Trojan.Siggen6.8190

Technical Information

To ensure autorun and distribution:

Substitutes the following executable system files:

<SYSTEM32>\dllcache\winhlp32.exe with <SYSTEM32>\dllcache\winhlp32.exe
<SYSTEM32>\dllcache\winchat.exe with <SYSTEM32>\dllcache\winchat.exe
<SYSTEM32>\dllcache\wiaacmgr.exe with <SYSTEM32>\dllcache\wiaacmgr.exe
<SYSTEM32>\dllcache\winmgmt.exe with <SYSTEM32>\dllcache\winmgmt.exe
<SYSTEM32>\dllcache\winlogon.exe with <SYSTEM32>\dllcache\winlogon.exe
<SYSTEM32>\dllcache\winhstb.exe with <SYSTEM32>\dllcache\winhstb.exe
<SYSTEM32>\dllcache\wextract.exe with <SYSTEM32>\dllcache\wextract.exe
<SYSTEM32>\dllcache\vssadmin.exe with <SYSTEM32>\dllcache\vssadmin.exe
<SYSTEM32>\dllcache\verifier.exe with <SYSTEM32>\dllcache\verifier.exe
<SYSTEM32>\dllcache\utilman.exe with <SYSTEM32>\dllcache\utilman.exe
<SYSTEM32>\dllcache\wbemtest.exe with <SYSTEM32>\dllcache\wbemtest.exe
<SYSTEM32>\dllcache\w32tm.exe with <SYSTEM32>\dllcache\w32tm.exe
<SYSTEM32>\dllcache\vssvc.exe with <SYSTEM32>\dllcache\vssvc.exe
<SYSTEM32>\dllcache\winmine.exe with <SYSTEM32>\dllcache\winmine.exe
<SYSTEM32>\dllcache\wscntfy.exe with <SYSTEM32>\dllcache\wscntfy.exe
<SYSTEM32>\dllcache\write.exe with <SYSTEM32>\dllcache\write.exe
<SYSTEM32>\dllcache\wpnpinst.exe with <SYSTEM32>\dllcache\wpnpinst.exe
<SYSTEM32>\dllcache\wuauclt1.exe with <SYSTEM32>\dllcache\wuauclt1.exe
<SYSTEM32>\dllcache\wuauclt.exe with <SYSTEM32>\dllcache\wuauclt.exe
<SYSTEM32>\dllcache\wscript.exe with <SYSTEM32>\dllcache\wscript.exe
<SYSTEM32>\dllcache\wpabaln.exe with <SYSTEM32>\dllcache\wpabaln.exe
<SYSTEM32>\dllcache\wmiadap.exe with <SYSTEM32>\dllcache\wmiadap.exe
<SYSTEM32>\dllcache\winver.exe with <SYSTEM32>\dllcache\winver.exe
<SYSTEM32>\dllcache\winmsd.exe with <SYSTEM32>\dllcache\winmsd.exe
<SYSTEM32>\dllcache\wmiprvse.exe with <SYSTEM32>\dllcache\wmiprvse.exe
<SYSTEM32>\dllcache\wmic.exe with <SYSTEM32>\dllcache\wmic.exe
<SYSTEM32>\dllcache\wmiapsrv.exe with <SYSTEM32>\dllcache\wmiapsrv.exe
<SYSTEM32>\dllcache\userinit.exe with <SYSTEM32>\dllcache\userinit.exe
<SYSTEM32>\dllcache\tlntsess.exe with <SYSTEM32>\dllcache\tlntsess.exe
<SYSTEM32>\dllcache\tlntadmn.exe with <SYSTEM32>\dllcache\tlntadmn.exe
<SYSTEM32>\dllcache\tintsetp.exe with <SYSTEM32>\dllcache\tintsetp.exe
<SYSTEM32>\dllcache\tracerpt.exe with <SYSTEM32>\dllcache\tracerpt.exe
<SYSTEM32>\dllcache\tourstrt.exe with <SYSTEM32>\dllcache\tourstrt.exe
<SYSTEM32>\dllcache\tlntsvr.exe with <SYSTEM32>\dllcache\tlntsvr.exe
<SYSTEM32>\dllcache\tintlphr.exe with <SYSTEM32>\dllcache\tintlphr.exe
<SYSTEM32>\dllcache\tcpsvcs.exe with <SYSTEM32>\dllcache\tcpsvcs.exe
<SYSTEM32>\dllcache\tcmsetup.exe with <SYSTEM32>\dllcache\tcmsetup.exe
<SYSTEM32>\dllcache\taskmgr.exe with <SYSTEM32>\dllcache\taskmgr.exe
<SYSTEM32>\dllcache\tftp.exe with <SYSTEM32>\dllcache\tftp.exe
<SYSTEM32>\dllcache\telnet.exe with <SYSTEM32>\dllcache\telnet.exe
<SYSTEM32>\dllcache\tcptest.exe with <SYSTEM32>\dllcache\tcptest.exe
<SYSTEM32>\dllcache\tracert.exe with <SYSTEM32>\dllcache\tracert.exe
<SYSTEM32>\dllcache\unlodctr.exe with <SYSTEM32>\dllcache\unlodctr.exe
<SYSTEM32>\dllcache\typeperf.exe with <SYSTEM32>\dllcache\typeperf.exe
<SYSTEM32>\dllcache\twunk_32.exe with <SYSTEM32>\dllcache\twunk_32.exe
<SYSTEM32>\dllcache\ups.exe with <SYSTEM32>\dllcache\ups.exe
<SYSTEM32>\dllcache\upnpcont.exe with <SYSTEM32>\dllcache\upnpcont.exe
<SYSTEM32>\dllcache\unsecapp.exe with <SYSTEM32>\dllcache\unsecapp.exe
<SYSTEM32>\dllcache\tsshutdn.exe with <SYSTEM32>\dllcache\tsshutdn.exe
<SYSTEM32>\dllcache\tscupgrd.exe with <SYSTEM32>\dllcache\tscupgrd.exe
<SYSTEM32>\dllcache\tscon.exe with <SYSTEM32>\dllcache\tscon.exe
<SYSTEM32>\dllcache\tracert6.exe with <SYSTEM32>\dllcache\tracert6.exe
<SYSTEM32>\dllcache\tsprof.exe with <SYSTEM32>\dllcache\tsprof.exe
<SYSTEM32>\dllcache\tskill.exe with <SYSTEM32>\dllcache\tskill.exe
<SYSTEM32>\dllcache\tsdiscon.exe with <SYSTEM32>\dllcache\tsdiscon.exe
<SYSTEM32>\getmac.exe with <SYSTEM32>\getmac.exe
<SYSTEM32>\ftp.exe with <SYSTEM32>\ftp.exe
<SYSTEM32>\fsutil.exe with <SYSTEM32>\fsutil.exe
<SYSTEM32>\graftabl.com with <SYSTEM32>\graftabl.com
<SYSTEM32>\gpupdate.exe with <SYSTEM32>\gpupdate.exe
<SYSTEM32>\gpresult.exe with <SYSTEM32>\gpresult.exe
<SYSTEM32>\fsquirt.exe with <SYSTEM32>\fsquirt.exe
<SYSTEM32>\fontview.exe with <SYSTEM32>\fontview.exe
<SYSTEM32>\fltMc.exe with <SYSTEM32>\fltMc.exe
<SYSTEM32>\fixmapi.exe with <SYSTEM32>\fixmapi.exe
<SYSTEM32>\freecell.exe with <SYSTEM32>\freecell.exe
<SYSTEM32>\format.com with <SYSTEM32>\format.com
<SYSTEM32>\forcedos.exe with <SYSTEM32>\forcedos.exe
<SYSTEM32>\grpconv.exe with <SYSTEM32>\grpconv.exe
<SYSTEM32>\ipxroute.exe with <SYSTEM32>\ipxroute.exe
<SYSTEM32>\ipv6.exe with <SYSTEM32>\ipv6.exe
<SYSTEM32>\ipsec6.exe with <SYSTEM32>\ipsec6.exe
<SYSTEM32>\lnkstub.exe with <SYSTEM32>\lnkstub.exe
<SYSTEM32>\lights.exe with <SYSTEM32>\lights.exe
<SYSTEM32>\label.exe with <SYSTEM32>\label.exe
<SYSTEM32>\ipconfig.exe with <SYSTEM32>\ipconfig.exe
<SYSTEM32>\icardagt.exe with <SYSTEM32>\icardagt.exe
<SYSTEM32>\hostname.exe with <SYSTEM32>\hostname.exe
<SYSTEM32>\help.exe with <SYSTEM32>\help.exe
<SYSTEM32>\imapi.exe with <SYSTEM32>\imapi.exe
<SYSTEM32>\iexpress.exe with <SYSTEM32>\iexpress.exe
<SYSTEM32>\ie4uinit.exe with <SYSTEM32>\ie4uinit.exe
<SYSTEM32>\finger.exe with <SYSTEM32>\finger.exe
<SYSTEM32>\dpvsetup.exe with <SYSTEM32>\dpvsetup.exe
<SYSTEM32>\dpnsvr.exe with <SYSTEM32>\dpnsvr.exe
<SYSTEM32>\dplaysvr.exe with <SYSTEM32>\dplaysvr.exe
<SYSTEM32>\dumprep.exe with <SYSTEM32>\dumprep.exe
<SYSTEM32>\drwtsn32.exe with <SYSTEM32>\drwtsn32.exe
<SYSTEM32>\driverquery.exe with <SYSTEM32>\driverquery.exe
<SYSTEM32>\doskey.exe with <SYSTEM32>\doskey.exe
<SYSTEM32>\dllhost.exe with <SYSTEM32>\dllhost.exe
<SYSTEM32>\dllcache\xcopy.exe with <SYSTEM32>\dllcache\xcopy.exe
<SYSTEM32>\dllcache\wupdmgr.exe with <SYSTEM32>\dllcache\wupdmgr.exe
<SYSTEM32>\dmremote.exe with <SYSTEM32>\dmremote.exe
<SYSTEM32>\dmadmin.exe with <SYSTEM32>\dmadmin.exe
<SYSTEM32>\dllhst3g.exe with <SYSTEM32>\dllhst3g.exe
<SYSTEM32>\dvdplay.exe with <SYSTEM32>\dvdplay.exe
<SYSTEM32>\extrac32.exe with <SYSTEM32>\extrac32.exe
<SYSTEM32>\expand.exe with <SYSTEM32>\expand.exe
<SYSTEM32>\eventvwr.exe with <SYSTEM32>\eventvwr.exe
<SYSTEM32>\findstr.exe with <SYSTEM32>\findstr.exe
<SYSTEM32>\find.exe with <SYSTEM32>\find.exe
<SYSTEM32>\fc.exe with <SYSTEM32>\fc.exe
<SYSTEM32>\eventtriggers.exe with <SYSTEM32>\eventtriggers.exe
<SYSTEM32>\dxdiag.exe with <SYSTEM32>\dxdiag.exe
<SYSTEM32>\dwwin.exe with <SYSTEM32>\dwwin.exe
<SYSTEM32>\dvdupgrd.exe with <SYSTEM32>\dvdupgrd.exe
<SYSTEM32>\eventcreate.exe with <SYSTEM32>\eventcreate.exe
<SYSTEM32>\eudcedit.exe with <SYSTEM32>\eudcedit.exe
<SYSTEM32>\esentutl.exe with <SYSTEM32>\esentutl.exe
<SYSTEM32>\dllcache\taskman.exe with <SYSTEM32>\dllcache\taskman.exe
<SYSTEM32>\dllcache\rsmsink.exe with <SYSTEM32>\dllcache\rsmsink.exe
<SYSTEM32>\dllcache\rsm.exe with <SYSTEM32>\dllcache\rsm.exe
<SYSTEM32>\dllcache\rsh.exe with <SYSTEM32>\dllcache\rsh.exe
<SYSTEM32>\dllcache\rsopprov.exe with <SYSTEM32>\dllcache\rsopprov.exe
<SYSTEM32>\dllcache\rsnotify.exe with <SYSTEM32>\dllcache\rsnotify.exe
<SYSTEM32>\dllcache\rsmui.exe with <SYSTEM32>\dllcache\rsmui.exe
<SYSTEM32>\dllcache\routemon.exe with <SYSTEM32>\dllcache\routemon.exe
<SYSTEM32>\dllcache\reset.exe with <SYSTEM32>\dllcache\reset.exe
<SYSTEM32>\dllcache\replace.exe with <SYSTEM32>\dllcache\replace.exe
<SYSTEM32>\dllcache\relog.exe with <SYSTEM32>\dllcache\relog.exe
<SYSTEM32>\dllcache\route.exe with <SYSTEM32>\dllcache\route.exe
<SYSTEM32>\dllcache\rexec.exe with <SYSTEM32>\dllcache\rexec.exe
<SYSTEM32>\dllcache\tourW.exe with <SYSTEM32>\dllcache\tourW.exe.new
<SYSTEM32>\dllcache\rstrui.exe with <SYSTEM32>\dllcache\rstrui.exe
<SYSTEM32>\dllcache\scardsvr.exe with <SYSTEM32>\dllcache\scardsvr.exe
<SYSTEM32>\dllcache\sc.exe with <SYSTEM32>\dllcache\sc.exe
<SYSTEM32>\dllcache\savedump.exe with <SYSTEM32>\dllcache\savedump.exe
<SYSTEM32>\dllcache\sctasks.exe with <SYSTEM32>\dllcache\sctasks.exe
<SYSTEM32>\dllcache\scrnsave.scr with <SYSTEM32>\dllcache\scrnsave.scr
<SYSTEM32>\dllcache\scrcons.exe with <SYSTEM32>\dllcache\scrcons.exe
<SYSTEM32>\dllcache\hh.exe with <SYSTEM32>\dllcache\hh.exe.new
<SYSTEM32>\dllcache\runas.exe with <SYSTEM32>\dllcache\runas.exe
<SYSTEM32>\dllcache\rtcshare.exe with <SYSTEM32>\dllcache\rtcshare.exe
<SYSTEM32>\dllcache\rsvp.exe with <SYSTEM32>\dllcache\rsvp.exe
<SYSTEM32>\dllcache\rwinsta.exe with <SYSTEM32>\dllcache\rwinsta.exe
<SYSTEM32>\dllcache\runonce.exe with <SYSTEM32>\dllcache\runonce.exe
<SYSTEM32>\dllcache\rundll32.exe with <SYSTEM32>\dllcache\rundll32.exe
<SYSTEM32>\dllcache\regwiz.exe with <SYSTEM32>\dllcache\regwiz.exe
<SYSTEM32>\dllcache\query.exe with <SYSTEM32>\dllcache\query.exe
<SYSTEM32>\dllcache\qprocess.exe with <SYSTEM32>\dllcache\qprocess.exe
<SYSTEM32>\dllcache\qappsrv.exe with <SYSTEM32>\dllcache\qappsrv.exe
<SYSTEM32>\dllcache\rasautou.exe with <SYSTEM32>\dllcache\rasautou.exe
<SYSTEM32>\dllcache\qwinsta.exe with <SYSTEM32>\dllcache\qwinsta.exe
<SYSTEM32>\dllcache\quser.exe with <SYSTEM32>\dllcache\quser.exe
<SYSTEM32>\dllcache\proxycfg.exe with <SYSTEM32>\dllcache\proxycfg.exe
<SYSTEM32>\dllcache\print.exe with <SYSTEM32>\dllcache\print.exe
<SYSTEM32>\dllcache\powercfg.exe with <SYSTEM32>\dllcache\powercfg.exe
<SYSTEM32>\dllcache\pintlphr.exe with <SYSTEM32>\dllcache\pintlphr.exe
<SYSTEM32>\dllcache\proquota.exe with <SYSTEM32>\dllcache\proquota.exe
<SYSTEM32>\dllcache\progman.exe with <SYSTEM32>\dllcache\progman.exe
<SYSTEM32>\dllcache\printfilterpipelinesvc.exe with <SYSTEM32>\dllcache\printfilterpipelinesvc.exe
<SYSTEM32>\dllcache\rasdial.exe with <SYSTEM32>\dllcache\rasdial.exe
<SYSTEM32>\dllcache\regedt32.exe with <SYSTEM32>\dllcache\regedt32.exe
<SYSTEM32>\dllcache\regedit.exe with <SYSTEM32>\dllcache\regedit.exe
<SYSTEM32>\dllcache\reg.exe with <SYSTEM32>\dllcache\reg.exe
<SYSTEM32>\dllcache\regsvr32.exe with <SYSTEM32>\dllcache\regsvr32.exe
<SYSTEM32>\dllcache\register.exe with <SYSTEM32>\dllcache\register.exe
<SYSTEM32>\dllcache\regini.exe with <SYSTEM32>\dllcache\regini.exe
<SYSTEM32>\dllcache\recover.exe with <SYSTEM32>\dllcache\recover.exe
<SYSTEM32>\dllcache\rcp.exe with <SYSTEM32>\dllcache\rcp.exe
<SYSTEM32>\dllcache\rcimlby.exe with <SYSTEM32>\dllcache\rcimlby.exe
<SYSTEM32>\dllcache\rasphone.exe with <SYSTEM32>\dllcache\rasphone.exe
<SYSTEM32>\dllcache\rdshost.exe with <SYSTEM32>\dllcache\rdshost.exe
<SYSTEM32>\dllcache\rdsaddin.exe with <SYSTEM32>\dllcache\rdsaddin.exe
<SYSTEM32>\dllcache\rdpclip.exe with <SYSTEM32>\dllcache\rdpclip.exe
<SYSTEM32>\dllcache\ssbezier.scr with <SYSTEM32>\dllcache\ssbezier.scr
<SYSTEM32>\dllcache\regedit.exe with <SYSTEM32>\dllcache\regedit.exe.new
<SYSTEM32>\dllcache\ss3dfo.scr with <SYSTEM32>\dllcache\ss3dfo.scr
<SYSTEM32>\dllcache\ssmypics.scr with <SYSTEM32>\dllcache\ssmypics.scr
<SYSTEM32>\dllcache\ssmarque.scr with <SYSTEM32>\dllcache\ssmarque.scr
<SYSTEM32>\dllcache\ssflwbox.scr with <SYSTEM32>\dllcache\ssflwbox.scr
<SYSTEM32>\dllcache\srdiag.exe with <SYSTEM32>\dllcache\srdiag.exe
<SYSTEM32>\dllcache\spiisupd.exe with <SYSTEM32>\dllcache\spiisupd.exe
<SYSTEM32>\dllcache\spider.exe with <SYSTEM32>\dllcache\spider.exe
<SYSTEM32>\dllcache\sort.exe with <SYSTEM32>\dllcache\sort.exe
<SYSTEM32>\dllcache\sprestrt.exe with <SYSTEM32>\dllcache\sprestrt.exe
<SYSTEM32>\dllcache\spoolsv.exe with <SYSTEM32>\dllcache\spoolsv.exe
<SYSTEM32>\dllcache\spnpinst.exe with <SYSTEM32>\dllcache\spnpinst.exe
<SYSTEM32>\dllcache\ssmyst.scr with <SYSTEM32>\dllcache\ssmyst.scr
<SYSTEM32>\dllcache\sysocmgr.exe with <SYSTEM32>\dllcache\sysocmgr.exe
<SYSTEM32>\dllcache\syskey.exe with <SYSTEM32>\dllcache\syskey.exe
<SYSTEM32>\dllcache\sysinfo.exe with <SYSTEM32>\dllcache\sysinfo.exe
<SYSTEM32>\dllcache\tasklist.exe with <SYSTEM32>\dllcache\tasklist.exe
<SYSTEM32>\dllcache\taskkill.exe with <SYSTEM32>\dllcache\taskkill.exe
<SYSTEM32>\dllcache\systray.exe with <SYSTEM32>\dllcache\systray.exe
<SYSTEM32>\dllcache\syncapp.exe with <SYSTEM32>\dllcache\syncapp.exe
<SYSTEM32>\dllcache\sstext3d.scr with <SYSTEM32>\dllcache\sstext3d.scr
<SYSTEM32>\dllcache\ssstars.scr with <SYSTEM32>\dllcache\ssstars.scr
<SYSTEM32>\dllcache\sspipes.scr with <SYSTEM32>\dllcache\sspipes.scr
<SYSTEM32>\dllcache\svchost.exe with <SYSTEM32>\dllcache\svchost.exe
<SYSTEM32>\dllcache\subst.exe with <SYSTEM32>\dllcache\subst.exe
<SYSTEM32>\dllcache\stimon.exe with <SYSTEM32>\dllcache\stimon.exe
<SYSTEM32>\dllcache\sol.exe with <SYSTEM32>\dllcache\sol.exe
<SYSTEM32>\dllcache\shadow.exe with <SYSTEM32>\dllcache\shadow.exe
<SYSTEM32>\dllcache\muisetup.exe with <SYSTEM32>\dllcache\muisetup.exe.new
<SYSTEM32>\dllcache\sfc.exe with <SYSTEM32>\dllcache\sfc.exe
<SYSTEM32>\dllcache\notepad.exe with <SYSTEM32>\dllcache\notepad.exe.new
<SYSTEM32>\dllcache\shrpubw.exe with <SYSTEM32>\dllcache\shrpubw.exe
<SYSTEM32>\dllcache\shmgrate.exe with <SYSTEM32>\dllcache\shmgrate.exe
<SYSTEM32>\dllcache\setup.exe with <SYSTEM32>\dllcache\setup.exe
<SYSTEM32>\dllcache\services.exe with <SYSTEM32>\dllcache\services.exe
<SYSTEM32>\dllcache\secedit.exe with <SYSTEM32>\dllcache\secedit.exe
<SYSTEM32>\dllcache\sdbinst.exe with <SYSTEM32>\dllcache\sdbinst.exe
<SYSTEM32>\dllcache\unregmp2.exe with <SYSTEM32>\dllcache\unregmp2.exe.new
<SYSTEM32>\dllcache\sethc.exe with <SYSTEM32>\dllcache\sethc.exe
<SYSTEM32>\dllcache\sessmgr.exe with <SYSTEM32>\dllcache\sessmgr.exe
<SYSTEM32>\dllcache\shtml.exe with <SYSTEM32>\dllcache\shtml.exe
<SYSTEM32>\dllcache\sndvol32.exe with <SYSTEM32>\dllcache\sndvol32.exe
<SYSTEM32>\dllcache\sndrec32.exe with <SYSTEM32>\dllcache\sndrec32.exe
<SYSTEM32>\dllcache\smss.exe with <SYSTEM32>\dllcache\smss.exe
<SYSTEM32>\dllcache\uploadm.exe with <SYSTEM32>\dllcache\uploadm.exe.new
<SYSTEM32>\dllcache\snmptrap.exe with <SYSTEM32>\dllcache\snmptrap.exe
<SYSTEM32>\dllcache\snmp.exe with <SYSTEM32>\dllcache\snmp.exe
<SYSTEM32>\dllcache\notiflag.exe with <SYSTEM32>\dllcache\notiflag.exe.new
<SYSTEM32>\dllcache\skeys.exe with <SYSTEM32>\dllcache\skeys.exe
<SYSTEM32>\dllcache\sigverif.exe with <SYSTEM32>\dllcache\sigverif.exe
<SYSTEM32>\dllcache\shutdown.exe with <SYSTEM32>\dllcache\shutdown.exe
<SYSTEM32>\dllcache\smlogsvc.exe with <SYSTEM32>\dllcache\smlogsvc.exe
<SYSTEM32>\dllcache\smi2smir.exe with <SYSTEM32>\dllcache\smi2smir.exe
<SYSTEM32>\dllcache\smbinst.exe with <SYSTEM32>\dllcache\smbinst.exe
<SYSTEM32>\locator.exe with <SYSTEM32>\locator.exe
<SYSTEM32>\notepad.exe with <SYSTEM32>\notepad.exe.new
<SYSTEM32>\syskey.exe with <SYSTEM32>\syskey.exe
<SYSTEM32>\syncapp.exe with <SYSTEM32>\syncapp.exe
<SYSTEM32>\systray.exe with <SYSTEM32>\systray.exe
<SYSTEM32>\systeminfo.exe with <SYSTEM32>\systeminfo.exe
<SYSTEM32>\sysocmgr.exe with <SYSTEM32>\sysocmgr.exe
<SYSTEM32>\subst.exe with <SYSTEM32>\subst.exe
<SYSTEM32>\sspipes.scr with <SYSTEM32>\sspipes.scr
<SYSTEM32>\ssmyst.scr with <SYSTEM32>\ssmyst.scr
<SYSTEM32>\ssmypics.scr with <SYSTEM32>\ssmypics.scr
<SYSTEM32>\stimon.exe with <SYSTEM32>\stimon.exe
<SYSTEM32>\sstext3d.scr with <SYSTEM32>\sstext3d.scr
<SYSTEM32>\ssstars.scr with <SYSTEM32>\ssstars.scr
<SYSTEM32>\taskkill.exe with <SYSTEM32>\taskkill.exe
<SYSTEM32>\tlntsvr.exe with <SYSTEM32>\tlntsvr.exe
<SYSTEM32>\tlntsess.exe with <SYSTEM32>\tlntsess.exe
<SYSTEM32>\tlntadmn.exe with <SYSTEM32>\tlntadmn.exe
<SYSTEM32>\tracert.exe with <SYSTEM32>\tracert.exe
<SYSTEM32>\tracerpt.exe with <SYSTEM32>\tracerpt.exe
<SYSTEM32>\tourstart.exe with <SYSTEM32>\tourstart.exe
<SYSTEM32>\tftp.exe with <SYSTEM32>\tftp.exe
<SYSTEM32>\taskmgr.exe with <SYSTEM32>\taskmgr.exe
<SYSTEM32>\taskman.exe with <SYSTEM32>\taskman.exe
<SYSTEM32>\tasklist.exe with <SYSTEM32>\tasklist.exe
<SYSTEM32>\telnet.exe with <SYSTEM32>\telnet.exe
<SYSTEM32>\tcpsvcs.exe with <SYSTEM32>\tcpsvcs.exe
<SYSTEM32>\tcmsetup.exe with <SYSTEM32>\tcmsetup.exe
<SYSTEM32>\ssmarque.scr with <SYSTEM32>\ssmarque.scr
<SYSTEM32>\shutdown.exe with <SYSTEM32>\shutdown.exe
<SYSTEM32>\shrpubw.exe with <SYSTEM32>\shrpubw.exe
<SYSTEM32>\shmgrate.exe with <SYSTEM32>\shmgrate.exe
<SYSTEM32>\smbinst.exe with <SYSTEM32>\smbinst.exe
<SYSTEM32>\skeys.exe with <SYSTEM32>\skeys.exe
<SYSTEM32>\sigverif.exe with <SYSTEM32>\sigverif.exe
<SYSTEM32>\shadow.exe with <SYSTEM32>\shadow.exe
<SYSTEM32>\sessmgr.exe with <SYSTEM32>\sessmgr.exe
<SYSTEM32>\secedit.exe with <SYSTEM32>\secedit.exe
<SYSTEM32>\sdbinst.exe with <SYSTEM32>\sdbinst.exe
<SYSTEM32>\sfc.exe with <SYSTEM32>\sfc.exe
<SYSTEM32>\setup.exe with <SYSTEM32>\setup.exe
<SYSTEM32>\sethc.exe with <SYSTEM32>\sethc.exe
<SYSTEM32>\smlogsvc.exe with <SYSTEM32>\smlogsvc.exe
<SYSTEM32>\spupdsvc.exe with <SYSTEM32>\spupdsvc.exe
<SYSTEM32>\sprestrt.exe with <SYSTEM32>\sprestrt.exe
<SYSTEM32>\spool\prtprocs\w32x86\printfilterpipelinesvc.exe with <SYSTEM32>\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
<SYSTEM32>\ssflwbox.scr with <SYSTEM32>\ssflwbox.scr
<SYSTEM32>\ssbezier.scr with <SYSTEM32>\ssbezier.scr
<SYSTEM32>\ss3dfo.scr with <SYSTEM32>\ss3dfo.scr
<SYSTEM32>\spnpinst.exe with <SYSTEM32>\spnpinst.exe
<SYSTEM32>\sol.exe with <SYSTEM32>\sol.exe
<SYSTEM32>\sndvol32.exe with <SYSTEM32>\sndvol32.exe
<SYSTEM32>\sndrec32.exe with <SYSTEM32>\sndrec32.exe
<SYSTEM32>\spiisupd.exe with <SYSTEM32>\spiisupd.exe
<SYSTEM32>\spider.exe with <SYSTEM32>\spider.exe
<SYSTEM32>\sort.exe with <SYSTEM32>\sort.exe
<SYSTEM32>\winhlp32.exe with <SYSTEM32>\winhlp32.exe
<SYSTEM32>\winchat.exe with <SYSTEM32>\winchat.exe
<SYSTEM32>\win.com with <SYSTEM32>\win.com
<SYSTEM32>\winver.exe with <SYSTEM32>\winver.exe
<SYSTEM32>\winmsd.exe with <SYSTEM32>\winmsd.exe
<SYSTEM32>\winmine.exe with <SYSTEM32>\winmine.exe
<SYSTEM32>\wiaacmgr.exe with <SYSTEM32>\wiaacmgr.exe
<SYSTEM32>\wbem\wmiadap.exe with <SYSTEM32>\wbem\wmiadap.exe
<SYSTEM32>\wbem\winmgmt.exe with <SYSTEM32>\wbem\winmgmt.exe
<SYSTEM32>\wbem\wbemtest.exe with <SYSTEM32>\wbem\wbemtest.exe
<SYSTEM32>\wextract.exe with <SYSTEM32>\wextract.exe
<SYSTEM32>\wbem\wmic.exe with <SYSTEM32>\wbem\wmic.exe
<SYSTEM32>\wbem\wmiapsrv.exe with <SYSTEM32>\wbem\wmiapsrv.exe
<SYSTEM32>\wpabaln.exe with <SYSTEM32>\wpabaln.exe
%WINDIR%\TASKMAN.EXE with %WINDIR%\TASKMAN.EXE
<SYSTEM32>\XPSViewer\XPSViewer.exe with <SYSTEM32>\XPSViewer\XPSViewer.exe
<SYSTEM32>\xcopy.exe with <SYSTEM32>\xcopy.exe
<Auxiliary element> with <Auxiliary element>
%WINDIR%\winhlp32.exe with %WINDIR%\winhlp32.exe
%WINDIR%\twunk_32.exe with %WINDIR%\twunk_32.exe
<SYSTEM32>\wupdmgr.exe with <SYSTEM32>\wupdmgr.exe
<SYSTEM32>\wscntfy.exe with <SYSTEM32>\wscntfy.exe
<SYSTEM32>\write.exe with <SYSTEM32>\write.exe
<SYSTEM32>\wpnpinst.exe with <SYSTEM32>\wpnpinst.exe
<SYSTEM32>\wuauclt1.exe with <SYSTEM32>\wuauclt1.exe
<SYSTEM32>\wuauclt.exe with <SYSTEM32>\wuauclt.exe
<SYSTEM32>\wscript.exe with <SYSTEM32>\wscript.exe
<SYSTEM32>\wbem\unsecapp.exe with <SYSTEM32>\wbem\unsecapp.exe
<SYSTEM32>\unlodctr.exe with <SYSTEM32>\unlodctr.exe
<SYSTEM32>\typeperf.exe with <SYSTEM32>\typeperf.exe
<SYSTEM32>\TsWpfWrp.exe with <SYSTEM32>\TsWpfWrp.exe
<SYSTEM32>\URTTEMP\regtlib.exe with <SYSTEM32>\URTTEMP\regtlib.exe
<SYSTEM32>\ups.exe with <SYSTEM32>\ups.exe
<SYSTEM32>\upnpcont.exe with <SYSTEM32>\upnpcont.exe
<SYSTEM32>\tsshutdn.exe with <SYSTEM32>\tsshutdn.exe
<SYSTEM32>\tscon.exe with <SYSTEM32>\tscon.exe
<SYSTEM32>\tree.com with <SYSTEM32>\tree.com
<SYSTEM32>\tracert6.exe with <SYSTEM32>\tracert6.exe
<SYSTEM32>\tskill.exe with <SYSTEM32>\tskill.exe
<SYSTEM32>\tsdiscon.exe with <SYSTEM32>\tsdiscon.exe
<SYSTEM32>\tscupgrd.exe with <SYSTEM32>\tscupgrd.exe
<SYSTEM32>\userinit.exe with <SYSTEM32>\userinit.exe
<SYSTEM32>\vssvc.exe with <SYSTEM32>\vssvc.exe
<SYSTEM32>\vssadmin.exe with <SYSTEM32>\vssadmin.exe
<SYSTEM32>\verifier.exe with <SYSTEM32>\verifier.exe
<SYSTEM32>\wbem\scrcons.exe with <SYSTEM32>\wbem\scrcons.exe
<SYSTEM32>\wbem\mofcomp.exe with <SYSTEM32>\wbem\mofcomp.exe
<SYSTEM32>\w32tm.exe with <SYSTEM32>\w32tm.exe
<SYSTEM32>\utilman.exe with <SYSTEM32>\utilman.exe
<SYSTEM32>\usmt\migwiz_a.exe with <SYSTEM32>\usmt\migwiz_a.exe
<SYSTEM32>\usmt\migwiz.exe with <SYSTEM32>\usmt\migwiz.exe
<SYSTEM32>\usmt\migload.exe with <SYSTEM32>\usmt\migload.exe
<SYSTEM32>\usrshuta.exe with <SYSTEM32>\usrshuta.exe
<SYSTEM32>\usrprbda.exe with <SYSTEM32>\usrprbda.exe
<SYSTEM32>\usrmlnka.exe with <SYSTEM32>\usrmlnka.exe
<SYSTEM32>\scrnsave.scr with <SYSTEM32>\scrnsave.scr
<SYSTEM32>\netdde.exe with <SYSTEM32>\netdde.exe
<SYSTEM32>\net1.exe with <SYSTEM32>\net1.exe
<SYSTEM32>\net.exe with <SYSTEM32>\net.exe
<SYSTEM32>\netstat.exe with <SYSTEM32>\netstat.exe
<SYSTEM32>\netsh.exe with <SYSTEM32>\netsh.exe
<SYSTEM32>\netsetup.exe with <SYSTEM32>\netsetup.exe
<SYSTEM32>\nddeapir.exe with <SYSTEM32>\nddeapir.exe
<SYSTEM32>\mstinit.exe with <SYSTEM32>\mstinit.exe
<SYSTEM32>\msswchx.exe with <SYSTEM32>\msswchx.exe
<SYSTEM32>\mspaint.exe with <SYSTEM32>\mspaint.exe
<SYSTEM32>\nbtstat.exe with <SYSTEM32>\nbtstat.exe
<SYSTEM32>\narrator.exe with <SYSTEM32>\narrator.exe
<SYSTEM32>\mstsc.exe with <SYSTEM32>\mstsc.exe
<SYSTEM32>\notepad.exe with <SYSTEM32>\notepad.exe
<SYSTEM32>\odbcconf.exe with <SYSTEM32>\odbcconf.exe
<SYSTEM32>\odbcad32.exe with <SYSTEM32>\odbcad32.exe
<SYSTEM32>\nwscript.exe with <SYSTEM32>\nwscript.exe
<SYSTEM32>\openfiles.exe with <SYSTEM32>\openfiles.exe
<SYSTEM32>\oobe\oobebaln.exe with <SYSTEM32>\oobe\oobebaln.exe
<SYSTEM32>\oobe\msoobe.exe with <SYSTEM32>\oobe\msoobe.exe
<SYSTEM32>\ntvdm.exe with <SYSTEM32>\ntvdm.exe
<SYSTEM32>\ntbackup.exe with <SYSTEM32>\ntbackup.exe
<SYSTEM32>\nslookup.exe with <SYSTEM32>\nslookup.exe
<SYSTEM32>\npp\nppagent.exe with <SYSTEM32>\npp\nppagent.exe
<SYSTEM32>\ntsd.exe with <SYSTEM32>\ntsd.exe
<SYSTEM32>\ntoskrnl.exe with <SYSTEM32>\ntoskrnl.exe
<SYSTEM32>\ntkrnlpa.exe with <SYSTEM32>\ntkrnlpa.exe
<SYSTEM32>\msiexec.exe with <SYSTEM32>\msiexec.exe
<SYSTEM32>\makecab.exe with <SYSTEM32>\makecab.exe
<SYSTEM32>\magnify.exe with <SYSTEM32>\magnify.exe
<SYSTEM32>\lpr.exe with <SYSTEM32>\lpr.exe
<SYSTEM32>\mnmsrvc.exe with <SYSTEM32>\mnmsrvc.exe
<SYSTEM32>\mmc.exe with <SYSTEM32>\mmc.exe
<SYSTEM32>\migpwd.exe with <SYSTEM32>\migpwd.exe
<SYSTEM32>\lpq.exe with <SYSTEM32>\lpq.exe
<SYSTEM32>\logman.exe with <SYSTEM32>\logman.exe
<SYSTEM32>\logagent.exe with <SYSTEM32>\logagent.exe
<SYSTEM32>\lodctr.exe with <SYSTEM32>\lodctr.exe
<SYSTEM32>\logonui.exe with <SYSTEM32>\logonui.exe
<SYSTEM32>\logon.scr with <SYSTEM32>\logon.scr
<SYSTEM32>\logoff.exe with <SYSTEM32>\logoff.exe
<SYSTEM32>\mobsync.exe with <SYSTEM32>\mobsync.exe
<SYSTEM32>\msdtc.exe with <SYSTEM32>\msdtc.exe
<SYSTEM32>\mrinfo.exe with <SYSTEM32>\mrinfo.exe
<SYSTEM32>\mqtgsvc.exe with <SYSTEM32>\mqtgsvc.exe
<SYSTEM32>\mshta.exe with <SYSTEM32>\mshta.exe
<SYSTEM32>\mshearts.exe with <SYSTEM32>\mshearts.exe
<SYSTEM32>\msg.exe with <SYSTEM32>\msg.exe
<SYSTEM32>\mqsvc.exe with <SYSTEM32>\mqsvc.exe
<SYSTEM32>\mountvol.exe with <SYSTEM32>\mountvol.exe
<SYSTEM32>\more.com with <SYSTEM32>\more.com
<SYSTEM32>\mode.com with <SYSTEM32>\mode.com
<SYSTEM32>\mqbkup.exe with <SYSTEM32>\mqbkup.exe
<SYSTEM32>\mpnotify.exe with <SYSTEM32>\mpnotify.exe
<SYSTEM32>\mplay32.exe with <SYSTEM32>\mplay32.exe
<SYSTEM32>\route.exe with <SYSTEM32>\route.exe
<SYSTEM32>\rexec.exe with <SYSTEM32>\rexec.exe
<SYSTEM32>\Restore\srdiag.exe with <SYSTEM32>\Restore\srdiag.exe
<SYSTEM32>\rsm.exe with <SYSTEM32>\rsm.exe
<SYSTEM32>\rsh.exe with <SYSTEM32>\rsh.exe
<SYSTEM32>\routemon.exe with <SYSTEM32>\routemon.exe
<SYSTEM32>\Restore\rstrui.exe with <SYSTEM32>\Restore\rstrui.exe
<SYSTEM32>\regwiz.exe with <SYSTEM32>\regwiz.exe
<SYSTEM32>\regsvr32.exe with <SYSTEM32>\regsvr32.exe
<SYSTEM32>\regini.exe with <SYSTEM32>\regini.exe
<SYSTEM32>\reset.exe with <SYSTEM32>\reset.exe
<SYSTEM32>\replace.exe with <SYSTEM32>\replace.exe
<SYSTEM32>\relog.exe with <SYSTEM32>\relog.exe
<SYSTEM32>\rsmsink.exe with <SYSTEM32>\rsmsink.exe
<SYSTEM32>\savedump.exe with <SYSTEM32>\savedump.exe
<SYSTEM32>\rwinsta.exe with <SYSTEM32>\rwinsta.exe
<SYSTEM32>\runonce.exe with <SYSTEM32>\runonce.exe
<SYSTEM32>\schtasks.exe with <SYSTEM32>\schtasks.exe
<SYSTEM32>\scardsvr.exe with <SYSTEM32>\scardsvr.exe
<SYSTEM32>\sc.exe with <SYSTEM32>\sc.exe
<SYSTEM32>\rundll32.exe with <SYSTEM32>\rundll32.exe
<SYSTEM32>\rsopprov.exe with <SYSTEM32>\rsopprov.exe
<SYSTEM32>\rsnotify.exe with <SYSTEM32>\rsnotify.exe
<SYSTEM32>\rsmui.exe with <SYSTEM32>\rsmui.exe
<SYSTEM32>\runas.exe with <SYSTEM32>\runas.exe
<SYSTEM32>\rtcshare.exe with <SYSTEM32>\rtcshare.exe
<SYSTEM32>\rsvp.exe with <SYSTEM32>\rsvp.exe
<SYSTEM32>\regedt32.exe with <SYSTEM32>\regedt32.exe
<SYSTEM32>\PresentationHost.exe with <SYSTEM32>\PresentationHost.exe
<SYSTEM32>\powercfg.exe with <SYSTEM32>\powercfg.exe
<SYSTEM32>\ping6.exe with <SYSTEM32>\ping6.exe
<SYSTEM32>\proquota.exe with <SYSTEM32>\proquota.exe
<SYSTEM32>\progman.exe with <SYSTEM32>\progman.exe
<SYSTEM32>\print.exe with <SYSTEM32>\print.exe
<SYSTEM32>\ping.exe with <SYSTEM32>\ping.exe
<SYSTEM32>\packager.exe with <SYSTEM32>\packager.exe
<SYSTEM32>\osuninst.exe with <SYSTEM32>\osuninst.exe
<SYSTEM32>\osk.exe with <SYSTEM32>\osk.exe
<SYSTEM32>\perfmon.exe with <SYSTEM32>\perfmon.exe
<SYSTEM32>\pentnt.exe with <SYSTEM32>\pentnt.exe
<SYSTEM32>\pathping.exe with <SYSTEM32>\pathping.exe
<SYSTEM32>\proxycfg.exe with <SYSTEM32>\proxycfg.exe
<SYSTEM32>\rdsaddin.exe with <SYSTEM32>\rdsaddin.exe
<SYSTEM32>\rdpclip.exe with <SYSTEM32>\rdpclip.exe
<SYSTEM32>\rcp.exe with <SYSTEM32>\rcp.exe
<SYSTEM32>\reg.exe with <SYSTEM32>\reg.exe
<SYSTEM32>\recover.exe with <SYSTEM32>\recover.exe
<SYSTEM32>\rdshost.exe with <SYSTEM32>\rdshost.exe
<SYSTEM32>\rcimlby.exe with <SYSTEM32>\rcimlby.exe
<SYSTEM32>\qwinsta.exe with <SYSTEM32>\qwinsta.exe
<SYSTEM32>\qprocess.exe with <SYSTEM32>\qprocess.exe
<SYSTEM32>\qappsrv.exe with <SYSTEM32>\qappsrv.exe
<SYSTEM32>\rasphone.exe with <SYSTEM32>\rasphone.exe
<SYSTEM32>\rasdial.exe with <SYSTEM32>\rasdial.exe
<SYSTEM32>\rasautou.exe with <SYSTEM32>\rasautou.exe
<SYSTEM32>\autochk.exe with <SYSTEM32>\autochk.exe
<SYSTEM32>\auditusr.exe with <SYSTEM32>\auditusr.exe
<SYSTEM32>\attrib.exe with <SYSTEM32>\attrib.exe
<SYSTEM32>\autolfn.exe with <SYSTEM32>\autolfn.exe
<SYSTEM32>\autofmt.exe with <SYSTEM32>\autofmt.exe
<SYSTEM32>\autoconv.exe with <SYSTEM32>\autoconv.exe
<SYSTEM32>\atmadm.exe with <SYSTEM32>\atmadm.exe
<SYSTEM32>\asr_fmt.exe with <SYSTEM32>\asr_fmt.exe
<SYSTEM32>\arp.exe with <SYSTEM32>\arp.exe
<SYSTEM32>\ahui.exe with <SYSTEM32>\ahui.exe
<SYSTEM32>\at.exe with <SYSTEM32>\at.exe
<SYSTEM32>\asr_pfu.exe with <SYSTEM32>\asr_pfu.exe
<SYSTEM32>\asr_ldm.exe with <SYSTEM32>\asr_ldm.exe
<SYSTEM32>\blastcln.exe with <SYSTEM32>\blastcln.exe
<SYSTEM32>\chkntfs.exe with <SYSTEM32>\chkntfs.exe
<SYSTEM32>\chkdsk.exe with <SYSTEM32>\chkdsk.exe
<SYSTEM32>\chcp.com with <SYSTEM32>\chcp.com
<SYSTEM32>\cisvc.exe with <SYSTEM32>\cisvc.exe
<SYSTEM32>\cipher.exe with <SYSTEM32>\cipher.exe
<SYSTEM32>\cidaemon.exe with <SYSTEM32>\cidaemon.exe
<SYSTEM32>\charmap.exe with <SYSTEM32>\charmap.exe
<SYSTEM32>\bootvrfy.exe with <SYSTEM32>\bootvrfy.exe
<SYSTEM32>\bootok.exe with <SYSTEM32>\bootok.exe
<SYSTEM32>\bootcfg.exe with <SYSTEM32>\bootcfg.exe
<SYSTEM32>\calc.exe with <SYSTEM32>\calc.exe
<SYSTEM32>\cacls.exe with <SYSTEM32>\cacls.exe
<SYSTEM32>\dllcache\bckgzm.exe with <SYSTEM32>\dllcache\bckgzm.exe.new
<SYSTEM32>\actmovie.exe with <SYSTEM32>\actmovie.exe
%WINDIR%\Microsoft.NET\NETFXRepair.exe with %WINDIR%\Microsoft.NET\NETFXRepair.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
%WINDIR%\NOTEPAD.EXE with %WINDIR%\NOTEPAD.EXE
%WINDIR%\mui\muisetup.exe with %WINDIR%\mui\muisetup.exe
%WINDIR%\msagent\agentsvr.exe with %WINDIR%\msagent\agentsvr.exe
<SYSTEM32>\dllcache\isignup.exe with <SYSTEM32>\dllcache\isignup.exe.new
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Setup.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Setup.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SetupUtility.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SetupUtility.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\vbc.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\vbc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SetupUtility.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SetupUtility.exe
<SYSTEM32>\dllcache\iedw.exe with <SYSTEM32>\dllcache\iedw.exe.new
%WINDIR%\sfk.exe with %WINDIR%\sfk.exe
%WINDIR%\regedit.exe with %WINDIR%\regedit.exe
%WINDIR%\pchealth\UploadLB\Binaries\UploadM.exe with %WINDIR%\pchealth\UploadLB\Binaries\UploadM.exe
<SYSTEM32>\accwiz.exe with <SYSTEM32>\accwiz.exe
<SYSTEM32>\dllcache\moviemk.exe with <SYSTEM32>\dllcache\moviemk.exe.new
%WINDIR%\sleep.exe with %WINDIR%\sleep.exe
<SYSTEM32>\dllcache\iexplore.exe with <SYSTEM32>\dllcache\iexplore.exe.new
%WINDIR%\pchealth\helpctr\binaries\HelpSvc.exe with %WINDIR%\pchealth\helpctr\binaries\HelpSvc.exe
%WINDIR%\pchealth\helpctr\binaries\HelpHost.exe with %WINDIR%\pchealth\helpctr\binaries\HelpHost.exe
%WINDIR%\pchealth\helpctr\binaries\HelpCtr.exe with %WINDIR%\pchealth\helpctr\binaries\HelpCtr.exe
%WINDIR%\pchealth\helpctr\binaries\notiflag.exe with %WINDIR%\pchealth\helpctr\binaries\notiflag.exe
%WINDIR%\pchealth\helpctr\binaries\msconfig.exe with %WINDIR%\pchealth\helpctr\binaries\msconfig.exe
%WINDIR%\pchealth\helpctr\binaries\HscUpd.exe with %WINDIR%\pchealth\helpctr\binaries\HscUpd.exe
<SYSTEM32>\dllcache\asr_fmt.exe with <SYSTEM32>\dllcache\asr_fmt.exe
<SYSTEM32>\dllcache\arp.exe with <SYSTEM32>\dllcache\arp.exe
<SYSTEM32>\dllcache\alg.exe with <SYSTEM32>\dllcache\alg.exe
<SYSTEM32>\dllcache\at.exe with <SYSTEM32>\dllcache\at.exe
<SYSTEM32>\dllcache\asr_pfu.exe with <SYSTEM32>\dllcache\asr_pfu.exe
<SYSTEM32>\dllcache\asr_ldm.exe with <SYSTEM32>\dllcache\asr_ldm.exe
<SYSTEM32>\dllcache\ahui.exe with <SYSTEM32>\dllcache\ahui.exe
<SYSTEM32>\dllcache\accwiz.exe with <SYSTEM32>\dllcache\accwiz.exe
<SYSTEM32>\diskperf.exe with <SYSTEM32>\diskperf.exe
<SYSTEM32>\diskpart.exe with <SYSTEM32>\diskpart.exe
<SYSTEM32>\dllcache\agentsvr.exe with <SYSTEM32>\dllcache\agentsvr.exe
<SYSTEM32>\dllcache\admin.exe with <SYSTEM32>\dllcache\admin.exe
<SYSTEM32>\dllcache\actmovie.exe with <SYSTEM32>\dllcache\actmovie.exe
%WINDIR%\inf\unregmp2.exe with %WINDIR%\inf\unregmp2.exe.new
<SYSTEM32>\dllcache\blastcln.exe with <SYSTEM32>\dllcache\blastcln.exe
<SYSTEM32>\dllcache\autolfn.exe with <SYSTEM32>\dllcache\autolfn.exe
<SYSTEM32>\dllcache\autofmt.exe with <SYSTEM32>\dllcache\autofmt.exe
<SYSTEM32>\dllcache\bootvrfy.exe with <SYSTEM32>\dllcache\bootvrfy.exe
<SYSTEM32>\dllcache\bootok.exe with <SYSTEM32>\dllcache\bootok.exe
<SYSTEM32>\dllcache\bootcfg.exe with <SYSTEM32>\dllcache\bootcfg.exe
<SYSTEM32>\dllcache\autoconv.exe with <SYSTEM32>\dllcache\autoconv.exe
<SYSTEM32>\dllcache\auditusr.exe with <SYSTEM32>\dllcache\auditusr.exe
<SYSTEM32>\dllcache\attrib.exe with <SYSTEM32>\dllcache\attrib.exe
<SYSTEM32>\dllcache\atmadm.exe with <SYSTEM32>\dllcache\atmadm.exe
<SYSTEM32>\dllcache\autochk.exe with <SYSTEM32>\dllcache\autochk.exe
<SYSTEM32>\dllcache\shvlzm.exe with <SYSTEM32>\dllcache\shvlzm.exe.new
<SYSTEM32>\dllcache\author.exe with <SYSTEM32>\dllcache\author.exe
<SYSTEM32>\dllcache\rvsezm.exe with <SYSTEM32>\dllcache\rvsezm.exe.new
<SYSTEM32>\Com\comrepl.exe with <SYSTEM32>\Com\comrepl.exe
<SYSTEM32>\cmstp.exe with <SYSTEM32>\cmstp.exe
<SYSTEM32>\cmmon32.exe with <SYSTEM32>\cmmon32.exe
<SYSTEM32>\compact.exe with <SYSTEM32>\compact.exe
<SYSTEM32>\comp.exe with <SYSTEM32>\comp.exe
<SYSTEM32>\Com\comrereg.exe with <SYSTEM32>\Com\comrereg.exe
<SYSTEM32>\cmdl32.exe with <SYSTEM32>\cmdl32.exe
<SYSTEM32>\cleanmgr.exe with <SYSTEM32>\cleanmgr.exe
<SYSTEM32>\dllcache\chkrzm.exe with <SYSTEM32>\dllcache\chkrzm.exe.new
<SYSTEM32>\ckcnv.exe with <SYSTEM32>\ckcnv.exe
<SYSTEM32>\clipsrv.exe with <SYSTEM32>\clipsrv.exe
<SYSTEM32>\clipbrd.exe with <SYSTEM32>\clipbrd.exe
<SYSTEM32>\cliconfg.exe with <SYSTEM32>\cliconfg.exe
%WINDIR%\Help\Tours\mmTour\tour.exe with %WINDIR%\Help\Tours\mmTour\tour.exe.new
<SYSTEM32>\dfrgntfs.exe with <SYSTEM32>\dfrgntfs.exe
%WINDIR%\hh.exe with %WINDIR%\hh.exe.new
<SYSTEM32>\dfrgfat.exe with <SYSTEM32>\dfrgfat.exe
<SYSTEM32>\diskcopy.com with <SYSTEM32>\diskcopy.com
<SYSTEM32>\diskcomp.com with <SYSTEM32>\diskcomp.com
<SYSTEM32>\diantz.exe with <SYSTEM32>\diantz.exe
<SYSTEM32>\defrag.exe with <SYSTEM32>\defrag.exe
<SYSTEM32>\control.exe with <SYSTEM32>\control.exe
<SYSTEM32>\conime.exe with <SYSTEM32>\conime.exe
<SYSTEM32>\dllcache\hrtzzm.exe with <SYSTEM32>\dllcache\hrtzzm.exe.new
<SYSTEM32>\ddeshare.exe with <SYSTEM32>\ddeshare.exe
<SYSTEM32>\dcomcnfg.exe with <SYSTEM32>\dcomcnfg.exe
<SYSTEM32>\convert.exe with <SYSTEM32>\convert.exe
<SYSTEM32>\dllcache\inetwiz.exe with <SYSTEM32>\dllcache\inetwiz.exe.new
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\vbc.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\vbc.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPol.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPol.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\jsc.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\jsc.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegAsm.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegAsm.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ngen.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ngen.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\jsc.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\jsc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
<SYSTEM32>\dllcache\msinfo32.exe with <SYSTEM32>\dllcache\msinfo32.exe.new
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\CasPol.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ilasm.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\IEExec.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\InstallUtil.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\InstallUtil.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\SMSvcHost\b9c1a29e684bc02e49226ff1e9eec253\SMSvcHost.ni.exe with %WINDIR%\assembly\NativeImages_v2.0.50727_32\SMSvcHost\b9c1a29e684bc02e49226ff1e9eec253\SMSvcHost.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\6781b87c8d3b55e6120b1e86bea6e040\ServiceModelReg.ni.exe with %WINDIR%\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\6781b87c8d3b55e6120b1e86bea6e040\ServiceModelReg.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\9469981a17c01dd154c540127e678b35\PresentationFontCache.ni.exe with %WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\9469981a17c01dd154c540127e678b35\PresentationFontCache.ni.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\dfsvc\b9b6069e6da06eb57e89cc544397f735\dfsvc.ni.exe with %WINDIR%\assembly\NativeImages_v4.0.30319_32\dfsvc\b9b6069e6da06eb57e89cc544397f735\dfsvc.ni.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\51819c709096229ee187a7feee395d9f\ComSvcConfig.ni.exe with %WINDIR%\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\51819c709096229ee187a7feee395d9f\ComSvcConfig.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\WsatConfig\7d2a3adbdcb675f872eb2dbf21f73596\WsatConfig.ni.exe with %WINDIR%\assembly\NativeImages_v2.0.50727_32\WsatConfig\7d2a3adbdcb675f872eb2dbf21f73596\WsatConfig.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\MSBuild\87c84ffaaad81d8d106a9aa9d68b5926\MSBuild.ni.exe with %WINDIR%\assembly\NativeImages_v2.0.50727_32\MSBuild\87c84ffaaad81d8d106a9aa9d68b5926\MSBuild.ni.exe
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.exe with %WINDIR%\$NtUninstallWIC$\spuninst\spuninst.exe
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.exe with %WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.exe
%WINDIR%\$NtUninstallKB942288-v3$\msiexec.exe with %WINDIR%\$NtUninstallKB942288-v3$\msiexec.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\dfsvc\a2865dcec9c5d3cc9c55f026cbad6fcc\dfsvc.ni.exe with %WINDIR%\assembly\NativeImages_v2.0.50727_32\dfsvc\a2865dcec9c5d3cc9c55f026cbad6fcc\dfsvc.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\19b50dd470540911fc5cc65331a769e4\ComSvcConfig.ni.exe with %WINDIR%\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\19b50dd470540911fc5cc65331a769e4\ComSvcConfig.ni.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe with %WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
%WINDIR%\Help\Tours\mmTour\tour.exe with %WINDIR%\Help\Tours\mmTour\tour.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\csc.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\csc.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\CasPol.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CasPol.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ilasm.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ilasm.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\IEExec.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\IEExec.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\cvtres.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\cvtres.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
%WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\Microsoft.Workflow.Compiler.exe with %WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\Microsoft.Workflow.Compiler.exe
%WINDIR%\inf\unregmp2.exe with %WINDIR%\inf\unregmp2.exe
%WINDIR%\hh.exe with %WINDIR%\hh.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe with %WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe
%WINDIR%\Microsoft.NET\Framework\NETFXSBS10.exe with %WINDIR%\Microsoft.NET\Framework\NETFXSBS10.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
<SYSTEM32>\dllcache\icwrmind.exe with <SYSTEM32>\dllcache\icwrmind.exe.new
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CasPol.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
<SYSTEM32>\dllcache\icwtutor.exe with <SYSTEM32>\dllcache\icwtutor.exe.new
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ilasm.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\jsc.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\jsc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\PerformanceCounterInstaller.exe with %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\PerformanceCounterInstaller.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe with %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe with %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe with %WINDIR%\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe with %WINDIR%\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe with %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe with %WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe with %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe with %WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe
<SYSTEM32>\dllcache\sapisvr.exe with <SYSTEM32>\dllcache\sapisvr.exe.new
%WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess32.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess32.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\WFServicesReg.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\WFServicesReg.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\vbc.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\vbc.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\MSBuild.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\MSBuild.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
<SYSTEM32>\dllcache\icwconn2.exe with <SYSTEM32>\dllcache\icwconn2.exe.new
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe with %WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\csc.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\csc.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\AddInUtil.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\AddInUtil.exe
<SYSTEM32>\dllcache\icwconn1.exe with <SYSTEM32>\dllcache\icwconn1.exe.new
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\DeleteTemp.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\DeleteTemp.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\EdmGen.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\EdmGen.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe with %WINDIR%\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe
<SYSTEM32>\dllcache\cacls.exe with <SYSTEM32>\dllcache\cacls.exe
<SYSTEM32>\dllcache\logoff.exe with <SYSTEM32>\dllcache\logoff.exe
<SYSTEM32>\dllcache\logman.exe with <SYSTEM32>\dllcache\logman.exe
<SYSTEM32>\dllcache\logagent.exe with <SYSTEM32>\dllcache\logagent.exe
<SYSTEM32>\dllcache\pinball.exe with <SYSTEM32>\dllcache\pinball.exe.new
<SYSTEM32>\dllcache\logonui.exe with <SYSTEM32>\dllcache\logonui.exe
<SYSTEM32>\dllcache\logon.scr with <SYSTEM32>\dllcache\logon.scr
<SYSTEM32>\dllcache\lodctr.exe with <SYSTEM32>\dllcache\lodctr.exe
<SYSTEM32>\dllcache\label.exe with <SYSTEM32>\dllcache\label.exe
<SYSTEM32>\dllcache\dialer.exe with <SYSTEM32>\dllcache\dialer.exe.new
<SYSTEM32>\dllcache\ipxroute.exe with <SYSTEM32>\dllcache\ipxroute.exe
<SYSTEM32>\dllcache\locator.exe with <SYSTEM32>\dllcache\locator.exe
<SYSTEM32>\dllcache\lnkstub.exe with <SYSTEM32>\dllcache\lnkstub.exe
<SYSTEM32>\dllcache\lights.exe with <SYSTEM32>\dllcache\lights.exe
<SYSTEM32>\dllcache\lpq.exe with <SYSTEM32>\dllcache\lpq.exe
<SYSTEM32>\dllcache\mmc.exe with <SYSTEM32>\dllcache\mmc.exe
<SYSTEM32>\dllcache\migwiz_a.exe with <SYSTEM32>\dllcache\migwiz_a.exe
<SYSTEM32>\dllcache\migwiz.exe with <SYSTEM32>\dllcache\migwiz.exe
<SYSTEM32>\dllcache\mofcomp.exe with <SYSTEM32>\dllcache\mofcomp.exe
<SYSTEM32>\dllcache\mobsync.exe with <SYSTEM32>\dllcache\mobsync.exe
<SYSTEM32>\dllcache\mnmsrvc.exe with <SYSTEM32>\dllcache\mnmsrvc.exe
<SYSTEM32>\dllcache\migregdb.exe with <SYSTEM32>\dllcache\migregdb.exe
<SYSTEM32>\dllcache\magnify.exe with <SYSTEM32>\dllcache\magnify.exe
<SYSTEM32>\dllcache\lsass.exe with <SYSTEM32>\dllcache\lsass.exe
<SYSTEM32>\dllcache\lpr.exe with <SYSTEM32>\dllcache\lpr.exe
<SYSTEM32>\dllcache\migload.exe with <SYSTEM32>\dllcache\migload.exe
<SYSTEM32>\dllcache\migisol.exe with <SYSTEM32>\dllcache\migisol.exe
<SYSTEM32>\dllcache\makecab.exe with <SYSTEM32>\dllcache\makecab.exe
<SYSTEM32>\dllcache\ipv6.exe with <SYSTEM32>\dllcache\ipv6.exe
<SYSTEM32>\dllcache\wmplayer.exe with <SYSTEM32>\dllcache\wmplayer.exe.new
<SYSTEM32>\dllcache\imapi.exe with <SYSTEM32>\dllcache\imapi.exe
<SYSTEM32>\dllcache\iissync.exe with <SYSTEM32>\dllcache\iissync.exe
<SYSTEM32>\dllcache\imjpdadm.exe with <SYSTEM32>\dllcache\imjpdadm.exe
<SYSTEM32>\dllcache\imepadsv.exe with <SYSTEM32>\dllcache\imepadsv.exe
<SYSTEM32>\dllcache\imekrmig.exe with <SYSTEM32>\dllcache\imekrmig.exe
<SYSTEM32>\dllcache\iisrstas.exe with <SYSTEM32>\dllcache\iisrstas.exe
<SYSTEM32>\dllcache\setup_wm.exe with <SYSTEM32>\dllcache\setup_wm.exe.new
<SYSTEM32>\dllcache\hscupd.exe with <SYSTEM32>\dllcache\hscupd.exe
<SYSTEM32>\dllcache\hostname.exe with <SYSTEM32>\dllcache\hostname.exe
<SYSTEM32>\dllcache\iisreset.exe with <SYSTEM32>\dllcache\iisreset.exe
<SYSTEM32>\dllcache\iexpress.exe with <SYSTEM32>\dllcache\iexpress.exe
<SYSTEM32>\dllcache\ie4uinit.exe with <SYSTEM32>\dllcache\ie4uinit.exe
<SYSTEM32>\dllcache\imjpdct.exe with <SYSTEM32>\dllcache\imjpdct.exe
<SYSTEM32>\dllcache\inetin51.exe with <SYSTEM32>\dllcache\inetin51.exe
<SYSTEM32>\dllcache\imscinst.exe with <SYSTEM32>\dllcache\imscinst.exe
<SYSTEM32>\dllcache\imkrinst.exe with <SYSTEM32>\dllcache\imkrinst.exe
<SYSTEM32>\dllcache\ipsec6.exe with <SYSTEM32>\dllcache\ipsec6.exe
<SYSTEM32>\dllcache\ipconfig.exe with <SYSTEM32>\dllcache\ipconfig.exe
<SYSTEM32>\dllcache\inetmgr.exe with <SYSTEM32>\dllcache\inetmgr.exe
<SYSTEM32>\dllcache\wordpad.exe with <SYSTEM32>\dllcache\wordpad.exe.new
<SYSTEM32>\dllcache\imjpmig.exe with <SYSTEM32>\dllcache\imjpmig.exe
<SYSTEM32>\dllcache\imjpinst.exe with <SYSTEM32>\dllcache\imjpinst.exe
<SYSTEM32>\dllcache\imjpdsvr.exe with <SYSTEM32>\dllcache\imjpdsvr.exe
<SYSTEM32>\dllcache\imjputy.exe with <SYSTEM32>\dllcache\imjputy.exe
<SYSTEM32>\dllcache\imjpuex.exe with <SYSTEM32>\dllcache\imjpuex.exe
<SYSTEM32>\dllcache\imjprw.exe with <SYSTEM32>\dllcache\imjprw.exe
<SYSTEM32>\dllcache\nppagent.exe with <SYSTEM32>\dllcache\nppagent.exe
<SYSTEM32>\dllcache\notiflag.exe with <SYSTEM32>\dllcache\notiflag.exe
<SYSTEM32>\dllcache\notepad.exe with <SYSTEM32>\dllcache\notepad.exe
<SYSTEM32>\dllcache\ntsd.exe with <SYSTEM32>\dllcache\ntsd.exe
<SYSTEM32>\dllcache\ntbackup.exe with <SYSTEM32>\dllcache\ntbackup.exe
<SYSTEM32>\dllcache\nslookup.exe with <SYSTEM32>\dllcache\nslookup.exe
<SYSTEM32>\dllcache\netstat.exe with <SYSTEM32>\dllcache\netstat.exe
<SYSTEM32>\dllcache\net1.exe with <SYSTEM32>\dllcache\net1.exe
<SYSTEM32>\dllcache\net.exe with <SYSTEM32>\dllcache\net.exe
<SYSTEM32>\dllcache\nddeapir.exe with <SYSTEM32>\dllcache\nddeapir.exe
<SYSTEM32>\dllcache\netsh.exe with <SYSTEM32>\dllcache\netsh.exe
<SYSTEM32>\dllcache\netsetup.exe with <SYSTEM32>\dllcache\netsetup.exe
<SYSTEM32>\dllcache\netdde.exe with <SYSTEM32>\dllcache\netdde.exe
<SYSTEM32>\dllcache\ntvdm.exe with <SYSTEM32>\dllcache\ntvdm.exe
<SYSTEM32>\dllcache\pentnt.exe with <SYSTEM32>\dllcache\pentnt.exe
<SYSTEM32>\dllcache\pathping.exe with <SYSTEM32>\dllcache\pathping.exe
<SYSTEM32>\dllcache\packager.exe with <SYSTEM32>\dllcache\packager.exe
<SYSTEM32>\dllcache\ping6.exe with <SYSTEM32>\dllcache\ping6.exe
<SYSTEM32>\dllcache\ping.exe with <SYSTEM32>\dllcache\ping.exe
<SYSTEM32>\dllcache\perfmon.exe with <SYSTEM32>\dllcache\perfmon.exe
<SYSTEM32>\dllcache\osuninst.exe with <SYSTEM32>\dllcache\osuninst.exe
<SYSTEM32>\dllcache\odbcconf.exe with <SYSTEM32>\dllcache\odbcconf.exe
<SYSTEM32>\dllcache\odbcad32.exe with <SYSTEM32>\dllcache\odbcad32.exe
<SYSTEM32>\dllcache\nwscript.exe with <SYSTEM32>\dllcache\nwscript.exe
<SYSTEM32>\dllcache\osk.exe with <SYSTEM32>\dllcache\osk.exe
<SYSTEM32>\dllcache\opnfiles.exe with <SYSTEM32>\dllcache\opnfiles.exe
<SYSTEM32>\dllcache\oobebaln.exe with <SYSTEM32>\dllcache\oobebaln.exe
<SYSTEM32>\dllcache\nbtstat.exe with <SYSTEM32>\dllcache\nbtstat.exe
<SYSTEM32>\dllcache\msconfig.exe with <SYSTEM32>\dllcache\msconfig.exe
<SYSTEM32>\dllcache\mrinfo.exe with <SYSTEM32>\dllcache\mrinfo.exe
<SYSTEM32>\dllcache\mqtgsvc.exe with <SYSTEM32>\dllcache\mqtgsvc.exe
<SYSTEM32>\dllcache\mshearts.exe with <SYSTEM32>\dllcache\mshearts.exe
<SYSTEM32>\dllcache\msg.exe with <SYSTEM32>\dllcache\msg.exe
<SYSTEM32>\dllcache\msdtc.exe with <SYSTEM32>\dllcache\msdtc.exe
<SYSTEM32>\dllcache\mqsvc.exe with <SYSTEM32>\dllcache\mqsvc.exe
<SYSTEM32>\dllcache\mplay32.exe with <SYSTEM32>\dllcache\mplay32.exe
%WINDIR%\mui\muisetup.exe with %WINDIR%\mui\muisetup.exe.new
<SYSTEM32>\dllcache\mountvol.exe with <SYSTEM32>\dllcache\mountvol.exe
<SYSTEM32>\dllcache\mqbkup.exe with <SYSTEM32>\dllcache\mqbkup.exe
<SYSTEM32>\dllcache\mpnotify.exe with <SYSTEM32>\dllcache\mpnotify.exe
%WINDIR%\NOTEPAD.EXE with %WINDIR%\notepad.exe.new
<SYSTEM32>\dllcache\mshta.exe with <SYSTEM32>\dllcache\mshta.exe
%WINDIR%\regedit.exe with %WINDIR%\regedit.exe.new
<SYSTEM32>\dllcache\mstsc.exe with <SYSTEM32>\dllcache\mstsc.exe
<SYSTEM32>\dllcache\mstinit.exe with <SYSTEM32>\dllcache\mstinit.exe
<SYSTEM32>\dllcache\narrator.exe with <SYSTEM32>\dllcache\narrator.exe
<SYSTEM32>\dllcache\muisetup.exe with <SYSTEM32>\dllcache\muisetup.exe
<SYSTEM32>\dllcache\mtstocom.exe with <SYSTEM32>\dllcache\mtstocom.exe
<SYSTEM32>\dllcache\msswchx.exe with <SYSTEM32>\dllcache\msswchx.exe
<SYSTEM32>\dllcache\msiregmv.exe with <SYSTEM32>\dllcache\msiregmv.exe
%WINDIR%\pchealth\helpctr\binaries\notiflag.exe with %WINDIR%\pchealth\helpctr\binaries\notiflag.exe.new
<SYSTEM32>\dllcache\msiexec.exe with <SYSTEM32>\dllcache\msiexec.exe
<SYSTEM32>\dllcache\mspaint.exe with <SYSTEM32>\dllcache\mspaint.exe
%WINDIR%\pchealth\UploadLB\Binaries\UploadM.exe with %WINDIR%\pchealth\UploadLB\Binaries\uploadm.exe.new
<SYSTEM32>\dllcache\msoobe.exe with <SYSTEM32>\dllcache\msoobe.exe
<SYSTEM32>\dllcache\hh.exe with <SYSTEM32>\dllcache\hh.exe
<SYSTEM32>\dllcache\wb32.exe with <SYSTEM32>\dllcache\wb32.exe.new
<SYSTEM32>\dllcache\csrss.exe with <SYSTEM32>\dllcache\csrss.exe
<SYSTEM32>\dllcache\cscript.exe with <SYSTEM32>\dllcache\cscript.exe
<SYSTEM32>\dllcache\dcomcnfg.exe with <SYSTEM32>\dllcache\dcomcnfg.exe
<SYSTEM32>\dllcache\davcdata.exe with <SYSTEM32>\dllcache\davcdata.exe
<SYSTEM32>\dllcache\ctfmon.exe with <SYSTEM32>\dllcache\ctfmon.exe
<SYSTEM32>\dllcache\cprofile.exe with <SYSTEM32>\dllcache\cprofile.exe
<SYSTEM32>\dllcache\control.exe with <SYSTEM32>\dllcache\control.exe
<SYSTEM32>\dllcache\conime.exe with <SYSTEM32>\dllcache\conime.exe
<SYSTEM32>\dllcache\comrereg.exe with <SYSTEM32>\dllcache\comrereg.exe
<SYSTEM32>\dllcache\cplexe.exe with <SYSTEM32>\dllcache\cplexe.exe
<SYSTEM32>\dllcache\convlog.exe with <SYSTEM32>\dllcache\convlog.exe
<SYSTEM32>\dllcache\convert.exe with <SYSTEM32>\dllcache\convert.exe
<SYSTEM32>\dllcache\ddeshare.exe with <SYSTEM32>\dllcache\ddeshare.exe
<SYSTEM32>\dllcache\dllhst3g.exe with <SYSTEM32>\dllcache\dllhst3g.exe
<SYSTEM32>\dllcache\dllhost.exe with <SYSTEM32>\dllcache\dllhost.exe
<SYSTEM32>\dllcache\diskperf.exe with <SYSTEM32>\dllcache\diskperf.exe
<SYSTEM32>\dllcache\doskey.exe with <SYSTEM32>\dllcache\doskey.exe
<SYSTEM32>\dllcache\dmremote.exe with <SYSTEM32>\dllcache\dmremote.exe
<SYSTEM32>\dllcache\dmadmin.exe with <SYSTEM32>\dllcache\dmadmin.exe
<SYSTEM32>\dllcache\diskpart.exe with <SYSTEM32>\dllcache\diskpart.exe
<SYSTEM32>\dllcache\dfrgntfs.exe with <SYSTEM32>\dllcache\dfrgntfs.exe
<SYSTEM32>\dllcache\dfrgfat.exe with <SYSTEM32>\dllcache\dfrgfat.exe
<SYSTEM32>\dllcache\defrag.exe with <SYSTEM32>\dllcache\defrag.exe
<SYSTEM32>\dllcache\diantz.exe with <SYSTEM32>\dllcache\diantz.exe
<SYSTEM32>\dllcache\msimn.exe with <SYSTEM32>\dllcache\msimn.exe.new
<SYSTEM32>\dllcache\dialer.exe with <SYSTEM32>\dllcache\dialer.exe
<SYSTEM32>\dllcache\comrepl.exe with <SYSTEM32>\dllcache\comrepl.exe
<SYSTEM32>\dllcache\chkdsk.exe with <SYSTEM32>\dllcache\chkdsk.exe
<SYSTEM32>\dllcache\chgusr.exe with <SYSTEM32>\dllcache\chgusr.exe
<SYSTEM32>\dllcache\chgport.exe with <SYSTEM32>\dllcache\chgport.exe
<SYSTEM32>\dllcache\cintsetp.exe with <SYSTEM32>\dllcache\cintsetp.exe
<SYSTEM32>\dllcache\cidaemon.exe with <SYSTEM32>\dllcache\cidaemon.exe
<SYSTEM32>\dllcache\chkntfs.exe with <SYSTEM32>\dllcache\chkntfs.exe
<SYSTEM32>\dllcache\chglogon.exe with <SYSTEM32>\dllcache\chglogon.exe
<SYSTEM32>\dllcache\cb32.exe with <SYSTEM32>\dllcache\cb32.exe
<SYSTEM32>\dllcache\calc.exe with <SYSTEM32>\dllcache\calc.exe
<SYSTEM32>\dllcache\zclientm.exe with <SYSTEM32>\dllcache\zclientm.exe.new
<SYSTEM32>\dllcache\charmap.exe with <SYSTEM32>\dllcache\charmap.exe
<SYSTEM32>\dllcache\change.exe with <SYSTEM32>\dllcache\change.exe
<SYSTEM32>\dllcache\cfgwiz.exe with <SYSTEM32>\dllcache\cfgwiz.exe
<SYSTEM32>\dllcache\cipher.exe with <SYSTEM32>\dllcache\cipher.exe
<SYSTEM32>\dllcache\cmstp.exe with <SYSTEM32>\dllcache\cmstp.exe
<SYSTEM32>\dllcache\cmmon32.exe with <SYSTEM32>\dllcache\cmmon32.exe
<SYSTEM32>\dllcache\cmdl32.exe with <SYSTEM32>\dllcache\cmdl32.exe
<SYSTEM32>\dllcache\conf.exe with <SYSTEM32>\dllcache\conf.exe.new
<SYSTEM32>\dllcache\compact.exe with <SYSTEM32>\dllcache\compact.exe
<SYSTEM32>\dllcache\comp.exe with <SYSTEM32>\dllcache\comp.exe
<SYSTEM32>\dllcache\cmd.exe with <SYSTEM32>\dllcache\cmd.exe
<SYSTEM32>\dllcache\ckcnv.exe with <SYSTEM32>\dllcache\ckcnv.exe
<SYSTEM32>\dllcache\cisvc.exe with <SYSTEM32>\dllcache\cisvc.exe
<SYSTEM32>\dllcache\cb32.exe with <SYSTEM32>\dllcache\cb32.exe.new
<SYSTEM32>\dllcache\clipsrv.exe with <SYSTEM32>\dllcache\clipsrv.exe
<SYSTEM32>\dllcache\clipbrd.exe with <SYSTEM32>\dllcache\clipbrd.exe
<SYSTEM32>\dllcache\cleanmgr.exe with <SYSTEM32>\dllcache\cleanmgr.exe
<SYSTEM32>\dllcache\migrate.exe with <SYSTEM32>\dllcache\migrate.exe.new
<SYSTEM32>\dllcache\fpcount.exe with <SYSTEM32>\dllcache\fpcount.exe
<SYSTEM32>\dllcache\fpadmcgi.exe with <SYSTEM32>\dllcache\fpadmcgi.exe
<SYSTEM32>\dllcache\fsutil.exe with <SYSTEM32>\dllcache\fsutil.exe
<SYSTEM32>\dllcache\freecell.exe with <SYSTEM32>\dllcache\freecell.exe
<SYSTEM32>\dllcache\fpremadm.exe with <SYSTEM32>\dllcache\fpremadm.exe
<SYSTEM32>\dllcache\fp98swin.exe with <SYSTEM32>\dllcache\fp98swin.exe
<SYSTEM32>\dllcache\fltmc.exe with <SYSTEM32>\dllcache\fltmc.exe
<SYSTEM32>\dllcache\flattemp.exe with <SYSTEM32>\dllcache\flattemp.exe
<SYSTEM32>\dllcache\fixmapi.exe with <SYSTEM32>\dllcache\fixmapi.exe
<SYSTEM32>\dllcache\fp98sadm.exe with <SYSTEM32>\dllcache\fp98sadm.exe
<SYSTEM32>\dllcache\forcedos.exe with <SYSTEM32>\dllcache\forcedos.exe
<SYSTEM32>\dllcache\fontview.exe with <SYSTEM32>\dllcache\fontview.exe
<SYSTEM32>\dllcache\ftp.exe with <SYSTEM32>\dllcache\ftp.exe
<SYSTEM32>\dllcache\help.exe with <SYSTEM32>\dllcache\help.exe
<SYSTEM32>\dllcache\grpconv.exe with <SYSTEM32>\dllcache\grpconv.exe
<SYSTEM32>\dllcache\mplayer2.exe with <SYSTEM32>\dllcache\mplayer2.exe.new
<SYSTEM32>\dllcache\helpsvc.exe with <SYSTEM32>\dllcache\helpsvc.exe
<SYSTEM32>\dllcache\helphost.exe with <SYSTEM32>\dllcache\helphost.exe
<SYSTEM32>\dllcache\helpctr.exe with <SYSTEM32>\dllcache\helpctr.exe
<SYSTEM32>\dllcache\gpupdate.exe with <SYSTEM32>\dllcache\gpupdate.exe
<SYSTEM32>\dllcache\fxssend.exe with <SYSTEM32>\dllcache\fxssend.exe
<SYSTEM32>\dllcache\fxscover.exe with <SYSTEM32>\dllcache\fxscover.exe
<SYSTEM32>\dllcache\fxsclnt.exe with <SYSTEM32>\dllcache\fxsclnt.exe
<SYSTEM32>\dllcache\gprslt.exe with <SYSTEM32>\dllcache\gprslt.exe
<SYSTEM32>\dllcache\getmac.exe with <SYSTEM32>\dllcache\getmac.exe
<SYSTEM32>\dllcache\fxssvc.exe with <SYSTEM32>\dllcache\fxssvc.exe
<SYSTEM32>\dllcache\finger.exe with <SYSTEM32>\dllcache\finger.exe
<SYSTEM32>\dllcache\dxdiag.exe with <SYSTEM32>\dllcache\dxdiag.exe
<SYSTEM32>\dllcache\dwwin.exe with <SYSTEM32>\dllcache\dwwin.exe
<SYSTEM32>\dllcache\dvdupgrd.exe with <SYSTEM32>\dllcache\dvdupgrd.exe
<SYSTEM32>\dllcache\eudcedit.exe with <SYSTEM32>\dllcache\eudcedit.exe
<SYSTEM32>\dllcache\esentutl.exe with <SYSTEM32>\dllcache\esentutl.exe
<SYSTEM32>\dllcache\setup50.exe with <SYSTEM32>\dllcache\setup50.exe.new
<SYSTEM32>\dllcache\dumprep.exe with <SYSTEM32>\dllcache\dumprep.exe
<SYSTEM32>\dllcache\dpnsvr.exe with <SYSTEM32>\dllcache\dpnsvr.exe
<SYSTEM32>\dllcache\oemig50.exe with <SYSTEM32>\dllcache\oemig50.exe.new
<SYSTEM32>\dllcache\dplaysvr.exe with <SYSTEM32>\dllcache\dplaysvr.exe
<SYSTEM32>\dllcache\drwtsn32.exe with <SYSTEM32>\dllcache\drwtsn32.exe
<SYSTEM32>\dllcache\drvqry.exe with <SYSTEM32>\dllcache\drvqry.exe
<SYSTEM32>\dllcache\dpvsetup.exe with <SYSTEM32>\dllcache\dpvsetup.exe
<SYSTEM32>\dllcache\evcreate.exe with <SYSTEM32>\dllcache\evcreate.exe
<SYSTEM32>\dllcache\fc.exe with <SYSTEM32>\dllcache\fc.exe
<SYSTEM32>\dllcache\extrac32.exe with <SYSTEM32>\dllcache\extrac32.exe
<SYSTEM32>\dllcache\explorer.exe with <SYSTEM32>\dllcache\explorer.exe
<SYSTEM32>\dllcache\wabmig.exe with <SYSTEM32>\dllcache\wabmig.exe.new
<SYSTEM32>\dllcache\findstr.exe with <SYSTEM32>\dllcache\findstr.exe
<SYSTEM32>\dllcache\find.exe with <SYSTEM32>\dllcache\find.exe
<SYSTEM32>\dllcache\expand.exe with <SYSTEM32>\dllcache\expand.exe
<SYSTEM32>\dllcache\evntwin.exe with <SYSTEM32>\dllcache\evntwin.exe
<SYSTEM32>\dllcache\evntcmd.exe with <SYSTEM32>\dllcache\evntcmd.exe
<SYSTEM32>\dllcache\eventvwr.exe with <SYSTEM32>\dllcache\eventvwr.exe
<SYSTEM32>\dllcache\wab.exe with <SYSTEM32>\dllcache\wab.exe.new
<SYSTEM32>\dllcache\EXCH_regtrace.exe with <SYSTEM32>\dllcache\EXCH_regtrace.exe
<SYSTEM32>\dllcache\evtrig.exe with <SYSTEM32>\dllcache\evtrig.exe

Infects the following executable files:

<SYSTEM32>\dllcache\dialer.exe.new
<SYSTEM32>\dllcache\wordpad.exe.new
<SYSTEM32>\dllcache\wmplayer.exe.new
%WINDIR%\notepad.exe.new
%WINDIR%\mui\muisetup.exe.new
<SYSTEM32>\dllcache\pinball.exe.new
<SYSTEM32>\dllcache\wabmig.exe.new
<SYSTEM32>\dllcache\wab.exe.new
<SYSTEM32>\dllcache\setup50.exe.new
<SYSTEM32>\dllcache\setup_wm.exe.new
<SYSTEM32>\dllcache\mplayer2.exe.new
<SYSTEM32>\dllcache\migrate.exe.new
<SYSTEM32>\dllcache\notiflag.exe.new
<SYSTEM32>\dllcache\notepad.exe.new
<SYSTEM32>\dllcache\muisetup.exe.new
<SYSTEM32>\notepad.exe.new
<SYSTEM32>\dllcache\regedit.exe.new
<SYSTEM32>\dllcache\uploadm.exe.new
%WINDIR%\regedit.exe.new
%WINDIR%\pchealth\UploadLB\Binaries\uploadm.exe.new
%WINDIR%\pchealth\helpctr\binaries\notiflag.exe.new
<SYSTEM32>\dllcache\unregmp2.exe.new
<SYSTEM32>\dllcache\hh.exe.new
<SYSTEM32>\dllcache\tourW.exe.new
<SYSTEM32>\dllcache\oemig50.exe.new
<SYSTEM32>\dllcache\iedw.exe.new
<SYSTEM32>\dllcache\isignup.exe.new
<SYSTEM32>\dllcache\inetwiz.exe.new
<SYSTEM32>\dllcache\bckgzm.exe.new
<SYSTEM32>\dllcache\moviemk.exe.new
<SYSTEM32>\dllcache\iexplore.exe.new
<SYSTEM32>\dllcache\icwconn1.exe.new
<SYSTEM32>\dllcache\sapisvr.exe.new
<SYSTEM32>\dllcache\msinfo32.exe.new
<SYSTEM32>\dllcache\icwtutor.exe.new
<SYSTEM32>\dllcache\icwrmind.exe.new
<SYSTEM32>\dllcache\icwconn2.exe.new
<SYSTEM32>\dllcache\cb32.exe.new
<SYSTEM32>\dllcache\zclientm.exe.new
<SYSTEM32>\dllcache\shvlzm.exe.new
<SYSTEM32>\dllcache\msimn.exe.new
<SYSTEM32>\dllcache\wb32.exe.new
<SYSTEM32>\dllcache\conf.exe.new
<SYSTEM32>\dllcache\hrtzzm.exe.new
%WINDIR%\Help\Tours\mmTour\tour.exe.new
<SYSTEM32>\dllcache\chkrzm.exe.new
%WINDIR%\inf\unregmp2.exe.new
<SYSTEM32>\dllcache\rvsezm.exe.new
%WINDIR%\hh.exe.new

Creates the following files on removable media:

<Drive name for removable media>:\Autorun.exe
<Drive name for removable media>:\Autorun.inf

Modifies file system :

Creates the following files:

<SYSTEM32>\dllcache\sapisvr.exe
<SYSTEM32>\dllcache\rvsezm.exe
<SYSTEM32>\dllcache\setup_wm.exe
<SYSTEM32>\dllcache\setup50.exe
<SYSTEM32>\dllcache\msinfo32.exe
<SYSTEM32>\dllcache\msimn.exe
<SYSTEM32>\dllcache\pinball.exe
<SYSTEM32>\dllcache\oemig50.exe
<SYSTEM32>\dllcache\wabmig.exe
<SYSTEM32>\dllcache\wab.exe
<SYSTEM32>\dllcache\wmplayer.exe
<SYSTEM32>\dllcache\wb32.exe
<SYSTEM32>\dllcache\tourW.exe
<SYSTEM32>\dllcache\shvlzm.exe
<SYSTEM32>\dllcache\uploadm.exe
<SYSTEM32>\dllcache\unregmp2.exe
<SYSTEM32>\dllcache\icwconn1.exe
<SYSTEM32>\dllcache\hrtzzm.exe
<SYSTEM32>\dllcache\icwrmind.exe
<SYSTEM32>\dllcache\icwconn2.exe
<SYSTEM32>\dllcache\chkrzm.exe
<SYSTEM32>\dllcache\bckgzm.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
<SYSTEM32>\dllcache\conf.exe
<SYSTEM32>\dllcache\migrate.exe
<SYSTEM32>\dllcache\isignup.exe
<SYSTEM32>\dllcache\mplayer2.exe
<SYSTEM32>\dllcache\moviemk.exe
<SYSTEM32>\dllcache\iedw.exe
<SYSTEM32>\dllcache\icwtutor.exe
<SYSTEM32>\dllcache\inetwiz.exe
<SYSTEM32>\dllcache\iexplore.exe
%WINDIR%\LastGood\TMP16.tmp
<SYSTEM32>\SET15.tmp
<SYSTEM32>\SET19.tmp
<SYSTEM32>\SET18.tmp
<SYSTEM32>\SET11.tmp
<SYSTEM32>\SET10.tmp
<SYSTEM32>\SET14.tmp
%WINDIR%\LastGood\TMP12.tmp
<SYSTEM32>\dllcache\ntkrnlmp.exe.new
<SYSTEM32>\dllcache\usrshuta.exe.new
<SYSTEM32>\dllcache\ntkrpamp.exe.new
<SYSTEM32>\dllcache\fsquirt.exe.new
<SYSTEM32>\SET1C.tmp
%WINDIR%\LastGood\TMP1A.tmp
<SYSTEM32>\dllcache\usrprbda.exe.new
<SYSTEM32>\dllcache\usrmlnka.exe.new
%WINDIR%\LastGood\TMP2.tmp
<SYSTEM32>\SET1.tmp
<SYSTEM32>\dllcache\dvdplay.exe.new
<SYSTEM32>\SET4.tmp
<SYSTEM32>\dllcache\zclientm.exe
<SYSTEM32>\dllcache\wordpad.exe
%WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\Microsoft.Workflow.Compiler.exe
<PATH_<Auxiliary name>.EXE>
<SYSTEM32>\SETC.tmp
%WINDIR%\LastGood\TMPA.tmp
%WINDIR%\LastGood\TMPE.tmp
<SYSTEM32>\SETD.tmp
%WINDIR%\LastGood\TMP6.tmp
<SYSTEM32>\SET5.tmp
<SYSTEM32>\SET9.tmp
<SYSTEM32>\SET8.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\RestorePointSize
%PROGRAM_FILES%\FireFox\uninstall\helper.exe
%PROGRAM_FILES%\FireFox\shlibsign.exe
%PROGRAM_FILES%\FireFox\xpcshell.exe
%PROGRAM_FILES%\FireFox\updater.exe
%PROGRAM_FILES%\FireFox\mangle.exe
%PROGRAM_FILES%\FireFox\js.exe
%PROGRAM_FILES%\FireFox\plugin-container.exe
%PROGRAM_FILES%\FireFox\nsinstall.exe
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwrmind.exe
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn2.exe
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\inetwiz.exe
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwtutor.exe
%PROGRAM_FILES%\FireFox\xpt_dump.exe
%PROGRAM_FILES%\FireFox\xpidl.exe
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn1.exe
%PROGRAM_FILES%\FireFox\xpt_link.exe
C:\Far2\Addons\Colors\export_colors.bat
C:\Far2\Addons\Colors\Default Highlighting\import_colors.bat
C:\Far2\Far.exe
C:\Far2\Addons\Colors\import_colors.bat
C:\Autorun.exe
C:\Autorun.inf
C:\Far2\Addons\Colors\Custom Highlighting\import_colors.bat
C:\AUTOEXEC.BAT
%CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe
%PROGRAM_FILES%\FireFox\firefox.exe
%PROGRAM_FILES%\FireFox\crashreporter.exe
C:\Far2\Plugins\ExtSearch\sources\esearch_debug.bat
C:\Far2\Plugins\ExtSearch\sources\ESEARCH.BAT
%CommonProgramFiles%\Microsoft Shared\DW\DWTRIG20.EXE
%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE
%PROGRAM_FILES%\Outlook Express\wabmig.exe
%PROGRAM_FILES%\Outlook Express\wab.exe
%PROGRAM_FILES%\Windows Media Player\mplayer2.exe
%PROGRAM_FILES%\Windows Media Player\migrate.exe
%PROGRAM_FILES%\Outlook Express\msimn.exe
%PROGRAM_FILES%\NetMeeting\wb32.exe
%PROGRAM_FILES%\Outlook Express\setup50.exe
%PROGRAM_FILES%\Outlook Express\oemig50.exe
%PROGRAM_FILES%\Windows NT\Pinball\PINBALL.EXE
%PROGRAM_FILES%\Windows NT\hypertrm.exe
<Auxiliary element>
C:\startup_local.bat
%PROGRAM_FILES%\Windows Media Player\wmplayer.exe
%PROGRAM_FILES%\Windows Media Player\setup_wm.exe
%PROGRAM_FILES%\Windows NT\dialer.exe
%PROGRAM_FILES%\Windows NT\Accessories\wordpad.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\Digcore.exe
%PROGRAM_FILES%\Movie Maker\moviemk.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\msnsusii.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\Msncli.exe
%PROGRAM_FILES%\Internet Explorer\iedw.exe
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\isignup.exe
%PROGRAM_FILES%\Messenger\msmsgs.exe
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE
%PROGRAM_FILES%\MSN Gaming Zone\Windows\zClientm.exe
%PROGRAM_FILES%\MSN Gaming Zone\Windows\shvlzm.exe
%PROGRAM_FILES%\NetMeeting\conf.exe
%PROGRAM_FILES%\NetMeeting\cb32.exe
%PROGRAM_FILES%\MSN Gaming Zone\Windows\chkrzm.exe
%PROGRAM_FILES%\MSN Gaming Zone\Windows\bckgzm.exe
%PROGRAM_FILES%\MSN Gaming Zone\Windows\Rvsezm.exe
%PROGRAM_FILES%\MSN Gaming Zone\Windows\hrtzzm.exe

Deletes the following files:

<SYSTEM32>\dllhst3g.exe
<SYSTEM32>\dllhost.exe
<SYSTEM32>\dllcache\zclientm.exe
<SYSTEM32>\dmadmin.exe
<SYSTEM32>\dosx.exe
<SYSTEM32>\doskey.exe
<SYSTEM32>\dmremote.exe
<SYSTEM32>\dllcache\wscript.exe
<SYSTEM32>\dllcache\wscntfy.exe
<SYSTEM32>\dllcache\write.exe
<SYSTEM32>\dllcache\wuauclt.exe
<SYSTEM32>\dllcache\xcopy.exe
<SYSTEM32>\dllcache\wupdmgr.exe
<SYSTEM32>\dllcache\wuauclt1.exe
<SYSTEM32>\dplaysvr.exe
<SYSTEM32>\dxdiag.exe
<SYSTEM32>\dwwin.exe
<SYSTEM32>\dvdupgrd.exe
<SYSTEM32>\edit.com
<SYSTEM32>\eudcedit.exe
<SYSTEM32>\esentutl.exe
<SYSTEM32>\edlin.exe
<SYSTEM32>\driverquery.exe
<SYSTEM32>\dpvsetup.exe
<SYSTEM32>\dpnsvr.exe
<SYSTEM32>\drwatson.exe
<SYSTEM32>\dvdplay.exe
<SYSTEM32>\dumprep.exe
<SYSTEM32>\drwtsn32.exe
<SYSTEM32>\dllcache\wpnpinst.exe
<SYSTEM32>\dllcache\wiaacmgr.exe
<SYSTEM32>\dllcache\wextract.exe
<SYSTEM32>\dllcache\wbemtest.exe
<SYSTEM32>\dllcache\winchat.exe
<SYSTEM32>\dllcache\winhstb.exe
<SYSTEM32>\dllcache\winhlp32.exe
<SYSTEM32>\dllcache\winhelp.exe
<SYSTEM32>\dllcache\vwipxspx.exe
<SYSTEM32>\dllcache\vssvc.exe
<SYSTEM32>\dllcache\vssadmin.exe
<SYSTEM32>\dllcache\w32tm.exe
<SYSTEM32>\dllcache\wb32.exe
<SYSTEM32>\dllcache\wabmig.exe
<SYSTEM32>\dllcache\wab.exe
<SYSTEM32>\dllcache\winlogon.exe
<SYSTEM32>\dllcache\wmplayer.exe
<SYSTEM32>\dllcache\wmiprvse.exe
<SYSTEM32>\dllcache\wmic.exe
<SYSTEM32>\dllcache\wordpad.exe
<SYSTEM32>\dllcache\wpabaln.exe
<SYSTEM32>\dllcache\wowexec.exe
<SYSTEM32>\dllcache\wowdeb.exe
<SYSTEM32>\dllcache\winmsd.exe
<SYSTEM32>\dllcache\winmine.exe
<SYSTEM32>\dllcache\winmgmt.exe
<SYSTEM32>\dllcache\winspool.exe
<SYSTEM32>\dllcache\wmiapsrv.exe
<SYSTEM32>\dllcache\wmiadap.exe
<SYSTEM32>\dllcache\winver.exe
<SYSTEM32>\label.exe
<SYSTEM32>\krnl386.exe
<SYSTEM32>\kb16.com
<SYSTEM32>\lights.exe
<SYSTEM32>\locator.exe
<SYSTEM32>\loadfix.com
<SYSTEM32>\lnkstub.exe
<SYSTEM32>\imapi.exe
<SYSTEM32>\iexpress.exe
<SYSTEM32>\ie4uinit.exe
<SYSTEM32>\ipconfig.exe
<SYSTEM32>\ipxroute.exe
<SYSTEM32>\ipv6.exe
<SYSTEM32>\ipsec6.exe
<SYSTEM32>\lodctr.exe
<SYSTEM32>\makecab.exe
<SYSTEM32>\magnify.exe
<SYSTEM32>\lsass.exe
<SYSTEM32>\mem.exe
<SYSTEM32>\mnmsrvc.exe
<SYSTEM32>\mmc.exe
<SYSTEM32>\migpwd.exe
<SYSTEM32>\logoff.exe
<SYSTEM32>\logman.exe
<SYSTEM32>\logagent.exe
<SYSTEM32>\logon.scr
<SYSTEM32>\lpr.exe
<SYSTEM32>\lpq.exe
<SYSTEM32>\logonui.exe
<SYSTEM32>\icardagt.exe
<SYSTEM32>\findstr.exe
<SYSTEM32>\find.exe
<SYSTEM32>\fc.exe
<SYSTEM32>\finger.exe
<SYSTEM32>\fontview.exe
<SYSTEM32>\fltMc.exe
<SYSTEM32>\fixmapi.exe
<SYSTEM32>\eventvwr.exe
<SYSTEM32>\eventtriggers.exe
<SYSTEM32>\eventcreate.exe
<SYSTEM32>\exe2bin.exe
<SYSTEM32>\fastopen.exe
<SYSTEM32>\extrac32.exe
<SYSTEM32>\expand.exe
<SYSTEM32>\forcedos.exe
<SYSTEM32>\graftabl.com
<SYSTEM32>\gpupdate.exe
<SYSTEM32>\gpresult.exe
<SYSTEM32>\graphics.com
<SYSTEM32>\hostname.exe
<SYSTEM32>\help.exe
<SYSTEM32>\grpconv.exe
<SYSTEM32>\fsquirt.exe
<SYSTEM32>\freecell.exe
<SYSTEM32>\format.com
<SYSTEM32>\fsutil.exe
<SYSTEM32>\getmac.exe
<SYSTEM32>\gdi.exe
<SYSTEM32>\ftp.exe
<SYSTEM32>\dllcache\verifier.exe
<SYSTEM32>\dllcache\share.exe
<SYSTEM32>\dllcache\shadow.exe
<SYSTEM32>\dllcache\sfc.exe
<SYSTEM32>\dllcache\shmgrate.exe
<SYSTEM32>\dllcache\shutdown.exe
<SYSTEM32>\dllcache\shtml.exe
<SYSTEM32>\dllcache\shrpubw.exe
<SYSTEM32>\dllcache\sessmgr.exe
<SYSTEM32>\dllcache\services.exe
<SYSTEM32>\dllcache\secedit.exe
<SYSTEM32>\dllcache\sethc.exe
<SYSTEM32>\dllcache\setup_wm.exe
<SYSTEM32>\dllcache\setup50.exe
<SYSTEM32>\dllcache\setup.exe
<SYSTEM32>\dllcache\shvlzm.exe
<SYSTEM32>\dllcache\snmptrap.exe
<SYSTEM32>\dllcache\snmp.exe
<SYSTEM32>\dllcache\sndvol32.exe
<SYSTEM32>\dllcache\sol.exe
<SYSTEM32>\dllcache\spiisupd.exe
<SYSTEM32>\dllcache\spider.exe
<SYSTEM32>\dllcache\sort.exe
<SYSTEM32>\dllcache\smbinst.exe
<SYSTEM32>\dllcache\skeys.exe
<SYSTEM32>\dllcache\sigverif.exe
<SYSTEM32>\dllcache\smi2smir.exe
<SYSTEM32>\dllcache\sndrec32.exe
<SYSTEM32>\dllcache\smss.exe
<SYSTEM32>\dllcache\smlogsvc.exe
<SYSTEM32>\dllcache\sdbinst.exe
<SYSTEM32>\dllcache\rsm.exe
<SYSTEM32>\dllcache\rsh.exe
<SYSTEM32>\dllcache\routemon.exe
<SYSTEM32>\dllcache\rsmsink.exe
<SYSTEM32>\dllcache\rsopprov.exe
<SYSTEM32>\dllcache\rsnotify.exe
<SYSTEM32>\dllcache\rsmui.exe
<SYSTEM32>\dllcache\relog.exe
<SYSTEM32>\dllcache\regwiz.exe
<SYSTEM32>\dllcache\regsvr32.exe
<SYSTEM32>\dllcache\replace.exe
<SYSTEM32>\dllcache\route.exe
<SYSTEM32>\dllcache\rexec.exe
<SYSTEM32>\dllcache\reset.exe
<SYSTEM32>\dllcache\rstrui.exe
<SYSTEM32>\dllcache\sc.exe
<SYSTEM32>\dllcache\savedump.exe
<SYSTEM32>\dllcache\sapisvr.exe
<SYSTEM32>\dllcache\scardsvr.exe
<SYSTEM32>\dllcache\sctasks.exe
<SYSTEM32>\dllcache\scrnsave.scr
<SYSTEM32>\dllcache\scrcons.exe
<SYSTEM32>\dllcache\runas.exe
<SYSTEM32>\dllcache\rtcshare.exe
<SYSTEM32>\dllcache\rsvp.exe
<SYSTEM32>\dllcache\rundll32.exe
<SYSTEM32>\dllcache\rwinsta.exe
<SYSTEM32>\dllcache\rvsezm.exe
<SYSTEM32>\dllcache\runonce.exe
<SYSTEM32>\dllcache\tracert.exe
<SYSTEM32>\dllcache\tracerpt.exe
<SYSTEM32>\dllcache\tourW.exe
<SYSTEM32>\dllcache\tracert6.exe
<SYSTEM32>\dllcache\tsdiscon.exe
<SYSTEM32>\dllcache\tscupgrd.exe
<SYSTEM32>\dllcache\tscon.exe
<SYSTEM32>\dllcache\tintsetp.exe
<SYSTEM32>\dllcache\tintlphr.exe
<SYSTEM32>\dllcache\tftp.exe
<SYSTEM32>\dllcache\tlntadmn.exe
<SYSTEM32>\dllcache\tourstrt.exe
<SYSTEM32>\dllcache\tlntsvr.exe
<SYSTEM32>\dllcache\tlntsess.exe
<SYSTEM32>\dllcache\tskill.exe
<SYSTEM32>\dllcache\upnpcont.exe
<SYSTEM32>\dllcache\uploadm.exe
<SYSTEM32>\dllcache\unsecapp.exe
<SYSTEM32>\dllcache\ups.exe
<SYSTEM32>\dllcache\utilman.exe
<SYSTEM32>\dllcache\userinit.exe
<SYSTEM32>\dllcache\user.exe
<SYSTEM32>\dllcache\twunk_16.exe
<SYSTEM32>\dllcache\tsshutdn.exe
<SYSTEM32>\dllcache\tsprof.exe
<SYSTEM32>\dllcache\twunk_32.exe
<SYSTEM32>\dllcache\unregmp2.exe
<SYSTEM32>\dllcache\unlodctr.exe
<SYSTEM32>\dllcache\typeperf.exe
<SYSTEM32>\dllcache\telnet.exe
<SYSTEM32>\dllcache\ssmyst.scr
<SYSTEM32>\dllcache\ssmypics.scr
<SYSTEM32>\dllcache\ssmarque.scr
<SYSTEM32>\dllcache\sspipes.scr
<SYSTEM32>\dllcache\stimon.exe
<SYSTEM32>\dllcache\sstext3d.scr
<SYSTEM32>\dllcache\ssstars.scr
<SYSTEM32>\dllcache\sprestrt.exe
<SYSTEM32>\dllcache\spoolsv.exe
<SYSTEM32>\dllcache\spnpinst.exe
<SYSTEM32>\dllcache\srdiag.exe
<SYSTEM32>\dllcache\ssflwbox.scr
<SYSTEM32>\dllcache\ssbezier.scr
<SYSTEM32>\dllcache\ss3dfo.scr
<SYSTEM32>\dllcache\subst.exe
<SYSTEM32>\dllcache\taskman.exe
<SYSTEM32>\dllcache\tasklist.exe
<SYSTEM32>\dllcache\taskkill.exe
<SYSTEM32>\dllcache\taskmgr.exe
<SYSTEM32>\dllcache\tcptest.exe
<SYSTEM32>\dllcache\tcpsvcs.exe
<SYSTEM32>\dllcache\tcmsetup.exe
<SYSTEM32>\dllcache\sysedit.exe
<SYSTEM32>\dllcache\syncapp.exe
<SYSTEM32>\dllcache\svchost.exe
<SYSTEM32>\dllcache\sysinfo.exe
<SYSTEM32>\dllcache\systray.exe
<SYSTEM32>\dllcache\sysocmgr.exe
<SYSTEM32>\dllcache\syskey.exe
<SYSTEM32>\mobsync.exe
<SYSTEM32>\tlntsess.exe
<SYSTEM32>\tlntadmn.exe
<SYSTEM32>\tftp.exe
<SYSTEM32>\tlntsvr.exe
<SYSTEM32>\tracert.exe
<SYSTEM32>\tracerpt.exe
<SYSTEM32>\tourstart.exe
<SYSTEM32>\taskman.exe
<SYSTEM32>\tasklist.exe
<SYSTEM32>\taskkill.exe
<SYSTEM32>\taskmgr.exe
<SYSTEM32>\telnet.exe
<SYSTEM32>\tcpsvcs.exe
<SYSTEM32>\tcmsetup.exe
<SYSTEM32>\tracert6.exe
<SYSTEM32>\upnpcont.exe
<SYSTEM32>\unlodctr.exe
<SYSTEM32>\typeperf.exe
<SYSTEM32>\ups.exe
<SYSTEM32>\userinit.exe
<SYSTEM32>\user.exe
<SYSTEM32>\URTTEMP\regtlib.exe
<SYSTEM32>\tscupgrd.exe
<SYSTEM32>\tscon.exe
<SYSTEM32>\tree.com
<SYSTEM32>\tsdiscon.exe
<SYSTEM32>\TsWpfWrp.exe
<SYSTEM32>\tsshutdn.exe
<SYSTEM32>\tskill.exe
<SYSTEM32>\systray.exe
<SYSTEM32>\spoolsv.exe
<SYSTEM32>\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
<SYSTEM32>\spnpinst.exe
<SYSTEM32>\sprestrt.exe
<SYSTEM32>\ssbezier.scr
<SYSTEM32>\ss3dfo.scr
<SYSTEM32>\spupdsvc.exe
<SYSTEM32>\sndvol32.exe
<SYSTEM32>\sndrec32.exe
<SYSTEM32>\smss.exe
<SYSTEM32>\sol.exe
<SYSTEM32>\spiisupd.exe
<SYSTEM32>\spider.exe
<SYSTEM32>\sort.exe
<SYSTEM32>\ssflwbox.scr
<SYSTEM32>\syncapp.exe
<SYSTEM32>\svchost.exe
<SYSTEM32>\subst.exe
<SYSTEM32>\sysedit.exe
<SYSTEM32>\systeminfo.exe
<SYSTEM32>\sysocmgr.exe
<SYSTEM32>\syskey.exe
<SYSTEM32>\ssmyst.scr
<SYSTEM32>\ssmypics.scr
<SYSTEM32>\ssmarque.scr
<SYSTEM32>\sspipes.scr
<SYSTEM32>\stimon.exe
<SYSTEM32>\sstext3d.scr
<SYSTEM32>\ssstars.scr
<SYSTEM32>\wuauclt1.exe
<SYSTEM32>\wuauclt.exe
<SYSTEM32>\wscript.exe
<SYSTEM32>\wupdmgr.exe
%WINDIR%\TASKMAN.EXE
<SYSTEM32>\XPSViewer\XPSViewer.exe
<SYSTEM32>\xcopy.exe
<SYSTEM32>\wowexec.exe
<SYSTEM32>\wowdeb.exe
<SYSTEM32>\winver.exe
<SYSTEM32>\wpabaln.exe
<SYSTEM32>\wscntfy.exe
<SYSTEM32>\write.exe
<SYSTEM32>\wpnpinst.exe
%WINDIR%\twunk_16.exe
<SYSTEM32>\SET9.tmp
<SYSTEM32>\SET5.tmp
<SYSTEM32>\SET1.tmp
<SYSTEM32>\SETD.tmp
<SYSTEM32>\SET19.tmp
<SYSTEM32>\SET15.tmp
<SYSTEM32>\SET11.tmp
%WINDIR%\winhlp32.exe
%WINDIR%\winhelp.exe
%WINDIR%\twunk_32.exe
<Auxiliary element>
%CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe
<Drive name for removable media>:\Autorun.exe
<SYSTEM32>\winspool.exe
<SYSTEM32>\vssvc.exe
<SYSTEM32>\vssadmin.exe
<SYSTEM32>\verifier.exe
<SYSTEM32>\vwipxspx.exe
<SYSTEM32>\wbem\scrcons.exe
<SYSTEM32>\wbem\mofcomp.exe
<SYSTEM32>\w32tm.exe
<SYSTEM32>\usmt\migwiz_a.exe
<SYSTEM32>\usmt\migwiz.exe
<SYSTEM32>\usmt\migload.exe
<SYSTEM32>\usrmlnka.exe
<SYSTEM32>\utilman.exe
<SYSTEM32>\usrshuta.exe
<SYSTEM32>\usrprbda.exe
<SYSTEM32>\wbem\unsecapp.exe
<SYSTEM32>\winchat.exe
<SYSTEM32>\win.com
<SYSTEM32>\wiaacmgr.exe
<SYSTEM32>\winhlp32.exe
<SYSTEM32>\winmsd.exe
<SYSTEM32>\winmine.exe
<SYSTEM32>\winlogon.exe
<SYSTEM32>\wbem\wmiadap.exe
<SYSTEM32>\wbem\winmgmt.exe
<SYSTEM32>\wbem\wbemtest.exe
<SYSTEM32>\wbem\wmiapsrv.exe
<SYSTEM32>\wextract.exe
<SYSTEM32>\wbem\wmiprvse.exe
<SYSTEM32>\wbem\wmic.exe
<SYSTEM32>\smlogsvc.exe
<SYSTEM32>\nwscript.exe
<SYSTEM32>\nw16.exe
<SYSTEM32>\ntvdm.exe
<SYSTEM32>\odbcad32.exe
<SYSTEM32>\oobe\oobebaln.exe
<SYSTEM32>\oobe\msoobe.exe
<SYSTEM32>\odbcconf.exe
<SYSTEM32>\nslookup.exe
<SYSTEM32>\npp\nppagent.exe
<SYSTEM32>\notepad.exe
<SYSTEM32>\ntbackup.exe
<SYSTEM32>\ntsd.exe
<SYSTEM32>\ntoskrnl.exe
<SYSTEM32>\ntkrnlpa.exe
<SYSTEM32>\openfiles.exe
<SYSTEM32>\PresentationHost.exe
<SYSTEM32>\powercfg.exe
<SYSTEM32>\ping6.exe
<SYSTEM32>\print.exe
<SYSTEM32>\proxycfg.exe
<SYSTEM32>\proquota.exe
<SYSTEM32>\progman.exe
<SYSTEM32>\packager.exe
<SYSTEM32>\osuninst.exe
<SYSTEM32>\osk.exe
<SYSTEM32>\pathping.exe
<SYSTEM32>\ping.exe
<SYSTEM32>\perfmon.exe
<SYSTEM32>\pentnt.exe
<SYSTEM32>\nlsfunc.exe
<SYSTEM32>\mscdexnt.exe
<SYSTEM32>\mrinfo.exe
<SYSTEM32>\mqtgsvc.exe
<SYSTEM32>\MsDtc\Trace\msdtcvtr.bat
<SYSTEM32>\mshearts.exe
<SYSTEM32>\msg.exe
<SYSTEM32>\msdtc.exe
<SYSTEM32>\mountvol.exe
<SYSTEM32>\more.com
<SYSTEM32>\mode.com
<SYSTEM32>\mplay32.exe
<SYSTEM32>\mqsvc.exe
<SYSTEM32>\mqbkup.exe
<SYSTEM32>\mpnotify.exe
<SYSTEM32>\mshta.exe
<SYSTEM32>\net1.exe
<SYSTEM32>\net.exe
<SYSTEM32>\nddeapir.exe
<SYSTEM32>\netdde.exe
<SYSTEM32>\netstat.exe
<SYSTEM32>\netsh.exe
<SYSTEM32>\netsetup.exe
<SYSTEM32>\msswchx.exe
<SYSTEM32>\mspaint.exe
<SYSTEM32>\msiexec.exe
<SYSTEM32>\mstinit.exe
<SYSTEM32>\nbtstat.exe
<SYSTEM32>\narrator.exe
<SYSTEM32>\mstsc.exe
<SYSTEM32>\sc.exe
<SYSTEM32>\savedump.exe
<SYSTEM32>\rwinsta.exe
<SYSTEM32>\scardsvr.exe
<SYSTEM32>\sdbinst.exe
<SYSTEM32>\scrnsave.scr
<SYSTEM32>\schtasks.exe
<SYSTEM32>\rsvp.exe
<SYSTEM32>\rsopprov.exe
<SYSTEM32>\rsnotify.exe
<SYSTEM32>\rtcshare.exe
<SYSTEM32>\runonce.exe
<SYSTEM32>\rundll32.exe
<SYSTEM32>\runas.exe
<SYSTEM32>\secedit.exe
<SYSTEM32>\shrpubw.exe
<SYSTEM32>\shmgrate.exe
<SYSTEM32>\share.exe
<SYSTEM32>\shutdown.exe
<SYSTEM32>\smbinst.exe
<SYSTEM32>\skeys.exe
<SYSTEM32>\sigverif.exe
<SYSTEM32>\sethc.exe
<SYSTEM32>\sessmgr.exe
<SYSTEM32>\services.exe
<SYSTEM32>\setup.exe
<SYSTEM32>\shadow.exe
<SYSTEM32>\sfc.exe
<SYSTEM32>\setver.exe
<SYSTEM32>\rsmui.exe
<SYSTEM32>\rdsaddin.exe
<SYSTEM32>\rdpclip.exe
<SYSTEM32>\rcp.exe
<SYSTEM32>\rdshost.exe
<SYSTEM32>\reg.exe
<SYSTEM32>\redir.exe
<SYSTEM32>\recover.exe
<SYSTEM32>\qwinsta.exe
<SYSTEM32>\qprocess.exe
<SYSTEM32>\qappsrv.exe
<SYSTEM32>\rasautou.exe
<SYSTEM32>\rcimlby.exe
<SYSTEM32>\rasphone.exe
<SYSTEM32>\rasdial.exe
<SYSTEM32>\regedt32.exe
<SYSTEM32>\route.exe
<SYSTEM32>\rexec.exe
<SYSTEM32>\Restore\srdiag.exe
<SYSTEM32>\routemon.exe
<SYSTEM32>\rsmsink.exe
<SYSTEM32>\rsm.exe
<SYSTEM32>\rsh.exe
<SYSTEM32>\regwiz.exe
<SYSTEM32>\regsvr32.exe
<SYSTEM32>\regini.exe
<SYSTEM32>\relog.exe
<SYSTEM32>\Restore\rstrui.exe
<SYSTEM32>\reset.exe
<SYSTEM32>\replace.exe
<SYSTEM32>\chkntfs.exe
<SYSTEM32>\chkdsk.exe
<SYSTEM32>\chcp.com
<SYSTEM32>\cidaemon.exe
<SYSTEM32>\ckcnv.exe
<SYSTEM32>\cisvc.exe
<SYSTEM32>\cipher.exe
<SYSTEM32>\bootok.exe
<SYSTEM32>\bootcfg.exe
<SYSTEM32>\blastcln.exe
<SYSTEM32>\bootvrfy.exe
<SYSTEM32>\charmap.exe
<SYSTEM32>\calc.exe
<SYSTEM32>\cacls.exe
<SYSTEM32>\cleanmgr.exe
<SYSTEM32>\command.com
<SYSTEM32>\Com\comrereg.exe
<SYSTEM32>\Com\comrepl.exe
<SYSTEM32>\comp.exe
<SYSTEM32>\control.exe
<SYSTEM32>\conime.exe
<SYSTEM32>\compact.exe
<SYSTEM32>\clipsrv.exe
<SYSTEM32>\clipbrd.exe
<SYSTEM32>\cliconfg.exe
<SYSTEM32>\cmd.exe
<SYSTEM32>\cmstp.exe
<SYSTEM32>\cmmon32.exe
<SYSTEM32>\cmdl32.exe
<SYSTEM32>\autolfn.exe
%WINDIR%\pchealth\UploadLB\Binaries\UploadM.exe
%WINDIR%\pchealth\helpctr\binaries\notiflag.exe
%WINDIR%\pchealth\helpctr\binaries\msconfig.exe
%WINDIR%\regedit.exe
<SYSTEM32>\accwiz.exe
%WINDIR%\sleep.exe
%WINDIR%\sfk.exe
%WINDIR%\ocx\_reg_all.bat
%WINDIR%\NOTEPAD.EXE
%WINDIR%\mui\muisetup.exe
%WINDIR%\pchealth\helpctr\binaries\HelpCtr.exe
%WINDIR%\pchealth\helpctr\binaries\HscUpd.exe
%WINDIR%\pchealth\helpctr\binaries\HelpSvc.exe
%WINDIR%\pchealth\helpctr\binaries\HelpHost.exe
<SYSTEM32>\actmovie.exe
<SYSTEM32>\attrib.exe
<SYSTEM32>\atmadm.exe
<SYSTEM32>\at.exe
<SYSTEM32>\auditusr.exe
<SYSTEM32>\autofmt.exe
<SYSTEM32>\autoconv.exe
<SYSTEM32>\autochk.exe
<SYSTEM32>\append.exe
<SYSTEM32>\alg.exe
<SYSTEM32>\ahui.exe
<SYSTEM32>\arp.exe
<SYSTEM32>\asr_pfu.exe
<SYSTEM32>\asr_ldm.exe
<SYSTEM32>\asr_fmt.exe
<SYSTEM32>\dllcache\cacls.exe
<SYSTEM32>\dllcache\bootvrfy.exe
<SYSTEM32>\dllcache\bootok.exe
<SYSTEM32>\dllcache\calc.exe
<SYSTEM32>\dllcache\change.exe
<SYSTEM32>\dllcache\cfgwiz.exe
<SYSTEM32>\dllcache\cb32.exe
<SYSTEM32>\dllcache\autofmt.exe
<SYSTEM32>\dllcache\autoconv.exe
<SYSTEM32>\dllcache\autochk.exe
<SYSTEM32>\dllcache\autolfn.exe
<SYSTEM32>\dllcache\bootcfg.exe
<SYSTEM32>\dllcache\blastcln.exe
<SYSTEM32>\dllcache\bckgzm.exe
<SYSTEM32>\dllcache\charmap.exe
<SYSTEM32>\dllcache\cisvc.exe
<SYSTEM32>\dllcache\cipher.exe
<SYSTEM32>\dllcache\cintsetp.exe
<SYSTEM32>\dllcache\ckcnv.exe
<SYSTEM32>\dllcache\clipsrv.exe
<SYSTEM32>\dllcache\clipbrd.exe
<SYSTEM32>\dllcache\cleanmgr.exe
<SYSTEM32>\dllcache\chgusr.exe
<SYSTEM32>\dllcache\chgport.exe
<SYSTEM32>\dllcache\chglogon.exe
<SYSTEM32>\dllcache\chkdsk.exe
<SYSTEM32>\dllcache\cidaemon.exe
<SYSTEM32>\dllcache\chkrzm.exe
<SYSTEM32>\dllcache\chkntfs.exe
<SYSTEM32>\dllcache\author.exe
<SYSTEM32>\diantz.exe
<SYSTEM32>\dfrgntfs.exe
<SYSTEM32>\dfrgfat.exe
<SYSTEM32>\diskcomp.com
<SYSTEM32>\diskperf.exe
<SYSTEM32>\diskpart.exe
<SYSTEM32>\diskcopy.com
<SYSTEM32>\ctfmon.exe
<SYSTEM32>\csrss.exe
<SYSTEM32>\convert.exe
<SYSTEM32>\dcomcnfg.exe
<SYSTEM32>\defrag.exe
<SYSTEM32>\debug.exe
<SYSTEM32>\ddeshare.exe
<SYSTEM32>\dllcache\accwiz.exe
<SYSTEM32>\dllcache\asr_pfu.exe
<SYSTEM32>\dllcache\asr_ldm.exe
<SYSTEM32>\dllcache\asr_fmt.exe
<SYSTEM32>\dllcache\at.exe
<SYSTEM32>\dllcache\auditusr.exe
<SYSTEM32>\dllcache\attrib.exe
<SYSTEM32>\dllcache\atmadm.exe
<SYSTEM32>\dllcache\agentsvr.exe
<SYSTEM32>\dllcache\admin.exe
<SYSTEM32>\dllcache\actmovie.exe
<SYSTEM32>\dllcache\ahui.exe
<SYSTEM32>\dllcache\arp.exe
<SYSTEM32>\dllcache\append.exe
<SYSTEM32>\dllcache\alg.exe
%WINDIR%\msagent\agentsvr.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\vbc.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegAsm.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\InstallUtil.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ilasm.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\IEExec.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\jsc.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ngen.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPol.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\jsc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\cvtres.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\6781b87c8d3b55e6120b1e86bea6e040\ServiceModelReg.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\9469981a17c01dd154c540127e678b35\PresentationFontCache.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\MSBuild\87c84ffaaad81d8d106a9aa9d68b5926\MSBuild.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\SMSvcHost\b9c1a29e684bc02e49226ff1e9eec253\SMSvcHost.ni.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\dfsvc\b9b6069e6da06eb57e89cc544397f735\dfsvc.ni.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\51819c709096229ee187a7feee395d9f\ComSvcConfig.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\WsatConfig\7d2a3adbdcb675f872eb2dbf21f73596\WsatConfig.ni.exe
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.exe
%WINDIR%\$NtUninstallKB942288-v3$\msiexec.exe
C:\Autorun.exe
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\dfsvc\a2865dcec9c5d3cc9c55f026cbad6fcc\dfsvc.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\19b50dd470540911fc5cc65331a769e4\ComSvcConfig.ni.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
%WINDIR%\explorer.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe
%WINDIR%\Microsoft.NET\Framework\NETFXSBS10.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\csc.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\CasPol.exe
%WINDIR%\inf\unregmp2.exe
%WINDIR%\hh.exe
%WINDIR%\Help\Tours\mmTour\tour.exe
%WINDIR%\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\PresentationHost_X86.exe
%WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\Microsoft.Workflow.Compiler.exe
%WINDIR%\Installer\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}\places.exe
%WINDIR%\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\XPSViewer_X86.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\jsc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SetupUtility.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Setup.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\vbc.exe
%WINDIR%\Microsoft.NET\NETFXRepair.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SetupUtility.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\PerformanceCounterInstaller.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\AddInUtil.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess32.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\csc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\DeleteTemp.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\EdmGen.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\WFServicesReg.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\vbc.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\MSBuild.exe
<SYSTEM32>\dllcache\cmd.exe
<SYSTEM32>\dllcache\mqtgsvc.exe
<SYSTEM32>\dllcache\mqsvc.exe
<SYSTEM32>\dllcache\mqbkup.exe
<SYSTEM32>\dllcache\mrinfo.exe
<SYSTEM32>\dllcache\msdtc.exe
<SYSTEM32>\dllcache\msconfig.exe
<SYSTEM32>\dllcache\mscdexnt.exe
<SYSTEM32>\dllcache\mountvol.exe
<SYSTEM32>\dllcache\mofcomp.exe
<SYSTEM32>\dllcache\mobsync.exe
<SYSTEM32>\dllcache\moviemk.exe
<SYSTEM32>\dllcache\mpnotify.exe
<SYSTEM32>\dllcache\mplayer2.exe
<SYSTEM32>\dllcache\mplay32.exe
<SYSTEM32>\dllcache\msg.exe
<SYSTEM32>\dllcache\mstinit.exe
<SYSTEM32>\dllcache\msswchx.exe
<SYSTEM32>\dllcache\mspaint.exe
<SYSTEM32>\dllcache\mstsc.exe
<SYSTEM32>\dllcache\narrator.exe
<SYSTEM32>\dllcache\muisetup.exe
<SYSTEM32>\dllcache\mtstocom.exe
<SYSTEM32>\dllcache\msiexec.exe
<SYSTEM32>\dllcache\mshta.exe
<SYSTEM32>\dllcache\mshearts.exe
<SYSTEM32>\dllcache\msimn.exe
<SYSTEM32>\dllcache\msoobe.exe
<SYSTEM32>\dllcache\msiregmv.exe
<SYSTEM32>\dllcache\msinfo32.exe
<SYSTEM32>\dllcache\mnmsrvc.exe
<SYSTEM32>\dllcache\locator.exe
<SYSTEM32>\dllcache\lnkstub.exe
<SYSTEM32>\dllcache\lights.exe
<SYSTEM32>\dllcache\lodctr.exe
<SYSTEM32>\dllcache\logoff.exe
<SYSTEM32>\dllcache\logman.exe
<SYSTEM32>\dllcache\logagent.exe
<SYSTEM32>\dllcache\ipv6.exe
<SYSTEM32>\dllcache\ipsec6.exe
<SYSTEM32>\dllcache\ipconfig.exe
<SYSTEM32>\dllcache\ipxroute.exe
<SYSTEM32>\dllcache\label.exe
<SYSTEM32>\dllcache\krnl386.exe
<SYSTEM32>\dllcache\isignup.exe
<SYSTEM32>\dllcache\logon.scr
<SYSTEM32>\dllcache\migrate.exe
<SYSTEM32>\dllcache\migload.exe
<SYSTEM32>\dllcache\migisol.exe
<SYSTEM32>\dllcache\migregdb.exe
<SYSTEM32>\dllcache\mmc.exe
<SYSTEM32>\dllcache\migwiz_a.exe
<SYSTEM32>\dllcache\migwiz.exe
<SYSTEM32>\dllcache\lpr.exe
<SYSTEM32>\dllcache\lpq.exe
<SYSTEM32>\dllcache\logonui.exe
<SYSTEM32>\dllcache\lsass.exe
<SYSTEM32>\dllcache\mem.exe
<SYSTEM32>\dllcache\makecab.exe
<SYSTEM32>\dllcache\magnify.exe
<SYSTEM32>\dllcache\qappsrv.exe
<SYSTEM32>\dllcache\proxycfg.exe
<SYSTEM32>\dllcache\proquota.exe
<SYSTEM32>\dllcache\qprocess.exe
<SYSTEM32>\dllcache\qwinsta.exe
<SYSTEM32>\dllcache\quser.exe
<SYSTEM32>\dllcache\query.exe
<SYSTEM32>\dllcache\pintlphr.exe
<SYSTEM32>\dllcache\ping6.exe
<SYSTEM32>\dllcache\ping.exe
<SYSTEM32>\dllcache\powercfg.exe
<SYSTEM32>\dllcache\progman.exe
<SYSTEM32>\dllcache\printfilterpipelinesvc.exe
<SYSTEM32>\dllcache\print.exe
<SYSTEM32>\dllcache\rasautou.exe
<SYSTEM32>\dllcache\reg.exe
<SYSTEM32>\dllcache\redir.exe
<SYSTEM32>\dllcache\recover.exe
<SYSTEM32>\dllcache\regedit.exe
<SYSTEM32>\dllcache\register.exe
<SYSTEM32>\dllcache\regini.exe
<SYSTEM32>\dllcache\regedt32.exe
<SYSTEM32>\dllcache\rcimlby.exe
<SYSTEM32>\dllcache\rasphone.exe
<SYSTEM32>\dllcache\rasdial.exe
<SYSTEM32>\dllcache\rcp.exe
<SYSTEM32>\dllcache\rdshost.exe
<SYSTEM32>\dllcache\rdsaddin.exe
<SYSTEM32>\dllcache\rdpclip.exe
<SYSTEM32>\dllcache\pinball.exe
<SYSTEM32>\dllcache\notepad.exe
<SYSTEM32>\dllcache\nlsfunc.exe
<SYSTEM32>\dllcache\netstat.exe
<SYSTEM32>\dllcache\notiflag.exe
<SYSTEM32>\dllcache\ntbackup.exe
<SYSTEM32>\dllcache\nslookup.exe
<SYSTEM32>\dllcache\nppagent.exe
<SYSTEM32>\dllcache\net.exe
<SYSTEM32>\dllcache\nddeapir.exe
<SYSTEM32>\dllcache\nbtstat.exe
<SYSTEM32>\dllcache\net1.exe
<SYSTEM32>\dllcache\netsh.exe
<SYSTEM32>\dllcache\netsetup.exe
<SYSTEM32>\dllcache\netdde.exe
<SYSTEM32>\dllcache\ntsd.exe
<SYSTEM32>\dllcache\osuninst.exe
<SYSTEM32>\dllcache\osk.exe
<SYSTEM32>\dllcache\opnfiles.exe
<SYSTEM32>\dllcache\packager.exe
<SYSTEM32>\dllcache\perfmon.exe
<SYSTEM32>\dllcache\pentnt.exe
<SYSTEM32>\dllcache\pathping.exe
<SYSTEM32>\dllcache\nwscript.exe
<SYSTEM32>\dllcache\nw16.exe
<SYSTEM32>\dllcache\ntvdm.exe
<SYSTEM32>\dllcache\odbcad32.exe
<SYSTEM32>\dllcache\oobebaln.exe
<SYSTEM32>\dllcache\oemig50.exe
<SYSTEM32>\dllcache\odbcconf.exe
<SYSTEM32>\dllcache\inetwiz.exe
<SYSTEM32>\dllcache\drwtsn32.exe
<SYSTEM32>\dllcache\drwatson.exe
<SYSTEM32>\dllcache\drvqry.exe
<SYSTEM32>\dllcache\dumprep.exe
<SYSTEM32>\dllcache\dxdiag.exe
<SYSTEM32>\dllcache\dwwin.exe
<SYSTEM32>\dllcache\dvdupgrd.exe
<SYSTEM32>\dllcache\doskey.exe
<SYSTEM32>\dllcache\dmremote.exe
<SYSTEM32>\dllcache\dmadmin.exe
<SYSTEM32>\dllcache\dosx.exe
<SYSTEM32>\dllcache\dpvsetup.exe
<SYSTEM32>\dllcache\dpnsvr.exe
<SYSTEM32>\dllcache\dplaysvr.exe
<SYSTEM32>\dllcache\edlin.exe
<SYSTEM32>\dllcache\expand.exe
<SYSTEM32>\dllcache\exe2bin.exe
<SYSTEM32>\dllcache\EXCH_regtrace.exe
<SYSTEM32>\dllcache\explorer.exe
<SYSTEM32>\dllcache\fc.exe
<SYSTEM32>\dllcache\fastopen.exe
<SYSTEM32>\dllcache\extrac32.exe
<SYSTEM32>\dllcache\evcreate.exe
<SYSTEM32>\dllcache\eudcedit.exe
<SYSTEM32>\dllcache\esentutl.exe
<SYSTEM32>\dllcache\eventvwr.exe
<SYSTEM32>\dllcache\evtrig.exe
<SYSTEM32>\dllcache\evntwin.exe
<SYSTEM32>\dllcache\evntcmd.exe
<SYSTEM32>\dllcache\dllhst3g.exe
<SYSTEM32>\dllcache\control.exe
<SYSTEM32>\dllcache\conime.exe
<SYSTEM32>\dllcache\conf.exe
<SYSTEM32>\dllcache\convert.exe
<SYSTEM32>\dllcache\cprofile.exe
<SYSTEM32>\dllcache\cplexe.exe
<SYSTEM32>\dllcache\convlog.exe
<SYSTEM32>\dllcache\cmstp.exe
<SYSTEM32>\dllcache\cmmon32.exe
<SYSTEM32>\dllcache\cmdl32.exe
<SYSTEM32>\dllcache\comp.exe
<SYSTEM32>\dllcache\comrereg.exe
<SYSTEM32>\dllcache\comrepl.exe
<SYSTEM32>\dllcache\compact.exe
<SYSTEM32>\dllcache\cscript.exe
<SYSTEM32>\dllcache\dialer.exe
<SYSTEM32>\dllcache\dfrgntfs.exe
<SYSTEM32>\dllcache\dfrgfat.exe
<SYSTEM32>\dllcache\diantz.exe
<SYSTEM32>\dllcache\dllhost.exe
<SYSTEM32>\dllcache\diskperf.exe
<SYSTEM32>\dllcache\diskpart.exe
<SYSTEM32>\dllcache\davcdata.exe
<SYSTEM32>\dllcache\ctfmon.exe
<SYSTEM32>\dllcache\csrss.exe
<SYSTEM32>\dllcache\dcomcnfg.exe
<SYSTEM32>\dllcache\defrag.exe
<SYSTEM32>\dllcache\debug.exe
<SYSTEM32>\dllcache\ddeshare.exe
<SYSTEM32>\dllcache\iexplore.exe
<SYSTEM32>\dllcache\iedw.exe
<SYSTEM32>\dllcache\ie4uinit.exe
<SYSTEM32>\dllcache\iexpress.exe
<SYSTEM32>\dllcache\iissync.exe
<SYSTEM32>\dllcache\iisrstas.exe
<SYSTEM32>\dllcache\iisreset.exe
<SYSTEM32>\dllcache\hscupd.exe
<SYSTEM32>\dllcache\hrtzzm.exe
<SYSTEM32>\dllcache\hostname.exe
<SYSTEM32>\dllcache\icwconn1.exe
<SYSTEM32>\dllcache\icwtutor.exe
<SYSTEM32>\dllcache\icwrmind.exe
<SYSTEM32>\dllcache\icwconn2.exe
<SYSTEM32>\dllcache\imapi.exe
<SYSTEM32>\dllcache\imjputy.exe
<SYSTEM32>\dllcache\imjpuex.exe
<SYSTEM32>\dllcache\imjprw.exe
<SYSTEM32>\dllcache\imkrinst.exe
<SYSTEM32>\dllcache\inetmgr.exe
<SYSTEM32>\dllcache\inetin51.exe
<SYSTEM32>\dllcache\imscinst.exe
<SYSTEM32>\dllcache\imjpdadm.exe
<SYSTEM32>\dllcache\imepadsv.exe
<SYSTEM32>\dllcache\imekrmig.exe
<SYSTEM32>\dllcache\imjpdct.exe
<SYSTEM32>\dllcache\imjpmig.exe
<SYSTEM32>\dllcache\imjpinst.exe
<SYSTEM32>\dllcache\imjpdsvr.exe
<SYSTEM32>\dllcache\hh.exe
<SYSTEM32>\dllcache\fp98swin.exe
<SYSTEM32>\dllcache\fp98sadm.exe
<SYSTEM32>\dllcache\forcedos.exe
<SYSTEM32>\dllcache\fpadmcgi.exe
<SYSTEM32>\dllcache\freecell.exe
<SYSTEM32>\dllcache\fpremadm.exe
<SYSTEM32>\dllcache\fpcount.exe
<SYSTEM32>\dllcache\finger.exe
<SYSTEM32>\dllcache\findstr.exe
<SYSTEM32>\dllcache\find.exe
<SYSTEM32>\dllcache\fixmapi.exe
<SYSTEM32>\dllcache\fontview.exe
<SYSTEM32>\dllcache\fltmc.exe
<SYSTEM32>\dllcache\flattemp.exe
<SYSTEM32>\dllcache\fsutil.exe
<SYSTEM32>\dllcache\grpconv.exe
<SYSTEM32>\dllcache\gpupdate.exe
<SYSTEM32>\dllcache\gprslt.exe
<SYSTEM32>\dllcache\help.exe
<SYSTEM32>\dllcache\helpsvc.exe
<SYSTEM32>\dllcache\helphost.exe
<SYSTEM32>\dllcache\helpctr.exe
<SYSTEM32>\dllcache\fxscover.exe
<SYSTEM32>\dllcache\fxsclnt.exe
<SYSTEM32>\dllcache\ftp.exe
<SYSTEM32>\dllcache\fxssend.exe
<SYSTEM32>\dllcache\getmac.exe
<SYSTEM32>\dllcache\gdi.exe
<SYSTEM32>\dllcache\fxssvc.exe

Moves the following files:

from <SYSTEM32>\dllcache\mplayer2.exe.new to <SYSTEM32>\dllcache\mplayer2.exe
from <SYSTEM32>\dllcache\setup_wm.exe.new to <SYSTEM32>\dllcache\setup_wm.exe
from <SYSTEM32>\dllcache\migrate.exe.new to <SYSTEM32>\dllcache\migrate.exe
from <SYSTEM32>\dllcache\wab.exe.new to <SYSTEM32>\dllcache\wab.exe
from <SYSTEM32>\dllcache\wabmig.exe.new to <SYSTEM32>\dllcache\wabmig.exe
from <SYSTEM32>\dllcache\pinball.exe.new to <SYSTEM32>\dllcache\pinball.exe
from <SYSTEM32>\dllcache\notepad.exe.new to <SYSTEM32>\dllcache\notepad.exe
from <SYSTEM32>\dllcache\dialer.exe.new to <SYSTEM32>\dllcache\dialer.exe
from <SYSTEM32>\dllcache\wmplayer.exe.new to <SYSTEM32>\dllcache\wmplayer.exe
from <SYSTEM32>\dllcache\wordpad.exe.new to <SYSTEM32>\dllcache\wordpad.exe
from <SYSTEM32>\dllcache\setup50.exe.new to <SYSTEM32>\dllcache\setup50.exe
from <SYSTEM32>\dllcache\shvlzm.exe.new to <SYSTEM32>\dllcache\shvlzm.exe
from <SYSTEM32>\dllcache\zclientm.exe.new to <SYSTEM32>\dllcache\zclientm.exe
from <SYSTEM32>\dllcache\rvsezm.exe.new to <SYSTEM32>\dllcache\rvsezm.exe
from <SYSTEM32>\dllcache\chkrzm.exe.new to <SYSTEM32>\dllcache\chkrzm.exe
from <SYSTEM32>\dllcache\hrtzzm.exe.new to <SYSTEM32>\dllcache\hrtzzm.exe
from <SYSTEM32>\dllcache\msimn.exe.new to <SYSTEM32>\dllcache\msimn.exe
from <SYSTEM32>\dllcache\oemig50.exe.new to <SYSTEM32>\dllcache\oemig50.exe
from <SYSTEM32>\dllcache\wb32.exe.new to <SYSTEM32>\dllcache\wb32.exe
from <SYSTEM32>\dllcache\cb32.exe.new to <SYSTEM32>\dllcache\cb32.exe
from <SYSTEM32>\dllcache\conf.exe.new to <SYSTEM32>\dllcache\conf.exe
from <SYSTEM32>\dllcache\uploadm.exe.new to <SYSTEM32>\dllcache\uploadm.exe
from <SYSTEM32>\SET1C.tmp to <SYSTEM32>\ntkrnlpa.exe
from <SYSTEM32>\dllcache\usrmlnka.exe.new to <SYSTEM32>\dllcache\usrmlnka.exe
from %WINDIR%\LastGood\TMP1A.tmp to %WINDIR%\LastGood\system32\ntkrnlpa.exe
from %WINDIR%\LastGood\TMP16.tmp to %WINDIR%\LastGood\system32\fsquirt.exe
from <SYSTEM32>\SET18.tmp to <SYSTEM32>\fsquirt.exe
from <SYSTEM32>\dllcache\fsquirt.exe.new to <SYSTEM32>\dllcache\fsquirt.exe
from <SYSTEM32>\dllcache\ntkrpamp.exe.new to <SYSTEM32>\dllcache\ntkrpamp.exe
from <SYSTEM32>\dllcache\ntkrnlmp.exe.new to <SYSTEM32>\dllcache\ntkrnlmp.exe
from <SYSTEM32>\dllcache\usrprbda.exe.new to <SYSTEM32>\dllcache\usrprbda.exe
from <SYSTEM32>\dllcache\usrshuta.exe.new to <SYSTEM32>\dllcache\usrshuta.exe
from <SYSTEM32>\SET14.tmp to <SYSTEM32>\ntoskrnl.exe
from %WINDIR%\LastGood\TMP6.tmp to %WINDIR%\LastGood\system32\usrmlnka.exe
from <SYSTEM32>\SET8.tmp to <SYSTEM32>\usrmlnka.exe
from <SYSTEM32>\dllcache\dvdplay.exe.new to <SYSTEM32>\dllcache\dvdplay.exe
from %WINDIR%\LastGood\TMP2.tmp to %WINDIR%\LastGood\system32\dvdplay.exe
from <SYSTEM32>\SET4.tmp to <SYSTEM32>\dvdplay.exe
from <SYSTEM32>\SET10.tmp to <SYSTEM32>\usrshuta.exe
from %WINDIR%\LastGood\TMP12.tmp to %WINDIR%\LastGood\system32\ntoskrnl.exe
from %WINDIR%\LastGood\TMPE.tmp to %WINDIR%\LastGood\system32\usrshuta.exe
from %WINDIR%\LastGood\TMPA.tmp to %WINDIR%\LastGood\system32\usrprbda.exe
from <SYSTEM32>\SETC.tmp to <SYSTEM32>\usrprbda.exe
from <SYSTEM32>\dllcache\bckgzm.exe.new to <SYSTEM32>\dllcache\bckgzm.exe
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\rvsezm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\rvsezm.exe
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\shvlzm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\shvlzm.exe
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\hrtzzm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\hrtzzm.exe
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\bckgzm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\bckgzm.exe
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\chkrzm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\chkrzm.exe
from %PROGRAM_FILES%\NetMeeting\wb32.exe.new to %PROGRAM_FILES%\NetMeeting\wb32.exe
from %PROGRAM_FILES%\Outlook Express\msimn.exe.new to %PROGRAM_FILES%\Outlook Express\msimn.exe
from %PROGRAM_FILES%\NetMeeting\conf.exe.new to %PROGRAM_FILES%\NetMeeting\conf.exe
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\zclientm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\zclientm.exe
from %PROGRAM_FILES%\NetMeeting\cb32.exe.new to %PROGRAM_FILES%\NetMeeting\cb32.exe
from %PROGRAM_FILES%\Movie Maker\moviemk.exe.new to %PROGRAM_FILES%\Movie Maker\moviemk.exe
from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn2.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn2.exe
from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwrmind.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwrmind.exe
from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn1.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn1.exe
from %CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe.new to %CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe
from %CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe.new to %CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe
from %PROGRAM_FILES%\Internet Explorer\iedw.exe.new to %PROGRAM_FILES%\Internet Explorer\iedw.exe
from %PROGRAM_FILES%\Internet Explorer\iexplore.exe.new to %PROGRAM_FILES%\Internet Explorer\iexplore.exe
from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\isignup.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\isignup.exe
from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwtutor.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwtutor.exe
from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\inetwiz.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\inetwiz.exe
from %PROGRAM_FILES%\Outlook Express\oemig50.exe.new to %PROGRAM_FILES%\Outlook Express\oemig50.exe
from <SYSTEM32>\dllcache\icwrmind.exe.new to <SYSTEM32>\dllcache\icwrmind.exe
from <SYSTEM32>\dllcache\icwtutor.exe.new to <SYSTEM32>\dllcache\icwtutor.exe
from <SYSTEM32>\dllcache\icwconn2.exe.new to <SYSTEM32>\dllcache\icwconn2.exe
from <SYSTEM32>\dllcache\sapisvr.exe.new to <SYSTEM32>\dllcache\sapisvr.exe
from <SYSTEM32>\dllcache\icwconn1.exe.new to <SYSTEM32>\dllcache\icwconn1.exe
from <SYSTEM32>\dllcache\iexplore.exe.new to <SYSTEM32>\dllcache\iexplore.exe
from <SYSTEM32>\dllcache\moviemk.exe.new to <SYSTEM32>\dllcache\moviemk.exe
from <SYSTEM32>\dllcache\iedw.exe.new to <SYSTEM32>\dllcache\iedw.exe
from <SYSTEM32>\dllcache\inetwiz.exe.new to <SYSTEM32>\dllcache\inetwiz.exe
from <SYSTEM32>\dllcache\isignup.exe.new to <SYSTEM32>\dllcache\isignup.exe
from <SYSTEM32>\dllcache\msinfo32.exe.new to <SYSTEM32>\dllcache\msinfo32.exe
from %PROGRAM_FILES%\Windows Media Player\migrate.exe.new to %PROGRAM_FILES%\Windows Media Player\migrate.exe
from %PROGRAM_FILES%\Windows Media Player\mplayer2.exe.new to %PROGRAM_FILES%\Windows Media Player\mplayer2.exe
from %PROGRAM_FILES%\Outlook Express\wabmig.exe.new to %PROGRAM_FILES%\Outlook Express\wabmig.exe
from %PROGRAM_FILES%\Outlook Express\setup50.exe.new to %PROGRAM_FILES%\Outlook Express\setup50.exe
from %PROGRAM_FILES%\Outlook Express\wab.exe.new to %PROGRAM_FILES%\Outlook Express\wab.exe
from %PROGRAM_FILES%\Windows NT\dialer.exe.new to %PROGRAM_FILES%\Windows NT\dialer.exe
from %PROGRAM_FILES%\Windows NT\Pinball\pinball.exe.new to %PROGRAM_FILES%\Windows NT\Pinball\pinball.exe
from %PROGRAM_FILES%\Windows NT\Accessories\wordpad.exe.new to %PROGRAM_FILES%\Windows NT\Accessories\wordpad.exe
from %PROGRAM_FILES%\Windows Media Player\setup_wm.exe.new to %PROGRAM_FILES%\Windows Media Player\setup_wm.exe
from %PROGRAM_FILES%\Windows Media Player\wmplayer.exe.new to %PROGRAM_FILES%\Windows Media Player\wmplayer.exe

Deletes itself.

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial