPDATA%\icqm\icq\smiles\flash\drako_bolnoy.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\devochka.swf to %APPDATA%\icqm\icq\smiles\flash\devochka.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\chillout.swf to %APPDATA%\icqm\icq\smiles\flash\chillout.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\canthearu.swf to %APPDATA%\icqm\icq\smiles\flash\canthearu.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\boo.swf to %APPDATA%\icqm\icq\smiles\flash\boo.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\bodun.swf to %APPDATA%\icqm\icq\smiles\flash\bodun.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\beer.swf to %APPDATA%\icqm\icq\smiles\flash\beer.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\beback.swf to %APPDATA%\icqm\icq\smiles\flash\beback.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\bad_cold.swf to %APPDATA%\icqm\icq\smiles\flash\bad_cold.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\angel.swf to %APPDATA%\icqm\icq\smiles\flash\angel.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\uz\loading\progress_agent.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\database\citylist_uz.csv to %APPDATA%\icqm\icq\database\citylist_uz.csv._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\ua\loading\progress_agent.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\tr\loading\progress_agent.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\ru\loading\progress_agent.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\pt\loading\progress_agent.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\kz\loading\progress_agent.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\en\loading\progress_agent.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\de\loading\progress_agent.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\cz\loading\progress_agent.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif to %APPDATA%\icqm\icq\html\bg\loading\progress_agent.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\dll\altergeo.msi to %APPDATA%\icqm\icq\dll\altergeo.msi._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_away.ico to %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_away.ico._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\set04\s010.gif to %APPDATA%\icqm\icq\smiles\smiles\set04\s010.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\hug.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\hug.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\blew.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\blew.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\devil.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\devil.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\biggrin.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\biggrin.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\bad.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\bad.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\air_kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\air_kiss.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\tongue out.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\tongue out.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thumbs up.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thumbs up.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thank you.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\thank you.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\surprised.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\surprised.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\stop.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\stop.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\smile.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\blum1.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\blum1.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\scream.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\scream.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\nothing to say.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\nothing to say.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\mad.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\mad.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\listening to music.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\listening to music.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing out loud (lol).gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\laughing out loud (lol).gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissing.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissing.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissed.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kissed.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\kiss.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\in love.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\in love.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\gross.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\gross.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\sad.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\falling asleep.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\falling asleep.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\bomb.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\bomb.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\bye2.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\bye2.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\flash\rosy.swf to %APPDATA%\icqm\icq\smiles\flash\rosy.swf._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\mocking.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\mocking.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\man_in_love.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\man_in_love.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\mad.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\mad.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\lol.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\lol.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss3.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss3.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\kiss.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\i_am_so_happy.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\i_am_so_happy.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\ireful.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\ireful.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\hi.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\hi.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_rose.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_rose.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\hang1.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\hang1.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\good.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\good.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_heart.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\give_heart.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\girl_angel.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\girl_angel.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\gamer.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\gamer.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\drinks.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\drinks.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\diablo.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\diablo.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\dance.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\dance.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\cry.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\cry.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\crazy.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\crazy.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\cool.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\cool.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\koloboks\blush.gif to %APPDATA%\icqm\icq\smiles\smiles\koloboks\blush.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\drinking.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\drinking.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\crying.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\crying.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\cool.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\cool.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\book.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\book.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\gg.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\gg.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\flowr.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\flowr.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\fingal.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\fingal.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\fight.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\fight.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\eat.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\eat.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\devil.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\devil.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\dance.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\dance.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\cry.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\cry.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\could.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\could.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\gg2.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\gg2.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\gift.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\gift.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\history.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\history.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\beauty.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\beauty.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\appl.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\appl.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\angel.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\angel.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\sunburn.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\sunburn.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\shoes.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\shoes.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\ring.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\ring.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\perfume.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\perfume.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\new_dress.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\new_dress.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\mad.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\mad.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\beer.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\beer.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\hungry.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\hungry.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\bomb.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\bomb.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\love.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\love.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\can't say-shut up.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\can't say-shut up.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\victory.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\victory.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blushing.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blushing.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blinking.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\blinking.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\angel.gif to %APPDATA%\icqm\icq\smiles\smiles\icq6.0-emoticons\angel.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_paper.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_paper.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_mouse.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_mouse.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_meow.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_meow.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_lick.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_lick.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_hand.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_hand.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\cat\cat_attack.gif to %APPDATA%\icqm\icq\smiles\smiles\cat\cat_attack.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\wonder.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\wonder.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\tongue.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\tongue.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\kiss.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\kiss.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\smile.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\smile.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\sleep.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\sleep.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\skuka.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\skuka.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\sing.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\sing.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\sad.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\sad.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\red.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\red.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\rainbow.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\rainbow.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\poison.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\poison.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\animated\pistolet.gif to %APPDATA%\icqm\icq\smiles\smiles\animated\pistolet.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\smiles\8march\love.gif to %APPDATA%\icqm\icq\smiles\smiles\8march\love.gif._nemty_fbpf6jo_
  • from %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_busy.ico to %APPDATA%\icqm\icq\smiles\statuses\gtalk\gtalk_status_busy.ico._nemty_fbpf6jo_
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Network activity
UDP
  • DNS ASK ap#.#pify.org
Miscellaneous
Searches for the following windows
  • ClassName: '' WindowName: ''
Creates and executes the following
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im sql.*' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c net stop' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c net stop QBVSS' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c net stop QBCFMontorService' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c net stop cbVSCService11' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c net stop CobianBackup11' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c net stop SQLBrowser' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c net stop SQLAgent$SQLEXPRESS' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c net stop MongoDB' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c net stop MSSQLServerADHelper100' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c net stop MSSQL$SQLEXPRESS' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c net stop SQLWriter' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c net stop Apache2.4' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c net stop AcronisAgent' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c net stop AcrSch2Svc' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c schtasks.exe /create /sc onstart /tn "_NEMTY_FBPF6JO_" /tr "%HOMEPATH%\AdobeUpdate.exe"' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c net stop OracleServiceXE' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c net stop DbxSvc' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im Flow.*' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im Teams.*' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im WBGX.*' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im QBW32.*' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im node.*' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im virtualboxvm.*' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im onenote.*' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im excel.*' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im oracle.*' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im thunderbird.*' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im outlook.*' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im wordpad.*' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im winword.*' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c net stop OracleXETNSListener' (with hidden window)
  • '<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet & wmic shadowc...' (with hidden window)
Executes the following
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im sql.*
  • '<SYSTEM32>\net1.exe' stop Apache2.4
  • '<SYSTEM32>\cmd.exe' /c net stop MSSQLServerADHelper100
  • '<SYSTEM32>\net1.exe' stop SQLWriter
  • '<SYSTEM32>\cmd.exe' /c net stop MongoDB
  • '<SYSTEM32>\net1.exe' stop MSSQL$SQLEXPRESS
  • '<SYSTEM32>\cmd.exe' /c net stop SQLAgent$SQLEXPRESS
  • '<SYSTEM32>\net1.exe' stop MSSQLServerADHelper100
  • '<SYSTEM32>\cmd.exe' /c net stop SQLBrowser
  • '<SYSTEM32>\cmd.exe' /c net stop CobianBackup11
  • '<SYSTEM32>\net1.exe' stop MongoDB
  • '<SYSTEM32>\net1.exe' stop SQLAgent$SQLEXPRESS
  • '<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet & wmic shadowc...
  • '<SYSTEM32>\cmd.exe' /c net stop QBCFMontorService
  • '<SYSTEM32>\net1.exe' stop SQLBrowser
  • '<SYSTEM32>\net1.exe' stop CobianBackup11
  • '<SYSTEM32>\cmd.exe' /c net stop QBVSS
  • '<SYSTEM32>\net1.exe' stop cbVSCService11
  • '<SYSTEM32>\cmd.exe' /c net stop
  • '<SYSTEM32>\net1.exe' stop QBCFMontorService
  • '<SYSTEM32>\net1.exe' stop QBVSS
  • '<SYSTEM32>\net1.exe' stop
  • '<SYSTEM32>\cmd.exe' /c schtasks.exe /create /sc onstart /tn "_NEMTY_FBPF6JO_" /tr "%HOMEPATH%\AdobeUpdate.exe"
  • '<SYSTEM32>\cmd.exe' /c net stop MSSQL$SQLEXPRESS
  • '<SYSTEM32>\cmd.exe' /c net stop cbVSCService11
  • '<SYSTEM32>\net1.exe' stop AcronisAgent
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im WBGX.*
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im winword.*
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im wordpad.*
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im outlook.*
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im thunderbird.*
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im oracle.*
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im excel.*
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im onenote.*
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im virtualboxvm.*
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im node.*
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im QBW32.*
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im Teams.*
  • '<SYSTEM32>\cmd.exe' /c net stop SQLWriter
  • '<SYSTEM32>\cmd.exe' /c taskkill /f /im Flow.*
  • '<SYSTEM32>\cmd.exe' /c net stop DbxSvc
  • '<SYSTEM32>\cmd.exe' /c net stop OracleXETNSListener
  • '<SYSTEM32>\cmd.exe' /c net stop OracleServiceXE
  • '<SYSTEM32>\cmd.exe' /c net stop AcrSch2Svc
  • '<SYSTEM32>\cmd.exe' /c net stop AcronisAgent
  • '<SYSTEM32>\net1.exe' stop DbxSvc
  • '<SYSTEM32>\cmd.exe' /c net stop Apache2.4
  • '<SYSTEM32>\net1.exe' stop OracleServiceXE
  • '<SYSTEM32>\net1.exe' stop OracleXETNSListener
  • '<SYSTEM32>\net1.exe' stop AcrSch2Svc
  • '<SYSTEM32>\schtasks.exe' /create /sc onstart /tn "_NEMTY_FBPF6JO_" /tr "%HOMEPATH%\AdobeUpdate.exe"

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android