Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '<SYSTEM32>\3PLANE~1.SCR'
Malicious functions:
Executes the following:
- '<SYSTEM32>\3Planesoft\Screensaver Manager\Configurator.exe'
- '<SYSTEM32>\3Planesoft_Screensaver_Manager.scr' /c
- '<SYSTEM32>\taskkill.exe' /F /IM 3Planesoft_Screensaver_Manager.scr /T
- '%TEMP%\is-8LB77.tmp\screensavermanager.tmp' /SL5="$10132,1884149,53248,%TEMP%\is-OGUIO.tmp\screensavermanager.exe" /VERYSILENT /LANG=en
- '%TEMP%\RarSFX0\ring.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-IGHP5.tmp\ring.tmp' /SL5="$10104,3391414,74240,%TEMP%\RarSFX0\ring.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\is-OGUIO.tmp\screensavermanager.exe' /VERYSILENT /LANG=en
Modifies file system:
Creates the following files:
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-5F05T.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-4DI6L.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-J1TNM.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-LNSUJ.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-3N5MT.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-MMROP.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GFJ3C.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-DSCAH.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GE8VI.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GK9T1.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-FLFU5.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-I6MF2.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-13LF6.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-E1985.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-5DN3D.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-VTJ3I.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-OU3C7.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2JO9Q.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-ASOKF.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-MI9MO.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-B7RT8.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-C0OJT.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-6P59H.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-LTA2Q.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9BCMH.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-LSMBN.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-BPQOV.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-USGD0.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-DFIQD.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-SDELK.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2LNLD.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-7LCGN.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2K9OF.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JDINJ.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-U4IVU.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JDRAC.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-4QIHS.tmp
- %ProgramFiles%\3Planesoft Screensaver Manager\unins000.dat
- <SYSTEM32>\ScreensaverManager.log
- %TEMP%\~DF6443.tmp
- %HOMEPATH%\Desktop\3Planesoft Screensaver Manager.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\Screensaver Manager\Open 3Planesoft Screensaver Manager.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\Screensaver Manager\License.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\Screensaver Manager\Uninstall 3Planesoft Screensaver Manager.lnk
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-SJRPG.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-O96DH.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9G9CI.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-361K0.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-CCMGP.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-6VFAP.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-H16NP.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-OR892.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-F4E16.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-CGF5J.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-8DL2S.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2HQ9I.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-F2HMC.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-C4SKI.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-ME06M.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-HG1VA.tmp
- %TEMP%\is-FHK11.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-FHK11.tmp\_isetup\_shfoldr.dll
- %ProgramFiles%\3Planesoft Screensaver Manager\is-94IAK.tmp
- %TEMP%\is-8LB77.tmp\screensavermanager.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\The One Ring 3D Screensaver\Uninstall The One Ring 3D Screensaver.lnk
- %ProgramFiles%\The One Ring 3D Screensaver\unins000.dat
- %TEMP%\is-OGUIO.tmp\screensavermanager.exe
- <SYSTEM32>\3Planesoft\Screensaver Manager\is-FG9UP.tmp
- <SYSTEM32>\is-AHSBR.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-3D6TF.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\is-GVLSQ.tmp
- <SYSTEM32>\is-3AMOP.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\is-OKLMT.tmp
- %ProgramFiles%\3Planesoft Screensaver Manager\is-IU41M.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\The One Ring 3D Screensaver\License.lnk
- %ProgramFiles%\The One Ring 3D Screensaver\is-MR4DF.tmp
- %ProgramFiles%\The One Ring 3D Screensaver\is-NFBQA.tmp
- <SYSTEM32>\is-DABUP.tmp
- %TEMP%\is-OGUIO.tmp\_isetup\_shfoldr.dll
- %TEMP%\RarSFX0\ring.exe
- %TEMP%\is-IGHP5.tmp\ring.tmp
- %TEMP%\is-OGUIO.tmp\_isetup\_RegDLL.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\The One Ring 3D Screensaver\Take a look at more 3D screensavers from 3Planesoft.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\The One Ring 3D Screensaver\Open The One Ring 3D Screensaver.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\The One Ring 3D Screensaver\The One Ring 3D Screensaver on the Web.lnk
- <SYSTEM32>\is-U23IJ.tmp
- <SYSTEM32>\is-RASA9.tmp
- %ProgramFiles%\The One Ring 3D Screensaver\is-UA4E1.tmp
- %ProgramFiles%\The One Ring 3D Screensaver\is-284K3.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-QFC6N.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-BO941.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-B22KQ.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-BEIJV.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-TCOQN.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-7RVEB.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-HK1TF.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2QT8A.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-U90QR.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-IH3IN.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-P6349.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-CT4GN.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-G9S83.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-D2L5T.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9H5P5.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-HOEIV.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-H8M02.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-D4VG8.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-M8P9E.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-KULF2.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9J1B9.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-KVOHC.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-TQNS4.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-6U9Q5.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JN3TD.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-I4E0V.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-RQIL5.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-ERLGK.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-PAJ2R.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-TU156.tmp
Deletes the following files:
- %TEMP%\is-OGUIO.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-OGUIO.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-IGHP5.tmp\ring.tmp
- %TEMP%\is-OGUIO.tmp\screensavermanager.exe
- %TEMP%\is-FHK11.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-FHK11.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-8LB77.tmp\screensavermanager.tmp
Moves the following files:
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-LNSUJ.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fireside_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-5F05T.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\valentine.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-4DI6L.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\valentine_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-3N5MT.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\iceclock.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-MMROP.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\iceclock_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GFJ3C.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fireside.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-E1985.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\waterfall_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-FLFU5.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\deepspace.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-DSCAH.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\deepspace_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-J1TNM.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\koifish.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-I6MF2.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\koifish_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-13LF6.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\waterfall.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2JO9Q.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\earth_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-BPQOV.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\coralclock.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-USGD0.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\coralclock_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-ASOKF.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\tower.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-VTJ3I.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\tower_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-OU3C7.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\earth.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-LTA2Q.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\cuckooclock_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9BCMH.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\lagoon.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-5DN3D.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\lagoon_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-DFIQD.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\columbus.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-LSMBN.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\columbus_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-6P59H.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\cuckooclock.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GE8VI.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\waterclock.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-8DL2S.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\dutchwindmills.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-SJRPG.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\dutchwindmills_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-U4IVU.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\hauntedhouse.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2HQ9I.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\coralreef_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-F4E16.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\lighthousepoint.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-CGF5J.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\lighthousepoint_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2LNLD.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\snowvillage.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-7LCGN.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\snowvillage_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2K9OF.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\updates.xml
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JDRAC.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\hauntedhouse_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-4QIHS.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\crystalfireplace.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JDINJ.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\crystalfireplace_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-H16NP.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\railway.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-OR892.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\railway_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-CCMGP.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\bells.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GK9T1.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\waterclock_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-SDELK.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\koipond.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-6VFAP.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\koipond_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-F2HMC.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\zodiacclock.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-C4SKI.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\zodiacclock_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-ME06M.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\coralreef.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-O96DH.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\bells_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9G9CI.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\sweethearts.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-361K0.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\sweethearts_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-QFC6N.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\sofire.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9J1B9.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\sof_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-KVOHC.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fmoon.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\is-FG9UP.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Configurator.exe
- from <SYSTEM32>\is-AHSBR.tmp to <SYSTEM32>\ScreensaverManager.log
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-3D6TF.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\screensavers.xml
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-D4VG8.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\watermill.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-M8P9E.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\watermill_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-ERLGK.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\nautilus.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-TQNS4.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fmoon_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-KULF2.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\galleon.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-H8M02.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\galleon_screen.jpg
- from <SYSTEM32>\is-RASA9.tmp to <SYSTEM32>\The One Ring 3D Screensaver.exe
- from %ProgramFiles%\The One Ring 3D Screensaver\is-UA4E1.tmp to %ProgramFiles%\The One Ring 3D Screensaver\The screensaver on the Web.url
- from %ProgramFiles%\The One Ring 3D Screensaver\is-284K3.tmp to %ProgramFiles%\The One Ring 3D Screensaver\license.txt
- from %ProgramFiles%\The One Ring 3D Screensaver\is-MR4DF.tmp to %ProgramFiles%\The One Ring 3D Screensaver\unins000.exe
- from %ProgramFiles%\The One Ring 3D Screensaver\is-NFBQA.tmp to %ProgramFiles%\The One Ring 3D Screensaver\Take a look at more 3D screensavers from 3Planesoft.url
- from <SYSTEM32>\is-DABUP.tmp to <SYSTEM32>\The_One_Ring_3D_Screensaver.scr
- from <SYSTEM32>\3Planesoft\Screensaver Manager\is-OKLMT.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Screensavers Updater.exe
- from %ProgramFiles%\3Planesoft Screensaver Manager\is-IU41M.tmp to %ProgramFiles%\3Planesoft Screensaver Manager\license.txt
- from <SYSTEM32>\3Planesoft\Screensaver Manager\is-GVLSQ.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Help.chm
- from <SYSTEM32>\is-U23IJ.tmp to <SYSTEM32>\The One Ring.log
- from %ProgramFiles%\3Planesoft Screensaver Manager\is-94IAK.tmp to %ProgramFiles%\3Planesoft Screensaver Manager\unins000.exe
- from <SYSTEM32>\is-3AMOP.tmp to <SYSTEM32>\3Planesoft_Screensaver_Manager.scr
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-PAJ2R.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\nautilus_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9H5P5.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\clock_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-CT4GN.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\flag.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-U90QR.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\flag_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-BEIJV.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\nature.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-G9S83.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\nature_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-D2L5T.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\clock.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-MI9MO.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fish_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-B7RT8.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fireplace.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-C0OJT.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fireplace_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-IH3IN.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\watch.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-P6349.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\watch_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-HG1VA.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fish.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JN3TD.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\castle_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-I4E0V.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\halloween.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-HOEIV.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\halloween_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-TU156.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\discovery.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-RQIL5.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\discovery_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-6U9Q5.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\castle.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-TCOQN.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\lantern_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-BO941.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\theonering.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-B22KQ.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\ring_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-7RVEB.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\christmas.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-HK1TF.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\christmas_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2QT8A.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\lantern.ico
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'Display Properties'
- ClassName: '' WindowName: 'Screen Saver Settings'
- ClassName: '' WindowName: '3Planesoft Screensaver Manager'
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
