Trojan.KillFiles.19978

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'windowsNT' = 'wscript.exe //B "%TEMP%\zdriver.vbs"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MSKERNEL' = '%TEMP%\xelag.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MSKERNEL' = '%TEMP%\xelag.exe'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\Startup.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\Startup.exe
%HOMEPATH%\Start Menu\Programs\Startup\Download Manager.exe

Substitutes the following executable system files:

%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.exe with %WINDIR%\$NtUninstallWIC$\spuninst\spuninst.exe
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.exe with %WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.exe

Creates the following files on removable media:

<Drive name for removable media>:\desktop.inf

Modifies file system :

Creates the following files:

%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\Microsoft.VisualBasic.Vsa.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\8.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\Microsoft.VisualBasic.Compatibility.Data.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\8.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\Microsoft.VisualC.STLCLR.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\1.0.0.0__b03f5f7f11d50a3a\1.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualC\Microsoft.VisualC.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\8.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\8.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\8.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\Microsoft.Transactions.Bridge.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\3.5.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.JScript\Microsoft.JScript.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\8.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\Microsoft.VisualBasic.Compatibility.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\3.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.VisualBasic\Microsoft.VisualBasic.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework\PresentationFramework.exe
%WINDIR%\assembly\GAC_MSIL\PresentationCFFRasterizer\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFontCache\PresentationFontCache.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Aero\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Classic\PresentationFramework.Classic.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Aero\PresentationFramework.Aero.exe
%WINDIR%\assembly\GAC_MSIL\PresentationCFFRasterizer\PresentationCFFRasterizer.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\Microsoft.Vsa.Vb.CodeDOMProcessor.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\8.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Vsa\Microsoft.Vsa.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\8.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\PresentationBuildTasks\PresentationBuildTasks.exe
%WINDIR%\assembly\GAC_MSIL\PresentationBuildTasks\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft_VsaVb\Microsoft_VsaVb.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\8.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\Microsoft.Build.Utilities.v3.5.exe
%WINDIR%\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\cscompmgd\cscompmgd.exe
%WINDIR%\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\AspNetMMCExt\AspNetMMCExt.exe
%WINDIR%\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\IEHost\IEHost.exe
%WINDIR%\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\8.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\IEExecRemote\IEExecRemote.exe
%WINDIR%\assembly\GAC_MSIL\Accessibility\Accessibility.exe
%WINDIR%\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_32\System.Transactions\System.Transactions.exe
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_32\System.Printing\System.Printing.exe
%WINDIR%\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\GAC_MSIL.exe
%WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\2.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_32\System.Web\System.Web.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Tasks\Microsoft.Build.Tasks.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\3.5.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Utilities\Microsoft.Build.Utilities.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\Microsoft.Build.Tasks.v3.5.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\3.5.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Framework\Microsoft.Build.Framework.exe
%WINDIR%\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\Microsoft.Build.Conversion.v3.5.exe
%WINDIR%\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\IIEHost\IIEHost.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\3.5.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\3.5.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Engine\Microsoft.Build.Engine.exe
%WINDIR%\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Design\System.Design.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\2.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Deployment\System.Deployment.exe
%WINDIR%\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\System.DirectoryServices.AccountManagement.exe
%WINDIR%\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.DirectoryServices\System.DirectoryServices.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.SqlXml\System.Data.SqlXml.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Services\System.Data.Services.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Services\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Linq\System.Data.Linq.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Linq\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Services.Design\System.Data.Services.Design.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Services.Design\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Services.Client\System.Data.Services.Client.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Services.Client\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.IO.Log\System.IO.Log.exe
%WINDIR%\assembly\GAC_MSIL\System.IO.Log\3.0.0.0__b03f5f7f11d50a3a\3.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.IdentityModel.Selectors\System.IdentityModel.Selectors.exe
%WINDIR%\assembly\GAC_MSIL\System.IdentityModel.Selectors\3.0.0.0__b77a5c561934e089\3.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Management.Instrumentation\System.Management.Instrumentation.exe
%WINDIR%\assembly\GAC_MSIL\System.Management.Instrumentation\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Management\System.Management.exe
%WINDIR%\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\3.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Drawing\System.Drawing.exe
%WINDIR%\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.DirectoryServices.Protocols\System.DirectoryServices.Protocols.exe
%WINDIR%\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.IdentityModel\System.IdentityModel.exe
%WINDIR%\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Drawing.Design\System.Drawing.Design.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Entity.Design\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\SMDiagnostics\SMDiagnostics.exe
%WINDIR%\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\3.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\Sentinel.v3.5Client\Sentinel.v3.5Client.exe
%WINDIR%\assembly\GAC_MSIL\Sentinel.v3.5Client\3.5.0.0__b03f5f7f11d50a3a\3.5.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System\System.exe
%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\2.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\sysglobl\sysglobl.exe
%WINDIR%\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\ReachFramework\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Luna\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Royale\PresentationFramework.Royale.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Classic\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Luna\PresentationFramework.Luna.exe
%WINDIR%\assembly\GAC_MSIL\PresentationUI\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\ReachFramework\ReachFramework.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFramework.Royale\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\PresentationUI\PresentationUI.exe
%WINDIR%\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.DataSetExtensions\System.Data.DataSetExtensions.exe
%WINDIR%\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Core\System.Core.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Entity\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Entity.Design\System.Data.Entity.Design.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.DataSetExtensions\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Data.Entity\System.Data.Entity.exe
%WINDIR%\assembly\GAC_MSIL\System.Configuration.Install\System.Configuration.Install.exe
%WINDIR%\assembly\GAC_MSIL\System.AddIn.Contract\System.AddIn.Contract.exe
%WINDIR%\assembly\GAC_MSIL\System.AddIn.Contract\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.AddIn\System.AddIn.exe
%WINDIR%\assembly\GAC_MSIL\System.AddIn\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Configuration\System.Configuration.exe
%WINDIR%\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\System.ComponentModel.DataAnnotations.exe
%WINDIR%\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\3.5.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_32\System.EnterpriseServices\System.EnterpriseServices.exe
%WINDIR%\AppPatch\AppPatch.exe
%WINDIR%\assembly\assembly.exe
%WINDIR%\$NtUninstallWIC$\$NtUninstallWIC$.exe
%WINDIR%\addins\addins.exe
%WINDIR%\assembly\GAC\Accessibility\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\cscompmgd\cscompmgd.exe
%WINDIR%\assembly\GAC\GAC.exe
%WINDIR%\assembly\GAC\Accessibility\Accessibility.exe
%WINDIR%\$NtUninstallKB942288-v3$\$NtUninstallKB942288-v3$.exe
%PROGRAM_FILES%\WindowsUpdate\WindowsUpdate.exe
%PROGRAM_FILES%\xerox\xerox.exe
%PROGRAM_FILES%\Windows NT\Accessories\Accessories.exe
%PROGRAM_FILES%\Windows NT\Pinball\Pinball.exe
C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\S-1-5-21-2052111302-484763869-725345543-1003.exe
%WINDIR%\WINDOWS.exe
%PROGRAM_FILES%\xerox\nwwia\nwwia.exe
C:\RECYCLER\RECYCLER.exe
%WINDIR%\assembly\GAC\Microsoft.JScript\Microsoft.JScript.exe
%WINDIR%\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\7.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\ISymWrapper\ISymWrapper.exe
%WINDIR%\assembly\GAC\ISymWrapper\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\Microsoft.VisualBasic.Vsa\Microsoft.VisualBasic.Vsa.exe
%WINDIR%\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.5000.0__b03f5f7f11d50a3a\7.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\Microsoft.VisualBasic\Microsoft.VisualBasic.exe
%WINDIR%\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\7.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\IIEHost\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\IEExecRemote\IEExecRemote.exe
%WINDIR%\assembly\GAC\cscompmgd\7.0.5000.0__b03f5f7f11d50a3a\7.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\CustomMarshalers\CustomMarshalers.exe
%WINDIR%\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\IIEHost\IIEHost.exe
%WINDIR%\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\IEHost\IEHost.exe
%PROGRAM_FILES%\Windows NT\Windows NT.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\Install.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\MSN9Components.exe
%PROGRAM_FILES%\MSN\MSN.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\MSNCoreFiles.exe
%PROGRAM_FILES%\MSN Gaming Zone\Windows\Windows.exe
%PROGRAM_FILES%\NetMeeting\NetMeeting.exe
%PROGRAM_FILES%\MSN\MSNCoreFiles\OOBE\OOBE.exe
%PROGRAM_FILES%\MSN Gaming Zone\MSN Gaming Zone.exe
%PROGRAM_FILES%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\v3.5.exe
%PROGRAM_FILES%\Movie Maker\Shared\Shared.exe
%PROGRAM_FILES%\Movie Maker\Shared\Profiles\Profiles.exe
%PROGRAM_FILES%\Movie Maker\MUI\MUI.exe
%PROGRAM_FILES%\Movie Maker\MUI\0409\0409.exe
%PROGRAM_FILES%\MSBuild\Microsoft\Windows Workflow Foundation\Windows Workflow Foundation.exe
%PROGRAM_FILES%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\v3.0.exe
%PROGRAM_FILES%\MSBuild\MSBuild.exe
%PROGRAM_FILES%\MSBuild\Microsoft\Microsoft.exe
%PROGRAM_FILES%\Uninstall Information\Uninstall Information.exe
%PROGRAM_FILES%\Windows Media Player\Windows Media Player.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\RedistList.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\SubsetList.exe
%PROGRAM_FILES%\Windows Media Player\Skins\Skins.exe
%PROGRAM_FILES%\Windows Media Player\Visualizations\Visualizations.exe
%PROGRAM_FILES%\Windows Media Player\Icons\Icons.exe
%PROGRAM_FILES%\Windows Media Player\Sample Playlists\Sample Playlists.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\v3.5.exe
%PROGRAM_FILES%\Reference Assemblies\Reference Assemblies.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Microsoft.exe
%PROGRAM_FILES%\Online Services\Online Services.exe
%PROGRAM_FILES%\Outlook Express\Outlook Express.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\RedistList.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\SubsetList.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\Framework.exe
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\v3.0.exe
%WINDIR%\assembly\GAC\System.Web.RegularExpressions\System.Web.RegularExpressions.exe
%WINDIR%\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Web.Mobile\System.Web.Mobile.exe
%WINDIR%\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Windows.Forms\System.Windows.Forms.exe
%WINDIR%\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\1.0.5000.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC\System.Web.Services\System.Web.Services.exe
%WINDIR%\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Security\System.Security.exe
%WINDIR%\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\1.0.5000.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\System.Runtime.Serialization.Formatters.Soap.exe
%WINDIR%\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Web\System.Web.exe
%WINDIR%\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.ServiceProcess\System.ServiceProcess.exe
%WINDIR%\assembly\GAC_32\PresentationCore\PresentationCore.exe
%WINDIR%\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_32\mscorlib\mscorlib.exe
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\2.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_32\System.Data.OracleClient\System.Data.OracleClient.exe
%WINDIR%\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\2.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_32\System.Data\System.Data.exe
%WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\2.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\3.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_32\GAC_32.exe
%WINDIR%\assembly\GAC_32\CustomMarshalers\CustomMarshalers.exe
%WINDIR%\assembly\GAC\System.Xml\System.Xml.exe
%WINDIR%\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\1.0.5000.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\Microsoft.Transactions.Bridge.Dtc.exe
%WINDIR%\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_32\ISymWrapper\ISymWrapper.exe
%WINDIR%\assembly\GAC\System.Runtime.Remoting\System.Runtime.Remoting.exe
%WINDIR%\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System\System.exe
%WINDIR%\assembly\GAC\mscorcfg\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\Regcode\Regcode.exe
%WINDIR%\assembly\GAC\System.Configuration.Install\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Data\System.Data.exe
%WINDIR%\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\1.0.5000.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC\System.Configuration.Install\System.Configuration.Install.exe
%WINDIR%\assembly\GAC\mscorcfg\mscorcfg.exe
%WINDIR%\assembly\GAC\Microsoft.Vsa\Microsoft.Vsa.exe
%WINDIR%\assembly\GAC\Microsoft.Vsa\7.0.5000.0__b03f5f7f11d50a3a\7.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\Microsoft.VisualC\Microsoft.VisualC.exe
%WINDIR%\assembly\GAC\Microsoft.VisualC\7.0.5000.0__b03f5f7f11d50a3a\7.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\Microsoft_VsaVb\Microsoft_VsaVb.exe
%WINDIR%\assembly\GAC\Microsoft_VsaVb\7.0.5000.0__b03f5f7f11d50a3a\7.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\Microsoft.Vsa.Vb.CodeDOMProcessor.exe
%WINDIR%\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\7.0.5000.0__b03f5f7f11d50a3a\7.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.EnterpriseServices\System.EnterpriseServices.exe
%WINDIR%\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Drawing.Design\System.Drawing.Design.exe
%WINDIR%\assembly\GAC\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Messaging\System.Messaging.exe
%WINDIR%\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Management\System.Management.exe
%WINDIR%\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\1.0.5000.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC\System.Design\System.Design.exe
%WINDIR%\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\1.0.5000.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC\System.Data.OracleClient\System.Data.OracleClient.exe
%WINDIR%\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.Drawing\System.Drawing.exe
%WINDIR%\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\1.0.5000.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC\System.DirectoryServices\System.DirectoryServices.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\8582bf6991112c859e843af4321a2fda\8582bf6991112c859e843af4321a2fda.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\fee2e476d10aac7784f46140ee1b4a59\fee2e476d10aac7784f46140ee1b4a59.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\57f7cf02ea17b36bc3d9c75c22d0f551\57f7cf02ea17b36bc3d9c75c22d0f551.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\System.Data.Service#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\System.Data.SqlXml.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\0ec1b690c5ee057fa92ecff78de1457c\0ec1b690c5ee057fa92ecff78de1457c.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Services\System.Data.Services.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Services\f24134b397836c33a65d4d05c54ef4f5\f24134b397836c33a65d4d05c54ef4f5.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\System.Data.OracleC#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\System.Data.Entity.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\8c050147d7031f912f6ca2b15550173f\8c050147d7031f912f6ca2b15550173f.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\System.Data.DataSet#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\4f4ddae492a4a4ce4a2961f3d72d9399\4f4ddae492a4a4ce4a2961f3d72d9399.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\System.Data.Linq.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\fa206c73f39721cd2c55829b9853de44\fa206c73f39721cd2c55829b9853de44.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\System.Data.Entity.#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\9867484f25281882e61f61066fa651a3\9867484f25281882e61f61066fa651a3.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\5f5d64dd0e7991aaaad2d98ee52afe42\5f5d64dd0e7991aaaad2d98ee52afe42.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\System.EnterpriseSe#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\6978f2e90f13bc720d57fa6895c911e2.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\System.Drawing.Desi#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\be8c7482f1e78a3b4984af9082d455a7\be8c7482f1e78a3b4984af9082d455a7.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\System.IdentityModel.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\5f9cd5bfebcb94175d440ebab3aa412f\5f9cd5bfebcb94175d440ebab3aa412f.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\System.IdentityMode#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Drawing\System.Drawing.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Design\System.Design.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Design\204db7071fb26343b0fd3f3d140c0bf8\204db7071fb26343b0fd3f3d140c0bf8.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Deployment\System.Deployment.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Deployment\df1efcbac5973454c608890f72eb994d\df1efcbac5973454c608890f72eb994d.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\6bcc481030a56c24d5990d199812c594\6bcc481030a56c24d5990d199812c594.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\c205bbbb88bfa4bd5e274f43ea0013cb\c205bbbb88bfa4bd5e274f43ea0013cb.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\System.DirectorySer#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\44de75caba2b9711b3d9030a30767f8b\44de75caba2b9711b3d9030a30767f8b.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\0b40341027c01716cec1dd97592698e0\0b40341027c01716cec1dd97592698e0.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\ServiceModelReg.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\6781b87c8d3b55e6120b1e86bea6e040\6781b87c8d3b55e6120b1e86bea6e040.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ReachFramework\ReachFramework.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ReachFramework\5c59991df60164cae10fd81b88a8e5b1\5c59991df60164cae10fd81b88a8e5b1.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\SMSvcHost\SMSvcHost.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\SMSvcHost\b9c1a29e684bc02e49226ff1e9eec253\b9c1a29e684bc02e49226ff1e9eec253.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\SMDiagnostics.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\2e19ccefc30d7b827bab3f7d8dcc0ab9\2e19ccefc30d7b827bab3f7d8dcc0ab9.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationUI\87fb973e4ab6a21fd00e45656fa7c115\87fb973e4ab6a21fd00e45656fa7c115.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\79c2fd29b1e46c943960278051b4e1b9\79c2fd29b1e46c943960278051b4e1b9.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\9519494798a88867406b5755e1dbded6\9519494798a88867406b5755e1dbded6.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\9469981a17c01dd154c540127e678b35\9469981a17c01dd154c540127e678b35.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\PresentationFramewo#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\ef1a93d10c3a91b728745dbfcc79c2c7\ef1a93d10c3a91b728745dbfcc79c2c7.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationUI\PresentationUI.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\9e71fd0d299c5668c96a54e4a63479fa\9e71fd0d299c5668c96a54e4a63479fa.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\b4dc4bd8534d90fbb7430926ad990cd9\b4dc4bd8534d90fbb7430926ad990cd9.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\22a1629a4dcdd493bbd8be40cc122e94\22a1629a4dcdd493bbd8be40cc122e94.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuration\System.Configuration.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\a8e047504bdad9ec14efd483574b0dd5\a8e047504bdad9ec14efd483574b0dd5.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\System.Configuratio#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\6c69930d05c557da70144bcc0add7065\6c69930d05c557da70144bcc0add7065.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Data\System.Data.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb4cb21d14767292e079366a5d3d76cd\cb4cb21d14767292e079366a5d3d76cd.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Core\System.Core.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\System.ComponentMod#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System\System.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\aa7926460a336408c8041330ad90929d.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\sysglobl\sysglobl.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\sysglobl\6e07cc846884a853b910775fcec87ced\6e07cc846884a853b910775fcec87ced.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\System.AddIn.Contra#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\f2b48eab657b4ef1d19dac11bdf0c913\f2b48eab657b4ef1d19dac11bdf0c913.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.AddIn\System.AddIn.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.AddIn\b01721205312c6c18df033cc47b60e5c\b01721205312c6c18df033cc47b60e5c.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\System.Web.RegularE#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\70764208219715962d310336b5959dfa\70764208219715962d310336b5959dfa.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\System.Web.Mobile.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\e5995a34d44ad5af7d9f335075bded4d\e5995a34d44ad5af7d9f335075bded4d.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Services\System.Web.Services.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Services\1dad08772eb89d48a8a0cfe9b0467eb0\1dad08772eb89d48a8a0cfe9b0467eb0.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\System.Web.Routing.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\18e1acd6761195389db42bab83169fd2\18e1acd6761195389db42bab83169fd2.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\d8a3d7926a927b9fd62aeabb16a74ab0\d8a3d7926a927b9fd62aeabb16a74ab0.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\System.Web.Entity.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\015d6049e237304a27105c3846c79648\015d6049e237304a27105c3846c79648.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\5bd3f76680b4c09039d42ae873ddd190\5bd3f76680b4c09039d42ae873ddd190.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\c171b28823047a7e9db5f3e092333336\c171b28823047a7e9db5f3e092333336.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\System.Web.Extensio#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\79f9b2acf94065fd92c54c29ff66017b\79f9b2acf94065fd92c54c29ff66017b.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\System.Web.Entity.D#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\119750ae4265d719a24ebe245e212db7\119750ae4265d719a24ebe245e212db7.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\43911ac4e29949c57560eee5cb7b76c2\43911ac4e29949c57560eee5cb7b76c2.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\System.Xml.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\6d0966370023925610756f368140b947\6d0966370023925610756f368140b947.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\System.WorkflowServ#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\8c0d96269480bdd3de8a825f0215308d\8c0d96269480bdd3de8a825f0215308d.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Temp\Temp.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml\36f3953f24d4f0b767bf172331ad6f3e\36f3953f24d4f0b767bf172331ad6f3e.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\System.Xml.Linq.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\System.Workflow.Run#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\System.Windows.Pres#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\b5a285233229bb4f9d9831ebf27fe9ac\b5a285233229bb4f9d9831ebf27fe9ac.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\System.Windows.Forms.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\9a254c455892c02355ab0ab0f0727c5b.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\System.Workflow.Com#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\9de33f5786cd15e220f47b916c5a15e9\9de33f5786cd15e220f47b916c5a15e9.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\System.Workflow.Act#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\d6cc33db5d526553ffbbfd1d372a8493\d6cc33db5d526553ffbbfd1d372a8493.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\System.Web.DynamicD#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Printing\System.Printing.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Printing\db428f231a2ccaf490ae219efd2edc69\db428f231a2ccaf490ae219efd2edc69.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Net\System.Net.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Net\eabe1915c13467e1e66e2b073bcb842f\eabe1915c13467e1e66e2b073bcb842f.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\System.Runtime.Seri#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\01dc643b54310ebc5ab7e4696df426bc\01dc643b54310ebc5ab7e4696df426bc.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\System.Runtime.Remo#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\3736ba3ecac186f9c5d85f01bda2be98\3736ba3ecac186f9c5d85f01bda2be98.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Messaging\643e95098a9ce99a598d3419b5ce157f\643e95098a9ce99a598d3419b5ce157f.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.IO.Log\bcfccfa22245d2223a764611c61a7cb9\bcfccfa22245d2223a764611c61a7cb9.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\System.Management.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\94b2ca600c860c76e387f8bd317bd4c3\94b2ca600c860c76e387f8bd317bd4c3.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.IO.Log\System.IO.Log.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.I#\1db9deebde7c96b2874b4ffccac2f48e\1db9deebde7c96b2874b4ffccac2f48e.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Messaging\System.Messaging.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management\894d87c08a9a5b5923e7104055a616d2\894d87c08a9a5b5923e7104055a616d2.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Management.I#\System.Management.I#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\System.Transactions.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Transactions\12903c3843fe923d1977801ffa3cf26c\12903c3843fe923d1977801ffa3cf26c.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Speech\System.Speech.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Speech\2e7a6c977ac9f8d46ebe2982697a0c8d\2e7a6c977ac9f8d46ebe2982697a0c8d.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\System.Web.Abstract#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\fbe60d84b9f1ab74e396fb1507f69615\fbe60d84b9f1ab74e396fb1507f69615.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web\System.Web.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Web\50ea744ffc3cb7f09b027fd6c5c93b2b\50ea744ffc3cb7f09b027fd6c5c93b2b.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\a9e71dda6389403be4db7b567592e3b8\a9e71dda6389403be4db7b567592e3b8.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Security\0418eb6dbffe9b46aa4c989153d6a3b5\0418eb6dbffe9b46aa4c989153d6a3b5.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\System.ServiceModel.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\bb748f8ef8c98eb5c7f79b8faee95397\bb748f8ef8c98eb5c7f79b8faee95397.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.Security\System.Security.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\bfa7858f498cd67ef58b689c2e0fec89\bfa7858f498cd67ef58b689c2e0fec89.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\System.ServiceProce#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\19644a754454916a619b68315e50b428\19644a754454916a619b68315e50b428.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\System.ServiceModel#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\PresentationFontCac#.exe
%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\System.Windows.Forms.exe
%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\2.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Services\System.Web.Services.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Workflow.Activities\System.Workflow.Activities.exe
%WINDIR%\assembly\GAC_MSIL\System.Workflow.Activities\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Windows.Presentation\System.Windows.Presentation.exe
%WINDIR%\assembly\GAC_MSIL\System.Windows.Presentation\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Routing\3.5.0.0__31bf3856ad364e35\3.5.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Extensions.Design\3.5.0.0__31bf3856ad364e35\3.5.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Mobile\System.Web.Mobile.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Extensions\3.5.0.0__31bf3856ad364e35\3.5.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Extensions.Design\System.Web.Extensions.Design.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Routing\System.Web.Routing.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.RegularExpressions\System.Web.RegularExpressions.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationClient\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationClientsideProviders\UIAutomationClientsideProviders.exe
%WINDIR%\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationClient\UIAutomationClient.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationProvider\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationTypes\UIAutomationTypes.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationClientsideProviders\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationProvider\UIAutomationProvider.exe
%WINDIR%\assembly\GAC_MSIL\System.Xml.Linq\System.Xml.Linq.exe
%WINDIR%\assembly\GAC_MSIL\System.Workflow.Runtime\System.Workflow.Runtime.exe
%WINDIR%\assembly\GAC_MSIL\System.Workflow.Runtime\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Workflow.ComponentModel\System.Workflow.ComponentModel.exe
%WINDIR%\assembly\GAC_MSIL\System.Workflow.ComponentModel\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Xml\System.Xml.exe
%WINDIR%\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\2.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.WorkflowServices\System.WorkflowServices.exe
%WINDIR%\assembly\GAC_MSIL\System.WorkflowServices\3.5.0.0__31bf3856ad364e35\3.5.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Extensions\System.Web.Extensions.exe
%WINDIR%\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel\System.ServiceModel.exe
%WINDIR%\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Security\System.Security.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel.Install\3.0.0.0__b77a5c561934e089\3.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel.WasHosting\System.ServiceModel.WasHosting.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\3.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel.Install\System.ServiceModel.Install.exe
%WINDIR%\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\System.Runtime.Serialization.Formatters.Soap.exe
%WINDIR%\assembly\GAC_MSIL\System.Net\System.Net.exe
%WINDIR%\assembly\GAC_MSIL\System.Net\3.5.0.0__b03f5f7f11d50a3a\3.5.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Messaging\System.Messaging.exe
%WINDIR%\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Runtime.Serialization\System.Runtime.Serialization.exe
%WINDIR%\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\3.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Runtime.Remoting\System.Runtime.Remoting.exe
%WINDIR%\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\2.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.DynamicData.Design\System.Web.DynamicData.Design.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.DynamicData.Design\3.5.0.0__31bf3856ad364e35\3.5.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.DynamicData\System.Web.DynamicData.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.DynamicData\3.5.0.0__31bf3856ad364e35\3.5.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Entity.Design\System.Web.Entity.Design.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Entity.Design\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Entity\System.Web.Entity.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Entity\3.5.0.0__b77a5c561934e089\3.5.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Abstractions\3.5.0.0__31bf3856ad364e35\3.5.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel.Web\3.5.0.0__31bf3856ad364e35\3.5.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceProcess\System.ServiceProcess.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel.WasHosting\3.0.0.0__b77a5c561934e089\3.0.0.0__b77a5c561934e089.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceModel.Web\System.ServiceModel.Web.exe
%WINDIR%\assembly\GAC_MSIL\System.Speech\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\System.Web.Abstractions\System.Web.Abstractions.exe
%WINDIR%\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\2.0.0.0__b03f5f7f11d50a3a.exe
%WINDIR%\assembly\GAC_MSIL\System.Speech\System.Speech.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\28eede53267524df58362a75a668cf86\28eede53267524df58362a75a668cf86.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\43dceeb2d0601d79af40752fb20283c2\43dceeb2d0601d79af40752fb20283c2.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\cd6eeb3d7ea1f65c28a43e665db38644\cd6eeb3d7ea1f65c28a43e665db38644.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\Microsoft.Build.Uti#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\Microsoft.Transacti#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\21bb6244c91b6207fbcb038884a641ef\21bb6244c91b6207fbcb038884a641ef.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\Microsoft.JScript.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\7d61e63dea85f4f77ea4c13df7651ec7\7d61e63dea85f4f77ea4c13df7651ec7.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\152cf75db013f0523933ac45177b4217\152cf75db013f0523933ac45177b4217.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\ce984d7bbd9a6d5d3cca28c4e5038020\ce984d7bbd9a6d5d3cca28c4e5038020.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\daf5ff5e06c80eefa80c6fcc79aec963\daf5ff5e06c80eefa80c6fcc79aec963.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\c5c4db4f9bc7a454e9cfc2548a9d45a5\c5c4db4f9bc7a454e9cfc2548a9d45a5.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\Microsoft.Build.Eng#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\66359457e427c0d547750a79f754f9ba\66359457e427c0d547750a79f754f9ba.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\Microsoft.Build.Tas#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\Microsoft.Build.Fra#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\36dbc4689f7c51e393504230004c9dec\36dbc4689f7c51e393504230004c9dec.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\PresentationBuildTa#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\b6bfb51dec7f8cc42c21c5928470c773\b6bfb51dec7f8cc42c21c5928470c773.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\mscorlib.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\9adb89fa22fd5b4ce433b5aca7fb1b07.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationCore\PresentationCore.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationCore\12dcb10b76012416357bdbb010fdaa97\12dcb10b76012416357bdbb010fdaa97.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\PresentationCFFRast#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\487c1bc20f6e73e8e79503898d17d102\487c1bc20f6e73e8e79503898d17d102.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\MSBuild\87c84ffaaad81d8d106a9aa9d68b5926\87c84ffaaad81d8d106a9aa9d68b5926.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\5b3d048d8c003d743ea5e72caf07773a\5b3d048d8c003d743ea5e72caf07773a.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\Microsoft.VisualC.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\539e297cc9bc67fbf2fbdc9dc5fcd0f1\539e297cc9bc67fbf2fbdc9dc5fcd0f1.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\Microsoft.VisualBas#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\28ea74096df47800fe2c78bb2b9a4f2a\28ea74096df47800fe2c78bb2b9a4f2a.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\MSBuild\MSBuild.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\f0e9a97ade4529d4caeccd467aa8e7db\f0e9a97ade4529d4caeccd467aa8e7db.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\Microsoft.Vsa.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\_filelst.cfg
%WINDIR%\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_27b9fd4f\1.0.5000.0__b77a5c561934e089_27b9fd4f.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Design\System.Design.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_5917eb5b\1.0.5000.0__b77a5c561934e089_5917eb5b.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System\System.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_c34133cb\1.0.5000.0__b03f5f7f11d50a3a_c34133cb.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\System.Drawing.Design.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_cd264933\1.0.5000.0__b03f5f7f11d50a3a_cd264933.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Drawing\System.Drawing.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\mscorlib\mscorlib.exe
%WINDIR%\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\WindowsFormsIntegration\WindowsFormsIntegration.exe
%WINDIR%\assembly\GAC_MSIL\UIAutomationTypes\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\GAC_MSIL\WindowsBase\WindowsBase.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\CustomMarshalers\CustomMarshalers.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_b50667e9\1.0.5000.0__b03f5f7f11d50a3a_b50667e9.exe
%WINDIR%\assembly\GAC_MSIL\WindowsFormsIntegration\3.0.0.0__31bf3856ad364e35\3.0.0.0__31bf3856ad364e35.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\NativeImages1_v1.1.4322.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\19b50dd470540911fc5cc65331a769e4\19b50dd470540911fc5cc65331a769e4.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\CustomMarshalers.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\c7ffd8c23e8de4018a88185b3b60631e\c7ffd8c23e8de4018a88185b3b60631e.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\ComSvcConfig.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\dfsvc\a2865dcec9c5d3cc9c55f026cbad6fcc\a2865dcec9c5d3cc9c55f026cbad6fcc.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\Microsoft.Build.Con#.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\e148983beeb0f30918b0564849a16456\e148983beeb0f30918b0564849a16456.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\dfsvc\dfsvc.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\AspNetMMCExt.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_353815cd\1.0.5000.0__b77a5c561934e089_353815cd.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Xml\System.Xml.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_7cac80ba\1.0.5000.0__b03f5f7f11d50a3a_7cac80ba.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\System.Windows.Forms.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Accessibility\Accessibility.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Accessibility\c2af7cfbb47c077029a2645930b4eeac\c2af7cfbb47c077029a2645930b4eeac.exe
%WINDIR%\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_f236c56a\1.0.5000.0__b77a5c561934e089_f236c56a.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\NativeImages_v2.0.50727_32.exe
<LS_APPDATA>\Mozilla\Mozilla.exe
<LS_APPDATA>\Mozilla\Firefox\Firefox.exe
<LS_APPDATA>\Microsoft\Windows Media\Windows Media.exe
<LS_APPDATA>\Microsoft\Windows Media\9.0\9.0.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\Cache.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\0.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\Profiles.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\cwdgt0y8.default.exe
<LS_APPDATA>\Microsoft\Windows\Windows.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\Outlook Express.exe
<LS_APPDATA>\Microsoft\Microsoft.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Microsoft.exe
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\S-1-5-21-2052111302-484763869-725345543-1003.exe
<LS_APPDATA>\Microsoft\Media Player\Media Player.exe
<LS_APPDATA>\Microsoft\CD Burning\CD Burning.exe
<LS_APPDATA>\Microsoft\Credentials\Credentials.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\C.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\D.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\A.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\B.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\startupCache.exe
<LS_APPDATA>\VMware\VMware.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\E.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\F.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\9.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\3.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\4.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\1.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\2.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\7.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\8.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\5.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\6.exe
<LS_APPDATA>\Identities\Identities.exe
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Quick Launch.exe
%APPDATA%\Microsoft\Media Player\Media Player.exe
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\S-1-5-21-2052111302-484763869-725345543-1003.exe
%APPDATA%\Microsoft\Internet Explorer\Internet Explorer.exe
%APPDATA%\Microsoft\SystemCertificates\My\My.exe
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\Certificates.exe
%APPDATA%\Microsoft\MMC\MMC.exe
%APPDATA%\Microsoft\SystemCertificates\SystemCertificates.exe
%APPDATA%\Microsoft\Credentials\Credentials.exe
%HOMEPATH%\%USERNAME%.exe
%APPDATA%\Application Data.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\U98D4X8H.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\YPORKZYZ.exe
%APPDATA%\Microsoft\Microsoft.exe
%APPDATA%\Microsoft\Address Book\Address Book.exe
%APPDATA%\Identities\Identities.exe
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}.exe
%HOMEPATH%\Cookies\Cookies.exe
%HOMEPATH%\Desktop\Desktop.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarkbackups.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\chrome.exe
%HOMEPATH%\Local Settings\Local Settings.exe
<LS_APPDATA>\Application Data.exe
%HOMEPATH%\Favorites\Favorites.exe
%HOMEPATH%\Favorites\Links\Links.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cwdgt0y8.default.exe
%APPDATA%\Microsoft\Windows\Windows.exe
%APPDATA%\Microsoft\Windows\Themes\Themes.exe
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\CRLs.exe
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\CTLs.exe
%APPDATA%\Mozilla\Firefox\Firefox.exe
%APPDATA%\Mozilla\Firefox\Profiles\Profiles.exe
%APPDATA%\Mozilla\Mozilla.exe
%APPDATA%\Mozilla\Extensions\Extensions.exe
C:\Far2\Plugins\Colorer\hrd\hrd.exe
C:\Far2\Plugins\Colorer\hrd\console\console.exe
C:\Far2\Plugins\Colorer\hrc\auto\auto.exe
C:\Far2\Plugins\Colorer\hrc\auto\types\types.exe
C:\Far2\Plugins\DrawLine\DrawLine.exe
C:\Far2\Plugins\EditCase\EditCase.exe
C:\Far2\Plugins\Colorer\hrd\console\contrib\contrib.exe
C:\Far2\Plugins\Compare\Compare.exe
C:\Far2\Plugins\Colorer\hrc\hrc.exe
C:\Far2\Plugins\Align\Align.exe
C:\Far2\Plugins\arclite\arclite.exe
C:\Far2\Plugins\Plugins.exe
C:\Far2\Plugins\7-Zip\7-Zip.exe
C:\Far2\Plugins\Colorer\Colorer.exe
C:\Far2\Plugins\Colorer\bin\bin.exe
C:\Far2\Plugins\AutoWrap\AutoWrap.exe
C:\Far2\Plugins\Brackets\Brackets.exe
C:\Far2\Plugins\MacroView\MacroView.exe
C:\Far2\Plugins\Network\Network.exe
C:\Far2\Plugins\FTP\lib\lib.exe
C:\Far2\Plugins\HlfViewer\HlfViewer.exe
C:\Far2\Plugins\WinSCP\WinSCP.exe
C:\Far2\Plugins\WinSCP\components\components.exe
C:\Far2\Plugins\ProcList\ProcList.exe
C:\Far2\Plugins\TmpPanel\TmpPanel.exe
C:\Far2\Plugins\FTP\FTP.exe
C:\Far2\Plugins\ExtSearch\doc\doc.exe
C:\Far2\Plugins\ExtSearch\keys\keys.exe
C:\Far2\Plugins\EMenu\EMenu.exe
C:\Far2\Plugins\ExtSearch\ExtSearch.exe
C:\Far2\Plugins\FarCmds\FarCmds.exe
C:\Far2\Plugins\FileCase\FileCase.exe
C:\Far2\Plugins\ExtSearch\sources\sources.exe
C:\Far2\Plugins\ExtSearch\sources\RegExp\RegExp.exe
C:\Far2\FExcept\FExcept.exe
%HOMEPATH%\PrintHood\PrintHood.exe
%HOMEPATH%\Recent\Recent.exe
%HOMEPATH%\My Documents\My Received Files\My Received Files.exe
%HOMEPATH%\NetHood\NetHood.exe
%HOMEPATH%\Start Menu\Programs\Programs.exe
%HOMEPATH%\Start Menu\Programs\Accessories\Accessories.exe
%HOMEPATH%\SendTo\SendTo.exe
%HOMEPATH%\Start Menu\Start Menu.exe
%HOMEPATH%\My Documents\My Pictures\My Pictures.exe
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\MSHist012011111020111111.exe
%TEMP%\Temp.exe
%HOMEPATH%\Local Settings\History\History.exe
%HOMEPATH%\Local Settings\History\History.IE5\History.IE5.exe
%HOMEPATH%\My Documents\Downloads\Downloads.exe
%HOMEPATH%\My Documents\My Music\My Music.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Temporary Internet Files.exe
%HOMEPATH%\My Documents\My Documents.exe
C:\Far2\Addons\XLat\XLat.exe
C:\Far2\Addons\XLat\Russian\Russian.exe
C:\Far2\Addons\SetUp\SetUp.exe
C:\Far2\Addons\Shell\Shell.exe
C:\Far2\Documentation\rus\rus.exe
C:\Far2\Encyclopedia\Encyclopedia.exe
C:\Far2\Documentation\Documentation.exe
C:\Far2\Documentation\eng\eng.exe
C:\Far2\Addons\Macros\Macros.exe
%HOMEPATH%\Templates\Templates.exe
C:\Far2\Far2.exe
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\Accessibility.exe
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\Entertainment.exe
C:\Far2\Addons\Colors\Custom Highlighting\Custom Highlighting.exe
C:\Far2\Addons\Colors\Default Highlighting\Default Highlighting.exe
C:\Far2\Addons\Addons.exe
C:\Far2\Addons\Colors\Colors.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\KHMHGZ4F.exe
C:\Documents and Settings\Default User\Application Data\Application Data.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\Microsoft.exe
%ALLUSERSPROFILE%\Templates\Templates.exe
C:\Documents and Settings\Default User\Default User.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\SystemCertificates.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\My.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Internet Explorer.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\Media Player.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Games\Games.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessories.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\Accessibility.exe
%ALLUSERSPROFILE%\Start Menu\Start Menu.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Programs.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\System Tools.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\Administrative Tools.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\Communications.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\Entertainment.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\9.0.exe
C:\Documents and Settings\Default User\Local Settings\History\History.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\Media Player.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\Windows Media.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Temporary Internet Files.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\Content.IE5.exe
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\History.IE5.exe
C:\Documents and Settings\Default User\Local Settings\Temp\Temp.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Microsoft.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLs.exe
C:\Documents and Settings\Default User\Cookies\Cookies.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\Certificates.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLs.exe
C:\Documents and Settings\Default User\Local Settings\Local Settings.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Application Data.exe
C:\Documents and Settings\Default User\Desktop\Desktop.exe
C:\Documents and Settings\Default User\Favorites\Favorites.exe
%ALLUSERSPROFILE%\Favorites\Favorites.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys\MachineKeys.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\S-1-5-18.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\MachineKeys.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\RSA.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\Media Index.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\Media Player.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\Dr Watson.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\HTML Help.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\DSS.exe
<Current directory>\bf32d3b0.exe
C:\Documents and Settings\Documents and Settings.exe
%TEMP%\xelag.exe
%TEMP%\zdriver.vbs
%ALLUSERSPROFILE%\Application Data\Microsoft\Microsoft.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\Crypto.exe
%ALLUSERSPROFILE%\All Users.exe
%ALLUSERSPROFILE%\Application Data\Application Data.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\Sample Playlists.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\0338E140.exe
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\My Playlists.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\Sample Music.exe
%ALLUSERSPROFILE%\Documents\My Videos\My Videos.exe
%ALLUSERSPROFILE%\DRM\DRM.exe
%ALLUSERSPROFILE%\Documents\My Pictures\My Pictures.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sample Pictures.exe
%ALLUSERSPROFILE%\Documents\My Music\My Music.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\Cm.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\Pbk.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Network.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Connections.exe
%ALLUSERSPROFILE%\Desktop\Desktop.exe
%ALLUSERSPROFILE%\Documents\Documents.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\User Account Pictures.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\Default Pictures.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Microsoft.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\Credentials.exe
C:\Documents and Settings\NetworkService\NetworkService.exe
C:\Documents and Settings\NetworkService\Application Data\Application Data.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\Media Player.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\SystemCertificates.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\S-1-5-20.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\Internet Explorer.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\MOE00UY1.exe
C:\Documents and Settings\LocalService\Local Settings\Temp\Temp.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Temporary Internet Files.exe
C:\Documents and Settings\LocalService\Local Settings\History\History.exe
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\History.IE5.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\CJCTQ25G.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\LBMMC3H3.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Content.IE5.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\BGGTYMH1.exe
C:\Documents and Settings\NetworkService\Local Settings\History\History.exe
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\History.IE5.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\S-1-5-20.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\Windows.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Content.IE5.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\2VAZY7AN.exe
C:\Documents and Settings\NetworkService\Local Settings\Temp\Temp.exe
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Temporary Internet Files.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\Credentials.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLs.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLs.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\My.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\Certificates.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Application Data.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Microsoft.exe
C:\Documents and Settings\NetworkService\Cookies\Cookies.exe
C:\Documents and Settings\NetworkService\Local Settings\Local Settings.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\Windows.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessories.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\Accessibility.exe
C:\Documents and Settings\Default User\Start Menu\Start Menu.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Programs.exe
C:\Documents and Settings\Default User\Templates\Templates.exe
C:\Documents and Settings\LocalService\LocalService.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\Entertainment.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\Startup.exe
C:\Documents and Settings\Default User\SendTo\SendTo.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\U98D4X8H.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\YPORKZYZ.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\2VAZY7AN.exe
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\KHMHGZ4F.exe
C:\Documents and Settings\Default User\PrintHood\PrintHood.exe
C:\Documents and Settings\Default User\Recent\Recent.exe
C:\Documents and Settings\Default User\My Documents\My Documents.exe
C:\Documents and Settings\Default User\NetHood\NetHood.exe
C:\Documents and Settings\LocalService\Cookies\Cookies.exe
C:\Documents and Settings\LocalService\Local Settings\Local Settings.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLs.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLs.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\Credentials.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\S-1-5-19.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Application Data.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Microsoft.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\Certificates.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\Credentials.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\S-1-5-19.exe
C:\Documents and Settings\LocalService\Application Data\Application Data.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Microsoft.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\SystemCertificates.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\My.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\Internet Explorer.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\Media Player.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\satchel\satchel.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\xbl-marquee\xbl-marquee.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\xpinstall\xpinstall.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\passwordmgr\passwordmgr.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\classic.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\aero.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\res\res.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\skin.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\update\update.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\downloads\downloads.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\extensions\extensions.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\xml\xml.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\mozapps.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\preferences\preferences.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\profile\profile.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\handling\handling.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\plugins\plugins.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\splitter.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\toolbar\toolbar.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\radio.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\scrollbar\scrollbar.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\downloads\downloads.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\extensions\extensions.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\tree\tree.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\mozapps.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\printpreview\printpreview.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\checkbox.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\global.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\alerts\alerts.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\icons.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\media\media.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\dirListing\dirListing.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\svg\svg.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\handling\handling.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\plugins\plugins.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\downloads.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\extensions\extensions.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\update\update.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\xpinstall\xpinstall.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\preferences\preferences.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\profile\profile.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\mozapps\mozapps.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xslt\xslt.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\global-platform.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xml\xml.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\xpinstall\xpinstall.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\win\win.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-region\global-region.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\mac\mac.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global-platform\unix\unix.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\content.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\cookie\cookie.exe
%PROGRAM_FILES%\FireFox\chrome\pippki\content\pippki\pippki.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\toolkit.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\bindings.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\cpow\cpow.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\global.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\alerts\alerts.exe
%PROGRAM_FILES%\FireFox\chrome\pippki\content\content.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pipnss\pipnss.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\pippki\pippki.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\necko\necko.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\passwordmgr\passwordmgr.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\feedback\feedback.exe
%PROGRAM_FILES%\FireFox\chrome\pippki\pippki.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\places\places.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\services\services.exe
%PROGRAM_FILES%\FireFox\modules\services-sync\ext\ext.exe
%PROGRAM_FILES%\FireFox\modules\tabview\tabview.exe
%PROGRAM_FILES%\FireFox\modules\services-sync\services-sync.exe
%PROGRAM_FILES%\FireFox\modules\services-sync\engines\engines.exe
%PROGRAM_FILES%\FireFox\res\dtd\dtd.exe
%PROGRAM_FILES%\FireFox\res\entityTables\entityTables.exe
%PROGRAM_FILES%\FireFox\plugins\plugins.exe
%PROGRAM_FILES%\FireFox\res\res.exe
%PROGRAM_FILES%\FireFox\modules\services-crypto\services-crypto.exe
%PROGRAM_FILES%\FireFox\defaults\profile\profile.exe
%PROGRAM_FILES%\FireFox\defaults\profile\chrome\chrome.exe
%PROGRAM_FILES%\FireFox\defaults\autoconfig\autoconfig.exe
%PROGRAM_FILES%\FireFox\defaults\pref\pref.exe
%PROGRAM_FILES%\FireFox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}\{972ce4c6-7e08-4474-a285-3208198ce6fd}.exe
%PROGRAM_FILES%\FireFox\modules\modules.exe
%PROGRAM_FILES%\FireFox\dictionaries\dictionaries.exe
%PROGRAM_FILES%\FireFox\extensions\extensions.exe
%PROGRAM_FILES%\microsoft frontpage\microsoft frontpage.exe
%PROGRAM_FILES%\microsoft frontpage\version3.0\version3.0.exe
%PROGRAM_FILES%\Internet Explorer\SIGNUP\SIGNUP.exe
%PROGRAM_FILES%\Messenger\Messenger.exe
%PROGRAM_FILES%\Microsoft.NET\RedistList\RedistList.exe
%PROGRAM_FILES%\Movie Maker\Movie Maker.exe
%PROGRAM_FILES%\microsoft frontpage\version3.0\bin\bin.exe
%PROGRAM_FILES%\Microsoft.NET\Microsoft.NET.exe
%PROGRAM_FILES%\Internet Explorer\PLUGINS\PLUGINS.exe
%PROGRAM_FILES%\FireFox\searchplugins\searchplugins.exe
%PROGRAM_FILES%\FireFox\uninstall\uninstall.exe
%PROGRAM_FILES%\FireFox\res\fonts\fonts.exe
%PROGRAM_FILES%\FireFox\res\html\html.exe
%PROGRAM_FILES%\Internet Explorer\MUI\MUI.exe
%PROGRAM_FILES%\Internet Explorer\MUI\0409\0409.exe
%PROGRAM_FILES%\Internet Explorer\Internet Explorer.exe
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\Connection Wizard.exe
%PROGRAM_FILES%\FireFox\defaults\defaults.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\checkbox\checkbox.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\console\console.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\alerts\alerts.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\media\media.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\printpreview\printpreview.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\dirListing\dirListing.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\icons\icons.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\global.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\places\places.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\plugins\plugins.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\handling\handling.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\passwordmgr\passwordmgr.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\viewsource\viewsource.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\xpinstall\xpinstall.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\profile\profile.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\mozapps\update\update.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\plugins\plugins.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\profile\profile.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\passwordmgr\passwordmgr.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\places\places.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\xpinstall\xpinstall.exe
%PROGRAM_FILES%\FireFox\components\components.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\update\update.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\viewsource\viewsource.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\handling\handling.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\splitter\splitter.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\toolbar\toolbar.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\radio\radio.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\scrollbar\scrollbar.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\downloads\downloads.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\extensions\extensions.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\tree\tree.exe
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\mozapps\mozapps.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\svg\svg.exe
%CommonProgramFiles%\Microsoft Shared\Triedit\Triedit.exe
%CommonProgramFiles%\Microsoft Shared\VC\VC.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Stationery.exe
%CommonProgramFiles%\Microsoft Shared\TextConv\TextConv.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\web server extensions.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\40.exe
%CommonProgramFiles%\Microsoft Shared\VGX\VGX.exe
%CommonProgramFiles%\Microsoft Shared\Web Folders\Web Folders.exe
%CommonProgramFiles%\Microsoft Shared\Speech\1033\1033.exe
%CommonProgramFiles%\Microsoft Shared\DW\1041\1041.exe
%CommonProgramFiles%\Microsoft Shared\DW\1042\1042.exe
%CommonProgramFiles%\Microsoft Shared\DW\1036\1036.exe
%CommonProgramFiles%\Microsoft Shared\DW\1040\1040.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\MSInfo.exe
%CommonProgramFiles%\Microsoft Shared\Speech\Speech.exe
%CommonProgramFiles%\Microsoft Shared\DW\2052\2052.exe
%CommonProgramFiles%\Microsoft Shared\DW\3082\3082.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\servsupp\servsupp.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_bin.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_adm\_vti_adm.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_aut\_vti_aut.exe
%CommonProgramFiles%\MSSoap\MSSoap.exe
%CommonProgramFiles%\MSSoap\Binaries\Binaries.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_adm\_vti_adm.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_aut\_vti_aut.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\isapi.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\admisapi.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\scripts\scripts.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\admcgi.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\scripts\scripts.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\bots.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\vinavbar\vinavbar.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\bin.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\1033.exe
%CommonProgramFiles%\Microsoft Shared\DW\1033\1033.exe
C:\Far2\Plugins\WinSCP\packages\filemng\filemng.exe
C:\Far2\Plugins\WinSCP\packages\my\my.exe
C:\Far2\Plugins\WinSCP\packages\packages.exe
C:\Far2\Plugins\WinSCP\packages\dragndrop\dragndrop.exe
C:\Far2\Plugins\WinSCP\packages\theme\theme.exe
C:\Far2\Plugins\WinSCP\putty\putty.exe
C:\Far2\Plugins\WinSCP\packages\tb2k\tb2k.exe
C:\Far2\Plugins\WinSCP\packages\tbx\tbx.exe
C:\Far2\Plugins\WinSCP\lib\lib.exe
C:\Far2\Plugins\WinSCP\dragext\dragext.exe
C:\Far2\Plugins\WinSCP\far\far.exe
C:\Far2\Plugins\WinSCP\console\console.exe
C:\Far2\Plugins\WinSCP\core\core.exe
C:\Far2\Plugins\WinSCP\filezilla\misc\misc.exe
C:\Far2\Plugins\WinSCP\forms\forms.exe
C:\Far2\Plugins\WinSCP\fari\fari.exe
C:\Far2\Plugins\WinSCP\filezilla\filezilla.exe
%CommonProgramFiles%\Microsoft Shared\Microsoft Shared.exe
%CommonProgramFiles%\Microsoft Shared\DAO\DAO.exe
%PROGRAM_FILES%\Program Files.exe
%CommonProgramFiles%\Common Files.exe
%CommonProgramFiles%\Microsoft Shared\DW\1028\1028.exe
%CommonProgramFiles%\Microsoft Shared\DW\1031\1031.exe
%CommonProgramFiles%\Microsoft Shared\DW\DW.exe
%CommonProgramFiles%\Microsoft Shared\DW\1025\1025.exe
<Auxiliary element>
C:\Far2\Plugins\WinSCP\release\release.exe
C:\Far2\Plugins\WinSCP\resource\resource.exe
C:\Far2\Plugins\WinSCP\putty\charset\charset.exe
C:\Far2\Plugins\WinSCP\putty\windows\windows.exe
C:\Far2\PluginSDK\Headers.c\Headers.c.exe
C:\Far2\PluginSDK\Headers.pas\Headers.pas.exe
C:\Far2\Plugins\WinSCP\windows\windows.exe
C:\Far2\PluginSDK\PluginSDK.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabview\tabview.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\communicator\communicator.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\preferences\preferences.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\tabbrowser.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\branding\branding.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\browser.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\en-US.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\locale.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\places\places.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\places\places.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\preferences.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\browser.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\feeds.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\browser.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\browser\feeds\feeds.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\tabbrowser.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\browser\tabview\tabview.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\cookie\cookie.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\global.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\alerts\alerts.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\autoconfig\autoconfig.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\search\search.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\security\security.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\dom\dom.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\global\layout\layout.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\en-US\en-US.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\migration\migration.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\places\places.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\downloads\downloads.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\feeds\feeds.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\sidebar\sidebar.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser-region\browser-region.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\preferences\preferences.exe
%PROGRAM_FILES%\FireFox\chrome\en-US\locale\browser\safebrowsing\safebrowsing.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\aero\aero.exe
%CommonProgramFiles%\System\System.exe
%CommonProgramFiles%\System\ado\ado.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\TTS.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\1033.exe
%PROGRAM_FILES%\ComPlus Applications\ComPlus Applications.exe
%PROGRAM_FILES%\FireFox\FireFox.exe
%CommonProgramFiles%\System\msadc\msadc.exe
%CommonProgramFiles%\System\Ole DB\Ole DB.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\1033.exe
%CommonProgramFiles%\ODBC\ODBC.exe
%CommonProgramFiles%\ODBC\Data Sources\Data Sources.exe
%CommonProgramFiles%\MSSoap\Binaries\Resources\Resources.exe
%CommonProgramFiles%\MSSoap\Binaries\Resources\1033\1033.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\Microsoft.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\Lexicon.exe
%CommonProgramFiles%\Services\Services.exe
%CommonProgramFiles%\SpeechEngines\SpeechEngines.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\places.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\preferences\preferences.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\migration\migration.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\pageinfo.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\skin.exe
%PROGRAM_FILES%\FireFox\chrome\browser\skin\classic\classic.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\safebrowsing\safebrowsing.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\search\search.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\history\history.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\content.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\branding\branding.exe
%PROGRAM_FILES%\FireFox\chrome\chrome.exe
%PROGRAM_FILES%\FireFox\chrome\browser\browser.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\certerror\certerror.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\feeds.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\browser.exe
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\bookmarks\bookmarks.exe

Sets the 'hidden' attribute to the following files:

<Drive name for removable media>:\desktop.inf

Deletes the following files:

%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.exe
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.exe

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'Indicator' WindowName: ''

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial