Trojan.Siggen6.336

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\.exe] '' = 'exefile'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '<Virus name>.exe' = '<Full path to virus>'

Substitutes the following executable system files:

<SYSTEM32>\dllcache\msdaremr.dll with <SYSTEM32>\dllcache\msdaremr.dll.new
<SYSTEM32>\dllcache\msdarem.dll with <SYSTEM32>\dllcache\msdarem.dll.new
<SYSTEM32>\dllcache\msdaprst.dll with <SYSTEM32>\dllcache\msdaprst.dll.new
<SYSTEM32>\dllcache\msdfmap.dll with <SYSTEM32>\dllcache\msdfmap.dll.new
<SYSTEM32>\dllcache\msdaer.dll with <SYSTEM32>\dllcache\msdaer.dll.new
<SYSTEM32>\dllcache\msdaenum.dll with <SYSTEM32>\dllcache\msdaenum.dll.new
<SYSTEM32>\dllcache\msdadc.dll with <SYSTEM32>\dllcache\msdadc.dll.new
<SYSTEM32>\dllcache\msdaprsr.dll with <SYSTEM32>\dllcache\msdaprsr.dll.new
<SYSTEM32>\dllcache\msadco.dll with <SYSTEM32>\dllcache\msadco.dll.new
<SYSTEM32>\dllcache\msadcfr.dll with <SYSTEM32>\dllcache\msadcfr.dll.new
<SYSTEM32>\dllcache\msadcf.dll with <SYSTEM32>\dllcache\msadcf.dll.new
<SYSTEM32>\dllcache\msadcor.dll with <SYSTEM32>\dllcache\msadcor.dll.new
<SYSTEM32>\dllcache\msaddsr.dll with <SYSTEM32>\dllcache\msaddsr.dll.new
<SYSTEM32>\dllcache\msadds.dll with <SYSTEM32>\dllcache\msadds.dll.new
<SYSTEM32>\dllcache\msadcs.dll with <SYSTEM32>\dllcache\msadcs.dll.new
<SYSTEM32>\dllcache\msdaora.dll with <SYSTEM32>\dllcache\msdaora.dll.new
<SYSTEM32>\dllcache\oledb32.dll with <SYSTEM32>\dllcache\oledb32.dll.new
<SYSTEM32>\dllcache\msxactps.dll with <SYSTEM32>\dllcache\msxactps.dll.new
<SYSTEM32>\dllcache\msdaurl.dll with <SYSTEM32>\dllcache\msdaurl.dll.new
<SYSTEM32>\dllcache\oledb32r.dll with <SYSTEM32>\dllcache\oledb32r.dll.new
<SYSTEM32>\dllcache\wab32res.dll with <SYSTEM32>\dllcache\wab32res.dll.new
<SYSTEM32>\dllcache\wab32.dll with <SYSTEM32>\dllcache\wab32.dll.new
<SYSTEM32>\dllcache\sqlxmlx.dll with <SYSTEM32>\dllcache\sqlxmlx.dll.new
<SYSTEM32>\dllcache\msdatt.dll with <SYSTEM32>\dllcache\msdatt.dll.new
<SYSTEM32>\dllcache\msdaps.dll with <SYSTEM32>\dllcache\msdaps.dll.new
<SYSTEM32>\dllcache\msdaosp.dll with <SYSTEM32>\dllcache\msdaosp.dll.new
<SYSTEM32>\dllcache\msdaorar.dll with <SYSTEM32>\dllcache\msdaorar.dll.new
<SYSTEM32>\dllcache\msdasc.dll with <SYSTEM32>\dllcache\msdasc.dll.new
<SYSTEM32>\dllcache\msdatl3.dll with <SYSTEM32>\dllcache\msdatl3.dll.new
<SYSTEM32>\dllcache\msdasqlr.dll with <SYSTEM32>\dllcache\msdasqlr.dll.new
<SYSTEM32>\dllcache\msdasql.dll with <SYSTEM32>\dllcache\msdasql.dll.new
<SYSTEM32>\dllcache\fp4autl.dll with <SYSTEM32>\dllcache\fp4autl.dll.new
<SYSTEM32>\dllcache\vgx.dll with <SYSTEM32>\dllcache\vgx.dll.new
<SYSTEM32>\dllcache\triedit.dll with <SYSTEM32>\dllcache\triedit.dll.new
<SYSTEM32>\dllcache\mssoap1.dll with <SYSTEM32>\dllcache\mssoap1.dll.new
<SYSTEM32>\dllcache\spcommon.dll with <SYSTEM32>\dllcache\spcommon.dll.new
<SYSTEM32>\dllcache\wisc10.dll with <SYSTEM32>\dllcache\wisc10.dll.new
<SYSTEM32>\dllcache\mssoapr.dll with <SYSTEM32>\dllcache\mssoapr.dll.new
<SYSTEM32>\dllcache\dhtmled.ocx with <SYSTEM32>\dllcache\dhtmled.ocx.new
<SYSTEM32>\dllcache\msinfo32.exe with <SYSTEM32>\dllcache\msinfo32.exe.new
<SYSTEM32>\dllcache\ieinfo5.ocx with <SYSTEM32>\dllcache\ieinfo5.ocx.new
<SYSTEM32>\dllcache\dao360.dll with <SYSTEM32>\dllcache\dao360.dll.new
<SYSTEM32>\dllcache\spcplui.dll with <SYSTEM32>\dllcache\spcplui.dll.new
<SYSTEM32>\dllcache\sapisvr.exe with <SYSTEM32>\dllcache\sapisvr.exe.new
<SYSTEM32>\dllcache\sapi.dll with <SYSTEM32>\dllcache\sapi.dll.new
<SYSTEM32>\dllcache\sapi.cpl with <SYSTEM32>\dllcache\sapi.cpl.new
<SYSTEM32>\dllcache\spttseng.dll with <SYSTEM32>\dllcache\spttseng.dll.new
<SYSTEM32>\dllcache\msadrh15.dll with <SYSTEM32>\dllcache\msadrh15.dll.new
<SYSTEM32>\dllcache\msadox.dll with <SYSTEM32>\dllcache\msadox.dll.new
<SYSTEM32>\dllcache\msador15.dll with <SYSTEM32>\dllcache\msador15.dll.new
<SYSTEM32>\dllcache\msjro.dll with <SYSTEM32>\dllcache\msjro.dll.new
<SYSTEM32>\dllcache\msadcer.dll with <SYSTEM32>\dllcache\msadcer.dll.new
<SYSTEM32>\dllcache\msadce.dll with <SYSTEM32>\dllcache\msadce.dll.new
<SYSTEM32>\dllcache\directdb.dll with <SYSTEM32>\dllcache\directdb.dll.new
<SYSTEM32>\dllcache\msadomd.dll with <SYSTEM32>\dllcache\msadomd.dll.new
<SYSTEM32>\dllcache\msado20.tlb with <SYSTEM32>\dllcache\msado20.tlb.new
<SYSTEM32>\dllcache\msado15.dll with <SYSTEM32>\dllcache\msado15.dll.new
<SYSTEM32>\dllcache\msader15.dll with <SYSTEM32>\dllcache\msader15.dll.new
<SYSTEM32>\dllcache\msado21.tlb with <SYSTEM32>\dllcache\msado21.tlb.new
<SYSTEM32>\dllcache\msado27.tlb with <SYSTEM32>\dllcache\msado27.tlb.new
<SYSTEM32>\dllcache\msado26.tlb with <SYSTEM32>\dllcache\msado26.tlb.new
<SYSTEM32>\dllcache\msado25.tlb with <SYSTEM32>\dllcache\msado25.tlb.new

Infects the following executable files:

<SYSTEM32>\dllcache\msdaremr.dll.new
<SYSTEM32>\dllcache\msdarem.dll.new
<SYSTEM32>\dllcache\msdaprst.dll.new
<SYSTEM32>\dllcache\msdfmap.dll.new
<SYSTEM32>\dllcache\msdaer.dll.new
<SYSTEM32>\dllcache\msdaenum.dll.new
<SYSTEM32>\dllcache\msdadc.dll.new
<SYSTEM32>\dllcache\msdaprsr.dll.new
<SYSTEM32>\dllcache\msadco.dll.new
<SYSTEM32>\dllcache\msadcfr.dll.new
<SYSTEM32>\dllcache\msadcf.dll.new
<SYSTEM32>\dllcache\msadcor.dll.new
<SYSTEM32>\dllcache\msaddsr.dll.new
<SYSTEM32>\dllcache\msadds.dll.new
<SYSTEM32>\dllcache\msadcs.dll.new
<SYSTEM32>\dllcache\msdaora.dll.new
<SYSTEM32>\dllcache\oledb32.dll.new
<SYSTEM32>\dllcache\msxactps.dll.new
<SYSTEM32>\dllcache\msdaurl.dll.new
<SYSTEM32>\dllcache\oledb32r.dll.new
<SYSTEM32>\dllcache\wab32res.dll.new
<SYSTEM32>\dllcache\wab32.dll.new
<SYSTEM32>\dllcache\sqlxmlx.dll.new
<SYSTEM32>\dllcache\msdatt.dll.new
<SYSTEM32>\dllcache\msdaps.dll.new
<SYSTEM32>\dllcache\msdaosp.dll.new
<SYSTEM32>\dllcache\msdaorar.dll.new
<SYSTEM32>\dllcache\msdasc.dll.new
<SYSTEM32>\dllcache\msdatl3.dll.new
<SYSTEM32>\dllcache\msdasqlr.dll.new
<SYSTEM32>\dllcache\msdasql.dll.new
<SYSTEM32>\dllcache\fp4autl.dll.new
<SYSTEM32>\dllcache\vgx.dll.new
<SYSTEM32>\dllcache\triedit.dll.new
<SYSTEM32>\dllcache\mssoap1.dll.new
<SYSTEM32>\dllcache\spcommon.dll.new
<SYSTEM32>\dllcache\wisc10.dll.new
<SYSTEM32>\dllcache\mssoapr.dll.new
<SYSTEM32>\dllcache\dhtmled.ocx.new
<SYSTEM32>\dllcache\msinfo32.exe.new
<SYSTEM32>\dllcache\ieinfo5.ocx.new
<SYSTEM32>\dllcache\dao360.dll.new
<SYSTEM32>\dllcache\spcplui.dll.new
<SYSTEM32>\dllcache\sapisvr.exe.new
<SYSTEM32>\dllcache\sapi.dll.new
<SYSTEM32>\dllcache\sapi.cpl.new
<SYSTEM32>\dllcache\spttseng.dll.new
<SYSTEM32>\dllcache\msadrh15.dll.new
<SYSTEM32>\dllcache\msadox.dll.new
<SYSTEM32>\dllcache\msador15.dll.new
<SYSTEM32>\dllcache\msjro.dll.new
<SYSTEM32>\dllcache\msadcer.dll.new
<SYSTEM32>\dllcache\msadce.dll.new
<SYSTEM32>\dllcache\directdb.dll.new
<SYSTEM32>\dllcache\msadomd.dll.new
<SYSTEM32>\dllcache\msado20.tlb.new
<SYSTEM32>\dllcache\msado15.dll.new
<SYSTEM32>\dllcache\msader15.dll.new
<SYSTEM32>\dllcache\msado21.tlb.new
<SYSTEM32>\dllcache\msado27.tlb.new
<SYSTEM32>\dllcache\msado26.tlb.new
<SYSTEM32>\dllcache\msado25.tlb.new

Malicious functions:

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Registry Editor (RegEdit)

Executes the following:

'%WINDIR%\explorer.exe'
'<SYSTEM32>\cmd.exe' /c c:\±шНЕ.bat
'<SYSTEM32>\taskkill.exe' /f /im 360tray.exe
'<SYSTEM32>\cmd.exe' /c c:\»Чіж.bat
'<SYSTEM32>\cmd.exe' /c c:\1.bat
'<SYSTEM32>\cmd.exe' /c <Current directory>\del.bat
'<SYSTEM32>\cmd.exe' /c <Current directory>\ddel.bat
'<SYSTEM32>\taskkill.exe' /f /im Aver.exe
'<SYSTEM32>\taskkill.exe' /f /im explorer.exe

Terminates or attempts to terminate

the following system processes:

%WINDIR%\Explorer.EXE

the following user processes:

360tray.exe

Modifies settings of Windows Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'

Modifies file system :

Creates the following files:

<Current directory>\vbs.vbs
C:\»Чіж.bat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\baidu[1]
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\RestorePointSize
C:\±шНЕ.bat
<Current directory>\del.bat
<SYSTEM32>\Aver.ico
<Current directory>\ddel.bat
C:\1.bat
C:\cc.ico

Deletes the following files:

%WINDIR%\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
%WINDIR%\assembly\GAC_MSIL\System.Management.Instrumentation\3.5.0.0__b77a5c561934e089\System.Management.Instrumentation.dll
%WINDIR%\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
%WINDIR%\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\System.IdentityModel.dll
%WINDIR%\assembly\GAC_MSIL\System.IdentityModel.Selectors\3.0.0.0__b77a5c561934e089\System.IdentityModel.Selectors.dll
%WINDIR%\assembly\GAC_MSIL\System.IO.Log\3.0.0.0__b03f5f7f11d50a3a\System.IO.Log.dll
%WINDIR%\assembly\GAC_MSIL\System.Net\3.5.0.0__b03f5f7f11d50a3a\System.Net.dll
%WINDIR%\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel.Install\3.0.0.0__b77a5c561934e089\System.ServiceModel.Install.dll
%WINDIR%\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
%WINDIR%\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll
%WINDIR%\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
%WINDIR%\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
%WINDIR%\assembly\GAC_MSIL\System.Data.Services\3.5.0.0__b77a5c561934e089\System.Data.Services.dll
%WINDIR%\assembly\GAC_MSIL\System.Data.Services.Client\3.5.0.0__b77a5c561934e089\System.Data.Services.Client.dll
%WINDIR%\assembly\GAC_MSIL\System.Data.Services.Design\3.5.0.0__b77a5c561934e089\System.Data.Services.Design.dll
%WINDIR%\assembly\GAC_MSIL\System.Data.Entity\3.5.0.0__b77a5c561934e089\System.Data.Entity.dll
%WINDIR%\assembly\GAC_MSIL\System.Data.Entity.Design\3.5.0.0__b77a5c561934e089\System.Data.Entity.Design.dll
%WINDIR%\assembly\GAC_MSIL\System.Data.Linq\3.5.0.0__b77a5c561934e089\System.Data.Linq.dll
%WINDIR%\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
%WINDIR%\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\3.5.0.0__b77a5c561934e089\System.DirectoryServices.AccountManagement.dll
%WINDIR%\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
%WINDIR%\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
%WINDIR%\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
%WINDIR%\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
%WINDIR%\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel.WasHosting\3.0.0.0__b77a5c561934e089\System.ServiceModel.WasHosting.dll
%WINDIR%\assembly\GAC_MSIL\System.Workflow.ComponentModel\3.0.0.0__31bf3856ad364e35\System.Workflow.ComponentModel.dll
%WINDIR%\assembly\GAC_MSIL\System.Workflow.Runtime\3.0.0.0__31bf3856ad364e35\System.Workflow.Runtime.dll
%WINDIR%\assembly\GAC_MSIL\System.WorkflowServices\3.5.0.0__31bf3856ad364e35\System.WorkflowServices.dll
%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
%WINDIR%\assembly\GAC_MSIL\System.Windows.Presentation\3.5.0.0__b77a5c561934e089\System.Windows.Presentation.dll
%WINDIR%\assembly\GAC_MSIL\System.Workflow.Activities\3.0.0.0__31bf3856ad364e35\System.Workflow.Activities.dll
%WINDIR%\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
%WINDIR%\assembly\GAC_MSIL\UIAutomationProvider\3.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll
%WINDIR%\assembly\GAC_MSIL\UIAutomationTypes\3.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll
%WINDIR%\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\WindowsBase.dll
%WINDIR%\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll
%WINDIR%\assembly\GAC_MSIL\UIAutomationClient\3.0.0.0__31bf3856ad364e35\UIAutomationClient.dll
%WINDIR%\assembly\GAC_MSIL\UIAutomationClientsideProviders\3.0.0.0__31bf3856ad364e35\UIAutomationClientsideProviders.dll
%WINDIR%\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
%WINDIR%\assembly\GAC_MSIL\System.Web.Abstractions\3.5.0.0__31bf3856ad364e35\System.Web.Abstractions.dll
%WINDIR%\assembly\GAC_MSIL\System.Web.DynamicData\3.5.0.0__31bf3856ad364e35\System.Web.DynamicData.dll
%WINDIR%\assembly\GAC_MSIL\System.Web.DynamicData.Design\3.5.0.0__31bf3856ad364e35\System.Web.DynamicData.Design.dll
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel.Web\3.5.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll
%WINDIR%\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
%WINDIR%\assembly\GAC_MSIL\System.Speech\3.0.0.0__31bf3856ad364e35\System.Speech.dll
%WINDIR%\assembly\GAC_MSIL\System.Web.Entity\3.5.0.0__b77a5c561934e089\System.Web.Entity.dll
%WINDIR%\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
%WINDIR%\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
%WINDIR%\assembly\GAC_MSIL\System.Web.Routing\3.5.0.0__31bf3856ad364e35\System.Web.Routing.dll
%WINDIR%\assembly\GAC_MSIL\System.Web.Entity.Design\3.5.0.0__b77a5c561934e089\System.Web.Entity.Design.dll
%WINDIR%\assembly\GAC_MSIL\System.Web.Extensions\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.dll
%WINDIR%\assembly\GAC_MSIL\System.Web.Extensions.Design\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.Design.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Conversion.v3.5.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.v3.5.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v3.5.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
%WINDIR%\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
%WINDIR%\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\System.Printing.dll
%WINDIR%\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll
%WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
%WINDIR%\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
%WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
%WINDIR%\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
%WINDIR%\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
%WINDIR%\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
%WINDIR%\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
%WINDIR%\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
%WINDIR%\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
%WINDIR%\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll
%WINDIR%\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
%WINDIR%\assembly\GAC_MSIL\PresentationUI\3.0.0.0__31bf3856ad364e35\PresentationUI.dll
%WINDIR%\assembly\GAC_MSIL\ReachFramework\3.0.0.0__31bf3856ad364e35\ReachFramework.dll
%WINDIR%\assembly\GAC_MSIL\Sentinel.v3.5Client\3.5.0.0__b03f5f7f11d50a3a\Sentinel.v3.5Client.dll
%WINDIR%\assembly\GAC_MSIL\System.AddIn\3.5.0.0__b77a5c561934e089\System.AddIn.dll
%WINDIR%\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
%WINDIR%\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.dll
%WINDIR%\assembly\GAC_MSIL\System.Data.DataSetExtensions\3.5.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll
%WINDIR%\assembly\GAC_MSIL\System.AddIn.Contract\2.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll
%WINDIR%\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll
%WINDIR%\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Royale\3.0.0.0__31bf3856ad364e35\PresentationFramework.Royale.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\1.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.STLCLR.dll
%WINDIR%\assembly\GAC_MSIL\PresentationBuildTasks\3.0.0.0__31bf3856ad364e35\PresentationBuildTasks.dll
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Aero\3.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Classic\3.0.0.0__31bf3856ad364e35\PresentationFramework.Classic.dll
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Luna\3.0.0.0__31bf3856ad364e35\PresentationFramework.Luna.dll
%WINDIR%\assembly\GAC_MSIL\PresentationCFFRasterizer\3.0.0.0__31bf3856ad364e35\PresentationCFFRasterizer.dll
%WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\PresentationFramework.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\0ec1b690c5ee057fa92ecff78de1457c\System.Data.SqlXml.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Deployment\df1efcbac5973454c608890f72eb994d\System.Deployment.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Design\204db7071fb26343b0fd3f3d140c0bf8\System.Design.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\8582bf6991112c859e843af4321a2fda\System.Data.Services.Design.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\fee2e476d10aac7784f46140ee1b4a59\System.Data.Services.Client.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Services\f24134b397836c33a65d4d05c54ef4f5\System.Data.Services.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\44de75caba2b9711b3d9030a30767f8b\System.DirectoryServices.Protocols.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\5f5d64dd0e7991aaaad2d98ee52afe42\System.Drawing.Design.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\5f9cd5bfebcb94175d440ebab3aa412f\System.EnterpriseServices.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\5f9cd5bfebcb94175d440ebab3aa412f\System.EnterpriseServices.Wrapper.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\6bcc481030a56c24d5990d199812c594\System.DirectoryServices.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\c205bbbb88bfa4bd5e274f43ea0013cb\System.DirectoryServices.AccountManagement.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\57f7cf02ea17b36bc3d9c75c22d0f551\System.Data.OracleClient.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\f2b48eab657b4ef1d19dac11bdf0c913\System.AddIn.Contract.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\a8e047504bdad9ec14efd483574b0dd5\System.ComponentModel.DataAnnotations.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\22a1629a4dcdd493bbd8be40cc122e94\System.Configuration.Install.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\sysglobl\6e07cc846884a853b910775fcec87ced\sysglobl.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.AddIn\b01721205312c6c18df033cc47b60e5c\System.AddIn.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb4cb21d14767292e079366a5d3d76cd\System.Configuration.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\8c050147d7031f912f6ca2b15550173f\System.Data.Entity.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\9867484f25281882e61f61066fa651a3\System.Data.Entity.Design.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\fa206c73f39721cd2c55829b9853de44\System.Data.Linq.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\6c69930d05c557da70144bcc0add7065\System.Core.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\0b40341027c01716cec1dd97592698e0\System.Data.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\4f4ddae492a4a4ce4a2961f3d72d9399\System.Data.DataSetExtensions.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\be8c7482f1e78a3b4984af9082d455a7\System.IdentityModel.Selectors.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\fbe60d84b9f1ab74e396fb1507f69615\System.Web.Abstractions.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\5bd3f76680b4c09039d42ae873ddd190\System.Web.DynamicData.Design.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\c171b28823047a7e9db5f3e092333336\System.Web.DynamicData.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Speech\2e7a6c977ac9f8d46ebe2982697a0c8d\System.Speech.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\12903c3843fe923d1977801ffa3cf26c\System.Transactions.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web\50ea744ffc3cb7f09b027fd6c5c93b2b\System.Web.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\015d6049e237304a27105c3846c79648\System.Web.Entity.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\e5995a34d44ad5af7d9f335075bded4d\System.Web.Mobile.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\70764208219715962d310336b5959dfa\System.Web.RegularExpressions.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\18e1acd6761195389db42bab83169fd2\System.Web.Routing.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\119750ae4265d719a24ebe245e212db7\System.Web.Entity.Design.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\79f9b2acf94065fd92c54c29ff66017b\System.Web.Extensions.Design.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\d8a3d7926a927b9fd62aeabb16a74ab0\System.Web.Extensions.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\a9e71dda6389403be4db7b567592e3b8\System.ServiceProcess.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.I#\1db9deebde7c96b2874b4ffccac2f48e\System.Management.Instrumentation.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Messaging\643e95098a9ce99a598d3419b5ce157f\System.Messaging.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Net\eabe1915c13467e1e66e2b073bcb842f\System.Net.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\94b2ca600c860c76e387f8bd317bd4c3\System.IdentityModel.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.IO.Log\bcfccfa22245d2223a764611c61a7cb9\System.IO.Log.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\894d87c08a9a5b5923e7104055a616d2\System.Management.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Printing\db428f231a2ccaf490ae219efd2edc69\System.Printing.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Security\0418eb6dbffe9b46aa4c989153d6a3b5\System.Security.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\19644a754454916a619b68315e50b428\System.ServiceModel.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\bfa7858f498cd67ef58b689c2e0fec89\System.ServiceModel.Web.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\3736ba3ecac186f9c5d85f01bda2be98\System.Runtime.Remoting.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\01dc643b54310ebc5ab7e4696df426bc\System.Runtime.Serialization.Formatters.Soap.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\bb748f8ef8c98eb5c7f79b8faee95397\System.Runtime.Serialization.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Accessibility\c2af7cfbb47c077029a2645930b4eeac\Accessibility.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\c7ffd8c23e8de4018a88185b3b60631e\AspNetMMCExt.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\19b50dd470540911fc5cc65331a769e4\ComSvcConfig.ni.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_353815cd\__AssemblyInfo__.ini
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_f236c56a\System.Xml.dll
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_f236c56a\__AssemblyInfo__.ini
%WINDIR%\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\e148983beeb0f30918b0564849a16456\CustomMarshalers.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\c5c4db4f9bc7a454e9cfc2548a9d45a5\Microsoft.Build.Conversion.v3.5.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\ce984d7bbd9a6d5d3cca28c4e5038020\Microsoft.Build.Engine.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\daf5ff5e06c80eefa80c6fcc79aec963\Microsoft.Build.Engine.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\dfsvc\a2865dcec9c5d3cc9c55f026cbad6fcc\dfsvc.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\indexa5.dat
%WINDIR%\assembly\NativeImages_v2.0.50727_32\indexa6.dat
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_353815cd\System.Windows.Forms.dll
%WINDIR%\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_5917eb5b\mscorlib.dll
%WINDIR%\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_5917eb5b\__AssemblyInfo__.ini
%WINDIR%\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_27b9fd4f\System.dll
%WINDIR%\assembly\GAC_MSIL\WindowsFormsIntegration\3.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll
%WINDIR%\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_b50667e9\CustomMarshalers.dll
%WINDIR%\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_b50667e9\__AssemblyInfo__.ini
%WINDIR%\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_27b9fd4f\__AssemblyInfo__.ini
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_c34133cb\__AssemblyInfo__.ini
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_7cac80ba\System.Drawing.Design.dll
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_7cac80ba\__AssemblyInfo__.ini
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_cd264933\System.Design.dll
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_cd264933\__AssemblyInfo__.ini
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_c34133cb\System.Drawing.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\36dbc4689f7c51e393504230004c9dec\Microsoft.Build.Framework.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\79c2fd29b1e46c943960278051b4e1b9\PresentationFramework.Royale.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\9519494798a88867406b5755e1dbded6\PresentationFramework.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\9e71fd0d299c5668c96a54e4a63479fa\PresentationFramework.Aero.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\487c1bc20f6e73e8e79503898d17d102\PresentationCFFRasterizer.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationCore\12dcb10b76012416357bdbb010fdaa97\PresentationCore.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\9469981a17c01dd154c540127e678b35\PresentationFontCache.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\b4dc4bd8534d90fbb7430926ad990cd9\PresentationFramework.Luna.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\6781b87c8d3b55e6120b1e86bea6e040\ServiceModelReg.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\2e19ccefc30d7b827bab3f7d8dcc0ab9\SMDiagnostics.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\SMSvcHost\b9c1a29e684bc02e49226ff1e9eec253\SMSvcHost.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\ef1a93d10c3a91b728745dbfcc79c2c7\PresentationFramework.Classic.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationUI\87fb973e4ab6a21fd00e45656fa7c115\PresentationUI.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ReachFramework\5c59991df60164cae10fd81b88a8e5b1\ReachFramework.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\b6bfb51dec7f8cc42c21c5928470c773\PresentationBuildTasks.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\28eede53267524df58362a75a668cf86\Microsoft.Build.Utilities.v3.5.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\43dceeb2d0601d79af40752fb20283c2\Microsoft.Build.Utilities.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\7d61e63dea85f4f77ea4c13df7651ec7\Microsoft.JScript.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\66359457e427c0d547750a79f754f9ba\Microsoft.Build.Framework.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\152cf75db013f0523933ac45177b4217\Microsoft.Build.Tasks.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\cd6eeb3d7ea1f65c28a43e665db38644\Microsoft.Build.Tasks.v3.5.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\21bb6244c91b6207fbcb038884a641ef\Microsoft.Transactions.Bridge.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\28ea74096df47800fe2c78bb2b9a4f2a\Microsoft.Vsa.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\MSBuild\87c84ffaaad81d8d106a9aa9d68b5926\MSBuild.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\539e297cc9bc67fbf2fbdc9dc5fcd0f1\Microsoft.Transactions.Bridge.Dtc.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\5b3d048d8c003d743ea5e72caf07773a\Microsoft.VisualBasic.ni.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\f0e9a97ade4529d4caeccd467aa8e7db\Microsoft.VisualC.ni.dll
%WINDIR%\$NtUninstallKB942288-v3$\reg00082
%WINDIR%\$NtUninstallKB942288-v3$\reg00083
%WINDIR%\$NtUninstallKB942288-v3$\reg00084
%WINDIR%\$NtUninstallKB942288-v3$\reg00079
%WINDIR%\$NtUninstallKB942288-v3$\reg00080
%WINDIR%\$NtUninstallKB942288-v3$\reg00081
%WINDIR%\$NtUninstallKB942288-v3$\reg00085
%WINDIR%\$NtUninstallKB942288-v3$\reg00089
%WINDIR%\$NtUninstallKB942288-v3$\reg00090
%WINDIR%\$NtUninstallKB942288-v3$\reg00091
%WINDIR%\$NtUninstallKB942288-v3$\reg00086
%WINDIR%\$NtUninstallKB942288-v3$\reg00087
%WINDIR%\$NtUninstallKB942288-v3$\reg00088
%WINDIR%\$NtUninstallKB942288-v3$\reg00078
%WINDIR%\$NtUninstallKB942288-v3$\reg00068
%WINDIR%\$NtUninstallKB942288-v3$\reg00069
%WINDIR%\$NtUninstallKB942288-v3$\reg00070
%WINDIR%\$NtUninstallKB942288-v3$\reg00065
%WINDIR%\$NtUninstallKB942288-v3$\reg00066
%WINDIR%\$NtUninstallKB942288-v3$\reg00067
%WINDIR%\$NtUninstallKB942288-v3$\reg00071
%WINDIR%\$NtUninstallKB942288-v3$\reg00075
%WINDIR%\$NtUninstallKB942288-v3$\reg00076
%WINDIR%\$NtUninstallKB942288-v3$\reg00077
%WINDIR%\$NtUninstallKB942288-v3$\reg00072
%WINDIR%\$NtUninstallKB942288-v3$\reg00073
%WINDIR%\$NtUninstallKB942288-v3$\reg00074
%WINDIR%\$NtUninstallKB942288-v3$\reg00092
%WINDIR%\$NtUninstallKB942288-v3$\reg00110
%WINDIR%\$NtUninstallKB942288-v3$\reg00111
%WINDIR%\$NtUninstallKB942288-v3$\reg00112
%WINDIR%\$NtUninstallKB942288-v3$\reg00107
%WINDIR%\$NtUninstallKB942288-v3$\reg00108
%WINDIR%\$NtUninstallKB942288-v3$\reg00109
%WINDIR%\$NtUninstallKB942288-v3$\reg00113
%WINDIR%\$NtUninstallKB942288-v3$\reg00117
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.exe
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.inf
%WINDIR%\$NtUninstallKB942288-v3$\reg00114
%WINDIR%\$NtUninstallKB942288-v3$\reg00115
%WINDIR%\$NtUninstallKB942288-v3$\reg00116
%WINDIR%\$NtUninstallKB942288-v3$\reg00106
%WINDIR%\$NtUninstallKB942288-v3$\reg00096
%WINDIR%\$NtUninstallKB942288-v3$\reg00097
%WINDIR%\$NtUninstallKB942288-v3$\reg00098
%WINDIR%\$NtUninstallKB942288-v3$\reg00093
%WINDIR%\$NtUninstallKB942288-v3$\reg00094
%WINDIR%\$NtUninstallKB942288-v3$\reg00095
%WINDIR%\$NtUninstallKB942288-v3$\reg00099
%WINDIR%\$NtUninstallKB942288-v3$\reg00103
%WINDIR%\$NtUninstallKB942288-v3$\reg00104
%WINDIR%\$NtUninstallKB942288-v3$\reg00105
%WINDIR%\$NtUninstallKB942288-v3$\reg00100
%WINDIR%\$NtUninstallKB942288-v3$\reg00101
%WINDIR%\$NtUninstallKB942288-v3$\reg00102
%WINDIR%\$NtUninstallKB942288-v3$\reg00024
%WINDIR%\$NtUninstallKB942288-v3$\reg00025
%WINDIR%\$NtUninstallKB942288-v3$\reg00026
%WINDIR%\$NtUninstallKB942288-v3$\reg00021
%WINDIR%\$NtUninstallKB942288-v3$\reg00022
%WINDIR%\$NtUninstallKB942288-v3$\reg00023
%WINDIR%\$NtUninstallKB942288-v3$\reg00027
%WINDIR%\$NtUninstallKB942288-v3$\reg00031
%WINDIR%\$NtUninstallKB942288-v3$\reg00032
%WINDIR%\$NtUninstallKB942288-v3$\reg00033
%WINDIR%\$NtUninstallKB942288-v3$\reg00028
%WINDIR%\$NtUninstallKB942288-v3$\reg00029
%WINDIR%\$NtUninstallKB942288-v3$\reg00030
%WINDIR%\$NtUninstallKB942288-v3$\reg00020
%WINDIR%\$NtUninstallKB942288-v3$\msihnd.dll
%WINDIR%\$NtUninstallKB942288-v3$\msimsg.dll
%WINDIR%\$NtUninstallKB942288-v3$\msisip.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\baidu[1]
%WINDIR%\$NtUninstallKB942288-v3$\msi.dll
%WINDIR%\$NtUninstallKB942288-v3$\msiexec.exe
%WINDIR%\$NtUninstallKB942288-v3$\reg00013
%WINDIR%\$NtUninstallKB942288-v3$\reg00017
%WINDIR%\$NtUninstallKB942288-v3$\reg00018
%WINDIR%\$NtUninstallKB942288-v3$\reg00019
%WINDIR%\$NtUninstallKB942288-v3$\reg00014
%WINDIR%\$NtUninstallKB942288-v3$\reg00015
%WINDIR%\$NtUninstallKB942288-v3$\reg00016
%WINDIR%\$NtUninstallKB942288-v3$\reg00034
%WINDIR%\$NtUninstallKB942288-v3$\reg00055
%WINDIR%\$NtUninstallKB942288-v3$\reg00056
%WINDIR%\$NtUninstallKB942288-v3$\reg00057
%WINDIR%\$NtUninstallKB942288-v3$\reg00052
%WINDIR%\$NtUninstallKB942288-v3$\reg00053
%WINDIR%\$NtUninstallKB942288-v3$\reg00054
%WINDIR%\$NtUninstallKB942288-v3$\reg00058
%WINDIR%\$NtUninstallKB942288-v3$\reg00062
%WINDIR%\$NtUninstallKB942288-v3$\reg00063
%WINDIR%\$NtUninstallKB942288-v3$\reg00064
%WINDIR%\$NtUninstallKB942288-v3$\reg00059
%WINDIR%\$NtUninstallKB942288-v3$\reg00060
%WINDIR%\$NtUninstallKB942288-v3$\reg00061
%WINDIR%\$NtUninstallKB942288-v3$\reg00049
%WINDIR%\$NtUninstallKB942288-v3$\reg00039
%WINDIR%\$NtUninstallKB942288-v3$\reg00040
%WINDIR%\$NtUninstallKB942288-v3$\reg00041
%WINDIR%\$NtUninstallKB942288-v3$\reg00035
%WINDIR%\$NtUninstallKB942288-v3$\reg00036
%WINDIR%\$NtUninstallKB942288-v3$\reg00037
%WINDIR%\$NtUninstallKB942288-v3$\reg00042
%WINDIR%\$NtUninstallKB942288-v3$\reg00046
%WINDIR%\$NtUninstallKB942288-v3$\reg00047
%WINDIR%\$NtUninstallKB942288-v3$\reg00048
%WINDIR%\$NtUninstallKB942288-v3$\reg00043
%WINDIR%\$NtUninstallKB942288-v3$\reg00044
%WINDIR%\$NtUninstallKB942288-v3$\reg00045
%WINDIR%\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\System.Runtime.Remoting.dll
%WINDIR%\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\System.Management.dll
%WINDIR%\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\System.Messaging.dll
%WINDIR%\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
%WINDIR%\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
%WINDIR%\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
%WINDIR%\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\System.Security.dll
%WINDIR%\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Design.dll
%WINDIR%\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
%WINDIR%\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\System.Data.OracleClient.dll
%WINDIR%\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
%WINDIR%\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.Thunk.dll
%WINDIR%\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.dll
%WINDIR%\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
%WINDIR%\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normidna.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfc.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfd.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bopomofo.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\ksc.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfkc.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\xjis.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfkd.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\prc.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\prcp.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\big5.nlp
%WINDIR%\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Services.dll
%WINDIR%\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
%WINDIR%\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
%WINDIR%\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\System.Windows.Forms.dll
%WINDIR%\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
%WINDIR%\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
%WINDIR%\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll
%WINDIR%\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\System.Xml.dll
%WINDIR%\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini
%WINDIR%\assembly\Desktop.ini
%WINDIR%\assembly\GAC\Accessibility\1.0.5000.0__b03f5f7f11d50a3a\Accessibility.dll
%WINDIR%\assembly\GAC\Accessibility\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\AppPatch\drvmain.sdb
%WINDIR%\AppPatch\msimain.sdb
%WINDIR%\AppPatch\sysmain.sdb
%WINDIR%\assembly\GAC\cscompmgd\7.0.5000.0__b03f5f7f11d50a3a\cscompmgd.dll
%WINDIR%\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\IEExecRemote.dll
%WINDIR%\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\IEHost.dll
%WINDIR%\assembly\GAC\cscompmgd\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a\CustomMarshalers.dll
%WINDIR%\assembly\GAC\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\AppPatch\apph_sp.sdb
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.inf
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt
%WINDIR%\$NtUninstallWIC$\spuninst\updspapi.dll
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.txt
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\updspapi.dll
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.exe
%WINDIR%\0.log
%WINDIR%\AppPatch\AcSpecfc.dll
%WINDIR%\AppPatch\AcXtrnal.dll
%WINDIR%\AppPatch\apphelp.sdb
%WINDIR%\AppPatch\AcGenral.dll
%WINDIR%\AppPatch\AcLayers.dll
%WINDIR%\AppPatch\AcLua.dll
%WINDIR%\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\Microsoft_VsaVb\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\mscorcfg\1.0.5000.0__b03f5f7f11d50a3a\mscorcfg.dll
%WINDIR%\assembly\GAC\mscorcfg\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
%WINDIR%\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\Microsoft_VsaVb\7.0.5000.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
%WINDIR%\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\RegCode.dll
%WINDIR%\assembly\GAC\System.Configuration.Install\1.0.5000.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
%WINDIR%\assembly\GAC\System.Configuration.Install\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\System.Data.dll
%WINDIR%\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
%WINDIR%\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\Microsoft.Vsa\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\ISymWrapper\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
%WINDIR%\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\IIEHost\1.0.5000.0__b03f5f7f11d50a3a\IIEHost.dll
%WINDIR%\assembly\GAC\IIEHost\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\ISymWrapper\1.0.5000.0__b03f5f7f11d50a3a\ISymWrapper.dll
%WINDIR%\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
%WINDIR%\assembly\GAC\Microsoft.VisualC\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualC.dll
%WINDIR%\assembly\GAC\Microsoft.VisualC\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\Microsoft.Vsa\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
%WINDIR%\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
%WINDIR%\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini

Moves the following files:

from %PROGRAM_FILES%\MSN Gaming Zone\Windows\rvseres.dll.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\rvseres.dll
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\rvse.dll.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\rvse.dll
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\shvl.dll.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\shvl.dll
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\rvsezm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\rvsezm.exe
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\hrtzzm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\hrtzzm.exe
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\cmnresm.dll.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\cmnresm.dll
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\cmnclim.dll.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\cmnclim.dll
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\hrtzres.dll.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\hrtzres.dll
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\hrtz.dll.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\hrtz.dll
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\shvlres.dll.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\shvlres.dll
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\zoneclim.dll.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\zoneclim.dll
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\znetm.dll.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\znetm.dll
from %PROGRAM_FILES%\NetMeeting\callcont.dll.new to %PROGRAM_FILES%\NetMeeting\callcont.dll
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\zonelibm.dll.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\zonelibm.dll
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\zeeverm.dll.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\zeeverm.dll
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\uniansi.dll.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\uniansi.dll
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\shvlzm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\shvlzm.exe
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\zcorem.dll.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\zcorem.dll
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\zclientm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\zclientm.exe
from %PROGRAM_FILES%\Movie Maker\wmm2eres.dll.new to %PROGRAM_FILES%\Movie Maker\wmm2eres.dll
from %PROGRAM_FILES%\Movie Maker\wmm2ae.dll.new to %PROGRAM_FILES%\Movie Maker\wmm2ae.dll
from %PROGRAM_FILES%\Movie Maker\wmm2filt.dll.new to %PROGRAM_FILES%\Movie Maker\wmm2filt.dll
from %PROGRAM_FILES%\Movie Maker\wmm2ext.dll.new to %PROGRAM_FILES%\Movie Maker\wmm2ext.dll
from %PROGRAM_FILES%\Movie Maker\moviemk.exe.new to %PROGRAM_FILES%\Movie Maker\moviemk.exe
from %PROGRAM_FILES%\Internet Explorer\hmmapi.dll.new to %PROGRAM_FILES%\Internet Explorer\hmmapi.dll
from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\trialoc.dll.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\trialoc.dll
from %PROGRAM_FILES%\Internet Explorer\iexplore.exe.new to %PROGRAM_FILES%\Internet Explorer\iexplore.exe
from %PROGRAM_FILES%\Internet Explorer\iedw.exe.new to %PROGRAM_FILES%\Internet Explorer\iedw.exe
from %PROGRAM_FILES%\Movie Maker\wmm2fxa.dll.new to %PROGRAM_FILES%\Movie Maker\wmm2fxa.dll
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\chkr.dll.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\chkr.dll
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\bckgzm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\bckgzm.exe
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\chkrzm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\chkrzm.exe
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\chkrres.dll.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\chkrres.dll
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\bckgres.dll.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\bckgres.dll
from %PROGRAM_FILES%\Movie Maker\wmm2res.dll.new to %PROGRAM_FILES%\Movie Maker\wmm2res.dll
from %PROGRAM_FILES%\Movie Maker\wmm2fxb.dll.new to %PROGRAM_FILES%\Movie Maker\wmm2fxb.dll
from %PROGRAM_FILES%\MSN Gaming Zone\Windows\bckg.dll.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\bckg.dll
from %PROGRAM_FILES%\Movie Maker\wmm2res2.dll.new to %PROGRAM_FILES%\Movie Maker\wmm2res2.dll
from %PROGRAM_FILES%\NetMeeting\cb32.exe.new to %PROGRAM_FILES%\NetMeeting\cb32.exe
from %PROGRAM_FILES%\Outlook Express\wabimp.dll.new to %PROGRAM_FILES%\Outlook Express\wabimp.dll
from %PROGRAM_FILES%\Outlook Express\wabfind.dll.new to %PROGRAM_FILES%\Outlook Express\wabfind.dll
from %PROGRAM_FILES%\Windows Media Player\custsat.dll.new to %PROGRAM_FILES%\Windows Media Player\custsat.dll
from %PROGRAM_FILES%\Outlook Express\wabmig.exe.new to %PROGRAM_FILES%\Outlook Express\wabmig.exe
from %PROGRAM_FILES%\Outlook Express\wab.exe.new to %PROGRAM_FILES%\Outlook Express\wab.exe
from %PROGRAM_FILES%\Outlook Express\oemig50.exe.new to %PROGRAM_FILES%\Outlook Express\oemig50.exe
from %PROGRAM_FILES%\Outlook Express\oeimport.dll.new to %PROGRAM_FILES%\Outlook Express\oeimport.dll
from %PROGRAM_FILES%\Outlook Express\setup50.exe.new to %PROGRAM_FILES%\Outlook Express\setup50.exe
from %PROGRAM_FILES%\Outlook Express\oemiglib.dll.new to %PROGRAM_FILES%\Outlook Express\oemiglib.dll
from %PROGRAM_FILES%\Windows Media Player\migrate.exe.new to %PROGRAM_FILES%\Windows Media Player\migrate.exe
from %PROGRAM_FILES%\Windows Media Player\wmpband.dll.new to %PROGRAM_FILES%\Windows Media Player\wmpband.dll
from %PROGRAM_FILES%\Windows Media Player\setup_wm.exe.new to %PROGRAM_FILES%\Windows Media Player\setup_wm.exe
from %PROGRAM_FILES%\Windows Media Player\wmpns.dll.new to %PROGRAM_FILES%\Windows Media Player\wmpns.dll
from %PROGRAM_FILES%\Windows Media Player\wmplayer.exe.new to %PROGRAM_FILES%\Windows Media Player\wmplayer.exe
from %PROGRAM_FILES%\Windows Media Player\npwmsdrm.dll.new to %PROGRAM_FILES%\Windows Media Player\npwmsdrm.dll
from %PROGRAM_FILES%\Windows Media Player\mpvis.dll.new to %PROGRAM_FILES%\Windows Media Player\mpvis.dll
from %PROGRAM_FILES%\Windows Media Player\mplayer2.exe.new to %PROGRAM_FILES%\Windows Media Player\mplayer2.exe
from %PROGRAM_FILES%\Windows Media Player\npdsplay.dll.new to %PROGRAM_FILES%\Windows Media Player\npdsplay.dll
from %PROGRAM_FILES%\Windows Media Player\npdrmv2.dll.new to %PROGRAM_FILES%\Windows Media Player\npdrmv2.dll
from %PROGRAM_FILES%\NetMeeting\nac.dll.new to %PROGRAM_FILES%\NetMeeting\nac.dll
from %PROGRAM_FILES%\NetMeeting\mst123.dll.new to %PROGRAM_FILES%\NetMeeting\mst123.dll
from %PROGRAM_FILES%\NetMeeting\nmasnt.dll.new to %PROGRAM_FILES%\NetMeeting\nmasnt.dll
from %PROGRAM_FILES%\NetMeeting\nmas.dll.new to %PROGRAM_FILES%\NetMeeting\nmas.dll
from %PROGRAM_FILES%\NetMeeting\mst120.dll.new to %PROGRAM_FILES%\NetMeeting\mst120.dll
from %PROGRAM_FILES%\NetMeeting\confmrsl.dll.new to %PROGRAM_FILES%\NetMeeting\confmrsl.dll
from %PROGRAM_FILES%\NetMeeting\conf.exe.new to %PROGRAM_FILES%\NetMeeting\conf.exe
from %PROGRAM_FILES%\NetMeeting\h323cc.dll.new to %PROGRAM_FILES%\NetMeeting\h323cc.dll
from %PROGRAM_FILES%\NetMeeting\dcap32.dll.new to %PROGRAM_FILES%\NetMeeting\dcap32.dll
from %PROGRAM_FILES%\NetMeeting\nmchat.dll.new to %PROGRAM_FILES%\NetMeeting\nmchat.dll
from %PROGRAM_FILES%\Outlook Express\msimn.exe.new to %PROGRAM_FILES%\Outlook Express\msimn.exe
from %PROGRAM_FILES%\NetMeeting\wb32.exe.new to %PROGRAM_FILES%\NetMeeting\wb32.exe
from %PROGRAM_FILES%\Outlook Express\msoeres.dll.new to %PROGRAM_FILES%\Outlook Express\msoeres.dll
from %PROGRAM_FILES%\Outlook Express\msoe.dll.new to %PROGRAM_FILES%\Outlook Express\msoe.dll
from %PROGRAM_FILES%\NetMeeting\rrcm.dll.new to %PROGRAM_FILES%\NetMeeting\rrcm.dll
from %PROGRAM_FILES%\NetMeeting\nmft.dll.new to %PROGRAM_FILES%\NetMeeting\nmft.dll
from %PROGRAM_FILES%\NetMeeting\nmcom.dll.new to %PROGRAM_FILES%\NetMeeting\nmcom.dll
from %PROGRAM_FILES%\NetMeeting\nmwb.dll.new to %PROGRAM_FILES%\NetMeeting\nmwb.dll
from %PROGRAM_FILES%\NetMeeting\nmoldwb.dll.new to %PROGRAM_FILES%\NetMeeting\nmoldwb.dll
from %CommonProgramFiles%\System\ado\msado26.tlb.new to %CommonProgramFiles%\System\ado\msado26.tlb
from %CommonProgramFiles%\System\ado\msado25.tlb.new to %CommonProgramFiles%\System\ado\msado25.tlb
from %CommonProgramFiles%\System\ado\msadomd.dll.new to %CommonProgramFiles%\System\ado\msadomd.dll
from %CommonProgramFiles%\System\ado\msado27.tlb.new to %CommonProgramFiles%\System\ado\msado27.tlb
from %CommonProgramFiles%\System\ado\msado21.tlb.new to %CommonProgramFiles%\System\ado\msado21.tlb
from %CommonProgramFiles%\System\ado\msader15.dll.new to %CommonProgramFiles%\System\ado\msader15.dll
from %CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\spttseng.dll.new to %CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\spttseng.dll
from %CommonProgramFiles%\System\ado\msado20.tlb.new to %CommonProgramFiles%\System\ado\msado20.tlb
from %CommonProgramFiles%\System\ado\msado15.dll.new to %CommonProgramFiles%\System\ado\msado15.dll
from %CommonProgramFiles%\System\ado\msador15.dll.new to %CommonProgramFiles%\System\ado\msador15.dll
from %CommonProgramFiles%\System\msadc\msadcf.dll.new to %CommonProgramFiles%\System\msadc\msadcf.dll
from %CommonProgramFiles%\System\msadc\msadcer.dll.new to %CommonProgramFiles%\System\msadc\msadcer.dll
from %CommonProgramFiles%\System\msadc\msadco.dll.new to %CommonProgramFiles%\System\msadc\msadco.dll
from %CommonProgramFiles%\System\msadc\msadcfr.dll.new to %CommonProgramFiles%\System\msadc\msadcfr.dll
from %CommonProgramFiles%\System\msadc\msadce.dll.new to %CommonProgramFiles%\System\msadc\msadce.dll
from %CommonProgramFiles%\System\ado\msadrh15.dll.new to %CommonProgramFiles%\System\ado\msadrh15.dll
from %CommonProgramFiles%\System\ado\msadox.dll.new to %CommonProgramFiles%\System\ado\msadox.dll
from %CommonProgramFiles%\System\directdb.dll.new to %CommonProgramFiles%\System\directdb.dll
from %CommonProgramFiles%\System\ado\msjro.dll.new to %CommonProgramFiles%\System\ado\msjro.dll
from %CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe.new to %CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe
from %CommonProgramFiles%\Microsoft Shared\Speech\sapi.dll.new to %CommonProgramFiles%\Microsoft Shared\Speech\sapi.dll
from %CommonProgramFiles%\Microsoft Shared\Triedit\triedit.dll.new to %CommonProgramFiles%\Microsoft Shared\Triedit\triedit.dll
from %CommonProgramFiles%\Microsoft Shared\Triedit\dhtmled.ocx.new to %CommonProgramFiles%\Microsoft Shared\Triedit\dhtmled.ocx
from %CommonProgramFiles%\Microsoft Shared\Speech\sapi.cpl.new to %CommonProgramFiles%\Microsoft Shared\Speech\sapi.cpl
from %CommonProgramFiles%\Microsoft Shared\MSInfo\ieinfo5.ocx.new to %CommonProgramFiles%\Microsoft Shared\MSInfo\ieinfo5.ocx
from %CommonProgramFiles%\Microsoft Shared\DAO\dao360.dll.new to %CommonProgramFiles%\Microsoft Shared\DAO\dao360.dll
from %CommonProgramFiles%\Microsoft Shared\Speech\1033\spcplui.dll.new to %CommonProgramFiles%\Microsoft Shared\Speech\1033\spcplui.dll
from %CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe.new to %CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe
from %CommonProgramFiles%\Microsoft Shared\VGX\vgx.dll.new to %CommonProgramFiles%\Microsoft Shared\VGX\vgx.dll
from %CommonProgramFiles%\SpeechEngines\Microsoft\spcommon.dll.new to %CommonProgramFiles%\SpeechEngines\Microsoft\spcommon.dll
from %CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\r1033tts.lxa.new to %CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\r1033tts.lxa
from %CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\sam.spd.new to %CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\sam.spd
from %CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\sam.sdf.new to %CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\sam.sdf
from %CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\ltts1033.lxa.new to %CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\ltts1033.lxa
from %CommonProgramFiles%\MSSoap\Binaries\mssoap1.dll.new to %CommonProgramFiles%\MSSoap\Binaries\mssoap1.dll
from %CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\fp4autl.dll.new to %CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\fp4autl.dll
from %CommonProgramFiles%\MSSoap\Binaries\wisc10.dll.new to %CommonProgramFiles%\MSSoap\Binaries\wisc10.dll
from %CommonProgramFiles%\MSSoap\Binaries\Resources\1033\mssoapr.dll.new to %CommonProgramFiles%\MSSoap\Binaries\Resources\1033\mssoapr.dll
from %CommonProgramFiles%\System\msadc\msadcor.dll.new to %CommonProgramFiles%\System\msadc\msadcor.dll
from %CommonProgramFiles%\System\wab32.dll.new to %CommonProgramFiles%\System\wab32.dll
from %CommonProgramFiles%\System\Ole DB\sqlxmlx.dll.new to %CommonProgramFiles%\System\Ole DB\sqlxmlx.dll
from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn.dll.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn.dll
from %CommonProgramFiles%\System\wab32res.dll.new to %CommonProgramFiles%\System\wab32res.dll
from %CommonProgramFiles%\System\Ole DB\oledb32r.dll.new to %CommonProgramFiles%\System\Ole DB\oledb32r.dll
from %CommonProgramFiles%\System\Ole DB\msdaurl.dll.new to %CommonProgramFiles%\System\Ole DB\msdaurl.dll
from %CommonProgramFiles%\System\Ole DB\msdatt.dll.new to %CommonProgramFiles%\System\Ole DB\msdatt.dll
from %CommonProgramFiles%\System\Ole DB\oledb32.dll.new to %CommonProgramFiles%\System\Ole DB\oledb32.dll
from %CommonProgramFiles%\System\Ole DB\msxactps.dll.new to %CommonProgramFiles%\System\Ole DB\msxactps.dll
from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn1.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn1.exe
from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwutil.dll.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwutil.dll
from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwtutor.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwtutor.exe
from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\isignup.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\isignup.exe
from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\inetwiz.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\inetwiz.exe
from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwrmind.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwrmind.exe
from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwdl.dll.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwdl.dll
from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn2.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn2.exe
from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwres.dll.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwres.dll
from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwhelp.dll.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwhelp.dll
from %CommonProgramFiles%\System\msadc\msdaremr.dll.new to %CommonProgramFiles%\System\msadc\msdaremr.dll
from %CommonProgramFiles%\System\msadc\msdarem.dll.new to %CommonProgramFiles%\System\msadc\msdarem.dll
from %CommonProgramFiles%\System\Ole DB\msdadc.dll.new to %CommonProgramFiles%\System\Ole DB\msdadc.dll
from %CommonProgramFiles%\System\msadc\msdfmap.dll.new to %CommonProgramFiles%\System\msadc\msdfmap.dll
from %CommonProgramFiles%\System\msadc\msdaprst.dll.new to %CommonProgramFiles%\System\msadc\msdaprst.dll
from %CommonProgramFiles%\System\msadc\msadds.dll.new to %CommonProgramFiles%\System\msadc\msadds.dll
from %CommonProgramFiles%\System\msadc\msadcs.dll.new to %CommonProgramFiles%\System\msadc\msadcs.dll
from %CommonProgramFiles%\System\msadc\msdaprsr.dll.new to %CommonProgramFiles%\System\msadc\msdaprsr.dll
from %CommonProgramFiles%\System\msadc\msaddsr.dll.new to %CommonProgramFiles%\System\msadc\msaddsr.dll
from %CommonProgramFiles%\System\Ole DB\msdaenum.dll.new to %CommonProgramFiles%\System\Ole DB\msdaenum.dll
from %CommonProgramFiles%\System\Ole DB\msdasql.dll.new to %CommonProgramFiles%\System\Ole DB\msdasql.dll
from %CommonProgramFiles%\System\Ole DB\msdasc.dll.new to %CommonProgramFiles%\System\Ole DB\msdasc.dll
from %CommonProgramFiles%\System\Ole DB\msdatl3.dll.new to %CommonProgramFiles%\System\Ole DB\msdatl3.dll
from %CommonProgramFiles%\System\Ole DB\msdasqlr.dll.new to %CommonProgramFiles%\System\Ole DB\msdasqlr.dll
from %CommonProgramFiles%\System\Ole DB\msdaps.dll.new to %CommonProgramFiles%\System\Ole DB\msdaps.dll
from %CommonProgramFiles%\System\Ole DB\msdaora.dll.new to %CommonProgramFiles%\System\Ole DB\msdaora.dll
from %CommonProgramFiles%\System\Ole DB\msdaer.dll.new to %CommonProgramFiles%\System\Ole DB\msdaer.dll
from %CommonProgramFiles%\System\Ole DB\msdaosp.dll.new to %CommonProgramFiles%\System\Ole DB\msdaosp.dll
from %CommonProgramFiles%\System\Ole DB\msdaorar.dll.new to %CommonProgramFiles%\System\Ole DB\msdaorar.dll

Network activity:

Connects to:

'12#.#25.114.144':80
'localhost':1036

TCP:

HTTP GET requests:

12#.#25.114.144/

UDP:

DNS ASK www.ba##u.com

Miscellaneous:

Searches for the following windows:

ClassName: 'BaseBar' WindowName: 'ChanApp'
ClassName: 'Proxy Desktop' WindowName: '(null)'
ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
ClassName: 'SysListView32' WindowName: '(null)'
ClassName: 'CSCHiddenWindow' WindowName: '(null)'
ClassName: 'SystemTray_Main' WindowName: '(null)'
ClassName: 'OleMainThreadWndClass' WindowName: '(null)'
ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
ClassName: 'Indicator' WindowName: '(null)'
ClassName: 'Progman' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: '(null)' WindowName: 'Microsoft Internet Explorer'
ClassName: 'IEFrame' WindowName: '(null)'
ClassName: '' WindowName: '(null)'
ClassName: '(null)' WindowName: '(null)'

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial