Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '_srjx' = '<SYSTEM32>\CMD.EXE /C START %HOMEPATH%\My Documents\sjtoci.exe'
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\RECOVERirhqm.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\RECOVERirhqm.png
- '<SYSTEM32>\cmd.exe' /c DEL <Full path to file> >> NUL
- '%HOMEPATH%\My Documents\sjtoci.exe'
- <SYSTEM32>\cmd.exe
- ecmd.exe
- %APPDATA%\Microsoft\Windows\RECOVERirhqm.html
- %APPDATA%\Microsoft\Windows\RECOVERirhqm.txt
- %APPDATA%\Microsoft\RECOVERirhqm.txt
- %APPDATA%\Microsoft\RECOVERirhqm.png
- %APPDATA%\Microsoft\Windows\RECOVERirhqm.png
- %APPDATA%\Microsoft\Windows\Themes\RECOVERirhqm.png
- %APPDATA%\Microsoft\SystemCertificates\RECOVERirhqm.html
- %APPDATA%\Microsoft\Windows\Themes\RECOVERirhqm.html
- %APPDATA%\Microsoft\Windows\Themes\RECOVERirhqm.txt
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\RECOVERirhqm.html
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\RECOVERirhqm.txt
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\RECOVERirhqm.txt
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\RECOVERirhqm.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\RECOVERirhqm.png
- %APPDATA%\Mozilla\Extensions\RECOVERirhqm.png
- %APPDATA%\Microsoft\RECOVERirhqm.html
- %APPDATA%\Mozilla\Extensions\RECOVERirhqm.html
- %APPDATA%\Mozilla\Extensions\RECOVERirhqm.txt
- %APPDATA%\Microsoft\SystemCertificates\RECOVERirhqm.txt
- %APPDATA%\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.txt
- %APPDATA%\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.png
- %APPDATA%\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.png
- %APPDATA%\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.html
- %APPDATA%\Microsoft\MMC\RECOVERirhqm.html
- %APPDATA%\Microsoft\Media Player\RECOVERirhqm.html
- %APPDATA%\Microsoft\Media Player\RECOVERirhqm.txt
- %APPDATA%\Microsoft\MMC\RECOVERirhqm.txt
- %APPDATA%\Microsoft\MMC\RECOVERirhqm.png
- %APPDATA%\Microsoft\SystemCertificates\My\RECOVERirhqm.txt
- %APPDATA%\Microsoft\SystemCertificates\My\RECOVERirhqm.png
- %APPDATA%\Microsoft\SystemCertificates\RECOVERirhqm.png
- %APPDATA%\Microsoft\SystemCertificates\My\RECOVERirhqm.html
- %APPDATA%\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.html
- %APPDATA%\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.html
- %APPDATA%\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.txt
- %APPDATA%\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.txt
- %APPDATA%\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\RECOVERirhqm.html
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\RECOVERirhqm.txt
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\RECOVERirhqm.png
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\RECOVERirhqm.png
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\RECOVERirhqm.html
- %HOMEPATH%\Favorites\RECOVERirhqm.html
- %HOMEPATH%\Favorites\Links\RECOVERirhqm.html
- %HOMEPATH%\Favorites\Links\RECOVERirhqm.txt
- %HOMEPATH%\Favorites\RECOVERirhqm.txt
- %HOMEPATH%\Favorites\RECOVERirhqm.png
- <LS_APPDATA>\Identities\RECOVERirhqm.txt
- <LS_APPDATA>\Identities\RECOVERirhqm.png
- <LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\RECOVERirhqm.png
- <LS_APPDATA>\Identities\RECOVERirhqm.html
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\RECOVERirhqm.html
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\RECOVERirhqm.html
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\RECOVERirhqm.txt
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\RECOVERirhqm.txt
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\RECOVERirhqm.png
- %HOMEPATH%\Favorites\Links\RECOVERirhqm.png
- %APPDATA%\Mozilla\Firefox\RECOVERirhqm.png
- %APPDATA%\Mozilla\Firefox\Profiles\RECOVERirhqm.html
- %APPDATA%\Mozilla\Firefox\RECOVERirhqm.html
- %APPDATA%\Mozilla\Firefox\RECOVERirhqm.txt
- %APPDATA%\Mozilla\Firefox\Profiles\RECOVERirhqm.txt
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\RECOVERirhqm.txt
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\RECOVERirhqm.png
- %APPDATA%\Mozilla\Firefox\Profiles\RECOVERirhqm.png
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\RECOVERirhqm.html
- %HOMEPATH%\Cookies\RECOVERirhqm.png
- %APPDATA%\RECOVERirhqm.html
- %HOMEPATH%\Cookies\RECOVERirhqm.html
- %HOMEPATH%\Cookies\RECOVERirhqm.txt
- %APPDATA%\RECOVERirhqm.txt
- %APPDATA%\Mozilla\RECOVERirhqm.txt
- %APPDATA%\Mozilla\RECOVERirhqm.png
- %APPDATA%\RECOVERirhqm.png
- %APPDATA%\Mozilla\RECOVERirhqm.html
- %APPDATA%\Microsoft\Media Player\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Local Settings\History\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Local Settings\History\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Local Settings\Temp\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Local Settings\History\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Local Settings\Temp\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Local Settings\Temp\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Cookies\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Cookies\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Application Data\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Application Data\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Cookies\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Application Data\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RECOVERirhqm.txt
- %APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\RECOVERirhqm.png
- %APPDATA%\Microsoft\Address Book\RECOVERirhqm.html
- %APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\RECOVERirhqm.html
- %APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\RECOVERirhqm.txt
- %APPDATA%\Microsoft\Address Book\RECOVERirhqm.txt
- %APPDATA%\Identities\RECOVERirhqm.txt
- %APPDATA%\Identities\RECOVERirhqm.png
- %APPDATA%\Microsoft\Address Book\RECOVERirhqm.png
- %APPDATA%\Identities\RECOVERirhqm.html
- %APPDATA%\Microsoft\Internet Explorer\RECOVERirhqm.png
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\RECOVERirhqm.html
- %APPDATA%\Microsoft\Internet Explorer\RECOVERirhqm.html
- %APPDATA%\Microsoft\Internet Explorer\RECOVERirhqm.txt
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\RECOVERirhqm.txt
- %APPDATA%\Microsoft\Credentials\RECOVERirhqm.txt
- %APPDATA%\Microsoft\Credentials\RECOVERirhqm.png
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\RECOVERirhqm.png
- %APPDATA%\Microsoft\Credentials\RECOVERirhqm.html
- %APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\RECOVERirhqm.txt
- %APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\RECOVERirhqm.txt
- %APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Local Settings\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Local Settings\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Local Settings\RECOVERirhqm.txt
- <LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\RECOVERirhqm.txt
- %TEMP%\RECOVERirhqm.txt
- %TEMP%\RECOVERirhqm.png
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RECOVERirhqm.png
- %TEMP%\RECOVERirhqm.html
- %HOMEPATH%\Local Settings\History\RECOVERirhqm.html
- %HOMEPATH%\Local Settings\History\History.IE5\RECOVERirhqm.html
- %HOMEPATH%\Local Settings\History\History.IE5\RECOVERirhqm.txt
- %HOMEPATH%\Local Settings\History\RECOVERirhqm.txt
- %HOMEPATH%\Local Settings\History\RECOVERirhqm.png
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RECOVERirhqm.txt
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RECOVERirhqm.png
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\RECOVERirhqm.png
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RECOVERirhqm.html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\RECOVERirhqm.html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RECOVERirhqm.html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RECOVERirhqm.txt
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\RECOVERirhqm.txt
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\RECOVERirhqm.png
- %HOMEPATH%\Local Settings\History\History.IE5\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\Firefox\RECOVERirhqm.html
- <LS_APPDATA>\Mozilla\RECOVERirhqm.html
- <LS_APPDATA>\Mozilla\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\Firefox\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\RECOVERirhqm.html
- %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\RECOVERirhqm.png
- <LS_APPDATA>\RECOVERirhqm.html
- %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\RECOVERirhqm.html
- %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\RECOVERirhqm.txt
- <LS_APPDATA>\RECOVERirhqm.txt
- <LS_APPDATA>\VMware\RECOVERirhqm.txt
- <LS_APPDATA>\VMware\RECOVERirhqm.png
- <LS_APPDATA>\RECOVERirhqm.png
- <LS_APPDATA>\VMware\RECOVERirhqm.html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\RECOVERirhqm.txt
- %HOMEPATH%\NetHood\RECOVERirhqm.png
- %HOMEPATH%\My Documents\RECOVERirhqm.html
- %HOMEPATH%\NetHood\RECOVERirhqm.html
- %HOMEPATH%\NetHood\RECOVERirhqm.txt
- %HOMEPATH%\My Documents\RECOVERirhqm.txt
- %HOMEPATH%\My Documents\My Received Files\RECOVERirhqm.txt
- %HOMEPATH%\My Documents\My Received Files\RECOVERirhqm.png
- %HOMEPATH%\My Documents\RECOVERirhqm.png
- %HOMEPATH%\My Documents\My Received Files\RECOVERirhqm.html
- %HOMEPATH%\SendTo\RECOVERirhqm.png
- %HOMEPATH%\Recent\RECOVERirhqm.html
- %HOMEPATH%\SendTo\RECOVERirhqm.html
- %HOMEPATH%\SendTo\RECOVERirhqm.txt
- %HOMEPATH%\Recent\RECOVERirhqm.txt
- %HOMEPATH%\PrintHood\RECOVERirhqm.txt
- %HOMEPATH%\PrintHood\RECOVERirhqm.png
- %HOMEPATH%\Recent\RECOVERirhqm.png
- %HOMEPATH%\PrintHood\RECOVERirhqm.html
- %HOMEPATH%\My Documents\My Pictures\RECOVERirhqm.html
- %HOMEPATH%\Local Settings\<INETFILES>\RECOVERirhqm.html
- %HOMEPATH%\Local Settings\<INETFILES>\RECOVERirhqm.txt
- %HOMEPATH%\Local Settings\RECOVERirhqm.txt
- %HOMEPATH%\Local Settings\RECOVERirhqm.png
- %HOMEPATH%\Local Settings\<INETFILES>\RECOVERirhqm.png
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.png
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\RECOVERirhqm.html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.txt
- %HOMEPATH%\My Documents\My Music\RECOVERirhqm.html
- %HOMEPATH%\My Documents\My Music\RECOVERirhqm.txt
- %HOMEPATH%\My Documents\My Pictures\RECOVERirhqm.txt
- %HOMEPATH%\My Documents\My Pictures\RECOVERirhqm.png
- %HOMEPATH%\My Documents\My Music\RECOVERirhqm.png
- %HOMEPATH%\My Documents\Downloads\RECOVERirhqm.png
- %HOMEPATH%\Local Settings\RECOVERirhqm.html
- %HOMEPATH%\My Documents\Downloads\RECOVERirhqm.html
- %HOMEPATH%\My Documents\Downloads\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\RECOVERirhqm.html
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\RECOVERirhqm.html
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\RECOVERirhqm.html
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\RECOVERirhqm.html
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\RECOVERirhqm.html
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\RECOVERirhqm.html
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\RECOVERirhqm.html
- <LS_APPDATA>\Microsoft\RECOVERirhqm.html
- <LS_APPDATA>\Microsoft\Media Player\RECOVERirhqm.html
- <LS_APPDATA>\Microsoft\Media Player\RECOVERirhqm.txt
- <LS_APPDATA>\Microsoft\Windows\RECOVERirhqm.txt
- <LS_APPDATA>\Microsoft\Windows\RECOVERirhqm.png
- <LS_APPDATA>\Microsoft\Media Player\RECOVERirhqm.png
- <LS_APPDATA>\Microsoft\Credentials\RECOVERirhqm.png
- <LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\RECOVERirhqm.html
- <LS_APPDATA>\Microsoft\Credentials\RECOVERirhqm.html
- <LS_APPDATA>\Microsoft\Credentials\RECOVERirhqm.txt
- <LS_APPDATA>\Microsoft\Windows Media\RECOVERirhqm.html
- <LS_APPDATA>\Microsoft\Windows Media\RECOVERirhqm.txt
- <LS_APPDATA>\Microsoft\RECOVERirhqm.txt
- <LS_APPDATA>\Microsoft\RECOVERirhqm.png
- <LS_APPDATA>\Microsoft\Windows Media\RECOVERirhqm.png
- <LS_APPDATA>\Microsoft\Windows Media\9.0\RECOVERirhqm.png
- <LS_APPDATA>\Microsoft\Windows\RECOVERirhqm.html
- <LS_APPDATA>\Microsoft\Windows Media\9.0\RECOVERirhqm.html
- <LS_APPDATA>\Microsoft\Windows Media\9.0\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\RECOVERirhqm.html
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\RECOVERirhqm.html
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\RECOVERirhqm.html
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\RECOVERirhqm.html
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\RECOVERirhqm.html
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\RECOVERirhqm.html
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\RECOVERirhqm.html
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\RECOVERirhqm.html
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\RECOVERirhqm.html
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\RECOVERirhqm.png
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\RECOVERirhqm.html
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\RECOVERirhqm.html
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\RECOVERirhqm.html
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\RECOVERirhqm.txt
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Cookies\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Cookies\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Favorites\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Favorites\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Cookies\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Application Data\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Application Data\Microsoft\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Application Data\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Application Data\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Favorites\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Application Data\Microsoft\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Local Settings\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Local Settings\RECOVERirhqm.png
- C:\Documents and Settings\Default User\My Documents\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Local Settings\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Local Settings\Temp\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Local Settings\Temp\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Local Settings\History\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Local Settings\History\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Local Settings\Temp\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Local Settings\History\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\RECOVERirhqm.png
- %ALLUSERSPROFILE%\Documents\My Pictures\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\Documents\My Pictures\RECOVERirhqm.png
- %ALLUSERSPROFILE%\Documents\My Videos\RECOVERirhqm.png
- %ALLUSERSPROFILE%\Documents\My Pictures\RECOVERirhqm.html
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\RECOVERirhqm.html
- %ALLUSERSPROFILE%\Documents\My Music\RECOVERirhqm.html
- %ALLUSERSPROFILE%\Documents\My Music\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\RECOVERirhqm.png
- %ALLUSERSPROFILE%\DRM\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\DRM\RECOVERirhqm.png
- %ALLUSERSPROFILE%\Favorites\RECOVERirhqm.png
- %ALLUSERSPROFILE%\DRM\RECOVERirhqm.html
- %ALLUSERSPROFILE%\Documents\RECOVERirhqm.html
- %ALLUSERSPROFILE%\Documents\My Videos\RECOVERirhqm.html
- %ALLUSERSPROFILE%\Documents\My Videos\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\Documents\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\Documents\RECOVERirhqm.png
- %ALLUSERSPROFILE%\Documents\My Music\RECOVERirhqm.png
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\phsys[1].htm
- %ALLUSERSPROFILE%\Documents\My Music\My Playlists\RECOVERirhqm.png
- %ALLUSERSPROFILE%\Documents\My Music\My Playlists\RECOVERirhqm.html
- %ALLUSERSPROFILE%\Documents\My Music\My Playlists\RECOVERirhqm.txt
- <Current directory>\RECOVERirhqm.html
- %HOMEPATH%\My Documents\recover_file.txt
- %HOMEPATH%\My Documents\sjtoci.exe
- <Current directory>\RECOVERirhqm.txt
- <Current directory>\RECOVERirhqm.png
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\RECOVERirhqm.png
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\RECOVERirhqm.html
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\RECOVERirhqm.html
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\RECOVERirhqm.png
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\RECOVERirhqm.png
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\RECOVERirhqm.html
- %ALLUSERSPROFILE%\Favorites\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\Start Menu\RECOVERirhqm.png
- %ALLUSERSPROFILE%\Start Menu\Programs\RECOVERirhqm.html
- %ALLUSERSPROFILE%\Start Menu\RECOVERirhqm.html
- %ALLUSERSPROFILE%\Start Menu\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\RECOVERirhqm.png
- %ALLUSERSPROFILE%\Start Menu\Programs\RECOVERirhqm.png
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\RECOVERirhqm.png
- %ALLUSERSPROFILE%\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\Templates\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\Templates\RECOVERirhqm.png
- %ALLUSERSPROFILE%\RECOVERirhqm.png
- %ALLUSERSPROFILE%\Templates\RECOVERirhqm.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\RECOVERirhqm.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\RECOVERirhqm.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\RECOVERirhqm.png
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\RECOVERirhqm.png
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\RECOVERirhqm.png
- %ALLUSERSPROFILE%\Favorites\RECOVERirhqm.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\RECOVERirhqm.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\RECOVERirhqm.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\RECOVERirhqm.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\RECOVERirhqm.png
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\RECOVERirhqm.png
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\RECOVERirhqm.png
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\RECOVERirhqm.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\RECOVERirhqm.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\My Documents\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Local Settings\Temp\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Local Settings\Temp\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Local Settings\Temp\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Local Settings\History\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Local Settings\History\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Local Settings\History\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Local Settings\Application Data\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Local Settings\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Local Settings\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Local Settings\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\RECOVERirhqm.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\RECOVERirhqm.png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\RECOVERirhqm.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Start Menu\Programs\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Start Menu\Programs\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Start Menu\Programs\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\RECOVERirhqm.html
- C:\Documents and Settings\Default User\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Templates\RECOVERirhqm.html
- C:\Documents and Settings\Default User\RECOVERirhqm.html
- C:\Documents and Settings\Default User\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Templates\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Start Menu\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Start Menu\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Templates\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Start Menu\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\RECOVERirhqm.html
- C:\Documents and Settings\Default User\PrintHood\RECOVERirhqm.html
- C:\Documents and Settings\Default User\PrintHood\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Recent\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Recent\RECOVERirhqm.png
- C:\Documents and Settings\Default User\PrintHood\RECOVERirhqm.png
- C:\Documents and Settings\Default User\NetHood\RECOVERirhqm.png
- C:\Documents and Settings\Default User\My Documents\RECOVERirhqm.html
- C:\Documents and Settings\Default User\NetHood\RECOVERirhqm.html
- C:\Documents and Settings\Default User\NetHood\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\RECOVERirhqm.html
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\RECOVERirhqm.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\RECOVERirhqm.png
- C:\Documents and Settings\Default User\SendTo\RECOVERirhqm.png
- C:\Documents and Settings\Default User\Recent\RECOVERirhqm.html
- C:\Documents and Settings\Default User\SendTo\RECOVERirhqm.html
- C:\Documents and Settings\Default User\SendTo\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Cookies\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Cookies\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Cookies\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Application Data\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Application Data\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Application Data\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\RECOVERirhqm.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.png
- %HOMEPATH%\My Documents\sjtoci.exe
- 'ex###ation.info':80
- 'co######nseprotection.com':80
- 'eb#####oreforyou.com':80
- 'es##ok.com':80
- 'hm##me.net':80
- 'sh####oherbal.com':80
- http://ex###ation.info/plugins/phsys.php
- http://co######nseprotection.com/phsys.php
- http://eb#####oreforyou.com/phsys.php
- http://es##ok.com/phsys.php
- http://hm##me.net/phsys.php
- http://sh####oherbal.com/phsys.php
- DNS ASK ex###ation.info
- DNS ASK co######nseprotection.com
- DNS ASK eb#####oreforyou.com
- DNS ASK es##ok.com
- DNS ASK hm##me.net
- DNS ASK sh####oherbal.com