Trojan.MulDrop4.63652

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk

Malicious functions:

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)

Executes the following:

'<SYSTEM32>\taskkill.exe' /f /im kav32.exe /t
'<SYSTEM32>\taskkill.exe' /f /im taskmgr.exe /t
'<SYSTEM32>\taskkill.exe' /f /im 360tray.exe
'<SYSTEM32>\taskkill.exe' /f /im dr.com /t
'<SYSTEM32>\taskkill.exe' /f /im qq.exe /t
'<SYSTEM32>\taskkill.exe' /f /im sogouExplorer exe /t
'<SYSTEM32>\taskkill.exe' /f /im QQMusic.exe /t
'<SYSTEM32>\taskkill.exe' /f /im MSN Explorer.exe /t
'<SYSTEM32>\taskkill.exe' /f /im 360se.exe /t
'<SYSTEM32>\taskkill.exe' /f /im QQPCTray.exe
'<SYSTEM32>\shutdown.exe' /s /t 1
'<SYSTEM32>\taskkill.exe' /f /im kavsvc.exe
'<SYSTEM32>\taskkill.exe' /f /im QQPCRTP.exe
'<SYSTEM32>\taskkill.exe' /f /im KVXP.kxp
'<SYSTEM32>\taskkill.exe' /f /im Mcshield.exe
'<SYSTEM32>\taskkill.exe' /f /im VsTskMgr.exe
'<SYSTEM32>\taskkill.exe' /f /im Rav.exe
'<SYSTEM32>\taskkill.exe' /f /im Ravmon.exe

Terminates or attempts to terminate

the following user processes:

chrome.exe

Attempts to shut down the Windows operating system.

Modifies file system :

Creates the following files:

<Current directory>\hknms.sys
<SYSTEM32>\WinIo.dll
<SYSTEM32>\winio.vxd

Sets the 'hidden' attribute to the following files:

<Current directory>\hknms.sys

Deletes the following files:

<Current directory>\hknms.sys

Moves the following system files:

from <SYSTEM32>\oobe\actsetup\aprvcyms.htm to <SYSTEM32>\oobe\actsetup\aprvcyms.exe
from <SYSTEM32>\oobe\actsetup\areg1.htm to <SYSTEM32>\oobe\actsetup\areg1.exe
from <SYSTEM32>\oobe\actsetup\adrdyreg.htm to <SYSTEM32>\oobe\actsetup\adrdyreg.exe
from <SYSTEM32>\oobe\actsetup\apolicy.htm to <SYSTEM32>\oobe\actsetup\apolicy.exe
from <SYSTEM32>\oobe\actsetup\ausrinfo.htm to <SYSTEM32>\oobe\actsetup\ausrinfo.exe
from <SYSTEM32>\oobe\error\cnncterr.htm to <SYSTEM32>\oobe\error\cnncterr.exe
from <SYSTEM32>\oobe\actsetup\aregdial.htm to <SYSTEM32>\oobe\actsetup\aregdial.exe
from <SYSTEM32>\oobe\actsetup\aregdone.htm to <SYSTEM32>\oobe\actsetup\aregdone.exe
from <SYSTEM32>\oobe\actsetup\adeskerr.htm to <SYSTEM32>\oobe\actsetup\adeskerr.exe
from <SYSTEM32>\oobe\actsetup\actconn.htm to <SYSTEM32>\oobe\actsetup\actconn.exe
from <SYSTEM32>\oobe\actsetup\actdone.htm to <SYSTEM32>\oobe\actsetup\actdone.exe
from <SYSTEM32>\oobe\msobshel.htm to <SYSTEM32>\oobe\msobshel.exe
from <SYSTEM32>\oobe\updshell.htm to <SYSTEM32>\oobe\updshell.exe
from <SYSTEM32>\oobe\actsetup\activsvc.htm to <SYSTEM32>\oobe\actsetup\activsvc.exe
from <SYSTEM32>\oobe\actsetup\actlan.htm to <SYSTEM32>\oobe\actsetup\actlan.exe
from <SYSTEM32>\oobe\actsetup\activ.htm to <SYSTEM32>\oobe\actsetup\activ.exe
from <SYSTEM32>\oobe\actsetup\activerr.htm to <SYSTEM32>\oobe\actsetup\activerr.exe
from <SYSTEM32>\oobe\error\dialtone.htm to <SYSTEM32>\oobe\error\dialtone.exe
from <SYSTEM32>\oobe\html\isptype\isptype.htm to <SYSTEM32>\oobe\html\isptype\isptype.exe
from <SYSTEM32>\oobe\html\mouse\mouse.htm to <SYSTEM32>\oobe\html\mouse\mouse.exe
from <SYSTEM32>\oobe\html\iconnect\icntlast.htm to <SYSTEM32>\oobe\html\iconnect\icntlast.exe
from <SYSTEM32>\oobe\html\iconnect\iconnect.htm to <SYSTEM32>\oobe\html\iconnect\iconnect.exe
from <SYSTEM32>\oobe\html\mouse\mouse_c.htm to <SYSTEM32>\oobe\html\mouse\mouse_c.exe
from <SYSTEM32>\oobe\html\mouse\mouse_d.htm to <SYSTEM32>\oobe\html\mouse\mouse_d.exe
from <SYSTEM32>\oobe\html\mouse\mouse_a.htm to <SYSTEM32>\oobe\html\mouse\mouse_a.exe
from <SYSTEM32>\oobe\html\mouse\mouse_b.htm to <SYSTEM32>\oobe\html\mouse\mouse_b.exe
from <SYSTEM32>\oobe\html\dslmain\dsl_b.htm to <SYSTEM32>\oobe\html\dslmain\dsl_b.exe
from <SYSTEM32>\oobe\error\noanswer.htm to <SYSTEM32>\oobe\error\noanswer.exe
from <SYSTEM32>\oobe\error\pberr.htm to <SYSTEM32>\oobe\error\pberr.exe
from <SYSTEM32>\oobe\error\hndshake.htm to <SYSTEM32>\oobe\error\hndshake.exe
from <SYSTEM32>\oobe\error\isp2busy.htm to <SYSTEM32>\oobe\error\isp2busy.exe
from <SYSTEM32>\oobe\html\dslmain\dslmain.htm to <SYSTEM32>\oobe\html\dslmain\dslmain.exe
from <SYSTEM32>\oobe\html\dslmain\dsl_a.htm to <SYSTEM32>\oobe\html\dslmain\dsl_a.exe
from <SYSTEM32>\oobe\error\pulse.htm to <SYSTEM32>\oobe\error\pulse.exe
from <SYSTEM32>\oobe\error\toobusy.htm to <SYSTEM32>\oobe\error\toobusy.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\confirm.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\confirm.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\rcstatus.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\rcstatus.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\OfflineOptions.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\OfflineOptions.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\pss_getting_worldwide_help.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\pss_getting_worldwide_help.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\RAHelp.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\RAHelp.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\RCMoreInfo.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\RCMoreInfo.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\ConnIssue.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\ConnIssue.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\LearnInternet.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\LearnInternet.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\OfflineDC.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\OfflineDC.exe
from %WINDIR%\pchealth\helpctr\System\UpdateCtr\AboutWU.htm to %WINDIR%\pchealth\helpctr\System\UpdateCtr\AboutWU.exe
from %WINDIR%\pchealth\helpctr\System\UpdateCtr\Learn.htm to %WINDIR%\pchealth\helpctr\System\UpdateCtr\Learn.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\sysServicesInfo.htm to %WINDIR%\pchealth\helpctr\System\sysinfo\sysServicesInfo.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\sysSoftwareInfo.htm to %WINDIR%\pchealth\helpctr\System\sysinfo\sysSoftwareInfo.exe
from %WINDIR%\pchealth\helpctr\System\UpdateCtr\updatecenter.htm to %WINDIR%\pchealth\helpctr\System\UpdateCtr\updatecenter.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Connection.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Connection.exe
from %WINDIR%\pchealth\helpctr\System\UpdateCtr\LearnInternet.htm to %WINDIR%\pchealth\helpctr\System\UpdateCtr\LearnInternet.exe
from %WINDIR%\pchealth\helpctr\System\UpdateCtr\learnWU.htm to %WINDIR%\pchealth\helpctr\System\UpdateCtr\learnWU.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcConnection.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcConnection.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen8.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen8.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen9.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen9.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen6_head.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen6_head.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen7.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen7.exe
from <SYSTEM32>\oobe\actshell.htm to <SYSTEM32>\oobe\actshell.exe
from <SYSTEM32>\oobe\dtsgnup.htm to <SYSTEM32>\oobe\dtsgnup.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\ShieldsUpMsg.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\ShieldsUpMsg.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Unsolicited\UnSolicitedRCUI.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Unsolicited\UnSolicitedRCUI.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen6.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen6.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcscreen3.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcscreen3.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\escalationhelp.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\escalationhelp.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcscreen1.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcscreen1.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcscreen2.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcscreen2.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen4.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen4.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen5.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen5.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcDetails.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcDetails.exe
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcInviteStatus.htm to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcInviteStatus.exe
from <SYSTEM32>\oobe\setup\isp.htm to <SYSTEM32>\oobe\setup\isp.exe
from <SYSTEM32>\oobe\setup\ispwait.htm to <SYSTEM32>\oobe\setup\ispwait.exe
from <SYSTEM32>\oobe\setup\ident1.htm to <SYSTEM32>\oobe\setup\ident1.exe
from <SYSTEM32>\oobe\setup\ident2.htm to <SYSTEM32>\oobe\setup\ident2.exe
from <SYSTEM32>\oobe\setup\keybd.htm to <SYSTEM32>\oobe\setup\keybd.exe
from <SYSTEM32>\oobe\setup\keybdcmt.htm to <SYSTEM32>\oobe\setup\keybdcmt.exe
from <SYSTEM32>\oobe\setup\jndomain.htm to <SYSTEM32>\oobe\setup\jndomain.exe
from <SYSTEM32>\oobe\setup\jndom_a.htm to <SYSTEM32>\oobe\setup\jndom_a.exe
from <SYSTEM32>\oobe\setup\ics.htm to <SYSTEM32>\oobe\setup\ics.exe
from <SYSTEM32>\oobe\setup\drdyoem.htm to <SYSTEM32>\oobe\setup\drdyoem.exe
from <SYSTEM32>\oobe\setup\drdyref.htm to <SYSTEM32>\oobe\setup\drdyref.exe
from <SYSTEM32>\oobe\setup\drdyisp.htm to <SYSTEM32>\oobe\setup\drdyisp.exe
from <SYSTEM32>\oobe\setup\drdymig.htm to <SYSTEM32>\oobe\setup\drdymig.exe
from <SYSTEM32>\oobe\setup\hnwprmpt.htm to <SYSTEM32>\oobe\setup\hnwprmpt.exe
from <SYSTEM32>\oobe\setup\iconn.htm to <SYSTEM32>\oobe\setup\iconn.exe
from <SYSTEM32>\oobe\setup\dtiwait.htm to <SYSTEM32>\oobe\setup\dtiwait.exe
from <SYSTEM32>\oobe\setup\fini.htm to <SYSTEM32>\oobe\setup\fini.exe
from <SYSTEM32>\oobe\setup\migdial.htm to <SYSTEM32>\oobe\setup\migdial.exe
from <SYSTEM32>\oobe\setup\regdial.htm to <SYSTEM32>\oobe\setup\regdial.exe
from <SYSTEM32>\oobe\setup\security.htm to <SYSTEM32>\oobe\setup\security.exe
from <SYSTEM32>\oobe\setup\reg1.htm to <SYSTEM32>\oobe\setup\reg1.exe
from <SYSTEM32>\oobe\setup\reg3.htm to <SYSTEM32>\oobe\setup\reg3.exe
from <SYSTEM32>\oobe\setup\welcome.htm to <SYSTEM32>\oobe\setup\welcome.exe
from %WINDIR%\Web\tip.htm to %WINDIR%\Web\tip.exe
from <SYSTEM32>\oobe\setup\timezone.htm to <SYSTEM32>\oobe\setup\timezone.exe
from <SYSTEM32>\oobe\setup\username.htm to <SYSTEM32>\oobe\setup\username.exe
from <SYSTEM32>\oobe\setup\refdial.htm to <SYSTEM32>\oobe\setup\refdial.exe
from <SYSTEM32>\oobe\setup\neweula.htm to <SYSTEM32>\oobe\setup\neweula.exe
from <SYSTEM32>\oobe\setup\neweula2.htm to <SYSTEM32>\oobe\setup\neweula2.exe
from <SYSTEM32>\oobe\setup\miglist.htm to <SYSTEM32>\oobe\setup\miglist.exe
from <SYSTEM32>\oobe\setup\migpage.htm to <SYSTEM32>\oobe\setup\migpage.exe
from <SYSTEM32>\oobe\setup\prodkey.htm to <SYSTEM32>\oobe\setup\prodkey.exe
from <SYSTEM32>\oobe\setup\prvcyms.htm to <SYSTEM32>\oobe\setup\prvcyms.exe
from <SYSTEM32>\oobe\setup\oempriv.htm to <SYSTEM32>\oobe\setup\oempriv.exe
from <SYSTEM32>\oobe\setup\Oobedisc.htm to <SYSTEM32>\oobe\setup\Oobedisc.exe
from <SYSTEM32>\oobe\isperror\ispdtone.htm to <SYSTEM32>\oobe\isperror\ispdtone.exe
from <SYSTEM32>\oobe\isperror\isphdshk.htm to <SYSTEM32>\oobe\isperror\isphdshk.exe
from <SYSTEM32>\oobe\icserror\icsdc.htm to <SYSTEM32>\oobe\icserror\icsdc.exe
from <SYSTEM32>\oobe\isperror\ispcnerr.htm to <SYSTEM32>\oobe\isperror\ispcnerr.exe
from <SYSTEM32>\oobe\isperror\isppberr.htm to <SYSTEM32>\oobe\isperror\isppberr.exe
from <SYSTEM32>\oobe\isperror\ispphbsy.htm to <SYSTEM32>\oobe\isperror\ispphbsy.exe
from <SYSTEM32>\oobe\isperror\ispins.htm to <SYSTEM32>\oobe\isperror\ispins.exe
from <SYSTEM32>\oobe\isperror\ispnoanw.htm to <SYSTEM32>\oobe\isperror\ispnoanw.exe
from <SYSTEM32>\oobe\html\sconnect\sconnect.htm to <SYSTEM32>\oobe\html\sconnect\sconnect.exe
from <SYSTEM32>\oobe\html\mouse\mouse_g.htm to <SYSTEM32>\oobe\html\mouse\mouse_g.exe
from <SYSTEM32>\oobe\html\mouse\mouse_h.htm to <SYSTEM32>\oobe\html\mouse\mouse_h.exe
from <SYSTEM32>\oobe\html\mouse\mouse_e.htm to <SYSTEM32>\oobe\html\mouse\mouse_e.exe
from <SYSTEM32>\oobe\html\mouse\mouse_f.htm to <SYSTEM32>\oobe\html\mouse\mouse_f.exe
from <SYSTEM32>\oobe\html\mouse\mouse_k.htm to <SYSTEM32>\oobe\html\mouse\mouse_k.exe
from <SYSTEM32>\oobe\html\sconnect\scntlast.htm to <SYSTEM32>\oobe\html\sconnect\scntlast.exe
from <SYSTEM32>\oobe\html\mouse\mouse_i.htm to <SYSTEM32>\oobe\html\mouse\mouse_i.exe
from <SYSTEM32>\oobe\html\mouse\mouse_j.htm to <SYSTEM32>\oobe\html\mouse\mouse_j.exe
from <SYSTEM32>\oobe\isperror\ispsbusy.htm to <SYSTEM32>\oobe\isperror\ispsbusy.exe
from <SYSTEM32>\oobe\setup\autoupdt.htm to <SYSTEM32>\oobe\setup\autoupdt.exe
from <SYSTEM32>\oobe\setup\au_plcy.htm to <SYSTEM32>\oobe\setup\au_plcy.exe
from <SYSTEM32>\oobe\setup\activate.htm to <SYSTEM32>\oobe\setup\activate.exe
from <SYSTEM32>\oobe\setup\act_plcy.htm to <SYSTEM32>\oobe\setup\act_plcy.exe
from <SYSTEM32>\oobe\setup\compname.htm to <SYSTEM32>\oobe\setup\compname.exe
from <SYSTEM32>\oobe\setup\dialup.htm to <SYSTEM32>\oobe\setup\dialup.exe
from <SYSTEM32>\oobe\setup\badeula.htm to <SYSTEM32>\oobe\setup\badeula.exe
from <SYSTEM32>\oobe\setup\badpkey.htm to <SYSTEM32>\oobe\setup\badpkey.exe
from <SYSTEM32>\oobe\setup\acterror.htm to <SYSTEM32>\oobe\setup\acterror.exe
from <SYSTEM32>\oobe\regerror\rhndshk.htm to <SYSTEM32>\oobe\regerror\rhndshk.exe
from <SYSTEM32>\oobe\regerror\rnoansw.htm to <SYSTEM32>\oobe\regerror\rnoansw.exe
from <SYSTEM32>\oobe\regerror\rcnterr.htm to <SYSTEM32>\oobe\regerror\rcnterr.exe
from <SYSTEM32>\oobe\regerror\rdtone.htm to <SYSTEM32>\oobe\regerror\rdtone.exe
from <SYSTEM32>\oobe\regerror\rpulse.htm to <SYSTEM32>\oobe\regerror\rpulse.exe
from <SYSTEM32>\oobe\regerror\rtoobusy.htm to <SYSTEM32>\oobe\regerror\rtoobusy.exe
from <SYSTEM32>\oobe\regerror\rnomdm.htm to <SYSTEM32>\oobe\regerror\rnomdm.exe
from <SYSTEM32>\oobe\regerror\rpberr.htm to <SYSTEM32>\oobe\regerror\rpberr.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\sysRemoteInfo.htm to %WINDIR%\pchealth\helpctr\System\sysinfo\sysRemoteInfo.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\snd.htm to %WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\snd.exe
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Cnt\contents.htm to %WINDIR%\Help\Tours\WindowsMediaPlayer\Cnt\contents.exe
from %WINDIR%\Help\Tours\htmlTour\unlock_optimized.htm to %WINDIR%\Help\Tours\htmlTour\unlock_optimized.exe
from %WINDIR%\Help\Tours\htmlTour\unlock_playing.htm to %WINDIR%\Help\Tours\htmlTour\unlock_playing.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\DHtmlHeader.html to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\DHtmlHeader.exe
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\DHtmlHeader.html to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\DHtmlHeader.exe
from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\repairRedist.htm to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\repairRedist.exe
from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\SmartNav.htm to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\SmartNav.exe
from %WINDIR%\Help\Tours\htmlTour\unlock_fr.htm to %WINDIR%\Help\Tours\htmlTour\unlock_fr.exe
from %WINDIR%\Help\Tours\htmlTour\start_fr.htm to %WINDIR%\Help\Tours\htmlTour\start_fr.exe
from %WINDIR%\Help\Tours\htmlTour\start_icons.htm to %WINDIR%\Help\Tours\htmlTour\start_icons.exe
from %WINDIR%\Help\Tours\htmlTour\start_ending.htm to %WINDIR%\Help\Tours\htmlTour\start_ending.exe
from %WINDIR%\Help\Tours\htmlTour\start_files.htm to %WINDIR%\Help\Tours\htmlTour\start_files.exe
from %WINDIR%\Help\Tours\htmlTour\start_windows.htm to %WINDIR%\Help\Tours\htmlTour\start_windows.exe
from %WINDIR%\Help\Tours\htmlTour\unlock_built.htm to %WINDIR%\Help\Tours\htmlTour\unlock_built.exe
from %WINDIR%\Help\Tours\htmlTour\start_menu.htm to %WINDIR%\Help\Tours\htmlTour\start_menu.exe
from %WINDIR%\Help\Tours\htmlTour\start_taskbar.htm to %WINDIR%\Help\Tours\htmlTour\start_taskbar.exe
from %WINDIR%\pchealth\helpctr\System\Headlines.htm to %WINDIR%\pchealth\helpctr\System\Headlines.exe
from %WINDIR%\pchealth\helpctr\System\blurbs\searchtips.htm to %WINDIR%\pchealth\helpctr\System\blurbs\searchtips.exe
from %WINDIR%\pchealth\helpctr\System\blurbs\tools.htm to %WINDIR%\pchealth\helpctr\System\blurbs\tools.exe
from %WINDIR%\pchealth\helpctr\System\blurbs\options.htm to %WINDIR%\pchealth\helpctr\System\blurbs\options.exe
from %WINDIR%\pchealth\helpctr\System\blurbs\searchblurb.htm to %WINDIR%\pchealth\helpctr\System\blurbs\searchblurb.exe
from %WINDIR%\pchealth\helpctr\System\CompatCtr\CompatMode.htm to %WINDIR%\pchealth\helpctr\System\CompatCtr\CompatMode.exe
from %WINDIR%\pchealth\helpctr\System\CompatCtr\CompatOffline.htm to %WINDIR%\pchealth\helpctr\System\CompatCtr\CompatOffline.exe
from %WINDIR%\pchealth\helpctr\System\blurbs\windows_newsgroups.htm to %WINDIR%\pchealth\helpctr\System\blurbs\windows_newsgroups.exe
from %WINDIR%\pchealth\helpctr\System\CompatCtr\AboutCompat.htm to %WINDIR%\pchealth\helpctr\System\CompatCtr\AboutCompat.exe
from %WINDIR%\pchealth\helpctr\System\blurbs\keywordhelp.htm to %WINDIR%\pchealth\helpctr\System\blurbs\keywordhelp.exe
from %WINDIR%\pchealth\helpctr\System\blurbs\about_support.htm to %WINDIR%\pchealth\helpctr\System\blurbs\about_support.exe
from %WINDIR%\pchealth\helpctr\System\blurbs\Favorites.htm to %WINDIR%\pchealth\helpctr\System\blurbs\Favorites.exe
from %WINDIR%\pchealth\helpctr\System\HomePage__DESKTOP.htm to %WINDIR%\pchealth\helpctr\System\HomePage__DESKTOP.exe
from %WINDIR%\pchealth\helpctr\System\HomePage__SERVER.htm to %WINDIR%\pchealth\helpctr\System\HomePage__SERVER.exe
from %WINDIR%\pchealth\helpctr\System\blurbs\Index.htm to %WINDIR%\pchealth\helpctr\System\blurbs\Index.exe
from %WINDIR%\pchealth\helpctr\System\blurbs\isupport.htm to %WINDIR%\pchealth\helpctr\System\blurbs\isupport.exe
from %WINDIR%\pchealth\helpctr\System\blurbs\ftshelp.htm to %WINDIR%\pchealth\helpctr\System\blurbs\ftshelp.exe
from %WINDIR%\pchealth\helpctr\System\blurbs\History.htm to %WINDIR%\pchealth\helpctr\System\blurbs\History.exe
from <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\Utility Manager.lnk to <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\Utility Manager.exe
from <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Entertainment\Windows Media Player.lnk to <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Entertainment\Windows Media Player.exe
from <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk to <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\Narrator.exe
from <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk to <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.exe
from %WINDIR%\Help\ixqlang.htm to %WINDIR%\Help\ixqlang.exe
from %WINDIR%\Help\migwiz.htm to %WINDIR%\Help\migwiz.exe
from %WINDIR%\Help\ciadmin.htm to %WINDIR%\Help\ciadmin.exe
from %WINDIR%\Help\ciquery.htm to %WINDIR%\Help\ciquery.exe
from <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\Magnifier.lnk to <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\Magnifier.exe
from <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Command Prompt.lnk to <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Command Prompt.exe
from <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Notepad.lnk to <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Notepad.exe
from <SYSTEM32>\config\systemprofile\Start Menu\Programs\Remote Assistance.lnk to <SYSTEM32>\config\systemprofile\Start Menu\Programs\Remote Assistance.exe
from <SYSTEM32>\config\systemprofile\Start Menu\Programs\Windows Media Player.lnk to <SYSTEM32>\config\systemprofile\Start Menu\Programs\Windows Media Player.exe
from <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Tour Windows XP.lnk to <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Tour Windows XP.exe
from <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Windows Explorer.lnk to <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Windows Explorer.exe
from <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Program Compatibility Wizard.lnk to <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Program Compatibility Wizard.exe
from <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Synchronize.lnk to <SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Synchronize.exe
from %WINDIR%\Help\migwiz2.htm to %WINDIR%\Help\migwiz2.exe
from %WINDIR%\Help\Tours\htmlTour\safe_better.htm to %WINDIR%\Help\Tours\htmlTour\safe_better.exe
from %WINDIR%\Help\Tours\htmlTour\safe_easier.htm to %WINDIR%\Help\Tours\htmlTour\safe_easier.exe
from %WINDIR%\Help\Tours\htmlTour\default.htm to %WINDIR%\Help\Tours\htmlTour\default.exe
from %WINDIR%\Help\Tours\htmlTour\footer.htm to %WINDIR%\Help\Tours\htmlTour\footer.exe
from %WINDIR%\Help\Tours\htmlTour\start_control.htm to %WINDIR%\Help\Tours\htmlTour\start_control.exe
from %WINDIR%\Help\Tours\htmlTour\start_desktop.htm to %WINDIR%\Help\Tours\htmlTour\start_desktop.exe
from %WINDIR%\Help\Tours\htmlTour\safe_faster.htm to %WINDIR%\Help\Tours\htmlTour\safe_faster.exe
from %WINDIR%\Help\Tours\htmlTour\safe_fr.htm to %WINDIR%\Help\Tours\htmlTour\safe_fr.exe
from %WINDIR%\Help\Tours\htmlTour\connected_wizard.htm to %WINDIR%\Help\Tours\htmlTour\connected_wizard.exe
from %WINDIR%\Help\Tours\htmlTour\best_robust.htm to %WINDIR%\Help\Tours\htmlTour\best_robust.exe
from %WINDIR%\Help\Tours\htmlTour\best_secure.htm to %WINDIR%\Help\Tours\htmlTour\best_secure.exe
from %WINDIR%\Help\Tours\htmlTour\best_fr.htm to %WINDIR%\Help\Tours\htmlTour\best_fr.exe
from %WINDIR%\Help\Tours\htmlTour\best_road.htm to %WINDIR%\Help\Tours\htmlTour\best_road.exe
from %WINDIR%\Help\Tours\htmlTour\connected_multiple.htm to %WINDIR%\Help\Tours\htmlTour\connected_multiple.exe
from %WINDIR%\Help\Tours\htmlTour\connected_networks.htm to %WINDIR%\Help\Tours\htmlTour\connected_networks.exe
from %WINDIR%\Help\Tours\htmlTour\connected_data.htm to %WINDIR%\Help\Tours\htmlTour\connected_data.exe
from %WINDIR%\Help\Tours\htmlTour\connected_fr.htm to %WINDIR%\Help\Tours\htmlTour\connected_fr.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\rcscreen6_head.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\rcscreen6_head.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\rctoolScreen1.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\rctoolScreen1.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAStatusBar.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAStatusBar.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAToolBar.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAToolBar.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\RCFileXfer.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\RCFileXfer.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\voicefirewallmsg.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\voicefirewallmsg.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\setting.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\setting.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\ErrorMsgs.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\ErrorMsgs.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAClient.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAClient.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\ConnIssue.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\ConnIssue.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\LearnInternet.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\LearnInternet.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\RAStartPage.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\RAStartPage.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\rcBuddy.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\rcBuddy.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\DividerBar.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\DividerBar.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAChatClient.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAChatClient.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\RAHelp.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\RAHelp.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\RCMoreInfo.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\RCMoreInfo.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\VOIPMsgs.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\VOIPMsgs.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\sysDiskTS.htm to %WINDIR%\pchealth\helpctr\System\sysinfo\sysDiskTS.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\sysEvtLogInfo.htm to %WINDIR%\pchealth\helpctr\System\sysinfo\sysEvtLogInfo.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\sysComponentInfo.htm to %WINDIR%\pchealth\helpctr\System\sysinfo\sysComponentInfo.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\sysConfigLaunch.htm to %WINDIR%\pchealth\helpctr\System\sysinfo\sysConfigLaunch.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\sysinfomain.htm to %WINDIR%\pchealth\helpctr\System\sysinfo\sysinfomain.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\sysinfosum.htm to %WINDIR%\pchealth\helpctr\System\sysinfo\sysinfosum.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\sysHealthInfo.htm to %WINDIR%\pchealth\helpctr\System\sysinfo\sysHealthInfo.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\sysInfoLaunch.htm to %WINDIR%\pchealth\helpctr\System\sysinfo\sysInfoLaunch.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\RSoP.htm to %WINDIR%\pchealth\helpctr\System\sysinfo\RSoP.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\RAChatServer.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\RAChatServer.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\RAServer.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\RAServer.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\DividerBar1.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\DividerBar1.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\DividerBar2.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\DividerBar2.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\TakeControlMsgs.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\TakeControlMsgs.exe
from %WINDIR%\pchealth\helpctr\System\sysinfo\msinfo.htm to %WINDIR%\pchealth\helpctr\System\sysinfo\msinfo.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\RAServerToolBar.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\RAServerToolBar.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\SettingServer.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\SettingServer.exe
from %WINDIR%\pchealth\helpctr\System\errors\redirect.htm to %WINDIR%\pchealth\helpctr\System\errors\redirect.exe
from %WINDIR%\pchealth\helpctr\System\errors\unreachable.htm to %WINDIR%\pchealth\helpctr\System\errors\unreachable.exe
from %WINDIR%\pchealth\helpctr\System\errors\notfound.htm to %WINDIR%\pchealth\helpctr\System\errors\notfound.exe
from %WINDIR%\pchealth\helpctr\System\errors\offline.htm to %WINDIR%\pchealth\helpctr\System\errors\offline.exe
from %WINDIR%\pchealth\helpctr\System\panels\AdvSearch.htm to %WINDIR%\pchealth\helpctr\System\panels\AdvSearch.exe
from %WINDIR%\pchealth\helpctr\System\panels\blank.htm to %WINDIR%\pchealth\helpctr\System\panels\blank.exe
from %WINDIR%\pchealth\helpctr\System\NetDiag\dglogs.htm to %WINDIR%\pchealth\helpctr\System\NetDiag\dglogs.exe
from %WINDIR%\pchealth\helpctr\System\NetDiag\dglogshelp.htm to %WINDIR%\pchealth\helpctr\System\NetDiag\dglogshelp.exe
from %WINDIR%\pchealth\helpctr\System\errors\indexfirstlevel.htm to %WINDIR%\pchealth\helpctr\System\errors\indexfirstlevel.exe
from %WINDIR%\pchealth\helpctr\System\DFS\uplddrvinfo.htm to %WINDIR%\pchealth\helpctr\System\DFS\uplddrvinfo.exe
from %WINDIR%\pchealth\helpctr\System\DFS\xmldialog.htm to %WINDIR%\pchealth\helpctr\System\DFS\xmldialog.exe
from %WINDIR%\pchealth\helpctr\System\CompatCtr\LearnCompat.htm to %WINDIR%\pchealth\helpctr\System\CompatCtr\LearnCompat.exe
from %WINDIR%\pchealth\helpctr\System\DFS\privacy.htm to %WINDIR%\pchealth\helpctr\System\DFS\privacy.exe
from %WINDIR%\pchealth\helpctr\System\errors\badurl.htm to %WINDIR%\pchealth\helpctr\System\errors\badurl.exe
from %WINDIR%\pchealth\helpctr\System\errors\connection.htm to %WINDIR%\pchealth\helpctr\System\errors\connection.exe
from %WINDIR%\pchealth\helpctr\System\DVDUpgrd\dvdupgrd.htm to %WINDIR%\pchealth\helpctr\System\DVDUpgrd\dvdupgrd.exe
from %WINDIR%\pchealth\helpctr\System\ErrMsg\ErrorMessagesOffline.htm to %WINDIR%\pchealth\helpctr\System\ErrMsg\ErrorMessagesOffline.exe
from %WINDIR%\pchealth\helpctr\System\panels\Context.htm to %WINDIR%\pchealth\helpctr\System\panels\Context.exe
from %WINDIR%\pchealth\helpctr\System\panels\subpanels\Index.htm to %WINDIR%\pchealth\helpctr\System\panels\subpanels\Index.exe
from %WINDIR%\pchealth\helpctr\System\panels\subpanels\Options.htm to %WINDIR%\pchealth\helpctr\System\panels\subpanels\Options.exe
from %WINDIR%\pchealth\helpctr\System\panels\subpanels\Favorites.htm to %WINDIR%\pchealth\helpctr\System\panels\subpanels\Favorites.exe
from %WINDIR%\pchealth\helpctr\System\panels\subpanels\History.htm to %WINDIR%\pchealth\helpctr\System\panels\subpanels\History.exe
from %WINDIR%\pchealth\helpctr\System\rc\rcRequest.htm to %WINDIR%\pchealth\helpctr\System\rc\rcRequest.exe
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\helpeeaccept.htm to %WINDIR%\pchealth\helpctr\System\Remote Assistance\helpeeaccept.exe
from %WINDIR%\pchealth\helpctr\System\panels\subpanels\Search.htm to %WINDIR%\pchealth\helpctr\System\panels\subpanels\Search.exe
from %WINDIR%\pchealth\helpctr\System\panels\subpanels\Subsite.htm to %WINDIR%\pchealth\helpctr\System\panels\subpanels\Subsite.exe
from %WINDIR%\pchealth\helpctr\System\panels\subpanels\Channels.htm to %WINDIR%\pchealth\helpctr\System\panels\subpanels\Channels.exe
from %WINDIR%\pchealth\helpctr\System\panels\MiniNavBar.htm to %WINDIR%\pchealth\helpctr\System\panels\MiniNavBar.exe
from %WINDIR%\pchealth\helpctr\System\panels\NavBar.htm to %WINDIR%\pchealth\helpctr\System\panels\NavBar.exe
from %WINDIR%\pchealth\helpctr\System\panels\firstpage.htm to %WINDIR%\pchealth\helpctr\System\panels\firstpage.exe
from %WINDIR%\pchealth\helpctr\System\panels\HHWrapper.htm to %WINDIR%\pchealth\helpctr\System\panels\HHWrapper.exe
from %WINDIR%\pchealth\helpctr\System\panels\ShareHelp.htm to %WINDIR%\pchealth\helpctr\System\panels\ShareHelp.exe
from %WINDIR%\pchealth\helpctr\System\panels\Topics.htm to %WINDIR%\pchealth\helpctr\System\panels\Topics.exe
from %WINDIR%\pchealth\helpctr\System\panels\Options.htm to %WINDIR%\pchealth\helpctr\System\panels\Options.exe
from %WINDIR%\pchealth\helpctr\System\panels\RemoteHelp.htm to %WINDIR%\pchealth\helpctr\System\panels\RemoteHelp.exe

Miscellaneous:

Searches for the following windows:

ClassName: '(null)' WindowName: 'QQ????.exe'
ClassName: '(null)' WindowName: 'my.exe'
ClassName: '(null)' WindowName: 'KuGoo.exe'
ClassName: '(null)' WindowName: 'QQGame.exe'
ClassName: '(null)' WindowName: 'CrossFire.exe'
ClassName: '(null)' WindowName: 'ui_launch_dx_bak.exe'
ClassName: '(null)' WindowName: 'imeutil.exe'
ClassName: '(null)' WindowName: 'ThunderNB.exe'
ClassName: '(null)' WindowName: 'plantsvszombies.exe.exe'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: '(null)' WindowName: 'NOTEPAD.exe'
ClassName: '(null)' WindowName: 'SoftManager.exe'
ClassName: '(null)' WindowName: 'Thunder.exe'
ClassName: '(null)' WindowName: 'Maxthon.exe'
ClassName: '(null)' WindowName: 'chrome.exe'
ClassName: '(null)' WindowName: 'ComputerZ_CN.exe'
ClassName: '(null)' WindowName: '(null)'
ClassName: '(null)' WindowName: 'AliIM.exe'
ClassName: '(null)' WindowName: 'TheWorld.exe'
ClassName: '(null)' WindowName: 'ComputerMonZ.exe'
ClassName: '(null)' WindowName: 'duospeak.exe'
ClassName: '(null)' WindowName: 'KartRider.exe'
ClassName: '(null)' WindowName: 'DNF.exe'
ClassName: '(null)' WindowName: 'QQLive.exe'
ClassName: '(null)' WindowName: 'QvodPlayer.exe'
ClassName: '(null)' WindowName: 'QvodTerminal.exe'

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial