Technical Information
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\README.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Services\whowhere.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\res\arrowd.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\res\arrow.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\tech.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\Sweets Bkgrd.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Services\verisign.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Services\bigfoot.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-sharp.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-hov.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-dis.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn-hov.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn-dis.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-hov.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn-sharp.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\sunbannA.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\aleabanr.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\Sunflower Bkgrd.jpg"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\anabnr2.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\amaizrul.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\Maize Bkgrd.jpg"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\Leaves Bkgrd.jpg"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\Pie Charts Bkgrd.jpg"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\Nature Bkgrd.jpg"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\fieruled.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\Citrus Punch Bkgrd.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\Network Blitz Bkgrd.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\Ivy.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\Blank Bkgrd.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\aswrule.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\citbannA.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\Btzhsepa.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-sharp-end.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\toolbar\chevron.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-top.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn-dis.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\tree\columnpicker.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-bottom.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\scrollbar\slider.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-right.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-left.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-sharp-end.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-hov.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-sharp.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn-sharp.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn-hov.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-dis.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\radio-check.gif"
- '%TEMP%\svchost.exe' /pid=1488
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up-sharp.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\cbox-check-dis.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-sharp.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up-hov.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up-dis.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Minimize.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Close.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\radio-check-dis.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Restore.gif"
- '%TEMP%\svchost.exe' /pid=3012
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\cbox-check.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console-error-dash.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console-error-caret.gif"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\Glacier Bkgrd.jpg"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Documents and Settings\Default User\Templates\winword.doc"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Documents and Settings\Default User\Templates\excel.xls"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Documents and Settings\Default User\Templates\winword2.doc"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Documents and Settings\Default User\Templates\excel4.xls"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\Colorer\hrc\changes.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\rus\Plugins.Review.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\rus\Plugins.Install.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\7-Zip\far7z.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\rus\TechInfo.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\FTP\Notes_rus.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\FTP\Notes.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\Fiesta Bkgrd.jpg"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%CommonProgramFiles%\Microsoft Shared\Stationery\Clear Day Bkgrd.jpg"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\FTP\FtpCmds_rus.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Plugins\FTP\FtpCmds.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\rus\Far.FAQ.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%HOMEPATH%\Templates\excel4.xls"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%HOMEPATH%\Templates\excel.xls"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Addons\README.TXT"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%HOMEPATH%\Templates\powerpnt.ppt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%APPDATA%\Microsoft\Internet Explorer\brndlog.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Documents and Settings\Default User\Templates\powerpnt.ppt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%HOMEPATH%\Templates\winword2.doc"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%HOMEPATH%\Templates\winword.doc"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\eng\TechInfo.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\eng\Plugins.Review.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\rus\Bug.Report.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\rus\Arc.Support.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\eng\Bug.Report.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\eng\Arc.Support.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\eng\Plugins.Install.txt"
- '%TEMP%\svchost.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "C:\Far2\Documentation\eng\Far.FAQ.txt"
- '<SYSTEM32>\attrib.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn.gif"
- '<SYSTEM32>\attrib.exe' /pid=2916
- '<SYSTEM32>\attrib.exe' +r +h "%APPDATA%\gnupg"
- '<SYSTEM32>\chcp.com' /pid=2816
- '<SYSTEM32>\attrib.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-sharp-end.gif"
- '<SYSTEM32>\attrib.exe' /pid=2996
- '<SYSTEM32>\attrib.exe' --batch --no-verbose -q --encrypt-files -r uncrypt "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-dis.gif"
- '<SYSTEM32>\attrib.exe' /pid=2948
- '<SYSTEM32>\attrib.exe' -s -h -r "%APPDATA%\gnupg\*.*"
- '<SYSTEM32>\attrib.exe' -s -h -r "%APPDATA%\gnupg"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\csrss.bat" "
- '<SYSTEM32>\chcp.com' 1251
- '<SYSTEM32>\attrib.exe' +r +h "%APPDATA%\gnupg\random_seed"
- '<SYSTEM32>\attrib.exe' +r +h "%APPDATA%\gnupg\trustdb.gpg"
- '<SYSTEM32>\attrib.exe' +r +h "%APPDATA%\gnupg\pubring.bak"
- '<SYSTEM32>\attrib.exe' +r +h "%APPDATA%\gnupg\pubring.gpg"
- <SYSTEM32>\attrib.exe
- %TEMP%\nse2.tmp\ExecDos.dll
- %TEMP%\uncrypt.t
- %TEMP%\svchost.exe
- %APPDATA%\gnupg\pubring.bak
- %APPDATA%\gnupg\trustdb.gpg
- %APPDATA%\gnupg\random_seed
- %APPDATA%\gnupg\pubring.gpg
- %TEMP%\gnupg\pubring.gpg
- %TEMP%\gnupg\pubring.bak
- %TEMP%\nse2.tmp\System.dll
- %TEMP%\gnupg\random_seed
- %TEMP%\iconv.dll
- %TEMP%\csrss.bat
- %TEMP%\gnupg\trustdb.gpg
- %APPDATA%\gnupg\random_seed
- %APPDATA%\gnupg\trustdb.gpg
- %APPDATA%\gnupg\pubring.bak
- %APPDATA%\gnupg\pubring.gpg
- %TEMP%\gnupg\random_seed
- %TEMP%\gnupg\trustdb.gpg
- %TEMP%\gnupg\pubring.bak
- %TEMP%\gnupg\pubring.gpg