Trojan.Encoder.2652

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'etcfg' = 'C'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'etcfg' = '%APPDATA%\dttovq.exe'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\Start Menu\Programs\Startup\HOWTO_RESTORE_FILES_qcqfe.html
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\HOWTO_RESTORE_FILES_qcqfe.html

Malicious functions:

Creates and executes the following:

'%APPDATA%\dttovq.exe'

Executes the following:

'<SYSTEM32>\vssadmin.exe' delete shadows /all /Quiet
'<SYSTEM32>\cmd.exe' /c DEL <Full path to virus>

Modifies file system :

Creates the following files:

%HOMEPATH%\Local Settings\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\Local Settings\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\My Documents\Downloads\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\My Documents\Downloads\HOWTO_RESTORE_FILES_qcqfe.txt
%TEMP%\HOWTO_RESTORE_FILES_qcqfe.html
%TEMP%\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\Local Settings\Temporary Internet Files\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\Local Settings\Temporary Internet Files\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\My Documents\My Music\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\My Documents\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\My Documents\My Received Files\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\NetHood\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\My Documents\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\My Documents\My Pictures\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\My Documents\My Music\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\My Documents\My Received Files\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\My Documents\My Pictures\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\Local Settings\History\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Mozilla\Firefox\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Mozilla\Firefox\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Mozilla\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\VMware\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\Local Settings\History\History.IE5\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\Local Settings\History\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\Local Settings\History\History.IE5\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\VMware\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Addons\Colors\Custom Highlighting\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Addons\Colors\Default Highlighting\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Addons\Colors\Custom Highlighting\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\Templates\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Addons\Colors\Default Highlighting\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Addons\SetUp\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Addons\SetUp\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Addons\Shell\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Addons\Shell\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Addons\Colors\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Addons\Colors\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Addons\Macros\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Addons\Macros\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\Templates\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\SendTo\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\Recent\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\SendTo\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\PrintHood\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\NetHood\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\Recent\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\PrintHood\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\Start Menu\Programs\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\Start Menu\Programs\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\Start Menu\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\Start Menu\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\Start Menu\Programs\Accessories\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\Start Menu\Programs\Accessories\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Microsoft\Credentials\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Microsoft\Media Player\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Microsoft\Credentials\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Identities\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Identities\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Microsoft\Media Player\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Microsoft\Windows Media\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Microsoft\Windows Media\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Microsoft\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Microsoft\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Microsoft\Windows\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Microsoft\Windows\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Microsoft\Windows Media\9.0\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Microsoft\Windows Media\9.0\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Mozilla\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\Cookies\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Mozilla\Firefox\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Mozilla\Firefox\Profiles\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Mozilla\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Mozilla\Firefox\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\Cookies\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\Favorites\Links\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\Favorites\Links\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\Favorites\HOWTO_RESTORE_FILES_qcqfe.html
%HOMEPATH%\Favorites\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\HOWTO_RESTORE_FILES_qcqfe.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\HOWTO_RESTORE_FILES_qcqfe.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\forms\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\WinSCP\filezilla\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\lib\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\WinSCP\forms\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\filezilla\misc\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\WinSCP\fari\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\filezilla\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\WinSCP\filezilla\misc\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\lib\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\packages\my\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\packages\my\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\WinSCP\packages\tb2k\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\packages\tb2k\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\WinSCP\packages\dragndrop\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\packages\dragndrop\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\WinSCP\packages\filemng\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\packages\filemng\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\WinSCP\fari\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\TmpPanel\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\ProcList\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\components\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\TmpPanel\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\Network\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\MacroView\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\ProcList\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\Network\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\components\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\dragext\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\dragext\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\WinSCP\far\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\far\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\WinSCP\console\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\console\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\WinSCP\core\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\core\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\PluginSDK\Headers.c\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\PluginSDK\Headers.c\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\PluginSDK\Headers.pas\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\PluginSDK\Headers.pas\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\WinSCP\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\PluginSDK\HOWTO_RESTORE_FILES_qcqfe.txt
C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\HOWTO_RESTORE_FILES_qcqfe.html
C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\HOWTO_RESTORE_FILES_qcqfe.txt
C:\RECYCLER\HOWTO_RESTORE_FILES_qcqfe.html
C:\RECYCLER\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\PluginSDK\HOWTO_RESTORE_FILES_qcqfe.html
<Auxiliary element>
C:\Far2\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\windows\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\packages\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\packages\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\WinSCP\putty\charset\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\putty\charset\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\WinSCP\packages\tbx\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\packages\tbx\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\WinSCP\packages\theme\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\packages\theme\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\WinSCP\putty\windows\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\WinSCP\resource\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\WinSCP\release\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\windows\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\WinSCP\resource\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\putty\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\WinSCP\putty\windows\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\WinSCP\release\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\WinSCP\putty\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\MacroView\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\AutoWrap\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\AutoWrap\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\Brackets\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\Brackets\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\Align\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\Align\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\arclite\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\arclite\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\Colorer\bin\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\Colorer\hrc\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\Colorer\hrc\auto\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\Colorer\hrd\console\contrib\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\Colorer\hrc\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\Colorer\hrc\auto\types\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\Colorer\bin\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\Colorer\hrc\auto\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\Colorer\hrc\auto\types\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\7-Zip\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Addons\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Addons\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Documentation\eng\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Documentation\eng\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Addons\XLat\Russian\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Addons\XLat\Russian\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Addons\XLat\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Addons\XLat\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Documentation\rus\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\FExcept\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Encyclopedia\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\7-Zip\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\FExcept\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Documentation\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Documentation\rus\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Encyclopedia\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Documentation\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\ExtSearch\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\ExtSearch\sources\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\FarCmds\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\ExtSearch\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\ExtSearch\sources\RegExp\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\ExtSearch\keys\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\ExtSearch\sources\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\ExtSearch\sources\RegExp\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\FarCmds\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\FTP\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\FTP\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\HlfViewer\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\HlfViewer\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\FileCase\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\FileCase\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\FTP\lib\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\FTP\lib\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\ExtSearch\keys\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\Colorer\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\Colorer\hrd\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\Compare\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\Colorer\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\Colorer\hrd\console\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\Colorer\hrd\console\contrib\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\Colorer\hrd\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\Colorer\hrd\console\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\Compare\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\EMenu\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\EMenu\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\ExtSearch\doc\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\ExtSearch\doc\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\DrawLine\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\DrawLine\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Far2\Plugins\EditCase\HOWTO_RESTORE_FILES_qcqfe.html
C:\Far2\Plugins\EditCase\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Mozilla\Firefox\Profiles\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\My Documents\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\My Documents\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\NetHood\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\NetHood\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Local Settings\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Local Settings\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Favorites\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Local Settings\History\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Local Settings\History\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Local Settings\Temp\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Local Settings\Temp\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Local Settings\Application Data\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Templates\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Templates\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Start Menu\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\SendTo\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\SendTo\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\PrintHood\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\PrintHood\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Recent\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Recent\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Start Menu\Programs\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Start Menu\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Start Menu\Programs\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Favorites\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\DRM\HOWTO_RESTORE_FILES_qcqfe.html
%ALLUSERSPROFILE%\DRM\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Favorites\HOWTO_RESTORE_FILES_qcqfe.html
%ALLUSERSPROFILE%\Favorites\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Documents\My Videos\HOWTO_RESTORE_FILES_qcqfe.html
%ALLUSERSPROFILE%\Documents\My Videos\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Documents\HOWTO_RESTORE_FILES_qcqfe.html
%ALLUSERSPROFILE%\Documents\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\HOWTO_RESTORE_FILES_qcqfe.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\HOWTO_RESTORE_FILES_qcqfe.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\HOWTO_RESTORE_FILES_qcqfe.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\HOWTO_RESTORE_FILES_qcqfe.html
%ALLUSERSPROFILE%\Documents\My Pictures\HOWTO_RESTORE_FILES_qcqfe.html
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\HOWTO_RESTORE_FILES_qcqfe.html
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\HOWTO_RESTORE_FILES_qcqfe.html
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\HOWTO_RESTORE_FILES_qcqfe.txt
%HOMEPATH%\My Documents\recover_file_aopdmumlq.txt
%APPDATA%\dttovq.exe
<Current directory>\HOWTO_RESTORE_FILES_qcqfe.html
<Current directory>\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Documents\My Music\HOWTO_RESTORE_FILES_qcqfe.html
%ALLUSERSPROFILE%\Documents\My Pictures\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\HOWTO_RESTORE_FILES_qcqfe.html
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\HOWTO_RESTORE_FILES_qcqfe.html
%ALLUSERSPROFILE%\Documents\My Music\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Cookies\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Cookies\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Desktop\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Desktop\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Application Data\Microsoft\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Application Data\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Application Data\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Start Menu\Programs\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\HOWTO_RESTORE_FILES_qcqfe.html
%ALLUSERSPROFILE%\Start Menu\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Start Menu\Programs\HOWTO_RESTORE_FILES_qcqfe.html
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\HOWTO_RESTORE_FILES_qcqfe.html
%ALLUSERSPROFILE%\Start Menu\Programs\Games\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\HOWTO_RESTORE_FILES_qcqfe.html
%ALLUSERSPROFILE%\Start Menu\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\Templates\HOWTO_RESTORE_FILES_qcqfe.html
%ALLUSERSPROFILE%\Templates\HOWTO_RESTORE_FILES_qcqfe.txt
%ALLUSERSPROFILE%\HOWTO_RESTORE_FILES_qcqfe.html
%ALLUSERSPROFILE%\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Local Settings\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Local Settings\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Microsoft\Address Book\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Identities\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Microsoft\Address Book\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Identities\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Local Settings\History\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Local Settings\Temp\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Local Settings\History\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Local Settings\Temp\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Microsoft\Windows\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Microsoft\Windows\Themes\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Microsoft\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Microsoft\Windows\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Microsoft\SystemCertificates\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Microsoft\SystemCertificates\My\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Microsoft\Windows\Themes\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Microsoft\SystemCertificates\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Microsoft\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Mozilla\Extensions\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Mozilla\Extensions\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Microsoft\SystemCertificates\My\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Microsoft\Internet Explorer\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Microsoft\Media Player\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Microsoft\Internet Explorer\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Microsoft\Credentials\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Microsoft\Credentials\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Microsoft\Media Player\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Microsoft\MMC\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Microsoft\MMC\HOWTO_RESTORE_FILES_qcqfe.txt
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\HOWTO_RESTORE_FILES_qcqfe.html
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Local Settings\History\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Local Settings\Temp\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Local Settings\History\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Local Settings\Temp\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Application Data\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Application Data\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Cookies\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Cookies\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Cookies\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Application Data\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Cookies\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Application Data\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Local Settings\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Local Settings\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\HOWTO_RESTORE_FILES_qcqfe.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\HOWTO_RESTORE_FILES_qcqfe.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\HOWTO_RESTORE_FILES_qcqfe.html

Deletes itself.

Network activity:

Connects to:

'he####zone.com.au':80
'my####rnalip.com':80

TCP:

HTTP GET requests:

http://he####zone.com.au/wp-admin/maint/misc.php?55##############################################################################################################################################...
http://my####rnalip.com/raw

UDP:

DNS ASK he####zone.com.au
DNS ASK my####rnalip.com

Miscellaneous:

Searches for the following windows:

ClassName: 'Indicator' WindowName: ''

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial