Trojan.AVKill.61568

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'dqeix' = '%HOMEPATH%\My Documents\tshdec.exe'

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\_ReCoVeRy_+ucfck.html
%HOMEPATH%\Start Menu\Programs\Startup\_ReCoVeRy_+ucfck.png
%HOMEPATH%\Start Menu\Programs\Startup\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Start Menu\Programs\Startup\_ReCoVeRy_+ucfck.html

Malicious functions:

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cmd.exe

the following user processes:

ecmd.exe

Modifies file system:

Creates the following files:

%HOMEPATH%\My Documents\tshdec.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\_ReCoVeRy_+ucfck.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\_ReCoVeRy_+ucfck.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\_ReCoVeRy_+ucfck.html
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\_ReCoVeRy_+ucfck.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\_ReCoVeRy_+ucfck.txt
%APPDATA%\Microsoft\Windows\Themes\_ReCoVeRy_+ucfck.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\_ReCoVeRy_+ucfck.html
%APPDATA%\Mozilla\Firefox\Profiles\_ReCoVeRy_+ucfck.txt
%APPDATA%\Mozilla\Firefox\Profiles\_ReCoVeRy_+ucfck.html
%APPDATA%\Mozilla\Firefox\_ReCoVeRy_+ucfck.png
%APPDATA%\Mozilla\Firefox\_ReCoVeRy_+ucfck.txt
%APPDATA%\Mozilla\Firefox\_ReCoVeRy_+ucfck.html
%APPDATA%\Mozilla\_ReCoVeRy_+ucfck.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\_ReCoVeRy_+ucfck.png
%APPDATA%\Mozilla\Firefox\Profiles\_ReCoVeRy_+ucfck.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\_ReCoVeRy_+ucfck.html
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\_ReCoVeRy_+ucfck.txt
%APPDATA%\Mozilla\Extensions\_ReCoVeRy_+ucfck.html
%APPDATA%\Mozilla\Extensions\_ReCoVeRy_+ucfck.txt
%APPDATA%\Microsoft\SystemCertificates\My\_ReCoVeRy_+ucfck.txt
%APPDATA%\Microsoft\SystemCertificates\My\_ReCoVeRy_+ucfck.html
%APPDATA%\Microsoft\SystemCertificates\_ReCoVeRy_+ucfck.png
%APPDATA%\Microsoft\SystemCertificates\_ReCoVeRy_+ucfck.txt
%APPDATA%\Microsoft\SystemCertificates\_ReCoVeRy_+ucfck.html
%APPDATA%\Mozilla\_ReCoVeRy_+ucfck.txt
%APPDATA%\Microsoft\Windows\Themes\_ReCoVeRy_+ucfck.png
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\_ReCoVeRy_+ucfck.txt
%APPDATA%\Microsoft\Windows\Themes\_ReCoVeRy_+ucfck.html
%APPDATA%\Microsoft\Windows\_ReCoVeRy_+ucfck.txt
%APPDATA%\Microsoft\Windows\_ReCoVeRy_+ucfck.html
%APPDATA%\Microsoft\_ReCoVeRy_+ucfck.png
%APPDATA%\Microsoft\_ReCoVeRy_+ucfck.txt
%APPDATA%\Microsoft\_ReCoVeRy_+ucfck.html
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\_ReCoVeRy_+ucfck.html
%APPDATA%\Mozilla\Extensions\_ReCoVeRy_+ucfck.png
%APPDATA%\Microsoft\Windows\_ReCoVeRy_+ucfck.png
%APPDATA%\Microsoft\SystemCertificates\My\_ReCoVeRy_+ucfck.png
%APPDATA%\Mozilla\_ReCoVeRy_+ucfck.html
%HOMEPATH%\Cookies\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Identities\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Microsoft\Credentials\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Microsoft\Credentials\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Microsoft\Credentials\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Microsoft\Media Player\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Microsoft\Media Player\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Microsoft\Windows\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Microsoft\Windows\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Microsoft\Windows\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Microsoft\Windows Media\9.0\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Identities\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Identities\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\_ReCoVeRy_+ucfck.png
%APPDATA%\Identities\_ReCoVeRy_+ucfck.png
%HOMEPATH%\Cookies\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Cookies\_ReCoVeRy_+ucfck.html
%HOMEPATH%\Favorites\Links\_ReCoVeRy_+ucfck.png
%HOMEPATH%\Favorites\Links\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Favorites\Links\_ReCoVeRy_+ucfck.html
%APPDATA%\_ReCoVeRy_+ucfck.png
%APPDATA%\_ReCoVeRy_+ucfck.html
%APPDATA%\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Favorites\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\_ReCoVeRy_+ucfck.html
%HOMEPATH%\Favorites\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Favorites\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\_ReCoVeRy_+ucfck.png
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\_ReCoVeRy_+ucfck.png
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\_ReCoVeRy_+ucfck.html
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Local Settings\Temp\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Local Settings\Temp\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Local Settings\Temp\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Local Settings\History\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Local Settings\Application Data\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Local Settings\History\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Local Settings\History\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\_ReCoVeRy_+ucfck.html
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\_ReCoVeRy_+ucfck.png
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\_ReCoVeRy_+ucfck.html
%APPDATA%\Microsoft\Internet Explorer\_ReCoVeRy_+ucfck.png
%APPDATA%\Microsoft\Internet Explorer\_ReCoVeRy_+ucfck.txt
%APPDATA%\Microsoft\Internet Explorer\_ReCoVeRy_+ucfck.html
%APPDATA%\Microsoft\Media Player\_ReCoVeRy_+ucfck.png
%APPDATA%\Microsoft\Credentials\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Local Settings\_ReCoVeRy_+ucfck.png
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\_ReCoVeRy_+ucfck.txt
%APPDATA%\Microsoft\Media Player\_ReCoVeRy_+ucfck.txt
%APPDATA%\Microsoft\MMC\_ReCoVeRy_+ucfck.html
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\_ReCoVeRy_+ucfck.png
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\_ReCoVeRy_+ucfck.txt
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\_ReCoVeRy_+ucfck.html
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\_ReCoVeRy_+ucfck.png
%APPDATA%\Microsoft\Media Player\_ReCoVeRy_+ucfck.html
%APPDATA%\Microsoft\MMC\_ReCoVeRy_+ucfck.png
%APPDATA%\Microsoft\MMC\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Microsoft\Media Player\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Microsoft\Windows Media\9.0\_ReCoVeRy_+ucfck.txt
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Local Settings\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\_ReCoVeRy_+ucfck.html
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\_ReCoVeRy_+ucfck.png
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\_ReCoVeRy_+ucfck.txt
%APPDATA%\Microsoft\Credentials\_ReCoVeRy_+ucfck.png
%APPDATA%\Microsoft\Credentials\_ReCoVeRy_+ucfck.txt
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\_ReCoVeRy_+ucfck.html
%APPDATA%\Identities\_ReCoVeRy_+ucfck.html
%APPDATA%\Microsoft\Address Book\_ReCoVeRy_+ucfck.png
%APPDATA%\Microsoft\Address Book\_ReCoVeRy_+ucfck.txt
%APPDATA%\Microsoft\Address Book\_ReCoVeRy_+ucfck.html
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\_ReCoVeRy_+ucfck.png
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Local Settings\_ReCoVeRy_+ucfck.txt
%APPDATA%\Identities\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Templates\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Microsoft\Windows Media\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\_ReCoVeRy_+ucfck.html
%HOMEPATH%\Local Settings\<INETFILES>\_ReCoVeRy_+ucfck.png
%HOMEPATH%\Local Settings\<INETFILES>\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Local Settings\<INETFILES>\_ReCoVeRy_+ucfck.html
%TEMP%\_ReCoVeRy_+ucfck.html
%HOMEPATH%\Local Settings\_ReCoVeRy_+ucfck.png
%HOMEPATH%\Local Settings\_ReCoVeRy_+ucfck.html
%HOMEPATH%\My Documents\Downloads\_ReCoVeRy_+ucfck.png
%HOMEPATH%\My Documents\Downloads\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\My Documents\Downloads\_ReCoVeRy_+ucfck.html
%HOMEPATH%\My Documents\My Music\_ReCoVeRy_+ucfck.png
%HOMEPATH%\My Documents\My Music\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Local Settings\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\_ReCoVeRy_+ucfck.png
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\_ReCoVeRy_+ucfck.html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\_ReCoVeRy_+ucfck.png
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\_ReCoVeRy_+ucfck.html
%HOMEPATH%\Local Settings\History\History.IE5\_ReCoVeRy_+ucfck.html
%HOMEPATH%\Local Settings\History\_ReCoVeRy_+ucfck.png
%HOMEPATH%\Local Settings\History\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Local Settings\History\_ReCoVeRy_+ucfck.html
%TEMP%\_ReCoVeRy_+ucfck.png
%HOMEPATH%\My Documents\My Music\_ReCoVeRy_+ucfck.html
%TEMP%\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\_ReCoVeRy_+ucfck.html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\_ReCoVeRy_+ucfck.png
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\_ReCoVeRy_+ucfck.html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\_ReCoVeRy_+ucfck.png
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\_ReCoVeRy_+ucfck.html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\_ReCoVeRy_+ucfck.png
%HOMEPATH%\Local Settings\History\History.IE5\_ReCoVeRy_+ucfck.png
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Local Settings\History\History.IE5\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\My Documents\My Pictures\_ReCoVeRy_+ucfck.png
%HOMEPATH%\My Documents\My Received Files\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\_ReCoVeRy_+ucfck.png
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\_ReCoVeRy_+ucfck.html
%HOMEPATH%\Start Menu\Programs\Accessories\_ReCoVeRy_+ucfck.png
%HOMEPATH%\Start Menu\Programs\Accessories\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Start Menu\Programs\Accessories\_ReCoVeRy_+ucfck.html
%HOMEPATH%\SendTo\_ReCoVeRy_+ucfck.html
%HOMEPATH%\Start Menu\Programs\_ReCoVeRy_+ucfck.png
%HOMEPATH%\Start Menu\Programs\_ReCoVeRy_+ucfck.html
%HOMEPATH%\Start Menu\_ReCoVeRy_+ucfck.png
%HOMEPATH%\Start Menu\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Start Menu\_ReCoVeRy_+ucfck.html
%HOMEPATH%\Templates\_ReCoVeRy_+ucfck.png
%HOMEPATH%\Templates\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\_ReCoVeRy_+ucfck.html
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\_ReCoVeRy_+ucfck.png
%HOMEPATH%\SendTo\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Microsoft\Windows Media\9.0\_ReCoVeRy_+ucfck.html
%HOMEPATH%\My Documents\My Received Files\_ReCoVeRy_+ucfck.html
%HOMEPATH%\My Documents\_ReCoVeRy_+ucfck.png
%HOMEPATH%\My Documents\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\My Documents\_ReCoVeRy_+ucfck.html
%HOMEPATH%\NetHood\_ReCoVeRy_+ucfck.png
%HOMEPATH%\My Documents\My Pictures\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\My Documents\My Received Files\_ReCoVeRy_+ucfck.png
%HOMEPATH%\My Documents\My Pictures\_ReCoVeRy_+ucfck.html
%HOMEPATH%\NetHood\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\PrintHood\_ReCoVeRy_+ucfck.html
%HOMEPATH%\Recent\_ReCoVeRy_+ucfck.png
%HOMEPATH%\Recent\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Recent\_ReCoVeRy_+ucfck.html
%HOMEPATH%\SendTo\_ReCoVeRy_+ucfck.png
%HOMEPATH%\NetHood\_ReCoVeRy_+ucfck.html
%HOMEPATH%\PrintHood\_ReCoVeRy_+ucfck.png
%HOMEPATH%\PrintHood\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Microsoft\Windows Media\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Microsoft\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Microsoft\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Microsoft\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Mozilla\Firefox\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Mozilla\Firefox\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\VMware\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\VMware\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\VMware\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Microsoft\Windows Media\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\_ReCoVeRy_+ucfck.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\_ReCoVeRy_+ucfck.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\_ReCoVeRy_+ucfck.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\_ReCoVeRy_+ucfck.html
%HOMEPATH%\Start Menu\Programs\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Cookies\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Cookies\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Favorites\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Favorites\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Favorites\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Application Data\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Cookies\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Application Data\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Application Data\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Application Data\Microsoft\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Application Data\Microsoft\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Application Data\Microsoft\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Local Settings\Application Data\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Local Settings\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Local Settings\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Local Settings\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\My Documents\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\My Documents\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Local Settings\History\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Local Settings\History\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Local Settings\Temp\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Local Settings\History\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Local Settings\Temp\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Local Settings\Temp\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\_ReCoVeRy_+ucfck.html
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\_ReCoVeRy_+ucfck.html
%ALLUSERSPROFILE%\Documents\My Pictures\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\Documents\My Pictures\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\Documents\My Pictures\_ReCoVeRy_+ucfck.html
%ALLUSERSPROFILE%\DRM\_ReCoVeRy_+ucfck.html
%ALLUSERSPROFILE%\Documents\My Videos\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\Documents\My Videos\_ReCoVeRy_+ucfck.html
%ALLUSERSPROFILE%\Documents\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\Documents\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\Documents\_ReCoVeRy_+ucfck.html
%ALLUSERSPROFILE%\DRM\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\Documents\My Music\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\_ReCoVeRy_+ucfck.html
%ALLUSERSPROFILE%\Documents\My Music\_ReCoVeRy_+ucfck.html
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\_ReCoVeRy_+ucfck.png
%TEMP%\dqeix.bat
<Current directory>\_ReCoVeRy_+ucfck.png
<Current directory>\_ReCoVeRy_+ucfck.txt
<Current directory>\_ReCoVeRy_+ucfck.html
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\DRM\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\binstr[1].htm
%ALLUSERSPROFILE%\Documents\My Videos\_ReCoVeRy_+ucfck.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\wcspng[1].htm
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\_ReCoVeRy_+ucfck.html
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\_ReCoVeRy_+ucfck.html
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\_ReCoVeRy_+ucfck.html
%HOMEPATH%\My Documents\recover.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\Documents\My Music\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\Favorites\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\Start Menu\Programs\Games\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\Start Menu\Programs\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\Start Menu\Programs\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\Start Menu\Programs\_ReCoVeRy_+ucfck.html
%ALLUSERSPROFILE%\Start Menu\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\Start Menu\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\Favorites\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\_ReCoVeRy_+ucfck.html
%ALLUSERSPROFILE%\Start Menu\_ReCoVeRy_+ucfck.html
%ALLUSERSPROFILE%\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\Templates\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\Templates\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\Templates\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\My Documents\_ReCoVeRy_+ucfck.html
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\_ReCoVeRy_+ucfck.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\_ReCoVeRy_+ucfck.html
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\_ReCoVeRy_+ucfck.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\_ReCoVeRy_+ucfck.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\_ReCoVeRy_+ucfck.png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\_ReCoVeRy_+ucfck.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\_ReCoVeRy_+ucfck.html
%ALLUSERSPROFILE%\Favorites\_ReCoVeRy_+ucfck.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\NetHood\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Local Settings\History\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Local Settings\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Local Settings\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Local Settings\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Local Settings\Application Data\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Local Settings\Application Data\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Local Settings\History\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Local Settings\Temp\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Local Settings\Temp\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Local Settings\Temp\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Local Settings\History\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Application Data\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Application Data\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Application Data\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Cookies\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Cookies\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Cookies\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\NetHood\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Start Menu\Programs\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Start Menu\Programs\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Start Menu\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Start Menu\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Start Menu\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Templates\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Templates\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Start Menu\Programs\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\PrintHood\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\PrintHood\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Recent\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Recent\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Recent\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\SendTo\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\SendTo\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Templates\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\Default User\SendTo\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\Default User\PrintHood\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Application Data\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Application Data\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Application Data\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Cookies\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Cookies\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Cookies\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\Default User\NetHood\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\_ReCoVeRy_+ucfck.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\_ReCoVeRy_+ucfck.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\_ReCoVeRy_+ucfck.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\_ReCoVeRy_+ucfck.png
%HOMEPATH%\_ReCoVeRy_+ucfck.png

Sets the 'hidden' attribute to the following files:

%HOMEPATH%\My Documents\tshdec.exe

Deletes the following files:

%TEMP%\dqeix.bat

Moves the following files:

from %APPDATA%\Microsoft\Internet Explorer\brndlog.bak to %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.mp3
from %APPDATA%\Microsoft\Internet Explorer\brndlog.txt to %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.mp3
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css.mp3
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css.mp3
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.mp3
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.mp3
from %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js to %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.mp3

Network activity:

Connects to:

'19#.1.95.93':80
'ke##2.com':80
'my###hour.com':80
'co######reaknetworks.com':80
'sa####raining.com':80

TCP:

HTTP POST requests:

http://19#.1.95.93/~deveconomytravel/cache/binstr.php
http://ke##2.com/wp-content/plugins/ajax-admin/binstr.php
http://my###hour.com/blog//wp-content/themes/berlinproof/binstr.php
http://co######reaknetworks.com/dev/wp-content/uploads/2015/07/binstr.php
http://sa####raining.com/wp-includes/theme-compat/wcspng.php
http://co######reaknetworks.com/dev/wp-content/uploads/2015/07/wcspng.php

UDP:

DNS ASK ke##2.com
DNS ASK my###hour.com
DNS ASK co######reaknetworks.com
DNS ASK sa####raining.com

Miscellaneous:

Creates and executes the following:

'%HOMEPATH%\My Documents\tshdec.exe'

Executes the following:

'<SYSTEM32>\cmd.exe' /c DEL <Full path to file> >> NUL
'<SYSTEM32>\cmd.exe' /c %TEMP%\dqeix.bat
'<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v dqeix /t REG_SZ /d "%HOMEPATH%\My Documents\tshdec.exe" /f

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней