TROJ_AGENT.AQOG

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %System Root%\Documents and Settings\Documents and Settings.scr
• %User Profile%\Administrator.scr
• %User Profile%\Application Data\Application Data.scr
• %User Profile%\Identities\Identities.scr
• %User Profile%\{341F68BA-C841-4200-A7B4-3D5CFF202166}\{341F68BA-C841-4200-A7B4-3D5CFF202166}.scr
• %User Profile%\Microsoft\Microsoft.scr
• %User Profile%\Address Book\Address Book.scr
• %User Profile%\Credentials\Credentials.scr
• %User Profile%\S-1-5-21-4025279379-4087772427-2915903831-500\S-1-5-21-4025279379-4087772427-2915903831-500.scr
• %User Profile%\S-1-5-21-436374069-362288127-839522115-500\S-1-5-21-436374069-362288127-839522115-500.scr
• %User Profile%\Internet Explorer\Internet Explorer.scr
• %User Profile%\Quick Launch\Quick Launch.scr
• %User Profile%\Media Player\Media Player.scr
• %User Profile%\MMC\MMC.scr
• %User Profile%\SystemCertificates\SystemCertificates.scr
• %User Profile%\My\My.scr
• %User Profile%\Certificates\Certificates.scr
• %User Profile%\CRLs\CRLs.scr
• %User Profile%\CTLs\CTLs.scr
• %User Profile%\Windows\Windows.scr
• %User Profile%\Themes\Themes.scr
• %User Profile%\Cookies\Cookies.scr
• %Desktop%\Desktop.scr
• %Favorites%\Favorites.scr
• %Favorites%\Links\Links.scr
• %User Profile%\Local Settings\Local Settings.scr
• %Application Data%\Application Data.scr
• %Application Data%\Identities\Identities.scr
• %Application Data%\Identities\{341F68BA-C841-4200-A7B4-3D5CFF202166}\{341F68BA-C841-4200-A7B4-3D5CFF202166}.scr
• %Application Data%\Identities\{341F68BA-C841-4200-A7B4-3D5CFF202166}\Microsoft\Microsoft.scr
• %Application Data%\Identities\{341F68BA-C841-4200-A7B4-3D5CFF202166}\Microsoft\Outlook Express\Outlook Express.scr
• %Application Data%\Microsoft\Microsoft.scr
• %Application Data%\Microsoft\CD Burning\CD Burning.scr
• %Application Data%\Microsoft\Credentials\Credentials.scr
• %Application Data%\Microsoft\Credentials\S-1-5-21-4025279379-4087772427-2915903831-500\S-1-5-21-4025279379-4087772427-2915903831-500.scr
• %Application Data%\Microsoft\Credentials\S-1-5-21-436374069-362288127-839522115-500\S-1-5-21-436374069-362288127-839522115-500.scr
• %Application Data%\Microsoft\Internet Explorer\Internet Explorer.scr
• %Application Data%\Microsoft\Media Player\Media Player.scr
• %Application Data%\Microsoft\Windows\Windows.scr
• %Application Data%\Microsoft\Windows Media\Windows Media.scr
• %Application Data%\Microsoft\Windows Media\9.0\9.0.scr
• %User Profile%\History\History.scr
• %User Profile%\History.IE5\History.IE5.scr
• %User Profile%\MSHist012010121320101220\MSHist012010121320101220.scr
• %User Profile%\MSHist012010122720110103\MSHist012010122720110103.scr
• %User Profile%\MSHist012011010720110108\MSHist012011010720110108.scr
• %User Temp%\Temp.scr
• %User Temp%\_$Df\_$Df.scr
• %Temporary Internet Files%\Temporary Internet Files.scr
• %Temporary Internet Files%\Content.IE5\Content.IE5.scr
• %Temporary Internet Files%\Content.IE5\2TPM8950\2TPM8950.scr
• %Temporary Internet Files%\Content.IE5\4H9MXTT9\4H9MXTT9.scr
• %Temporary Internet Files%\Content.IE5\SMCZPN4M\SMCZPN4M.scr
• %Temporary Internet Files%\Content.IE5\X9QQH2D9\X9QQH2D9.scr
• %User Profile%\My Documents\My Documents.scr
• %User Profile%\My Music\My Music.scr
• %User Profile%\My Pictures\My Pictures.scr
• %User Profile%\NetHood\NetHood.scr
• %User Profile%\PrintHood\PrintHood.scr
• %User Profile%\Recent\Recent.scr
• %User Profile%\SendTo\SendTo.scr
• %Start Menu%\Start Menu.scr
• %Start Menu%\Programs\Programs.scr
• %Start Menu%\Programs\Accessories\Accessories.scr
• %Start Menu%\Programs\Accessories\Accessibility\Accessibility.scr
• %Start Menu%\Programs\Accessories\Entertainment\Entertainment.scr
• %User Profile%\Templates\Templates.scr
• %User Profile%\All Users.scr
• %User Profile%\Crypto\Crypto.scr
• %User Profile%\DSS\DSS.scr
• %User Profile%\MachineKeys\MachineKeys.scr
• %User Profile%\RSA\RSA.scr
• %User Profile%\S-1-5-18\S-1-5-18.scr
• %User Profile%\HTML Help\HTML Help.scr
• %User Profile%\Media Index\Media Index.scr
• %User Profile%\Network\Network.scr
• %User Profile%\Connections\Connections.scr
• %User Profile%\Cm\Cm.scr
• %User Profile%\Pbk\Pbk.scr
• %User Profile%\Downloader\Downloader.scr
• %User Profile%\User Account Pictures\User Account Pictures.scr
• %User Profile%\Default Pictures\Default Pictures.scr
• %User Profile%\Documents\Documents.scr
• %User Profile%\My Playlists\My Playlists.scr
• %User Profile%\Sample Music\Sample Music.scr
• %User Profile%\Sample Playlists\Sample Playlists.scr
• %User Profile%\002BDCF1\002BDCF1.scr
• %User Profile%\Sample Pictures\Sample Pictures.scr
• %User Profile%\My Videos\My Videos.scr
• %User Profile%\DRM\DRM.scr
• %Start Menu%\Programs\Accessories\Communications\Communications.scr
• %Start Menu%\Programs\Accessories\System Tools\System Tools.scr
• %Start Menu%\Programs\Administrative Tools\Administrative Tools.scr
• %Start Menu%\Programs\Games\Games.scr
• %Start Menu%\Programs\WinPcap\WinPcap.scr
• %User Profile%\Default User.scr
• %User Profile%\MSHist012010120620101213\MSHist012010120620101213.scr
• %User Profile%\MSHist012010121320101214\MSHist012010121320101214.scr
• %User Profile%\LocalService.scr
• %User Profile%\S-1-5-19\S-1-5-19.scr
• %Application Data%\Microsoft\Credentials\S-1-5-19\S-1-5-19.scr
• %Temporary Internet Files%\Content.IE5\2BAREZOP\2BAREZOP.scr
• %Temporary Internet Files%\Content.IE5\IX09SXE9\IX09SXE9.scr
• %Temporary Internet Files%\Content.IE5\M94XI96V\M94XI96V.scr
• %Temporary Internet Files%\Content.IE5\O7EHUPCN\O7EHUPCN.scr
• %User Profile%\NetworkService.scr
• %User Profile%\S-1-5-20\S-1-5-20.scr
• %Application Data%\Microsoft\Credentials\S-1-5-20\S-1-5-20.scr
• %User Profile%\rsa.scr
• %User Profile%\{736CCBC7-ECC5-4A94-8856-77115D1B5FF1}\{736CCBC7-ECC5-4A94-8856-77115D1B5FF1}.scr
• %User Profile%\S-1-5-21-436374069-362288127-839522115-1003\S-1-5-21-436374069-362288127-839522115-1003.scr
• %Application Data%\Identities\{736CCBC7-ECC5-4A94-8856-77115D1B5FF1}\{736CCBC7-ECC5-4A94-8856-77115D1B5FF1}.scr
• %Application Data%\Identities\{736CCBC7-ECC5-4A94-8856-77115D1B5FF1}\Microsoft\Microsoft.scr
• %Application Data%\Identities\{736CCBC7-ECC5-4A94-8856-77115D1B5FF1}\Microsoft\Outlook Express\Outlook Express.scr
• %Application Data%\Microsoft\Credentials\S-1-5-21-436374069-362288127-839522115-1003\S-1-5-21-436374069-362288127-839522115-1003.scr
• %User Profile%\rsa.RSA-CWSCLNTTEST.scr
• %User Profile%\S-1-5-21-4025279379-4087772427-2915903831-1005\S-1-5-21-4025279379-4087772427-2915903831-1005.scr
• %Application Data%\Microsoft\Credentials\S-1-5-21-4025279379-4087772427-2915903831-1005\S-1-5-21-4025279379-4087772427-2915903831-1005.scr
• %User Profile%\MSHist012010122820101229\MSHist012010122820101229.scr
• %Program Files%\Program Files.scr
• %Program Files%\Common Files\Common Files.scr
• %Program Files%\Common Files\Microsoft Shared\Microsoft Shared.scr
• %Program Files%\Common Files\Microsoft Shared\DAO\DAO.scr
• %Program Files%\Common Files\Microsoft Shared\MSInfo\MSInfo.scr
• %Program Files%\Common Files\Microsoft Shared\Speech\Speech.scr
• %Program Files%\Common Files\Microsoft Shared\Speech\1033\1033.scr
• %Program Files%\Common Files\Microsoft Shared\Stationery\Stationery.scr
• %Program Files%\Common Files\Microsoft Shared\TextConv\TextConv.scr
• %Program Files%\Common Files\Microsoft Shared\Triedit\Triedit.scr
• %Program Files%\Common Files\Microsoft Shared\VC\VC.scr
• %Program Files%\Common Files\Microsoft Shared\VGX\VGX.scr
• %Program Files%\Common Files\Microsoft Shared\Web Folders\Web Folders.scr
• %Program Files%\Common Files\Microsoft Shared\web server extensions\web server extensions.scr
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\40.scr
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\admcgi\admcgi.scr
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\admcgi\scripts\scripts.scr
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\admisapi\admisapi.scr
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\admisapi\scripts\scripts.scr
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\bin\bin.scr
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\bin\1033\1033.scr
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\bots\bots.scr
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\bots\vinavbar\vinavbar.scr
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\isapi\isapi.scr
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\isapi\_vti_adm\_vti_adm.scr
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\isapi\_vti_aut\_vti_aut.scr
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\servsupp\servsupp.scr
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\_vti_bin\_vti_bin.scr
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\_vti_bin\_vti_adm\_vti_adm.scr
• %Program Files%\Common Files\Microsoft Shared\web server extensions\40\_vti_bin\_vti_aut\_vti_aut.scr
• %Program Files%\Common Files\MSSoap\MSSoap.scr
• %Program Files%\Common Files\MSSoap\Binaries\Binaries.scr
• %Program Files%\Common Files\MSSoap\Binaries\Resources\Resources.scr
• %Program Files%\Common Files\MSSoap\Binaries\Resources\1033\1033.scr
• %Program Files%\Common Files\ODBC\ODBC.scr
• %Program Files%\Common Files\ODBC\Data Sources\Data Sources.scr
• %Program Files%\Common Files\Services\Services.scr
• %Program Files%\Common Files\SpeechEngines\SpeechEngines.scr
• %Program Files%\Common Files\SpeechEngines\Microsoft\Microsoft.scr
• %Program Files%\Common Files\SpeechEngines\Microsoft\Lexicon\Lexicon.scr
• %Program Files%\Common Files\SpeechEngines\Microsoft\Lexicon\1033\1033.scr
• %Program Files%\Common Files\SpeechEngines\Microsoft\TTS\TTS.scr
• %Program Files%\Common Files\SpeechEngines\Microsoft\TTS\1033\1033.scr
• %Program Files%\Common Files\System\System.scr
• %Program Files%\Common Files\System\ado\ado.scr
• %Program Files%\Common Files\System\msadc\msadc.scr
• %Program Files%\Common Files\System\Ole DB\Ole DB.scr
• %Program Files%\ComPlus Applications\ComPlus Applications.scr
• %Program Files%\Internet Explorer\Internet Explorer.scr
• %Program Files%\Internet Explorer\Connection Wizard\Connection Wizard.scr
• %Program Files%\Internet Explorer\PLUGINS\PLUGINS.scr
• %Program Files%\Internet Explorer\SIGNUP\SIGNUP.scr
• %Program Files%\Messenger\Messenger.scr
• %Program Files%\microsoft frontpage\microsoft frontpage.scr
• %Program Files%\microsoft frontpage\version3.0\version3.0.scr
• %Program Files%\microsoft frontpage\version3.0\bin\bin.scr
• %Program Files%\Movie Maker\Movie Maker.scr
• %Program Files%\Movie Maker\MUI\MUI.scr
• %Program Files%\Movie Maker\MUI\0409\0409.scr
• %Program Files%\Movie Maker\Shared\Shared.scr
• %Program Files%\Movie Maker\Shared\Profiles\Profiles.scr
• %Program Files%\MSN\MSN.scr
• %Program Files%\MSN\MSNCoreFiles\MSNCoreFiles.scr
• %Program Files%\MSN\MSNCoreFiles\Install\Install.scr
• %Program Files%\MSN\MSNCoreFiles\Install\MSN9Components\MSN9Components.scr
• %Program Files%\MSN\MSNCoreFiles\OOBE\OOBE.scr
• %Program Files%\MSN Gaming Zone\MSN Gaming Zone.scr
• %Program Files%\MSN Gaming Zone\Windows\Windows.scr
• %Program Files%\NetMeeting\NetMeeting.scr
• %Program Files%\Online Services\Online Services.scr
• %Program Files%\Outlook Express\Outlook Express.scr
• %Program Files%\Uninstall Information\Uninstall Information.scr
• %Program Files%\Windows Media Player\Windows Media Player.scr
• %Program Files%\Windows Media Player\Icons\Icons.scr
• %Program Files%\Windows Media Player\Sample Playlists\Sample Playlists.scr
• %Program Files%\Windows Media Player\Skins\Skins.scr
• %Program Files%\Windows Media Player\Visualizations\Visualizations.scr
• %Program Files%\Windows NT\Windows NT.scr
• %Program Files%\Windows NT\Accessories\Accessories.scr
• %Program Files%\Windows NT\Pinball\Pinball.scr
• %Program Files%\WindowsUpdate\WindowsUpdate.scr
• %Program Files%\WinPcap\WinPcap.scr
• %Program Files%\xerox\xerox.scr
• %Program Files%\xerox\nwwia\nwwia.scr
• %System Root%\RECYCLER\RECYCLER.scr
• %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-1003\S-1-5-21-436374069-362288127-839522115-1003.scr
• %System Root%\RECYCLER\S-1-5-21-436374069-362288127-839522115-500\S-1-5-21-436374069-362288127-839522115-500.scr
• %System Root%\System Volume Information\System Volume Information.scr
• %Windows%\WINDOWS.scr
• %Windows%\addins\addins.scr
• %Windows%\AppPatch\AppPatch.scr
• %Windows%\Config\Config.scr
• %Windows%\Connection Wizard\Connection Wizard.scr
• %Windows%\Cursors\Cursors.scr
• %Windows%\Debug\Debug.scr
• %Windows%\Debug\UserMode\UserMode.scr
• %Windows%\Downloaded Program Files\Downloaded Program Files.scr
• %Windows%\Driver Cache\Driver Cache.scr
• %Windows%\Driver Cache\i386\i386.scr
• %Windows%\ehome\ehome.scr
• %Windows%\Fonts\Fonts.scr
• %Windows%\Help\Help.scr
• %Windows%\Help\Tours\Tours.scr
• %Windows%\Help\Tours\htmlTour\htmlTour.scr
• %Windows%\Help\Tours\mmTour\mmTour.scr
• %Windows%\Help\Tours\WindowsMediaPlayer\WindowsMediaPlayer.scr
• %Windows%\Help\Tours\WindowsMediaPlayer\Audio\Audio.scr
• %Windows%\Help\Tours\WindowsMediaPlayer\Audio\Wav\Wav.scr
• %Windows%\Help\Tours\WindowsMediaPlayer\Cnt\Cnt.scr
• %Windows%\Help\Tours\WindowsMediaPlayer\Css\Css.scr
• %Windows%\Help\Tours\WindowsMediaPlayer\Img\Img.scr
• %Windows%\Help\Tours\WindowsMediaPlayer\Img\Btn\Btn.scr
• %Windows%\Help\Tours\WindowsMediaPlayer\Img\WMarks\WMarks.scr
• %Windows%\Help\Tours\WindowsMediaPlayer\Scr\Scr.scr
• %Windows%\Help\Tours\WindowsMediaPlayer\Video\Video.scr
• %Windows%\ime\ime.scr
• %Windows%\ime\chsime\chsime.scr
• %Windows%\ime\chsime\applets\applets.scr
• %Windows%\ime\CHTIME\CHTIME.scr
• %Windows%\ime\CHTIME\Applets\Applets.scr
• %Windows%\ime\imejp\imejp.scr
• %Windows%\ime\imejp\applets\applets.scr
• %Windows%\ime\imejp98\imejp98.scr
• %Windows%\ime\imjp8_1\imjp8_1.scr
• %Windows%\ime\imjp8_1\applets\applets.scr
• %Windows%\ime\imkr6_1\imkr6_1.scr
• %Windows%\ime\imkr6_1\applets\applets.scr
• %Windows%\ime\imkr6_1\dicts\dicts.scr
• %Windows%\ime\shared\shared.scr
• %Windows%\ime\shared\res\res.scr
• %Windows%\inf\inf.scr
• %Windows%\Installer\Installer.scr
• %Windows%\Installer\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}.scr
• %Windows%\Installer\{FE2F6A2C-196E-4210-9C04-2B1BC21F07EF}\{FE2F6A2C-196E-4210-9C04-2B1BC21F07EF}.scr
• %Windows%\java\java.scr
• %Windows%\java\classes\classes.scr
• %Windows%\java\trustlib\trustlib.scr
• %Windows%\Media\Media.scr
• %Windows%\msagent\msagent.scr
• %Windows%\msagent\chars\chars.scr
• %Windows%\msagent\intl\intl.scr
• %Windows%\msapps\msapps.scr
• %Windows%\msapps\msinfo\msinfo.scr
• %Windows%\mui\mui.scr
• %Windows%\Offline Web Pages\Offline Web Pages.scr
• %Windows%\pchealth\pchealth.scr
• %Windows%\pchealth\helpctr\helpctr.scr
• %Windows%\pchealth\helpctr\BATCH\BATCH.scr
• %Windows%\pchealth\helpctr\binaries\binaries.scr
• %Windows%\pchealth\helpctr\Config\Config.scr
• %Windows%\pchealth\helpctr\Config\Cache\Cache.scr
• %Windows%\pchealth\helpctr\Config\CheckPoint\CheckPoint.scr
• %Windows%\pchealth\helpctr\Database\Database.scr
• %Windows%\pchealth\helpctr\DataColl\DataColl.scr
• %Windows%\pchealth\helpctr\HelpFiles\HelpFiles.scr
• %Windows%\pchealth\helpctr\Indices\Indices.scr
• %Windows%\pchealth\helpctr\InstalledSKUs\InstalledSKUs.scr
• %Windows%\pchealth\helpctr\Logs\Logs.scr
• %Windows%\pchealth\helpctr\OfflineCache\OfflineCache.scr
• %Windows%\pchealth\helpctr\OfflineCache\Professional_32#0409\Professional_32#0409.scr
• %Windows%\pchealth\helpctr\PackageStore\PackageStore.scr
• %Windows%\pchealth\helpctr\System\System.scr
• %Windows%\pchealth\helpctr\System\blurbs\blurbs.scr
• %Windows%\pchealth\helpctr\System\CompatCtr\CompatCtr.scr
• %Windows%\pchealth\helpctr\System\css\css.scr
• %Windows%\pchealth\helpctr\System\DFS\DFS.scr
• %Windows%\pchealth\helpctr\System\dialogs\dialogs.scr
• %Windows%\pchealth\helpctr\System\DVDUpgrd\DVDUpgrd.scr
• %Windows%\pchealth\helpctr\System\ErrMsg\ErrMsg.scr
• %Windows%\pchealth\helpctr\System\errors\errors.scr
• %Windows%\pchealth\helpctr\System\images\images.scr
• %Windows%\pchealth\helpctr\System\images\16x16\16x16.scr
• %Windows%\pchealth\helpctr\System\images\24x24\24x24.scr
• %Windows%\pchealth\helpctr\System\images\32x32\32x32.scr
• %Windows%\pchealth\helpctr\System\images\48x48\48x48.scr
• %Windows%\pchealth\helpctr\System\images\Centers\Centers.scr
• %Windows%\pchealth\helpctr\System\images\Expando\Expando.scr
• %Windows%\pchealth\helpctr\System\NetDiag\NetDiag.scr
• %Windows%\pchealth\helpctr\System\panels\panels.scr
• %Windows%\pchealth\helpctr\System\panels\subpanels\subpanels.scr
• %Windows%\pchealth\helpctr\System\rc\rc.scr
• %Windows%\pchealth\helpctr\System\Remote Assistance\Remote Assistance.scr
• %Windows%\pchealth\helpctr\System\Remote Assistance\Common\Common.scr
• %Windows%\pchealth\helpctr\System\Remote Assistance\Css\Css.scr
• %Windows%\pchealth\helpctr\System\Remote Assistance\Interaction\Interaction.scr
• %Windows%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\Client.scr
• %Windows%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Common.scr
• %Windows%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\Server.scr
• %Windows%\pchealth\helpctr\System\scripts\scripts.scr
• %Windows%\pchealth\helpctr\System\sysinfo\sysinfo.scr
• %Windows%\pchealth\helpctr\System\sysinfo\graphics\graphics.scr
• %Windows%\pchealth\helpctr\System\sysinfo\graphics\33x16pie\33x16pie.scr
• %Windows%\pchealth\helpctr\System\sysinfo\graphics\47x24pie\47x24pie.scr
• %Windows%\pchealth\helpctr\System\UpdateCtr\UpdateCtr.scr
• %Windows%\pchealth\helpctr\System_OEM\System_OEM.scr
• %Windows%\pchealth\helpctr\Temp\Temp.scr
• %Windows%\pchealth\helpctr\Vendors\Vendors.scr
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US.scr
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Remote Assistance.scr
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\Common.scr
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Css\Css.scr
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Escalation.scr
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Common.scr
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\Email.scr
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Unsolicited\Unsolicited.scr
• %Windows%\pchealth\UploadLB\UploadLB.scr
• %Windows%\pchealth\UploadLB\Binaries\Binaries.scr
• %Windows%\pchealth\UploadLB\Config\Config.scr
• %Windows%\PeerNet\PeerNet.scr
• %Windows%\Prefetch\Prefetch.scr
• %Windows%\Provisioning\Provisioning.scr
• %Windows%\Provisioning\Schemas\Schemas.scr
• %Windows%\pss\pss.scr
• %Windows%\Registration\Registration.scr
• %Windows%\Registration\CRMLog\CRMLog.scr
• %Windows%\repair\repair.scr
• %Windows%\Resources\Resources.scr
• %Windows%\Resources\Themes\Themes.scr
• %Windows%\Resources\Themes\Luna\Luna.scr
• %Windows%\Resources\Themes\Luna\Shell\Shell.scr
• %Windows%\Resources\Themes\Luna\Shell\Homestead\Homestead.scr
• %Windows%\Resources\Themes\Luna\Shell\Metallic\Metallic.scr
• %Windows%\Resources\Themes\Luna\Shell\NormalColor\NormalColor.scr
• %Windows%\security\security.scr
• %Windows%\security\Database\Database.scr
• %Windows%\security\logs\logs.scr
• %Windows%\security\templates\templates.scr
• %Windows%\SoftwareDistribution\SoftwareDistribution.scr
• %Windows%\SoftwareDistribution\DataStore\DataStore.scr
• %Windows%\SoftwareDistribution\DataStore\Logs\Logs.scr
• %Windows%\SoftwareDistribution\Download\Download.scr
• %Windows%\SoftwareDistribution\EventCache\EventCache.scr
• %Windows%\SoftwareDistribution\SelfUpdate\SelfUpdate.scr
• %Windows%\srchasst\srchasst.scr
• %Windows%\srchasst\chars\chars.scr
• %Windows%\srchasst\mui\mui.scr
• %Windows%\srchasst\mui\0409\0409.scr
• %System%\system.scr
• %System%\system32.scr
• %System%\1025\1025.scr
• %System%\1028\1028.scr
• %System%\1031\1031.scr
• %System%\1033\1033.scr
• %System%\1037\1037.scr
• %System%\1041\1041.scr
• %System%\1042\1042.scr
• %System%\1054\1054.scr
• %System%\2052\2052.scr
• %System%\3076\3076.scr
• %System%\3com_dmi\3com_dmi.scr
• %System%\CatRoot\CatRoot.scr
• %System%\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}.scr
• %System%\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}.scr
• %System%\CatRoot2\CatRoot2.scr
• %System%\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}.scr
• %System%\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}.scr
• %System%\Com\Com.scr
• %System%\config\config.scr
• %System%\config\systemprofile\systemprofile.scr
• %System%\config\systemprofile\Application Data\Application Data.scr
• %System%\config\systemprofile\Application Data\Identities\Identities.scr
• %System%\config\systemprofile\Application Data\Identities\{341F68BA-C841-4200-A7B4-3D5CFF202166}\{341F68BA-C841-4200-A7B4-3D5CFF202166}.scr
• %System%\config\systemprofile\Application Data\Microsoft\Microsoft.scr
• %System%\config\systemprofile\Application Data\Microsoft\Address Book\Address Book.scr
• %System%\config\systemprofile\Application Data\Microsoft\Credentials\Credentials.scr
• %System%\config\systemprofile\Application Data\Microsoft\Credentials\S-1-5-21-436374069-362288127-839522115-500\S-1-5-21-436374069-362288127-839522115-500.scr
• %System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\CryptnetUrlCache.scr
• %System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\Content.scr
• %System%\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\MetaData.scr
• %System%\config\systemprofile\Application Data\Microsoft\Internet Explorer\Internet Explorer.scr
• %System%\config\systemprofile\Application Data\Microsoft\Internet Explorer\Quick Launch\Quick Launch.scr
• %System%\config\systemprofile\Application Data\Microsoft\Media Player\Media Player.scr
• %System%\config\systemprofile\Application Data\Microsoft\MMC\MMC.scr
• %System%\config\systemprofile\Application Data\Microsoft\SystemCertificates\SystemCertificates.scr
• %System%\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\My.scr
• %System%\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\Certificates\Certificates.scr
• %System%\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLs.scr
• %System%\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLs.scr
• %System%\config\systemprofile\Application Data\Microsoft\Windows\Windows.scr
• %System%\config\systemprofile\Application Data\Microsoft\Windows\Themes\Themes.scr
• %System%\config\systemprofile\Cookies\Cookies.scr
• %System%\config\systemprofile\Desktop\Desktop.scr
• %System%\config\systemprofile\Favorites\Favorites.scr
• %System%\config\systemprofile\Favorites\Links\Links.scr
• %System%\config\systemprofile\Local Settings\Local Settings.scr
• %System%\config\systemprofile\Local Settings\Application Data\Application Data.scr
• %System%\config\systemprofile\Local Settings\Application Data\Identities\Identities.scr
• %System%\config\systemprofile\Local Settings\Application Data\Identities\{341F68BA-C841-4200-A7B4-3D5CFF202166}\{341F68BA-C841-4200-A7B4-3D5CFF202166}.scr
• %System%\config\systemprofile\Local Settings\Application Data\Identities\{341F68BA-C841-4200-A7B4-3D5CFF202166}\Microsoft\Microsoft.scr
• %System%\config\systemprofile\Local Settings\Application Data\Identities\{341F68BA-C841-4200-A7B4-3D5CFF202166}\Microsoft\Outlook Express\Outlook Express.scr
• %System%\config\systemprofile\Local Settings\Application Data\Microsoft\Microsoft.scr
• %System%\config\systemprofile\Local Settings\Application Data\Microsoft\CD Burning\CD Burning.scr
• %System%\config\systemprofile\Local Settings\Application Data\Microsoft\Credentials\Credentials.scr
• %System%\config\systemprofile\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-436374069-362288127-839522115-500\S-1-5-21-436374069-362288127-839522115-500.scr
• %System%\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\Internet Explorer.scr
• %System%\config\systemprofile\Local Settings\Application Data\Microsoft\Media Player\Media Player.scr
• %System%\config\systemprofile\Local Settings\Application Data\Microsoft\Windows\Windows.scr
• %System%\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\Windows Media.scr
• %System%\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\9.0\9.0.scr
• %System%\config\systemprofile\Local Settings\History\History.scr
• %System%\config\systemprofile\Local Settings\History\History.IE5\History.IE5.scr
• %System%\config\systemprofile\Local Settings\History\History.IE5\MSHist012010120620101213\MSHist012010120620101213.scr
• %System%\config\systemprofile\Local Settings\History\History.IE5\MSHist012010121320101214\MSHist012010121320101214.scr
• %System%\config\systemprofile\Local Settings\History\History.IE5\MSHist012010122820101229\MSHist012010122820101229.scr
• %System%\config\systemprofile\Local Settings\Temp\Temp.scr
• %System%\config\systemprofile\Local Settings\Temp\_$Df\_$Df.scr
• %System%\config\systemprofile\Local Settings\Temporary Internet Files\Temporary Internet Files.scr
• %System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Content.IE5.scr
• %System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\0XIJ0DEZ\0XIJ0DEZ.scr
• %System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2TPM8950\2TPM8950.scr
• %System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\4H9MXTT9\4H9MXTT9.scr
• %System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8XQVK9U7\8XQVK9U7.scr
• %System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\K96JWPA7\K96JWPA7.scr
• %System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\OLQ78TEZ\OLQ78TEZ.scr
• %System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\SMCZPN4M\SMCZPN4M.scr
• %System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\X9QQH2D9\X9QQH2D9.scr
• %System%\config\systemprofile\My Documents\My Documents.scr
• %System%\config\systemprofile\My Documents\My Music\My Music.scr
• %System%\config\systemprofile\My Documents\My Pictures\My Pictures.scr
• %System%\config\systemprofile\NetHood\NetHood.scr
• %System%\config\systemprofile\PrintHood\PrintHood.scr
• %System%\config\systemprofile\Recent\Recent.scr
• %System%\config\systemprofile\SendTo\SendTo.scr
• %System%\config\systemprofile\Start Menu\Start Menu.scr
• %System%\config\systemprofile\Start Menu\Programs\Programs.scr
• %System%\config\systemprofile\Start Menu\Programs\Accessories\Accessories.scr
• %System%\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\Accessibility.scr
• %System%\config\systemprofile\Start Menu\Programs\Accessories\Entertainment\Entertainment.scr
• %System%\config\systemprofile\Start Menu\Programs\Startup\Startup.scr
• %System%\config\systemprofile\Templates\Templates.scr
• %System%\dhcp\dhcp.scr
• %System%\DirectX\DirectX.scr
• %System%\DirectX\Dinput\Dinput.scr
• %System%\dllcache\dllcache.scr
• %System%\drivers\drivers.scr
• %System%\drivers\disdn\disdn.scr
• %System%\drivers\etc\etc.scr
• %System%\export\export.scr
• %System%\ias\ias.scr
• %System%\icsxml\icsxml.scr
• %System%\IME\IME.scr
• %System%\IME\CINTLGNT\CINTLGNT.scr
• %System%\IME\PINTLGNT\PINTLGNT.scr
• %System%\IME\TINTLGNT\TINTLGNT.scr
• %System%\inetsrv\inetsrv.scr
• %System%\Macromed\Macromed.scr
• %System%\Macromed\Flash\Flash.scr
• %System%\Microsoft\Microsoft.scr
• %System%\Microsoft\Protect\Protect.scr
• %System%\Microsoft\Protect\S-1-5-18\S-1-5-18.scr
• %System%\Microsoft\Protect\S-1-5-18\User\User.scr
• %System%\MsDtc\MsDtc.scr
• %System%\MsDtc\Trace\Trace.scr
• %System%\mui\mui.scr
• %System%\mui\0009\0009.scr
• %System%\mui\0401\0401.scr
• %System%\mui\0402\0402.scr
• %System%\mui\0404\0404.scr
• %System%\mui\0405\0405.scr
• %System%\mui\0406\0406.scr
• %System%\mui\0407\0407.scr
• %System%\mui\0408\0408.scr
• %System%\mui\040b\040b.scr
• %System%\mui\040C\040C.scr
• %System%\mui\040D\040D.scr
• %System%\mui\040e\040e.scr
• %System%\mui\0410\0410.scr
• %System%\mui\0411\0411.scr
• %System%\mui\0412\0412.scr
• %System%\mui\0413\0413.scr
• %System%\mui\0414\0414.scr
• %System%\mui\0415\0415.scr
• %System%\mui\0416\0416.scr
• %System%\mui\0418\0418.scr
• %System%\mui\0419\0419.scr
• %System%\mui\041a\041a.scr
• %System%\mui\041b\041b.scr
• %System%\mui\041D\041D.scr
• %System%\mui\041e\041e.scr
• %System%\mui\041f\041f.scr
• %System%\mui\0424\0424.scr
• %System%\mui\0425\0425.scr
• %System%\mui\0426\0426.scr
• %System%\mui\0427\0427.scr
• %System%\mui\0804\0804.scr
• %System%\mui\0816\0816.scr
• %System%\mui\0C0A\0C0A.scr
• %System%\mui\dispspec\dispspec.scr
• %System%\npp\npp.scr
• %System%\oobe\oobe.scr
• %System%\oobe\actsetup\actsetup.scr
• %System%\oobe\error\error.scr
• %System%\oobe\html\html.scr
• %System%\oobe\html\dslmain\dslmain.scr
• %System%\oobe\html\iconnect\iconnect.scr
• %System%\oobe\html\ispsgnup\ispsgnup.scr
• %System%\oobe\html\isptype\isptype.scr
• %System%\oobe\html\mouse\mouse.scr
• %System%\oobe\html\mouse\images\images.scr
• %System%\oobe\html\oemcust\oemcust.scr
• %System%\oobe\html\oemhw\oemhw.scr
• %System%\oobe\html\oemreg\oemreg.scr
• %System%\oobe\html\sconnect\sconnect.scr
• %System%\oobe\icserror\icserror.scr
• %System%\oobe\images\images.scr
• %System%\oobe\isperror\isperror.scr
• %System%\oobe\regerror\regerror.scr
• %System%\oobe\sample\sample.scr
• %System%\oobe\setup\setup.scr
• %System%\ras\ras.scr
• %System%\ReinstallBackups\ReinstallBackups.scr
• %System%\ReinstallBackups\0000\0000.scr
• %System%\ReinstallBackups\0000\DriverFiles\DriverFiles.scr
• %System%\ReinstallBackups\0001\0001.scr
• %System%\ReinstallBackups\0001\DriverFiles\DriverFiles.scr
• %System%\ReinstallBackups\0002\0002.scr
• %System%\ReinstallBackups\0002\DriverFiles\DriverFiles.scr
• %System%\ReinstallBackups\0002\DriverFiles\i386\i386.scr
• %System%\Restore\Restore.scr
• %System%\Setup\Setup.scr
• %System%\ShellExt\ShellExt.scr
• %System%\spool\spool.scr
• %System%\spool\drivers\drivers.scr
• %System%\spool\drivers\color\color.scr
• %System%\spool\drivers\w32x86\w32x86.scr
• %System%\spool\drivers\w32x86\3\3.scr
• %System%\spool\drivers\w32x86\3\temp\temp.scr
• %System%\spool\PRINTERS\PRINTERS.scr
• %System%\spool\prtprocs\prtprocs.scr
• %System%\spool\prtprocs\w32x86\w32x86.scr
• %System%\usmt\usmt.scr
• %System%\wbem\wbem.scr
• %System%\wbem\AutoRecover\AutoRecover.scr
• %System%\wbem\Logs\Logs.scr
• %System%\wbem\mof\mof.scr
• %System%\wbem\mof\bad\bad.scr
• %System%\wbem\mof\good\good.scr
• %System%\wbem\Performance\Performance.scr
• %System%\wbem\Repository\Repository.scr
• %System%\wbem\Repository\FS\FS.scr
• %System%\wbem\snmp\snmp.scr
• %System%\wbem\xml\xml.scr
• %System%\wins\wins.scr
• %System%\xircom\xircom.scr
• %Windows%\Tasks\Tasks.scr
• %Temp%\Temp.scr
• %Temp%\00006684\00006684.scr
• %Temp%\00006684\Program Files\Program Files.scr
• %Temp%\Cookies\Cookies.scr
• %Temp%\DF51.tmp\DF51.tmp.scr
• %Temp%\History\History.scr
• %Temp%\History\History.IE5\History.IE5.scr
• %Temp%\Temporary Internet Files\Temporary Internet Files.scr
• %Temp%\Temporary Internet Files\Content.IE5\Content.IE5.scr
• %Temp%\Temporary Internet Files\Content.IE5\36502Y5M\36502Y5M.scr
• %Temp%\Temporary Internet Files\Content.IE5\4NVMMLQI\4NVMMLQI.scr
• %Temp%\Temporary Internet Files\Content.IE5\OROODQAZ\OROODQAZ.scr
• %Temp%\Temporary Internet Files\Content.IE5\YMT3YC75\YMT3YC75.scr
• %Temp%\_$Df\_$Df.scr
• %Windows%\twain_32\twain_32.scr
• %Windows%\Web\Web.scr
• %Windows%\Web\printers\printers.scr
• %Windows%\Web\printers\images\images.scr
• %Windows%\Web\Wallpaper\Wallpaper.scr
• %Windows%\WinSxS\WinSxS.scr
• %Windows%\WinSxS\InstallTemp\InstallTemp.scr
• %Windows%\WinSxS\Manifests\Manifests.scr
• %Windows%\WinSxS\Policies\Policies.scr
• %Windows%\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac.scr
• %Windows%\WinSxS\Policies\x86_policy.5.1.Microsoft.Windows.SystemCompatible_6595b64144ccf1df_x-ww_a0111510\x86_policy.5.1.Microsoft.Windows.SystemCompatible_6595b64144ccf1df_x-ww_a0111510.scr
• %Windows%\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_x-ww_362e60dd\x86_policy.5.2.Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_x-ww_362e60dd.scr
• %Windows%\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Rtcdll_6595b64144ccf1df_x-ww_c7b7206f\x86_policy.5.2.Microsoft.Windows.Networking.Rtcdll_6595b64144ccf1df_x-ww_c7b7206f.scr
• %Windows%\WinSxS\Policies\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775.scr
• %Windows%\WinSxS\Policies\x86_policy.7.0.Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_x-ww_a317e4b3\x86_policy.7.0.Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_x-ww_a317e4b3.scr
• %Windows%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773.scr
• %Windows%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150.scr
• %Windows%\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e.scr
• %Windows%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501\x86_policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501.scr
• %Windows%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75.scr
• %Windows%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_x-ww_b8438ace\x86_policy.9.0.Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_x-ww_b8438ace.scr
• %Windows%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_x-ww_4ee8bb30\x86_policy.9.0.Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_x-ww_4ee8bb30.scr
• %Windows%\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_x-ww_6ad67377\x86_policy.9.0.Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_x-ww_6ad67377.scr
• %Windows%\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7.scr
• %Windows%\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.scr
• %Windows%\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303.scr
• %Windows%\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05.scr
• %Windows%\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2.scr
• %Windows%\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e.scr
• %Windows%\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03.scr
• %Windows%\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943.scr
• %Windows%\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1.scr
• %Windows%\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a.scr
• %Windows%\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9.scr
• %Windows%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a.scr
• %Windows%\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9.scr
• %Windows%\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13.scr
• %Windows%\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82.scr
• %Windows%\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7.scr
• %Windows%\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95.scr
• %Windows%\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc0\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc0.scr

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %Desktop% is the current user's desktop, which is usually C:\Windows\Profiles\{user name}\Desktop on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Desktop on Windows NT, and C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003.. %Favorites% is the current user's Favorites folder, which is usually C:\Windows\Favorites on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Favorites on Windows NT, and C:\Documents and Settings\{user name}\Favorites on Windows 2000, XP, and Server 2003.. %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %Temp% is the Windows Temporary folder, which is usually C:\Windows\Temp or C:\WINNT\Temp.)

Dropping Routine

This Trojan drops the following files:

• %User Startup%\Startup.scr
• %Common Startup%\Startup.scr

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.. %Common Startup% is the system's shared Startup folder, which is usually C:\Windows\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\All Users\Programs\Startup on Windows NT, and C:\Documents and Settings\All Users\Start Menu\Programs\Startup on Windows 2000, XP, and Server 2003.)

This report is generated via an automated analysis system.