Trojan.Encoder.3564

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'hostslertjyydky' = '<SYSTEM32>\CMD.EXE /C START "" "%HOMEPATH%\My Documents\dsbwtoekgyeh.exe"'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\-!RecOveR!-futex++.Png
%HOMEPATH%\Start Menu\Programs\Startup\-!RecOveR!-futex++.Txt
%HOMEPATH%\Start Menu\Programs\Startup\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\-!RecOveR!-futex++.Htm

Malicious functions:

Executes the following:

'<SYSTEM32>\cmd.exe' /c DEL <Full path to file> >> NUL
'%HOMEPATH%\My Documents\dsbwtoekgyeh.exe'

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cmd.exe

the following user processes:

ecmd.exe

Modifies file system:

Creates the following files:

%APPDATA%\Microsoft\Windows\-!RecOveR!-futex++.Png
%APPDATA%\Microsoft\Windows\Themes\-!RecOveR!-futex++.Htm
%APPDATA%\Microsoft\Windows\-!RecOveR!-futex++.Htm
%APPDATA%\Microsoft\Windows\-!RecOveR!-futex++.Txt
%APPDATA%\Microsoft\Windows\Themes\-!RecOveR!-futex++.Txt
%APPDATA%\Microsoft\SystemCertificates\-!RecOveR!-futex++.Txt
%APPDATA%\Microsoft\SystemCertificates\-!RecOveR!-futex++.Png
%APPDATA%\Microsoft\Windows\Themes\-!RecOveR!-futex++.Png
%APPDATA%\Microsoft\SystemCertificates\-!RecOveR!-futex++.Htm
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\-!RecOveR!-futex++.Png
%APPDATA%\Mozilla\Extensions\-!RecOveR!-futex++.Htm
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\-!RecOveR!-futex++.Htm
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\-!RecOveR!-futex++.Txt
%APPDATA%\Mozilla\Extensions\-!RecOveR!-futex++.Txt
%APPDATA%\Microsoft\-!RecOveR!-futex++.Txt
%APPDATA%\Microsoft\-!RecOveR!-futex++.Png
%APPDATA%\Mozilla\Extensions\-!RecOveR!-futex++.Png
%APPDATA%\Microsoft\-!RecOveR!-futex++.Htm
%APPDATA%\Microsoft\SystemCertificates\My\-!RecOveR!-futex++.Htm
%APPDATA%\Microsoft\MMC\-!RecOveR!-futex++.Htm
%APPDATA%\Microsoft\MMC\-!RecOveR!-futex++.Txt
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\-!RecOveR!-futex++.Txt
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\-!RecOveR!-futex++.Png
%APPDATA%\Microsoft\MMC\-!RecOveR!-futex++.Png
%APPDATA%\Microsoft\Media Player\-!RecOveR!-futex++.Png
%APPDATA%\Microsoft\Internet Explorer\-!RecOveR!-futex++.Htm
%APPDATA%\Microsoft\Media Player\-!RecOveR!-futex++.Htm
%APPDATA%\Microsoft\Media Player\-!RecOveR!-futex++.Txt
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\-!RecOveR!-futex++.Htm
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\-!RecOveR!-futex++.Txt
%APPDATA%\Microsoft\SystemCertificates\My\-!RecOveR!-futex++.Txt
%APPDATA%\Microsoft\SystemCertificates\My\-!RecOveR!-futex++.Png
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\-!RecOveR!-futex++.Png
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\-!RecOveR!-futex++.Png
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\-!RecOveR!-futex++.Htm
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\-!RecOveR!-futex++.Htm
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\-!RecOveR!-futex++.Txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\-!RecOveR!-futex++.Png
%HOMEPATH%\Favorites\-!RecOveR!-futex++.Htm
%HOMEPATH%\Favorites\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\-!RecOveR!-futex++.Png
%HOMEPATH%\Favorites\-!RecOveR!-futex++.Png
%HOMEPATH%\Favorites\Links\-!RecOveR!-futex++.Png
%HOMEPATH%\Cookies\-!RecOveR!-futex++.Htm
%HOMEPATH%\Favorites\Links\-!RecOveR!-futex++.Htm
%HOMEPATH%\Favorites\Links\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Identities\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Identities\-!RecOveR!-futex++.Png
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\-!RecOveR!-futex++.Png
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\-!RecOveR!-futex++.Png
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\-!RecOveR!-futex++.Txt
%HOMEPATH%\Cookies\-!RecOveR!-futex++.Txt
%APPDATA%\Mozilla\Firefox\Profiles\-!RecOveR!-futex++.Txt
%APPDATA%\Mozilla\Firefox\Profiles\-!RecOveR!-futex++.Png
%APPDATA%\Mozilla\Firefox\-!RecOveR!-futex++.Png
%APPDATA%\Mozilla\Firefox\Profiles\-!RecOveR!-futex++.Htm
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\-!RecOveR!-futex++.Htm
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\-!RecOveR!-futex++.Htm
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\-!RecOveR!-futex++.Txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\-!RecOveR!-futex++.Txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\-!RecOveR!-futex++.Png
%APPDATA%\-!RecOveR!-futex++.Txt
%APPDATA%\-!RecOveR!-futex++.Png
%HOMEPATH%\Cookies\-!RecOveR!-futex++.Png
%APPDATA%\-!RecOveR!-futex++.Htm
%APPDATA%\Mozilla\-!RecOveR!-futex++.Htm
%APPDATA%\Mozilla\Firefox\-!RecOveR!-futex++.Htm
%APPDATA%\Mozilla\Firefox\-!RecOveR!-futex++.Txt
%APPDATA%\Mozilla\-!RecOveR!-futex++.Txt
%APPDATA%\Mozilla\-!RecOveR!-futex++.Png
%APPDATA%\Microsoft\Internet Explorer\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Local Settings\History\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Local Settings\History\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Local Settings\Application Data\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Local Settings\Application Data\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Local Settings\Application Data\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Local Settings\Temp\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Local Settings\History\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Local Settings\Temp\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Local Settings\Temp\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Cookies\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Cookies\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Cookies\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Application Data\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Application Data\Microsoft\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Application Data\Microsoft\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Application Data\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Application Data\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\-!RecOveR!-futex++.Htm
%APPDATA%\Microsoft\Address Book\-!RecOveR!-futex++.Txt
%APPDATA%\Microsoft\Address Book\-!RecOveR!-futex++.Png
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\-!RecOveR!-futex++.Png
%APPDATA%\Microsoft\Address Book\-!RecOveR!-futex++.Htm
%APPDATA%\Identities\-!RecOveR!-futex++.Htm
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\-!RecOveR!-futex++.Htm
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\-!RecOveR!-futex++.Txt
%APPDATA%\Identities\-!RecOveR!-futex++.Txt
%APPDATA%\Identities\-!RecOveR!-futex++.Png
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\-!RecOveR!-futex++.Txt
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\-!RecOveR!-futex++.Png
%APPDATA%\Microsoft\Internet Explorer\-!RecOveR!-futex++.Png
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\-!RecOveR!-futex++.Htm
%APPDATA%\Microsoft\Credentials\-!RecOveR!-futex++.Htm
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\-!RecOveR!-futex++.Htm
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\-!RecOveR!-futex++.Txt
%APPDATA%\Microsoft\Credentials\-!RecOveR!-futex++.Txt
%APPDATA%\Microsoft\Credentials\-!RecOveR!-futex++.Png
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Local Settings\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Local Settings\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Local Settings\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\-!RecOveR!-futex++.Htm
%HOMEPATH%\Local Settings\History\-!RecOveR!-futex++.Txt
%HOMEPATH%\Local Settings\History\-!RecOveR!-futex++.Png
%TEMP%\-!RecOveR!-futex++.Png
%HOMEPATH%\Local Settings\History\-!RecOveR!-futex++.Htm
%HOMEPATH%\Local Settings\History\History.IE5\-!RecOveR!-futex++.Htm
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\-!RecOveR!-futex++.Htm
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\-!RecOveR!-futex++.Txt
%HOMEPATH%\Local Settings\History\History.IE5\-!RecOveR!-futex++.Txt
%HOMEPATH%\Local Settings\History\History.IE5\-!RecOveR!-futex++.Png
%HOMEPATH%\My Documents\Downloads\-!RecOveR!-futex++.Txt
%HOMEPATH%\My Documents\Downloads\-!RecOveR!-futex++.Png
%HOMEPATH%\My Documents\My Music\-!RecOveR!-futex++.Png
%HOMEPATH%\My Documents\Downloads\-!RecOveR!-futex++.Htm
%HOMEPATH%\Local Settings\-!RecOveR!-futex++.Htm
%TEMP%\-!RecOveR!-futex++.Htm
%TEMP%\-!RecOveR!-futex++.Txt
%HOMEPATH%\Local Settings\-!RecOveR!-futex++.Txt
%HOMEPATH%\Local Settings\-!RecOveR!-futex++.Png
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\Firefox\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\Firefox\Profiles\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Mozilla\Firefox\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Mozilla\Firefox\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\Firefox\Profiles\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\-!RecOveR!-futex++.Htm
<LS_APPDATA>\-!RecOveR!-futex++.Png
<LS_APPDATA>\VMware\-!RecOveR!-futex++.Htm
<LS_APPDATA>\-!RecOveR!-futex++.Htm
<LS_APPDATA>\-!RecOveR!-futex++.Txt
<LS_APPDATA>\VMware\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\-!RecOveR!-futex++.Png
<LS_APPDATA>\VMware\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\-!RecOveR!-futex++.Htm
%HOMEPATH%\My Documents\My Music\-!RecOveR!-futex++.Txt
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\-!RecOveR!-futex++.Png
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\-!RecOveR!-futex++.Htm
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\-!RecOveR!-futex++.Htm
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\-!RecOveR!-futex++.Txt
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\-!RecOveR!-futex++.Txt
%HOMEPATH%\SendTo\-!RecOveR!-futex++.Txt
%HOMEPATH%\SendTo\-!RecOveR!-futex++.Png
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\-!RecOveR!-futex++.Png
%HOMEPATH%\SendTo\-!RecOveR!-futex++.Htm
%HOMEPATH%\Start Menu\-!RecOveR!-futex++.Png
%HOMEPATH%\Start Menu\Programs\-!RecOveR!-futex++.Htm
%HOMEPATH%\Start Menu\-!RecOveR!-futex++.Htm
%HOMEPATH%\Start Menu\-!RecOveR!-futex++.Txt
%HOMEPATH%\Start Menu\Programs\-!RecOveR!-futex++.Txt
%HOMEPATH%\Start Menu\Programs\Accessories\-!RecOveR!-futex++.Txt
%HOMEPATH%\Start Menu\Programs\Accessories\-!RecOveR!-futex++.Png
%HOMEPATH%\Start Menu\Programs\-!RecOveR!-futex++.Png
%HOMEPATH%\Start Menu\Programs\Accessories\-!RecOveR!-futex++.Htm
%HOMEPATH%\Recent\-!RecOveR!-futex++.Htm
%HOMEPATH%\My Documents\My Received Files\-!RecOveR!-futex++.Htm
%HOMEPATH%\My Documents\My Received Files\-!RecOveR!-futex++.Txt
%HOMEPATH%\My Documents\-!RecOveR!-futex++.Txt
%HOMEPATH%\My Documents\-!RecOveR!-futex++.Png
%HOMEPATH%\My Documents\My Received Files\-!RecOveR!-futex++.Png
%HOMEPATH%\My Documents\My Pictures\-!RecOveR!-futex++.Png
%HOMEPATH%\My Documents\My Music\-!RecOveR!-futex++.Htm
%HOMEPATH%\My Documents\My Pictures\-!RecOveR!-futex++.Htm
%HOMEPATH%\My Documents\My Pictures\-!RecOveR!-futex++.Txt
%HOMEPATH%\PrintHood\-!RecOveR!-futex++.Htm
%HOMEPATH%\PrintHood\-!RecOveR!-futex++.Txt
%HOMEPATH%\Recent\-!RecOveR!-futex++.Txt
%HOMEPATH%\Recent\-!RecOveR!-futex++.Png
%HOMEPATH%\PrintHood\-!RecOveR!-futex++.Png
%HOMEPATH%\NetHood\-!RecOveR!-futex++.Png
%HOMEPATH%\My Documents\-!RecOveR!-futex++.Htm
%HOMEPATH%\NetHood\-!RecOveR!-futex++.Htm
%HOMEPATH%\NetHood\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Microsoft\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Microsoft\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\-!RecOveR!-futex++.Png
<LS_APPDATA>\Microsoft\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Microsoft\Windows Media\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Microsoft\Credentials\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Microsoft\Credentials\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Microsoft\Media Player\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Microsoft\Media Player\-!RecOveR!-futex++.Png
<LS_APPDATA>\Microsoft\Credentials\-!RecOveR!-futex++.Png
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\-!RecOveR!-futex++.Png
<LS_APPDATA>\Identities\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Microsoft\Windows Media\9.0\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Microsoft\Windows Media\9.0\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Microsoft\Windows Media\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Microsoft\Windows Media\-!RecOveR!-futex++.Png
<LS_APPDATA>\Microsoft\Windows Media\9.0\-!RecOveR!-futex++.Png
<LS_APPDATA>\Microsoft\Windows\-!RecOveR!-futex++.Png
<LS_APPDATA>\Microsoft\Media Player\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Microsoft\Windows\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Microsoft\Windows\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\-!RecOveR!-futex++.Png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\-!RecOveR!-futex++.Htm
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\-!RecOveR!-futex++.Txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Cookies\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Application Data\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Cookies\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Cookies\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Application Data\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Application Data\Microsoft\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Application Data\Microsoft\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Application Data\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Application Data\Microsoft\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Favorites\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Favorites\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Favorites\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Local Settings\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Local Settings\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Local Settings\Application Data\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Local Settings\Application Data\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Local Settings\Application Data\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Local Settings\Temp\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Local Settings\Temp\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Local Settings\Temp\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Local Settings\History\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Local Settings\History\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Local Settings\History\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\Documents\My Pictures\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\Documents\My Pictures\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\Documents\My Music\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Documents\My Music\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Documents\My Music\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\Documents\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Documents\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\DRM\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\DRM\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\Documents\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\Documents\My Videos\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\Documents\My Pictures\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Documents\My Videos\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Documents\My Videos\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\-!RecOveR!-futex++.Txt
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\eac[1].htm
<Current directory>\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\-!RecOveR!-futex++.Png
<Current directory>\-!RecOveR!-futex++.Txt
%HOMEPATH%\My Documents\desctop._ini
%HOMEPATH%\My Documents\dsbwtoekgyeh.exe
<Current directory>\-!RecOveR!-futex++.Png
%HOMEPATH%\My Documents\-!recover!-!file!-.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\-!RecOveR!-futex++.Htm
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\mzpfile[1].htm
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\DRM\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Start Menu\Programs\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\Start Menu\Programs\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\Start Menu\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\Start Menu\Programs\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Start Menu\Programs\Games\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Templates\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Start Menu\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Start Menu\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\Templates\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\Templates\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\Favorites\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\Favorites\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\Favorites\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\-!RecOveR!-futex++.Htm
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\-!RecOveR!-futex++.Txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\-!RecOveR!-futex++.Png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Local Settings\Temp\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Local Settings\History\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Local Settings\History\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Local Settings\Temp\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Local Settings\Temp\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Local Settings\History\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Local Settings\Application Data\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Local Settings\Application Data\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Local Settings\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Local Settings\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Local Settings\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\-!RecOveR!-futex++.Txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\-!RecOveR!-futex++.Png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\-!RecOveR!-futex++.Htm
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Cookies\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Templates\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Start Menu\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Templates\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Templates\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Start Menu\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Start Menu\Programs\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Start Menu\Programs\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Start Menu\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Start Menu\Programs\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\NetHood\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\NetHood\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\PrintHood\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\PrintHood\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\NetHood\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\My Documents\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Local Settings\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\My Documents\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\My Documents\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\SendTo\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\SendTo\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\SendTo\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\Recent\-!RecOveR!-futex++.Png
C:\Documents and Settings\Default User\PrintHood\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Recent\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\Recent\-!RecOveR!-futex++.Txt
C:\Documents and Settings\Default User\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Application Data\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Application Data\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Cookies\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Cookies\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Application Data\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Application Data\Microsoft\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Application Data\Microsoft\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Application Data\Microsoft\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\-!RecOveR!-futex++.Htm
C:\Documents and Settings\Default User\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\-!RecOveR!-futex++.Png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\-!RecOveR!-futex++.Htm
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\-!RecOveR!-futex++.Txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\-!RecOveR!-futex++.Png

Sets the 'hidden' attribute to the following files:

%HOMEPATH%\My Documents\dsbwtoekgyeh.exe

Deletes itself.

Network activity:

Connects to:

'ar##abc.com':80
'bl###room.club':80
'bl#####gshealthuk.com':80
'bo####rtablier.com':80
'ca###che.com':80
'an##ug.net':80

TCP:

HTTP POST requests:

http://ar##abc.com/wp-content/themes/twentyfourteen/mzpfile.php
http://bl###room.club/mzpfile.php
http://bl#####gshealthuk.com/mzpfile.php
http://bo####rtablier.com/wp-content/uploads/eac.php
http://ca###che.com/wp-admin/eac.php
http://an##ug.net/wp-content/uploads/eac.php

UDP:

DNS ASK ar##abc.com
DNS ASK bl###room.club
DNS ASK bl#####gshealthuk.com
DNS ASK bo####rtablier.com
DNS ASK ca###che.com
DNS ASK an##ug.net

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial