Trojan.DownLoader8.42784

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Yahoo' = '<SYSTEM32>\SSVICHOSST.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.exe SSVICHOSST.exe'

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\done.exe
%HOMEPATH%\Start Menu\Programs\Startup\Startup.exe
%HOMEPATH%\Start Menu\Programs\Startup\done.exe
%WINDIR%\Tasks\At1.job
%WINDIR%\Tasks\At2.job
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\Startup.exe

Malicious functions:

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Task Manager (Taskmgr)
Registry Editor (RegEdit)

Executes the following:

'<SYSTEM32>\at.exe' 22:00 /interactive /EVERY:m,t,w,th,f,s,su <SYSTEM32>\SSVICHOSST.exe
'<SYSTEM32>\at.exe' 09:00 /interactive /EVERY:m,t,w,th,f,s,su <SYSTEM32>\SSVICHOSST.exe
'<SYSTEM32>\at.exe' /delete /yes

Modifies settings of Windows Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NofolderOptions' = '00000001'

Modifies file system :

Creates the following files:

C:\Far2\done.exe
C:\Far2\PluginSDK\done.exe
C:\Far2\PluginSDK\Headers.pas\done.exe
<Auxiliary element>
%CommonProgramFiles%\Microsoft Shared\Microsoft Shared.exe
%CommonProgramFiles%\Common Files.exe
%PROGRAM_FILES%\Program Files.exe
C:\Far2\Plugins\done.exe
C:\Far2\Plugins\WinSCP\done.exe
C:\Far2\Plugins\WinSCP\windows\done.exe
C:\Far2\PluginSDK\PluginSDK.exe
C:\Far2\PluginSDK\Headers.pas\Headers.pas.exe
C:\Far2\PluginSDK\Headers.c\done.exe
C:\Far2\PluginSDK\Headers.c\Headers.c.exe
%CommonProgramFiles%\Microsoft Shared\DW\1033\1033.exe
%CommonProgramFiles%\Microsoft Shared\DW\1031\done.exe
%CommonProgramFiles%\Microsoft Shared\DW\1031\1031.exe
%CommonProgramFiles%\Microsoft Shared\DW\1033\done.exe
%CommonProgramFiles%\Microsoft Shared\DW\1040\1040.exe
%CommonProgramFiles%\Microsoft Shared\DW\1036\done.exe
%CommonProgramFiles%\Microsoft Shared\DW\1036\1036.exe
%CommonProgramFiles%\Microsoft Shared\DW\DW.exe
%CommonProgramFiles%\Microsoft Shared\DAO\done.exe
%CommonProgramFiles%\Microsoft Shared\DAO\DAO.exe
%CommonProgramFiles%\Microsoft Shared\DW\1025\1025.exe
%CommonProgramFiles%\Microsoft Shared\DW\1028\done.exe
%CommonProgramFiles%\Microsoft Shared\DW\1028\1028.exe
%CommonProgramFiles%\Microsoft Shared\DW\1025\done.exe
C:\Far2\Plugins\WinSCP\windows\windows.exe
C:\Far2\Plugins\WinSCP\packages\my\my.exe
C:\Far2\Plugins\WinSCP\packages\filemng\done.exe
C:\Far2\Plugins\WinSCP\packages\filemng\filemng.exe
C:\Far2\Plugins\WinSCP\packages\my\done.exe
C:\Far2\Plugins\WinSCP\packages\tbx\tbx.exe
C:\Far2\Plugins\WinSCP\packages\tb2k\done.exe
C:\Far2\Plugins\WinSCP\packages\tb2k\tb2k.exe
C:\Far2\Plugins\WinSCP\lib\lib.exe
C:\Far2\Plugins\WinSCP\forms\done.exe
C:\Far2\Plugins\WinSCP\forms\forms.exe
C:\Far2\Plugins\WinSCP\lib\done.exe
C:\Far2\Plugins\WinSCP\packages\dragndrop\done.exe
C:\Far2\Plugins\WinSCP\packages\dragndrop\dragndrop.exe
C:\Far2\Plugins\WinSCP\packages\packages.exe
C:\Far2\Plugins\WinSCP\putty\done.exe
C:\Far2\Plugins\WinSCP\putty\windows\done.exe
C:\Far2\Plugins\WinSCP\putty\windows\windows.exe
C:\Far2\Plugins\WinSCP\release\release.exe
C:\Far2\Plugins\WinSCP\resource\done.exe
C:\Far2\Plugins\WinSCP\resource\resource.exe
C:\Far2\Plugins\WinSCP\release\done.exe
C:\Far2\Plugins\WinSCP\packages\theme\done.exe
C:\Far2\Plugins\WinSCP\packages\theme\theme.exe
C:\Far2\Plugins\WinSCP\packages\tbx\done.exe
C:\Far2\Plugins\WinSCP\packages\done.exe
C:\Far2\Plugins\WinSCP\putty\charset\done.exe
C:\Far2\Plugins\WinSCP\putty\charset\charset.exe
C:\Far2\Plugins\WinSCP\putty\putty.exe
%CommonProgramFiles%\Microsoft Shared\DW\1040\done.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\1033.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\bin.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\done.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\done.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\vinavbar\vinavbar.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\bots.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\done.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\scripts\done.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\scripts\scripts.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\admcgi.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\done.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\scripts\done.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\scripts\scripts.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\admisapi.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\servsupp\done.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\servsupp\servsupp.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\done.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_bin.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_aut\_vti_aut.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_adm\done.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_adm\_vti_adm.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\isapi.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\done.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\vinavbar\done.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_adm\_vti_adm.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_aut\done.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_aut\_vti_aut.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_adm\done.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\40.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\MSInfo.exe
%CommonProgramFiles%\Microsoft Shared\DW\done.exe
%CommonProgramFiles%\Microsoft Shared\DW\3082\done.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\done.exe
%CommonProgramFiles%\Microsoft Shared\Speech\1033\done.exe
%CommonProgramFiles%\Microsoft Shared\Speech\1033\1033.exe
%CommonProgramFiles%\Microsoft Shared\Speech\Speech.exe
%CommonProgramFiles%\Microsoft Shared\DW\1042\1042.exe
%CommonProgramFiles%\Microsoft Shared\DW\1041\done.exe
%CommonProgramFiles%\Microsoft Shared\DW\1041\1041.exe
%CommonProgramFiles%\Microsoft Shared\DW\1042\done.exe
%CommonProgramFiles%\Microsoft Shared\DW\3082\3082.exe
%CommonProgramFiles%\Microsoft Shared\DW\2052\done.exe
%CommonProgramFiles%\Microsoft Shared\DW\2052\2052.exe
%CommonProgramFiles%\Microsoft Shared\VGX\VGX.exe
%CommonProgramFiles%\Microsoft Shared\VC\done.exe
%CommonProgramFiles%\Microsoft Shared\VC\VC.exe
%CommonProgramFiles%\Microsoft Shared\VGX\done.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\web server extensions.exe
%CommonProgramFiles%\Microsoft Shared\Web Folders\done.exe
%CommonProgramFiles%\Microsoft Shared\Web Folders\Web Folders.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\done.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Stationery.exe
%CommonProgramFiles%\Microsoft Shared\Speech\done.exe
%CommonProgramFiles%\Microsoft Shared\TextConv\TextConv.exe
%CommonProgramFiles%\Microsoft Shared\Triedit\done.exe
%CommonProgramFiles%\Microsoft Shared\Triedit\Triedit.exe
%CommonProgramFiles%\Microsoft Shared\TextConv\done.exe
C:\Far2\Plugins\Align\Align.exe
C:\Far2\Plugins\7-Zip\done.exe
C:\Far2\Plugins\7-Zip\7-Zip.exe
C:\Far2\Plugins\Align\done.exe
C:\Far2\Plugins\AutoWrap\AutoWrap.exe
C:\Far2\Plugins\arclite\done.exe
C:\Far2\Plugins\arclite\arclite.exe
C:\Far2\Encyclopedia\Encyclopedia.exe
C:\Far2\Documentation\done.exe
C:\Far2\Documentation\rus\done.exe
C:\Far2\Encyclopedia\done.exe
C:\Far2\Plugins\Plugins.exe
C:\Far2\FExcept\done.exe
C:\Far2\FExcept\FExcept.exe
C:\Far2\Plugins\Colorer\hrc\auto\types\done.exe
C:\Far2\Plugins\Colorer\hrc\auto\types\types.exe
C:\Far2\Plugins\Colorer\hrc\auto\auto.exe
C:\Far2\Plugins\Colorer\hrc\auto\done.exe
C:\Far2\Plugins\Colorer\hrd\console\console.exe
C:\Far2\Plugins\Colorer\hrd\hrd.exe
C:\Far2\Plugins\Colorer\hrc\done.exe
C:\Far2\Plugins\Brackets\done.exe
C:\Far2\Plugins\Brackets\Brackets.exe
C:\Far2\Plugins\AutoWrap\done.exe
C:\Far2\Plugins\Colorer\Colorer.exe
C:\Far2\Plugins\Colorer\hrc\hrc.exe
C:\Far2\Plugins\Colorer\bin\done.exe
C:\Far2\Plugins\Colorer\bin\bin.exe
C:\Far2\Documentation\rus\rus.exe
C:\Far2\Addons\Colors\Custom Highlighting\Custom Highlighting.exe
C:\Far2\Addons\Colors\Colors.exe
C:\Far2\Addons\Addons.exe
C:\Far2\Addons\Colors\Custom Highlighting\done.exe
C:\Far2\Addons\Colors\done.exe
C:\Far2\Addons\Colors\Default Highlighting\done.exe
C:\Far2\Addons\Colors\Default Highlighting\Default Highlighting.exe
%HOMEPATH%\Templates\Templates.exe
%HOMEPATH%\Start Menu\done.exe
%HOMEPATH%\Start Menu\Programs\done.exe
%HOMEPATH%\Templates\done.exe
C:\Far2\Far2.exe
C:\Documents and Settings\done.exe
%HOMEPATH%\done.exe
C:\Far2\Addons\XLat\done.exe
C:\Far2\Addons\XLat\Russian\done.exe
C:\Far2\Addons\XLat\Russian\Russian.exe
C:\Far2\Addons\done.exe
C:\Far2\Documentation\eng\done.exe
C:\Far2\Documentation\eng\eng.exe
C:\Far2\Documentation\Documentation.exe
C:\Far2\Addons\SetUp\SetUp.exe
C:\Far2\Addons\Macros\done.exe
C:\Far2\Addons\Macros\Macros.exe
C:\Far2\Addons\SetUp\done.exe
C:\Far2\Addons\XLat\XLat.exe
C:\Far2\Addons\Shell\done.exe
C:\Far2\Addons\Shell\Shell.exe
C:\Far2\Plugins\Colorer\hrd\console\contrib\contrib.exe
C:\Far2\Plugins\TmpPanel\TmpPanel.exe
C:\Far2\Plugins\ProcList\done.exe
C:\Far2\Plugins\ProcList\ProcList.exe
C:\Far2\Plugins\TmpPanel\done.exe
C:\Far2\Plugins\WinSCP\components\done.exe
C:\Far2\Plugins\WinSCP\components\components.exe
C:\Far2\Plugins\WinSCP\WinSCP.exe
C:\Far2\Plugins\HlfViewer\done.exe
C:\Far2\Plugins\HlfViewer\HlfViewer.exe
C:\Far2\Plugins\FTP\done.exe
C:\Far2\Plugins\MacroView\MacroView.exe
C:\Far2\Plugins\Network\done.exe
C:\Far2\Plugins\Network\Network.exe
C:\Far2\Plugins\MacroView\done.exe
C:\Far2\Plugins\WinSCP\fari\done.exe
C:\Far2\Plugins\WinSCP\fari\fari.exe
C:\Far2\Plugins\WinSCP\far\done.exe
C:\Far2\Plugins\WinSCP\filezilla\filezilla.exe
C:\Far2\Plugins\WinSCP\filezilla\done.exe
C:\Far2\Plugins\WinSCP\filezilla\misc\done.exe
C:\Far2\Plugins\WinSCP\filezilla\misc\misc.exe
C:\Far2\Plugins\WinSCP\core\core.exe
C:\Far2\Plugins\WinSCP\console\done.exe
C:\Far2\Plugins\WinSCP\console\console.exe
C:\Far2\Plugins\WinSCP\core\done.exe
C:\Far2\Plugins\WinSCP\far\far.exe
C:\Far2\Plugins\WinSCP\dragext\done.exe
C:\Far2\Plugins\WinSCP\dragext\dragext.exe
C:\Far2\Plugins\FTP\lib\done.exe
C:\Far2\Plugins\EditCase\done.exe
C:\Far2\Plugins\EditCase\EditCase.exe
C:\Far2\Plugins\DrawLine\done.exe
C:\Far2\Plugins\EMenu\EMenu.exe
C:\Far2\Plugins\ExtSearch\doc\doc.exe
C:\Far2\Plugins\ExtSearch\ExtSearch.exe
C:\Far2\Plugins\EMenu\done.exe
C:\Far2\Plugins\Colorer\hrd\done.exe
C:\Far2\Plugins\Colorer\hrd\console\done.exe
C:\Far2\Plugins\Colorer\hrd\console\contrib\done.exe
C:\Far2\Plugins\Colorer\done.exe
C:\Far2\Plugins\DrawLine\DrawLine.exe
C:\Far2\Plugins\Compare\done.exe
C:\Far2\Plugins\Compare\Compare.exe
C:\Far2\Plugins\FarCmds\done.exe
C:\Far2\Plugins\FarCmds\FarCmds.exe
C:\Far2\Plugins\ExtSearch\done.exe
C:\Far2\Plugins\FileCase\FileCase.exe
C:\Far2\Plugins\FTP\lib\lib.exe
C:\Far2\Plugins\FTP\FTP.exe
C:\Far2\Plugins\FileCase\done.exe
C:\Far2\Plugins\ExtSearch\keys\done.exe
C:\Far2\Plugins\ExtSearch\keys\keys.exe
C:\Far2\Plugins\ExtSearch\doc\done.exe
C:\Far2\Plugins\ExtSearch\sources\sources.exe
C:\Far2\Plugins\ExtSearch\sources\done.exe
C:\Far2\Plugins\ExtSearch\sources\RegExp\done.exe
C:\Far2\Plugins\ExtSearch\sources\RegExp\RegExp.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_aut\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\unix\unix.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\mac\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\mac\mac.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\unix\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\win\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\win\win.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xpinstall\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xpinstall\xpinstall.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xml\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xslt\xslt.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\global-platform.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xslt\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\plugins\plugins.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\handling\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\handling\handling.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\plugins\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\profile\profile.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\preferences\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\preferences\preferences.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\mozapps.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-region\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-region\global-region.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\downloads.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\extensions\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\extensions\extensions.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xml\xml.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser-region\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser-region\browser-region.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\en-US.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\autoconfig\autoconfig.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\alerts\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\alerts\alerts.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\preferences\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\preferences\preferences.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\safebrowsing\safebrowsing.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\sidebar\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\sidebar\sidebar.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\safebrowsing\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\search\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\search\search.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\layout\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\security\security.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\svg\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\svg\svg.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\security\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\cookie\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\cookie\cookie.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\autoconfig\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\global.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\layout\layout.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\dom\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\dom\dom.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\profile\done.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\done.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\cpow.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\done.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\svg\svg.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\xml\done.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\xml\xml.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\svg\done.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\cookie\done.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\cookie\cookie.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\content.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\global.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\bindings.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\alerts\done.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\alerts\alerts.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\plugins\done.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\plugins\plugins.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\handling\done.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\preferences\preferences.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\profile\done.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\profile\profile.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\preferences\done.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\downloads\downloads.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\mozapps.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\done.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\downloads\done.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\handling\handling.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\extensions\done.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\extensions\extensions.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\toolkit.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pipnss\pipnss.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\passwordmgr\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\passwordmgr\passwordmgr.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pipnss\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\places\places.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pippki\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pippki\pippki.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\xpinstall\xpinstall.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\update\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\update\update.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\xpinstall\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\necko\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\necko\necko.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\done.exe
%PROGRAM_FILES%\FireFox\chrome\pippki\content\content.exe
%PROGRAM_FILES%\FireFox\chrome\pippki\pippki.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\done.exe
%PROGRAM_FILES%\FireFox\chrome\pippki\content\pippki\pippki.exe
%PROGRAM_FILES%\FireFox\chrome\pippki\done.exe
%PROGRAM_FILES%\FireFox\chrome\pippki\content\done.exe
%PROGRAM_FILES%\FireFox\chrome\pippki\content\pippki\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\services\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\services\services.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\places\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\feedback\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\feedback\feedback.exe
%CommonProgramFiles%\System\done.exe
%CommonProgramFiles%\System\Ole DB\done.exe
%CommonProgramFiles%\System\Ole DB\Ole DB.exe
%CommonProgramFiles%\done.exe
%PROGRAM_FILES%\FireFox\chrome\chrome.exe
%PROGRAM_FILES%\ComPlus Applications\done.exe
%PROGRAM_FILES%\ComPlus Applications\ComPlus Applications.exe
%CommonProgramFiles%\System\System.exe
%CommonProgramFiles%\SpeechEngines\done.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\done.exe
%CommonProgramFiles%\System\ado\ado.exe
%CommonProgramFiles%\System\msadc\done.exe
%CommonProgramFiles%\System\msadc\msadc.exe
%CommonProgramFiles%\System\ado\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\feeds.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\certerror\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\certerror\certerror.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\migration\migration.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\history\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\history\history.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\branding\branding.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\content.exe
%PROGRAM_FILES%\FireFox\chrome\browser\browser.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\branding\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\bookmarks\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\bookmarks\bookmarks.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\browser.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\done.exe
%CommonProgramFiles%\MSSoap\Binaries\Resources\done.exe
%CommonProgramFiles%\MSSoap\Binaries\Resources\1033\done.exe
%CommonProgramFiles%\MSSoap\Binaries\Resources\1033\1033.exe
%CommonProgramFiles%\MSSoap\Binaries\done.exe
%CommonProgramFiles%\ODBC\Data Sources\Data Sources.exe
%CommonProgramFiles%\ODBC\ODBC.exe
%CommonProgramFiles%\MSSoap\done.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\done.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\done.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\done.exe
%CommonProgramFiles%\Microsoft Shared\done.exe
%CommonProgramFiles%\MSSoap\Binaries\Resources\Resources.exe
%CommonProgramFiles%\MSSoap\Binaries\Binaries.exe
%CommonProgramFiles%\MSSoap\MSSoap.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\done.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\done.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\1033.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\TTS.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\done.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\1033.exe
%CommonProgramFiles%\Services\Services.exe
%CommonProgramFiles%\ODBC\done.exe
%CommonProgramFiles%\ODBC\Data Sources\done.exe
%CommonProgramFiles%\Services\done.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\Lexicon.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\Microsoft.exe
%CommonProgramFiles%\SpeechEngines\SpeechEngines.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\migration\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabview\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabview\tabview.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\communicator\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\communicator\communicator.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\places\places.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\feeds\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\feeds\feeds.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\places\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\tabbrowser.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\preferences\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\preferences\preferences.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\feeds\feeds.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\downloads\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\downloads\downloads.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\feeds\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\places.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\migration\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\migration\migration.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\en-US.exe
%PROGRAM_FILES%\FireFox\chrome\browser\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\locale.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\browser.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\branding\done.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\branding\branding.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\browser.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\search\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\search\search.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\safebrowsing\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\classic.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\skin.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\places.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\pageinfo.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\safebrowsing\safebrowsing.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\preferences\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\preferences\preferences.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\tabbrowser.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabview\tabview.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabview\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\feeds.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\browser.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\aero.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\preferences.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\places\done.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\places\places.exe
%HOMEPATH%\Start Menu\Programs\Accessories\done.exe
C:\Documents and Settings\Default User\Recent\done.exe
C:\Documents and Settings\Default User\Recent\Recent.exe
C:\Documents and Settings\Default User\PrintHood\done.exe
C:\Documents and Settings\Default User\SendTo\SendTo.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Programs.exe
C:\Documents and Settings\Default User\Start Menu\Start Menu.exe
C:\Documents and Settings\Default User\SendTo\done.exe
C:\Documents and Settings\Default User\My Documents\My Documents.exe
C:\Documents and Settings\Default User\Local Settings\done.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\done.exe
C:\Documents and Settings\Default User\My Documents\done.exe
C:\Documents and Settings\Default User\PrintHood\PrintHood.exe
C:\Documents and Settings\Default User\NetHood\done.exe
C:\Documents and Settings\Default User\NetHood\NetHood.exe
C:\Documents and Settings\Default User\Start Menu\done.exe
C:\Documents and Settings\Default User\Start Menu\Programs\done.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\done.exe
C:\Documents and Settings\Default User\Templates\Templates.exe
C:\Documents and Settings\LocalService\LocalService.exe
C:\Documents and Settings\Default User\done.exe
C:\Documents and Settings\Default User\Templates\done.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\done.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\Accessibility.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessories.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\Entertainment.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\Startup.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\done.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\done.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\done.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\done.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\done.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\9.0.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\done.exe
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\History.IE5.exe
C:\Documents and Settings\Default User\Local Settings\History\History.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\done.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Application Data.exe
C:\Documents and Settings\Default User\Local Settings\Local Settings.exe
C:\Documents and Settings\Default User\Favorites\done.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Microsoft.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\Windows Media.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\done.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\Media Player.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\done.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\KHMHGZ4F.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\done.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\U98D4X8H.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\done.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\YPORKZYZ.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\done.exe
C:\Documents and Settings\Default User\Local Settings\Temp\Temp.exe
C:\Documents and Settings\Default User\Local Settings\History\done.exe
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\done.exe
C:\Documents and Settings\Default User\Local Settings\Temp\done.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\2VAZY7AN.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\Content.IE5.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Temporary Internet Files.exe
C:\Documents and Settings\LocalService\Application Data\Application Data.exe
C:\Documents and Settings\LocalService\Local Settings\Temp\Temp.exe
C:\Documents and Settings\LocalService\Local Settings\History\done.exe
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\done.exe
C:\Documents and Settings\LocalService\Local Settings\Temp\done.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\BGGTYMH1.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Content.IE5.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Temporary Internet Files.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\done.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\Windows.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\done.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\done.exe
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\History.IE5.exe
C:\Documents and Settings\LocalService\Local Settings\History\History.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\done.exe
C:\Documents and Settings\LocalService\Local Settings\done.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\done.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\done.exe
C:\Documents and Settings\LocalService\done.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Microsoft.exe
C:\Documents and Settings\NetworkService\Application Data\Application Data.exe
C:\Documents and Settings\NetworkService\NetworkService.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\done.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\CJCTQ25G.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\done.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\LBMMC3H3.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\done.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\MOE00UY1.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\done.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\done.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\SystemCertificates.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\done.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\Media Player.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\My.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLs.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\done.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\Certificates.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\S-1-5-19.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\Credentials.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Microsoft.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\done.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\done.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\Internet Explorer.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\done.exe
C:\Documents and Settings\LocalService\Local Settings\Local Settings.exe
C:\Documents and Settings\LocalService\Cookies\done.exe
C:\Documents and Settings\LocalService\Cookies\Cookies.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Application Data.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\S-1-5-19.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\Credentials.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Microsoft.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\done.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLs.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\done.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\done.exe
C:\Documents and Settings\LocalService\Application Data\done.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\done.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\done.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\done.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\done.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\Pbk.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\done.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\done.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\Default Pictures.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\User Account Pictures.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\done.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\Media Player.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\done.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Network.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\done.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\Cm.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Connections.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Sample Music.exe
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\done.exe
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\My Playlists.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\done.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\done.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\0338E140.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\Sample Playlists.exe
%ALLUSERSPROFILE%\Application Data\done.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\done.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\done.exe
%ALLUSERSPROFILE%\Desktop\Desktop.exe
%ALLUSERSPROFILE%\Documents\My Music\My Music.exe
%ALLUSERSPROFILE%\Documents\Documents.exe
%ALLUSERSPROFILE%\Desktop\done.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\Media Index.exe
%ALLUSERSPROFILE%\All Users.exe
C:\Documents and Settings\Documents and Settings.exe
<Current directory>\done.exe
%ALLUSERSPROFILE%\Application Data\Application Data.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\DSS.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\Crypto.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Microsoft.exe
<SYSTEM32>\autorun.ini
%WINDIR%\SSVICHOSST.exe
<SYSTEM32>\SSVICHOSST.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\setting[1].nql
<Current directory>\af32d3b0.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\setting[1].nql
<SYSTEM32>\setting.ini
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\done.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\done.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\done.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\Dr Watson.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\done.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\HTML Help.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\done.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\done.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\done.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\MachineKeys.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\RSA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\S-1-5-18.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\done.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\MachineKeys.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\done.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\Media Player.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\done.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Internet Explorer.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\done.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\Certificates.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\My.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\SystemCertificates.exe
%ALLUSERSPROFILE%\Templates\done.exe
%ALLUSERSPROFILE%\Templates\Templates.exe
%ALLUSERSPROFILE%\Start Menu\done.exe
%ALLUSERSPROFILE%\done.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\Microsoft.exe
C:\Documents and Settings\Default User\Application Data\Application Data.exe
C:\Documents and Settings\Default User\Default User.exe
C:\Documents and Settings\Default User\Cookies\Cookies.exe
C:\Documents and Settings\Default User\Application Data\done.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\done.exe
C:\Documents and Settings\Default User\Cookies\done.exe
C:\Documents and Settings\Default User\Favorites\Favorites.exe
C:\Documents and Settings\Default User\Desktop\done.exe
C:\Documents and Settings\Default User\Desktop\Desktop.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\done.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLs.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\done.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLs.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\done.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\done.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\done.exe
%ALLUSERSPROFILE%\Start Menu\Programs\done.exe
%ALLUSERSPROFILE%\DRM\done.exe
%ALLUSERSPROFILE%\DRM\DRM.exe
%ALLUSERSPROFILE%\Documents\done.exe
%ALLUSERSPROFILE%\Favorites\Favorites.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Programs.exe
%ALLUSERSPROFILE%\Start Menu\Start Menu.exe
%ALLUSERSPROFILE%\Favorites\done.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sample Pictures.exe
%ALLUSERSPROFILE%\Documents\My Pictures\My Pictures.exe
%ALLUSERSPROFILE%\Documents\My Music\done.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\done.exe
%ALLUSERSPROFILE%\Documents\My Videos\done.exe
%ALLUSERSPROFILE%\Documents\My Videos\My Videos.exe
%ALLUSERSPROFILE%\Documents\My Pictures\done.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\done.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\done.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\System Tools.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\Administrative Tools.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Games\done.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Games\Games.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\done.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\done.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\Accessibility.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessories.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\Communications.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\done.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\Entertainment.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\done.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\Credentials.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\done.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\5.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\done.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\6.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\done.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\7.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\done.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\2.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\done.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\1.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\done.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\4.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\done.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\3.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\done.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\C.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\done.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\D.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\done.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\E.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\done.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\9.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\done.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\8.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\done.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\B.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\done.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\A.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\done.exe
<LS_APPDATA>\Microsoft\Credentials\Credentials.exe
<LS_APPDATA>\Microsoft\CD Burning\done.exe
<LS_APPDATA>\Microsoft\CD Burning\CD Burning.exe
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\S-1-5-21-2052111302-484763869-725345543-1003.exe
<LS_APPDATA>\Microsoft\Media Player\Media Player.exe
<LS_APPDATA>\Microsoft\Credentials\done.exe
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\done.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\done.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\Outlook Express.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Microsoft.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\done.exe
<LS_APPDATA>\Microsoft\Microsoft.exe
<LS_APPDATA>\Identities\done.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\done.exe
<LS_APPDATA>\Mozilla\Firefox\Firefox.exe
<LS_APPDATA>\Mozilla\Mozilla.exe
<LS_APPDATA>\Microsoft\done.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\Profiles.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\0.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\Cache.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\cwdgt0y8.default.exe
<LS_APPDATA>\Microsoft\Windows\done.exe
<LS_APPDATA>\Microsoft\Windows\Windows.exe
<LS_APPDATA>\Microsoft\Media Player\done.exe
<LS_APPDATA>\Microsoft\Windows Media\Windows Media.exe
<LS_APPDATA>\Microsoft\Windows Media\done.exe
<LS_APPDATA>\Microsoft\Windows Media\9.0\done.exe
<LS_APPDATA>\Microsoft\Windows Media\9.0\9.0.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\F.exe
%HOMEPATH%\My Documents\My Pictures\done.exe
%HOMEPATH%\My Documents\My Pictures\My Pictures.exe
%HOMEPATH%\My Documents\My Music\done.exe
%HOMEPATH%\My Documents\My Received Files\My Received Files.exe
%HOMEPATH%\NetHood\NetHood.exe
%HOMEPATH%\My Documents\done.exe
%HOMEPATH%\My Documents\My Received Files\done.exe
%HOMEPATH%\Local Settings\done.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\done.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\done.exe
%HOMEPATH%\My Documents\My Documents.exe
%HOMEPATH%\My Documents\My Music\My Music.exe
%HOMEPATH%\My Documents\Downloads\done.exe
%HOMEPATH%\My Documents\Downloads\Downloads.exe
%HOMEPATH%\Start Menu\Programs\Accessories\Accessories.exe
%HOMEPATH%\Start Menu\Programs\Programs.exe
%HOMEPATH%\Start Menu\Start Menu.exe
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\Accessibility.exe
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\done.exe
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\Entertainment.exe
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\done.exe
%HOMEPATH%\PrintHood\done.exe
%HOMEPATH%\PrintHood\PrintHood.exe
%HOMEPATH%\NetHood\done.exe
%HOMEPATH%\Recent\Recent.exe
%HOMEPATH%\SendTo\done.exe
%HOMEPATH%\SendTo\SendTo.exe
%HOMEPATH%\Recent\done.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\done.exe
<LS_APPDATA>\VMware\done.exe
<LS_APPDATA>\VMware\VMware.exe
<LS_APPDATA>\Mozilla\done.exe
<LS_APPDATA>\done.exe
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\MSHist012011111020111111.exe
%HOMEPATH%\Local Settings\History\History.IE5\History.IE5.exe
%HOMEPATH%\Local Settings\History\History.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\startupCache.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\done.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\done.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\done.exe
<LS_APPDATA>\Mozilla\Firefox\done.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\done.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\done.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\KHMHGZ4F.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\done.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\2VAZY7AN.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\done.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\YPORKZYZ.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\done.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\U98D4X8H.exe
%HOMEPATH%\Local Settings\History\done.exe
%HOMEPATH%\Local Settings\History\History.IE5\done.exe
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\done.exe
%TEMP%\Temp.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\Content.IE5.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Temporary Internet Files.exe
%TEMP%\done.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Temporary Internet Files.exe
C:\Documents and Settings\NetworkService\Local Settings\Temp\done.exe
C:\Documents and Settings\NetworkService\Local Settings\Temp\Temp.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Content.IE5.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\KHMHGZ4F.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\done.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\2VAZY7AN.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\done.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\done.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\done.exe
C:\Documents and Settings\NetworkService\Local Settings\History\History.exe
C:\Documents and Settings\NetworkService\Local Settings\History\done.exe
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\done.exe
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\History.IE5.exe
%HOMEPATH%\%USERNAME%.exe
C:\Documents and Settings\NetworkService\done.exe
C:\Documents and Settings\NetworkService\Local Settings\done.exe
%APPDATA%\Application Data.exe
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\done.exe
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}.exe
%APPDATA%\Identities\Identities.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\done.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\U98D4X8H.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\done.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\YPORKZYZ.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\done.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\done.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\done.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\Windows.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\Certificates.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\My.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\SystemCertificates.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\done.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLs.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\done.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLs.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\done.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\done.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\S-1-5-20.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\Internet Explorer.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\done.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\Media Player.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\done.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Microsoft.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Application Data.exe
C:\Documents and Settings\NetworkService\Local Settings\Local Settings.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\Credentials.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\done.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\done.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\S-1-5-20.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\done.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\done.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\done.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\done.exe
C:\Documents and Settings\NetworkService\Cookies\done.exe
C:\Documents and Settings\NetworkService\Cookies\Cookies.exe
C:\Documents and Settings\NetworkService\Application Data\done.exe
%APPDATA%\Identities\done.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\chrome.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\done.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarkbackups.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\done.exe
%APPDATA%\Mozilla\Firefox\done.exe
%APPDATA%\Mozilla\Firefox\Profiles\done.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\done.exe
%APPDATA%\Mozilla\Extensions\Extensions.exe
%APPDATA%\Mozilla\Mozilla.exe
%APPDATA%\Microsoft\done.exe
%APPDATA%\Mozilla\Extensions\done.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cwdgt0y8.default.exe
%APPDATA%\Mozilla\Firefox\Profiles\Profiles.exe
%APPDATA%\Mozilla\Firefox\Firefox.exe
%HOMEPATH%\Favorites\done.exe
%HOMEPATH%\Favorites\Links\done.exe
%HOMEPATH%\Favorites\Links\Links.exe
%HOMEPATH%\Local Settings\Local Settings.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}.exe
<LS_APPDATA>\Identities\Identities.exe
<LS_APPDATA>\Application Data.exe
%HOMEPATH%\Cookies\Cookies.exe
%APPDATA%\done.exe
%APPDATA%\Mozilla\done.exe
%HOMEPATH%\Cookies\done.exe
%HOMEPATH%\Favorites\Favorites.exe
%HOMEPATH%\Desktop\done.exe
%HOMEPATH%\Desktop\Desktop.exe
%APPDATA%\Microsoft\Windows\done.exe
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\done.exe
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Quick Launch.exe
%APPDATA%\Microsoft\Internet Explorer\Internet Explorer.exe
%APPDATA%\Microsoft\Internet Explorer\done.exe
%APPDATA%\Microsoft\MMC\MMC.exe
%APPDATA%\Microsoft\Media Player\done.exe
%APPDATA%\Microsoft\Media Player\Media Player.exe
%APPDATA%\Microsoft\Address Book\done.exe
%APPDATA%\Microsoft\Address Book\Address Book.exe
%APPDATA%\Microsoft\Microsoft.exe
%APPDATA%\Microsoft\Credentials\Credentials.exe
%APPDATA%\Microsoft\Credentials\done.exe
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\done.exe
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\S-1-5-21-2052111302-484763869-725345543-1003.exe
%APPDATA%\Microsoft\SystemCertificates\My\done.exe
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\done.exe
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\CTLs.exe
%APPDATA%\Microsoft\SystemCertificates\done.exe
%APPDATA%\Microsoft\Windows\Themes\done.exe
%APPDATA%\Microsoft\Windows\Themes\Themes.exe
%APPDATA%\Microsoft\Windows\Windows.exe
%APPDATA%\Microsoft\SystemCertificates\My\My.exe
%APPDATA%\Microsoft\SystemCertificates\SystemCertificates.exe
%APPDATA%\Microsoft\MMC\done.exe
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\Certificates.exe
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\done.exe
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\CRLs.exe
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\done.exe

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\setting.ini
<SYSTEM32>\autorun.ini
<SYSTEM32>\SSVICHOSST.exe

Network activity:

Connects to:

'nh#####nglan4.t35.com':80
'nh#####nglan3.t35.com':80

TCP:

HTTP GET requests:

nh#####nglan4.t35.com/setting.nql
nh#####nglan3.t35.com/setting.nql

UDP:

DNS ASK nh#####nglan4.t35.com
DNS ASK nh#####nglan3.t35.com

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'Indicator' WindowName: ''

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial