Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'hostslertalxnyw' = '<SYSTEM32>\CMD.EXE /C START "" "%HOMEPATH%\My Documents\aebhubsjwktc.exe"'
- %HOMEPATH%\Start Menu\Programs\Startup\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\Start Menu\Programs\Startup\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\-!RecOveR!-kcsaw++.Png
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\-!RecOveR!-kcsaw++.Txt
- '<SYSTEM32>\cmd.exe' /c DEL <Full path to virus> >> NUL
- '%HOMEPATH%\My Documents\aebhubsjwktc.exe'
- <SYSTEM32>\cmd.exe
- ecmd.exe
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\My Documents\My Music\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\My Documents\Downloads\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\My Documents\My Pictures\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\My Documents\My Music\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\Local Settings\-!RecOveR!-kcsaw++.Png
- %TEMP%\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\My Documents\Downloads\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\Local Settings\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\NetHood\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\My Documents\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\PrintHood\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\NetHood\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\My Documents\My Received Files\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\My Documents\My Pictures\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\My Documents\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\My Documents\My Received Files\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\VMware\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\VMware\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Mozilla\Firefox\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Mozilla\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\Firefox\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\Local Settings\History\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\Local Settings\History\History.IE5\-!RecOveR!-kcsaw++.Txt
- %TEMP%\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\Local Settings\History\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\Local Settings\History\History.IE5\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Mozilla\Firefox\Profiles\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Mozilla\Extensions\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Mozilla\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\Cookies\-!RecOveR!-kcsaw++.Png
- %APPDATA%\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Mozilla\Firefox\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Mozilla\Firefox\Profiles\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Mozilla\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Mozilla\Firefox\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Microsoft\SystemCertificates\My\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Microsoft\SystemCertificates\My\CTLs\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Microsoft\SystemCertificates\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Microsoft\SystemCertificates\My\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Microsoft\SystemCertificates\My\CRLs\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Microsoft\SystemCertificates\My\Certificates\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Microsoft\SystemCertificates\My\CTLs\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Microsoft\SystemCertificates\My\CRLs\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Microsoft\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Microsoft\Windows\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Mozilla\Extensions\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Microsoft\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Microsoft\Windows\Themes\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Microsoft\SystemCertificates\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Microsoft\Windows\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Microsoft\Windows\Themes\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\Cookies\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Microsoft\Windows Media\9.0\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Microsoft\Windows Media\9.0\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Microsoft\Windows Media\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Microsoft\Windows Media\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Microsoft\Media Player\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Microsoft\Media Player\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Microsoft\Windows\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Microsoft\Windows\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Microsoft\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Microsoft\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\Favorites\Links\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\Favorites\Links\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\Favorites\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\Favorites\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Microsoft\Credentials\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Microsoft\Credentials\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\-!RecOveR!-kcsaw++.Png
- <LS_APPDATA>\Identities\-!RecOveR!-kcsaw++.Txt
- <LS_APPDATA>\Identities\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\ExtSearch\keys\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\ExtSearch\keys\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\ExtSearch\sources\RegExp\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\ExtSearch\sources\RegExp\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\EMenu\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\EMenu\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\ExtSearch\doc\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\ExtSearch\doc\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\FarCmds\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\FarCmds\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\FileCase\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\FileCase\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\ExtSearch\sources\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\ExtSearch\sources\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\ExtSearch\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\ExtSearch\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\Colorer\hrd\console\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\Colorer\hrd\console\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\Colorer\hrd\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\Colorer\hrd\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\Colorer\hrc\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\Colorer\hrc\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\Colorer\hrd\console\contrib\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\Colorer\hrd\console\contrib\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\DrawLine\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\DrawLine\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\EditCase\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\EditCase\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\Colorer\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\Colorer\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\Compare\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\Compare\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\FTP\lib\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\WinSCP\far\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\WinSCP\dragext\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\WinSCP\fari\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\WinSCP\far\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\WinSCP\core\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\WinSCP\console\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\WinSCP\dragext\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\WinSCP\core\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\WinSCP\forms\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\WinSCP\filezilla\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\WinSCP\lib\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\WinSCP\forms\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\WinSCP\filezilla\misc\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\WinSCP\fari\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\WinSCP\filezilla\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\WinSCP\filezilla\misc\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\MacroView\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\HlfViewer\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\Network\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\MacroView\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\FTP\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\FTP\lib\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\HlfViewer\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\FTP\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\WinSCP\components\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\TmpPanel\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\WinSCP\console\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\WinSCP\components\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\ProcList\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\Network\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\TmpPanel\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\ProcList\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Addons\Colors\Custom Highlighting\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Addons\Colors\Default Highlighting\-!RecOveR!-kcsaw++.Png
- C:\Far2\Addons\Colors\Custom Highlighting\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\Templates\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Addons\SetUp\-!RecOveR!-kcsaw++.Png
- C:\Far2\Addons\Macros\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Addons\Shell\-!RecOveR!-kcsaw++.Png
- C:\Far2\Addons\SetUp\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Addons\Colors\-!RecOveR!-kcsaw++.Png
- C:\Far2\Addons\Colors\Default Highlighting\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Addons\Macros\-!RecOveR!-kcsaw++.Png
- C:\Far2\Addons\Colors\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\SendTo\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\Recent\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\PrintHood\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\SendTo\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\Recent\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\Start Menu\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\Start Menu\Programs\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\Templates\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\Start Menu\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\Start Menu\Programs\Accessories\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\Start Menu\Programs\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\Start Menu\Programs\Accessories\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Addons\Shell\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\arclite\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\arclite\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\AutoWrap\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\AutoWrap\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\7-Zip\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\7-Zip\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\Align\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\Align\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\Colorer\hrc\auto\types\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\Colorer\hrc\auto\types\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\Colorer\hrc\auto\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\Colorer\hrc\auto\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\Brackets\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\Brackets\-!RecOveR!-kcsaw++.Png
- C:\Far2\Plugins\Colorer\bin\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Plugins\Colorer\bin\-!RecOveR!-kcsaw++.Png
- C:\Far2\Addons\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Addons\-!RecOveR!-kcsaw++.Png
- C:\Far2\Documentation\eng\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Documentation\eng\-!RecOveR!-kcsaw++.Png
- C:\Far2\Addons\XLat\Russian\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Addons\XLat\Russian\-!RecOveR!-kcsaw++.Png
- C:\Far2\Addons\XLat\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Addons\XLat\-!RecOveR!-kcsaw++.Png
- C:\Far2\Encyclopedia\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Encyclopedia\-!RecOveR!-kcsaw++.Png
- C:\Far2\FExcept\-!RecOveR!-kcsaw++.Txt
- C:\Far2\FExcept\-!RecOveR!-kcsaw++.Png
- C:\Far2\Documentation\rus\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Documentation\rus\-!RecOveR!-kcsaw++.Png
- C:\Far2\Documentation\-!RecOveR!-kcsaw++.Txt
- C:\Far2\Documentation\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Microsoft\SystemCertificates\My\Certificates\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Local Settings\History\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Local Settings\Temp\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Local Settings\History\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Local Settings\Application Data\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Local Settings\Temp\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Cookies\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Application Data\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Favorites\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Cookies\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Application Data\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Application Data\Microsoft\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Favorites\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Templates\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Templates\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Start Menu\Programs\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Start Menu\Programs\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Start Menu\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Start Menu\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Local Settings\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Local Settings\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\My Documents\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\My Documents\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Recent\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Recent\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\SendTo\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\SendTo\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\NetHood\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\NetHood\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\PrintHood\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\PrintHood\-!RecOveR!-kcsaw++.Png
- %ALLUSERSPROFILE%\Documents\My Pictures\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\Documents\My Pictures\-!RecOveR!-kcsaw++.Png
- %ALLUSERSPROFILE%\Documents\My Videos\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\Documents\My Videos\-!RecOveR!-kcsaw++.Png
- %ALLUSERSPROFILE%\Documents\My Music\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\Documents\My Music\-!RecOveR!-kcsaw++.Png
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\-!RecOveR!-kcsaw++.Png
- %ALLUSERSPROFILE%\Favorites\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\Favorites\-!RecOveR!-kcsaw++.Png
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\-!RecOveR!-kcsaw++.Png
- %ALLUSERSPROFILE%\Documents\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\Documents\-!RecOveR!-kcsaw++.Png
- %ALLUSERSPROFILE%\DRM\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\DRM\-!RecOveR!-kcsaw++.Png
- <Current directory>\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\inifile[1].htm
- %ALLUSERSPROFILE%\Documents\My Music\My Playlists\-!RecOveR!-kcsaw++.Png
- <Current directory>\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\My Documents\desctop._ini
- %HOMEPATH%\My Documents\aebhubsjwktc.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\sys_init[1].htm
- %HOMEPATH%\My Documents\-!recover!-!file!-.txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\-!RecOveR!-kcsaw++.Png
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\-!RecOveR!-kcsaw++.Png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\sys_info[1].htm
- %ALLUSERSPROFILE%\Documents\My Music\My Playlists\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\-!RecOveR!-kcsaw++.Png
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\-!RecOveR!-kcsaw++.Png
- %ALLUSERSPROFILE%\Templates\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\-!RecOveR!-kcsaw++.Png
- %ALLUSERSPROFILE%\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\-!RecOveR!-kcsaw++.Png
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\-!RecOveR!-kcsaw++.Png
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\-!RecOveR!-kcsaw++.Png
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\-!RecOveR!-kcsaw++.Png
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\Start Menu\-!RecOveR!-kcsaw++.Png
- %ALLUSERSPROFILE%\Start Menu\Programs\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\Templates\-!RecOveR!-kcsaw++.Png
- %ALLUSERSPROFILE%\Start Menu\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\-!RecOveR!-kcsaw++.Png
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\-!RecOveR!-kcsaw++.Txt
- %ALLUSERSPROFILE%\Start Menu\Programs\-!RecOveR!-kcsaw++.Png
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Local Settings\Temp\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Local Settings\History\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Local Settings\Temp\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Local Settings\History\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Cookies\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Application Data\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Cookies\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Application Data\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Microsoft\Credentials\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Microsoft\Credentials\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Identities\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Identities\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Microsoft\Address Book\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Microsoft\Address Book\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Microsoft\Media Player\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Microsoft\Media Player\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Microsoft\MMC\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Microsoft\MMC\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Microsoft\Internet Explorer\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Microsoft\Internet Explorer\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\-!RecOveR!-kcsaw++.Png
- %APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\-!RecOveR!-kcsaw++.Txt
- %APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Local Settings\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Local Settings\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Application Data\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Application Data\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Cookies\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Cookies\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Local Settings\Application Data\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Local Settings\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Local Settings\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Local Settings\Temp\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Local Settings\History\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Local Settings\Temp\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Local Settings\Application Data\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Local Settings\History\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\-!RecOveR!-kcsaw++.Txt
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\-!RecOveR!-kcsaw++.Png
- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\-!RecOveR!-kcsaw++.Txt
- %HOMEPATH%\My Documents\aebhubsjwktc.exe
- 'lo######htwithmysite.com':80
- 'bl###reambd.com':80
- 'th######mbebeautiful.com.au':80
- 'he##el.com':80
- 'on##so.com':80
- 'lo#####riedelareine.fr':80
- http://lo######htwithmysite.com/sys_info.php
- http://bl###reambd.com/inifile.php
- http://th######mbebeautiful.com.au/sys_init.php
- http://he##el.com/sys_init.php
- http://on##so.com/inifile.php
- http://lo#####riedelareine.fr/sys_init.php
- DNS ASK lo######htwithmysite.com
- DNS ASK bl###reambd.com
- DNS ASK th######mbebeautiful.com.au
- DNS ASK he##el.com
- DNS ASK on##so.com
- DNS ASK lo#####riedelareine.fr