Trojan.PWS.Siggen1.30671

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svcav_module' = '%APPDATA%\xblibtw.exe'

Changes the following executable system files:

%WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.tlb
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.tlb
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.JScript.tlb
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.JScript.dll
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
%WINDIR%\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
%WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\7d61e63dea85f4f77ea4c13df7651ec7\Microsoft.JScript.ni.dll
%WINDIR%\Microsoft.NET\Framework\sbs_microsoft.jscript.dll
%WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll

Malicious functions:

Creates and executes the following:

'%APPDATA%\xblibtw.exe'

Executes the following:

'<SYSTEM32>\vssadmin.exe' delete shadows /all

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cmd.exe

the following user processes:

ecmd.exe

Modifies file system :

Creates the following files:

%HOMEPATH%\Desktop\HELP_TO_SAVE_YOUR_FILES.bmp
%HOMEPATH%\Desktop\HELP_TO_SAVE_YOUR_FILES.txt
%HOMEPATH%\Desktop\CryptoLocker.lnk
<Auxiliary element>
%APPDATA%\xblibtw.exe
%APPDATA%\key.dat
%APPDATA%\log.html

Deletes the following files:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ip[1]

Moves the following system files:

from <SYSTEM32>\DirectX\Dinput\ms56_8.png to <SYSTEM32>\DirectX\Dinput\ms56_8.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms56_9.png to <SYSTEM32>\DirectX\Dinput\ms56_9.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms6.png to <SYSTEM32>\DirectX\Dinput\ms6.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms56_7.png to <SYSTEM32>\DirectX\Dinput\ms56_7.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms56_4.png to <SYSTEM32>\DirectX\Dinput\ms56_4.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms56_5.png to <SYSTEM32>\DirectX\Dinput\ms56_5.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms56_6.png to <SYSTEM32>\DirectX\Dinput\ms56_6.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms6_1.png to <SYSTEM32>\DirectX\Dinput\ms6_1.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms6_5.png to <SYSTEM32>\DirectX\Dinput\ms6_5.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms6_6.png to <SYSTEM32>\DirectX\Dinput\ms6_6.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms6_7.png to <SYSTEM32>\DirectX\Dinput\ms6_7.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms6_4.png to <SYSTEM32>\DirectX\Dinput\ms6_4.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms6_10.png to <SYSTEM32>\DirectX\Dinput\ms6_10.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms6_2.png to <SYSTEM32>\DirectX\Dinput\ms6_2.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms6_3.png to <SYSTEM32>\DirectX\Dinput\ms6_3.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms56_3.png to <SYSTEM32>\DirectX\Dinput\ms56_3.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms3b_2.png to <SYSTEM32>\DirectX\Dinput\ms3b_2.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms3b_3.png to <SYSTEM32>\DirectX\Dinput\ms3b_3.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms3b_4.png to <SYSTEM32>\DirectX\Dinput\ms3b_4.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms3b_1.png to <SYSTEM32>\DirectX\Dinput\ms3b_1.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms34_07.png to <SYSTEM32>\DirectX\Dinput\ms34_07.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms34_08.png to <SYSTEM32>\DirectX\Dinput\ms34_08.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms3b.png to <SYSTEM32>\DirectX\Dinput\ms3b.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms3b_a.png to <SYSTEM32>\DirectX\Dinput\ms3b_a.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms56_1.png to <SYSTEM32>\DirectX\Dinput\ms56_1.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms56_10.png to <SYSTEM32>\DirectX\Dinput\ms56_10.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms56_2.png to <SYSTEM32>\DirectX\Dinput\ms56_2.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms56.png to <SYSTEM32>\DirectX\Dinput\ms56.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms3b_c.png to <SYSTEM32>\DirectX\Dinput\ms3b_c.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms3b_m.png to <SYSTEM32>\DirectX\Dinput\ms3b_m.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms3b_t.png to <SYSTEM32>\DirectX\Dinput\ms3b_t.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms8_7.png to <SYSTEM32>\DirectX\Dinput\ms8_7.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms8_8.png to <SYSTEM32>\DirectX\Dinput\ms8_8.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms8_9.png to <SYSTEM32>\DirectX\Dinput\ms8_9.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms8_6.png to <SYSTEM32>\DirectX\Dinput\ms8_6.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms8_3.png to <SYSTEM32>\DirectX\Dinput\ms8_3.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms8_4.png to <SYSTEM32>\DirectX\Dinput\ms8_4.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms8_5.png to <SYSTEM32>\DirectX\Dinput\ms8_5.png.ecc
from <SYSTEM32>\DirectX\Dinput\mse.png to <SYSTEM32>\DirectX\Dinput\mse.png.ecc
from <SYSTEM32>\DirectX\Dinput\mse_4.png to <SYSTEM32>\DirectX\Dinput\mse_4.png.ecc
from <SYSTEM32>\DirectX\Dinput\mse_5.png to <SYSTEM32>\DirectX\Dinput\mse_5.png.ecc
from <SYSTEM32>\DirectX\Dinput\mse_6.png to <SYSTEM32>\DirectX\Dinput\mse_6.png.ecc
from <SYSTEM32>\DirectX\Dinput\mse_3.png to <SYSTEM32>\DirectX\Dinput\mse_3.png.ecc
from <SYSTEM32>\DirectX\Dinput\mse_1.png to <SYSTEM32>\DirectX\Dinput\mse_1.png.ecc
from <SYSTEM32>\DirectX\Dinput\mse_10.png to <SYSTEM32>\DirectX\Dinput\mse_10.png.ecc
from <SYSTEM32>\DirectX\Dinput\mse_2.png to <SYSTEM32>\DirectX\Dinput\mse_2.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms8_2.png to <SYSTEM32>\DirectX\Dinput\ms8_2.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms7_2.png to <SYSTEM32>\DirectX\Dinput\ms7_2.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms7_3.png to <SYSTEM32>\DirectX\Dinput\ms7_3.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms7_4.png to <SYSTEM32>\DirectX\Dinput\ms7_4.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms7_1.png to <SYSTEM32>\DirectX\Dinput\ms7_1.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms6_8.png to <SYSTEM32>\DirectX\Dinput\ms6_8.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms6_9.png to <SYSTEM32>\DirectX\Dinput\ms6_9.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms7.png to <SYSTEM32>\DirectX\Dinput\ms7.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms7_5.png to <SYSTEM32>\DirectX\Dinput\ms7_5.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms8.png to <SYSTEM32>\DirectX\Dinput\ms8.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms8_1.png to <SYSTEM32>\DirectX\Dinput\ms8_1.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms8_10.png to <SYSTEM32>\DirectX\Dinput\ms8_10.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms7_9.png to <SYSTEM32>\DirectX\Dinput\ms7_9.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms7_6.png to <SYSTEM32>\DirectX\Dinput\ms7_6.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms7_7.png to <SYSTEM32>\DirectX\Dinput\ms7_7.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms7_8.png to <SYSTEM32>\DirectX\Dinput\ms7_8.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms1b.png to <SYSTEM32>\DirectX\Dinput\ms1b.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms1b_01.png to <SYSTEM32>\DirectX\Dinput\ms1b_01.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms1b_02.png to <SYSTEM32>\DirectX\Dinput\ms1b_02.png.ecc
from <SYSTEM32>\DirectX\Dinput\lgc291.png to <SYSTEM32>\DirectX\Dinput\lgc291.png.ecc
from <SYSTEM32>\DirectX\Dinput\lgc207.png to <SYSTEM32>\DirectX\Dinput\lgc207.png.ecc
from <SYSTEM32>\DirectX\Dinput\lgc209.png to <SYSTEM32>\DirectX\Dinput\lgc209.png.ecc
from <SYSTEM32>\DirectX\Dinput\lgc20a.png to <SYSTEM32>\DirectX\Dinput\lgc20a.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms1b_03.png to <SYSTEM32>\DirectX\Dinput\ms1b_03.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms1b_08.png to <SYSTEM32>\DirectX\Dinput\ms1b_08.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms1b_09.png to <SYSTEM32>\DirectX\Dinput\ms1b_09.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms1b_10.png to <SYSTEM32>\DirectX\Dinput\ms1b_10.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms1b_07.png to <SYSTEM32>\DirectX\Dinput\ms1b_07.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms1b_04.png to <SYSTEM32>\DirectX\Dinput\ms1b_04.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms1b_05.png to <SYSTEM32>\DirectX\Dinput\ms1b_05.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms1b_06.png to <SYSTEM32>\DirectX\Dinput\ms1b_06.png.ecc
from <SYSTEM32>\DirectX\Dinput\lgc202.png to <SYSTEM32>\DirectX\Dinput\lgc202.png.ecc
from <SYSTEM32>\config\systemprofile\Templates\winword2.doc to <SYSTEM32>\config\systemprofile\Templates\winword2.doc.ecc
from <SYSTEM32>\DirectX\Dinput\act_rs.png to <SYSTEM32>\DirectX\Dinput\act_rs.png.ecc
from <SYSTEM32>\DirectX\Dinput\glmda.png to <SYSTEM32>\DirectX\Dinput\glmda.png.ecc
from <SYSTEM32>\config\systemprofile\Templates\winword.doc to <SYSTEM32>\config\systemprofile\Templates\winword.doc.ecc
from <SYSTEM32>\config\systemprofile\Templates\excel4.xls to <SYSTEM32>\config\systemprofile\Templates\excel4.xls.ecc
from <SYSTEM32>\config\systemprofile\Templates\powerpnt.ppt to <SYSTEM32>\config\systemprofile\Templates\powerpnt.ppt.ecc
from <SYSTEM32>\config\systemprofile\Templates\quattro.wb2 to <SYSTEM32>\config\systemprofile\Templates\quattro.wb2.ecc
from <SYSTEM32>\DirectX\Dinput\glmdiggp.png to <SYSTEM32>\DirectX\Dinput\glmdiggp.png.ecc
from <SYSTEM32>\DirectX\Dinput\gr4005.png to <SYSTEM32>\DirectX\Dinput\gr4005.png.ecc
from <SYSTEM32>\DirectX\Dinput\ia3002_1.png to <SYSTEM32>\DirectX\Dinput\ia3002_1.png.ecc
from <SYSTEM32>\DirectX\Dinput\ia3002_2.png to <SYSTEM32>\DirectX\Dinput\ia3002_2.png.ecc
from <SYSTEM32>\DirectX\Dinput\gr4003.png to <SYSTEM32>\DirectX\Dinput\gr4003.png.ecc
from <SYSTEM32>\DirectX\Dinput\gr3001.png to <SYSTEM32>\DirectX\Dinput\gr3001.png.ecc
from <SYSTEM32>\DirectX\Dinput\gr4001.png to <SYSTEM32>\DirectX\Dinput\gr4001.png.ecc
from <SYSTEM32>\DirectX\Dinput\gr4001_g.png to <SYSTEM32>\DirectX\Dinput\gr4001_g.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms28_5.png to <SYSTEM32>\DirectX\Dinput\ms28_5.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms28_6.png to <SYSTEM32>\DirectX\Dinput\ms28_6.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms28_7.png to <SYSTEM32>\DirectX\Dinput\ms28_7.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms28_4.png to <SYSTEM32>\DirectX\Dinput\ms28_4.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms28_1.png to <SYSTEM32>\DirectX\Dinput\ms28_1.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms28_2.png to <SYSTEM32>\DirectX\Dinput\ms28_2.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms28_3.png to <SYSTEM32>\DirectX\Dinput\ms28_3.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms28_8.png to <SYSTEM32>\DirectX\Dinput\ms28_8.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms34_04.png to <SYSTEM32>\DirectX\Dinput\ms34_04.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms34_05.png to <SYSTEM32>\DirectX\Dinput\ms34_05.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms34_06.png to <SYSTEM32>\DirectX\Dinput\ms34_06.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms34_03.png to <SYSTEM32>\DirectX\Dinput\ms34_03.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms34.png to <SYSTEM32>\DirectX\Dinput\ms34.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms34_01.png to <SYSTEM32>\DirectX\Dinput\ms34_01.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms34_02.png to <SYSTEM32>\DirectX\Dinput\ms34_02.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms28.png to <SYSTEM32>\DirectX\Dinput\ms28.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms26_04.png to <SYSTEM32>\DirectX\Dinput\ms26_04.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms26_05.png to <SYSTEM32>\DirectX\Dinput\ms26_05.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms26_06.png to <SYSTEM32>\DirectX\Dinput\ms26_06.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms26_03.png to <SYSTEM32>\DirectX\Dinput\ms26_03.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms26.png to <SYSTEM32>\DirectX\Dinput\ms26.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms26_01.png to <SYSTEM32>\DirectX\Dinput\ms26_01.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms26_02.png to <SYSTEM32>\DirectX\Dinput\ms26_02.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms26_07.png to <SYSTEM32>\DirectX\Dinput\ms26_07.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms27_3.png to <SYSTEM32>\DirectX\Dinput\ms27_3.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms27_4.png to <SYSTEM32>\DirectX\Dinput\ms27_4.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms27_5.png to <SYSTEM32>\DirectX\Dinput\ms27_5.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms27_2.png to <SYSTEM32>\DirectX\Dinput\ms27_2.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms26_08.png to <SYSTEM32>\DirectX\Dinput\ms26_08.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms27.png to <SYSTEM32>\DirectX\Dinput\ms27.png.ecc
from <SYSTEM32>\DirectX\Dinput\ms27_1.png to <SYSTEM32>\DirectX\Dinput\ms27_1.png.ecc
from <SYSTEM32>\DirectX\Dinput\mse_7.png to <SYSTEM32>\DirectX\Dinput\mse_7.png.ecc
from <SYSTEM32>\oobe\images\wpabtm.jpg to <SYSTEM32>\oobe\images\wpabtm.jpg.ecc
from <SYSTEM32>\oobe\images\wpaflag.jpg to <SYSTEM32>\oobe\images\wpaflag.jpg.ecc
from <SYSTEM32>\oobe\images\wpakey.jpg to <SYSTEM32>\oobe\images\wpakey.jpg.ecc
from <SYSTEM32>\oobe\images\wpaback.jpg to <SYSTEM32>\oobe\images\wpaback.jpg.ecc
from <SYSTEM32>\oobe\images\thanks10.png to <SYSTEM32>\oobe\images\thanks10.png.ecc
from <SYSTEM32>\oobe\images\thanks8.png to <SYSTEM32>\oobe\images\thanks8.png.ecc
from <SYSTEM32>\oobe\images\title.wma to <SYSTEM32>\oobe\images\title.wma.ecc
from <SYSTEM32>\oobe\images\wpatop.jpg to <SYSTEM32>\oobe\images\wpatop.jpg.ecc
from <SYSTEM32>\oobe\sconnect.js to <SYSTEM32>\oobe\sconnect.js.ecc
from <SYSTEM32>\oobe\setup\oobestyl.css to <SYSTEM32>\oobe\setup\oobestyl.css.ecc
from <SYSTEM32>\Restore\MachineGuid.txt to <SYSTEM32>\Restore\MachineGuid.txt.ecc
from <SYSTEM32>\oobe\oobeutil.js to <SYSTEM32>\oobe\oobeutil.js.ecc
from <SYSTEM32>\oobe\isptype.js to <SYSTEM32>\oobe\isptype.js.ecc
from <SYSTEM32>\oobe\migrate.js to <SYSTEM32>\oobe\migrate.js.ecc
from <SYSTEM32>\oobe\mousetut.js to <SYSTEM32>\oobe\mousetut.js.ecc
from <SYSTEM32>\oobe\images\skipup.jpg to <SYSTEM32>\oobe\images\skipup.jpg.ecc
from <SYSTEM32>\oobe\images\newmark8.jpg to <SYSTEM32>\oobe\images\newmark8.jpg.ecc
from <SYSTEM32>\oobe\images\newtop1.jpg to <SYSTEM32>\oobe\images\newtop1.jpg.ecc
from <SYSTEM32>\oobe\images\newtop8.jpg to <SYSTEM32>\oobe\images\newtop8.jpg.ecc
from <SYSTEM32>\oobe\images\newmark1.jpg to <SYSTEM32>\oobe\images\newmark1.jpg.ecc
from <SYSTEM32>\oobe\images\mslogo.jpg to <SYSTEM32>\oobe\images\mslogo.jpg.ecc
from <SYSTEM32>\oobe\images\newbtm1.jpg to <SYSTEM32>\oobe\images\newbtm1.jpg.ecc
from <SYSTEM32>\oobe\images\newbtm8.jpg to <SYSTEM32>\oobe\images\newbtm8.jpg.ecc
from <SYSTEM32>\oobe\images\nextdown.jpg to <SYSTEM32>\oobe\images\nextdown.jpg.ecc
from <SYSTEM32>\oobe\images\skipdown.jpg to <SYSTEM32>\oobe\images\skipdown.jpg.ecc
from <SYSTEM32>\oobe\images\skipoff.jpg to <SYSTEM32>\oobe\images\skipoff.jpg.ecc
from <SYSTEM32>\oobe\images\skipover.jpg to <SYSTEM32>\oobe\images\skipover.jpg.ecc
from <SYSTEM32>\oobe\images\oemcoa.jpg to <SYSTEM32>\oobe\images\oemcoa.jpg.ecc
from <SYSTEM32>\oobe\images\nextoff.jpg to <SYSTEM32>\oobe\images\nextoff.jpg.ecc
from <SYSTEM32>\oobe\images\nextover.jpg to <SYSTEM32>\oobe\images\nextover.jpg.ecc
from <SYSTEM32>\oobe\images\nextup.jpg to <SYSTEM32>\oobe\images\nextup.jpg.ecc
from %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca.cat to %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca.cat.ecc
from %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca.manifest to %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca.manifest.ecc
from %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.cat to %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.cat.ecc
from %WINDIR%\Web\Wallpaper\Windows XP.jpg to %WINDIR%\Web\Wallpaper\Windows XP.jpg.ecc
from %WINDIR%\Web\Wallpaper\Tulips.jpg to %WINDIR%\Web\Wallpaper\Tulips.jpg.ecc
from %WINDIR%\Web\Wallpaper\Vortec space.jpg to %WINDIR%\Web\Wallpaper\Vortec space.jpg.ecc
from %WINDIR%\Web\Wallpaper\Wind.jpg to %WINDIR%\Web\Wallpaper\Wind.jpg.ecc
from %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.manifest to %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.manifest.ecc
from %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e.cat to %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e.cat.ecc
from %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e.manifest to %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e.manifest.ecc
from <Auxiliary element> to <Auxiliary element>
from %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375.manifest to %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375.manifest.ecc
from %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.cat to %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.cat.ecc
from %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.manifest to %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.manifest.ecc
from %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375.cat to %WINDIR%\WinSxS\Manifests\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375.cat.ecc
from %WINDIR%\Web\Wallpaper\Stonehenge.jpg to %WINDIR%\Web\Wallpaper\Stonehenge.jpg.ecc
from %WINDIR%\Web\Wallpaper\Crystal.jpg to %WINDIR%\Web\Wallpaper\Crystal.jpg.ecc
from %WINDIR%\Web\Wallpaper\Follow.jpg to %WINDIR%\Web\Wallpaper\Follow.jpg.ecc
from %WINDIR%\Web\Wallpaper\Friend.jpg to %WINDIR%\Web\Wallpaper\Friend.jpg.ecc
from %WINDIR%\Web\Wallpaper\Azul.jpg to %WINDIR%\Web\Wallpaper\Azul.jpg.ecc
from %WINDIR%\Web\printers\prtwebvw.css to %WINDIR%\Web\printers\prtwebvw.css.ecc
from %WINDIR%\Web\Wallpaper\Ascent.jpg to %WINDIR%\Web\Wallpaper\Ascent.jpg.ecc
from %WINDIR%\Web\Wallpaper\Autumn.jpg to %WINDIR%\Web\Wallpaper\Autumn.jpg.ecc
from %WINDIR%\Web\Wallpaper\Home.jpg to %WINDIR%\Web\Wallpaper\Home.jpg.ecc
from %WINDIR%\Web\Wallpaper\Radiance.jpg to %WINDIR%\Web\Wallpaper\Radiance.jpg.ecc
from %WINDIR%\Web\Wallpaper\Red moon desert.jpg to %WINDIR%\Web\Wallpaper\Red moon desert.jpg.ecc
from %WINDIR%\Web\Wallpaper\Ripple.jpg to %WINDIR%\Web\Wallpaper\Ripple.jpg.ecc
from %WINDIR%\Web\Wallpaper\Purple flower.jpg to %WINDIR%\Web\Wallpaper\Purple flower.jpg.ecc
from %WINDIR%\Web\Wallpaper\Moon flower.jpg to %WINDIR%\Web\Wallpaper\Moon flower.jpg.ecc
from %WINDIR%\Web\Wallpaper\Peace.jpg to %WINDIR%\Web\Wallpaper\Peace.jpg.ecc
from %WINDIR%\Web\Wallpaper\Power.jpg to %WINDIR%\Web\Wallpaper\Power.jpg.ecc
from <SYSTEM32>\DirectX\Dinput\msprw_7.png to <SYSTEM32>\DirectX\Dinput\msprw_7.png.ecc
from <SYSTEM32>\DirectX\Dinput\msprw_8.png to <SYSTEM32>\DirectX\Dinput\msprw_8.png.ecc
from <SYSTEM32>\DirectX\Dinput\SV-262e1.png to <SYSTEM32>\DirectX\Dinput\SV-262e1.png.ecc
from <SYSTEM32>\DirectX\Dinput\msprw_6.png to <SYSTEM32>\DirectX\Dinput\msprw_6.png.ecc
from <SYSTEM32>\DirectX\Dinput\msprw_3.png to <SYSTEM32>\DirectX\Dinput\msprw_3.png.ecc
from <SYSTEM32>\DirectX\Dinput\msprw_4.png to <SYSTEM32>\DirectX\Dinput\msprw_4.png.ecc
from <SYSTEM32>\DirectX\Dinput\msprw_5.png to <SYSTEM32>\DirectX\Dinput\msprw_5.png.ecc
from <SYSTEM32>\DirectX\Dinput\SV-262e3.png to <SYSTEM32>\DirectX\Dinput\SV-262e3.png.ecc
from <SYSTEM32>\eula.txt to <SYSTEM32>\eula.txt.ecc
from <SYSTEM32>\ias\dnary.mdb to <SYSTEM32>\ias\dnary.mdb.ecc
from <SYSTEM32>\ias\ias.mdb to <SYSTEM32>\ias\ias.mdb.ecc
from <DRIVERS>\gmreadme.txt to <DRIVERS>\gmreadme.txt.ecc
from <SYSTEM32>\DirectX\Dinput\SV-262e4.png to <SYSTEM32>\DirectX\Dinput\SV-262e4.png.ecc
from <SYSTEM32>\DirectX\Dinput\sv2511.png to <SYSTEM32>\DirectX\Dinput\sv2511.png.ecc
from <SYSTEM32>\DirectX\Dinput\sv2512.png to <SYSTEM32>\DirectX\Dinput\sv2512.png.ecc
from <SYSTEM32>\DirectX\Dinput\msprw_2.png to <SYSTEM32>\DirectX\Dinput\msprw_2.png.ecc
from <SYSTEM32>\DirectX\Dinput\msf1f_10.png to <SYSTEM32>\DirectX\Dinput\msf1f_10.png.ecc
from <SYSTEM32>\DirectX\Dinput\msf1f_2.png to <SYSTEM32>\DirectX\Dinput\msf1f_2.png.ecc
from <SYSTEM32>\DirectX\Dinput\msf1f_3.png to <SYSTEM32>\DirectX\Dinput\msf1f_3.png.ecc
from <SYSTEM32>\DirectX\Dinput\msf1f_1.png to <SYSTEM32>\DirectX\Dinput\msf1f_1.png.ecc
from <SYSTEM32>\DirectX\Dinput\mse_8.png to <SYSTEM32>\DirectX\Dinput\mse_8.png.ecc
from <SYSTEM32>\DirectX\Dinput\mse_9.png to <SYSTEM32>\DirectX\Dinput\mse_9.png.ecc
from <SYSTEM32>\DirectX\Dinput\msf1f.png to <SYSTEM32>\DirectX\Dinput\msf1f.png.ecc
from <SYSTEM32>\DirectX\Dinput\msf1f_4.png to <SYSTEM32>\DirectX\Dinput\msf1f_4.png.ecc
from <SYSTEM32>\DirectX\Dinput\msf1f_9.png to <SYSTEM32>\DirectX\Dinput\msf1f_9.png.ecc
from <SYSTEM32>\DirectX\Dinput\msprw.png to <SYSTEM32>\DirectX\Dinput\msprw.png.ecc
from <SYSTEM32>\DirectX\Dinput\msprw_1.png to <SYSTEM32>\DirectX\Dinput\msprw_1.png.ecc
from <SYSTEM32>\DirectX\Dinput\msf1f_8.png to <SYSTEM32>\DirectX\Dinput\msf1f_8.png.ecc
from <SYSTEM32>\DirectX\Dinput\msf1f_5.png to <SYSTEM32>\DirectX\Dinput\msf1f_5.png.ecc
from <SYSTEM32>\DirectX\Dinput\msf1f_6.png to <SYSTEM32>\DirectX\Dinput\msf1f_6.png.ecc
from <SYSTEM32>\DirectX\Dinput\msf1f_7.png to <SYSTEM32>\DirectX\Dinput\msf1f_7.png.ecc
from <SYSTEM32>\oobe\html\mouse\images\venice.jpg to <SYSTEM32>\oobe\html\mouse\images\venice.jpg.ecc
from <SYSTEM32>\oobe\html\mouse\images\venicem.jpg to <SYSTEM32>\oobe\html\mouse\images\venicem.jpg.ecc
from <SYSTEM32>\oobe\html\mouse\images\verona.jpg to <SYSTEM32>\oobe\html\mouse\images\verona.jpg.ecc
from <SYSTEM32>\oobe\html\mouse\images\tyrolm.jpg to <SYSTEM32>\oobe\html\mouse\images\tyrolm.jpg.ecc
from <SYSTEM32>\oobe\html\mouse\images\prague.jpg to <SYSTEM32>\oobe\html\mouse\images\prague.jpg.ecc
from <SYSTEM32>\oobe\html\mouse\images\praguem.jpg to <SYSTEM32>\oobe\html\mouse\images\praguem.jpg.ecc
from <SYSTEM32>\oobe\html\mouse\images\tyrol.jpg to <SYSTEM32>\oobe\html\mouse\images\tyrol.jpg.ecc
from <SYSTEM32>\oobe\html\mouse\images\veronam.jpg to <SYSTEM32>\oobe\html\mouse\images\veronam.jpg.ecc
from <SYSTEM32>\oobe\images\backover.jpg to <SYSTEM32>\oobe\images\backover.jpg.ecc
from <SYSTEM32>\oobe\images\backup.jpg to <SYSTEM32>\oobe\images\backup.jpg.ecc
from <SYSTEM32>\oobe\images\intro.wmv to <SYSTEM32>\oobe\images\intro.wmv.ecc
from <SYSTEM32>\oobe\images\backoff.jpg to <SYSTEM32>\oobe\images\backoff.jpg.ecc
from <SYSTEM32>\oobe\iconnect.js to <SYSTEM32>\oobe\iconnect.js.ecc
from <SYSTEM32>\oobe\icsmgr.js to <SYSTEM32>\oobe\icsmgr.js.ecc
from <SYSTEM32>\oobe\images\backdown.jpg to <SYSTEM32>\oobe\images\backdown.jpg.ecc
from <SYSTEM32>\oobe\html\mouse\images\pisam.jpg to <SYSTEM32>\oobe\html\mouse\images\pisam.jpg.ecc
from <SYSTEM32>\oobe\agtscrpt.js to <SYSTEM32>\oobe\agtscrpt.js.ecc
from <SYSTEM32>\oobe\dialmgr.js to <SYSTEM32>\oobe\dialmgr.js.ecc
from <SYSTEM32>\oobe\dslmain.js to <SYSTEM32>\oobe\dslmain.js.ecc
from <SYSTEM32>\oobe\agtscrp2.js to <SYSTEM32>\oobe\agtscrp2.js.ecc
from <SYSTEM32>\oobe\actsetup\aregsty2.css to <SYSTEM32>\oobe\actsetup\aregsty2.css.ecc
from <SYSTEM32>\oobe\actsetup\aregstyl.css to <SYSTEM32>\oobe\actsetup\aregstyl.css.ecc
from <SYSTEM32>\oobe\agtcore.js to <SYSTEM32>\oobe\agtcore.js.ecc
from <SYSTEM32>\oobe\error.js to <SYSTEM32>\oobe\error.js.ecc
from <SYSTEM32>\oobe\html\mouse\images\paris.jpg to <SYSTEM32>\oobe\html\mouse\images\paris.jpg.ecc
from <SYSTEM32>\oobe\html\mouse\images\parism.jpg to <SYSTEM32>\oobe\html\mouse\images\parism.jpg.ecc
from <SYSTEM32>\oobe\html\mouse\images\pisa.jpg to <SYSTEM32>\oobe\html\mouse\images\pisa.jpg.ecc
from <SYSTEM32>\oobe\html\mouse\images\heidelbm.jpg to <SYSTEM32>\oobe\html\mouse\images\heidelbm.jpg.ecc
from <SYSTEM32>\oobe\html\mouse\images\bulzano.jpg to <SYSTEM32>\oobe\html\mouse\images\bulzano.jpg.ecc
from <SYSTEM32>\oobe\html\mouse\images\bulzanom.jpg to <SYSTEM32>\oobe\html\mouse\images\bulzanom.jpg.ecc
from <SYSTEM32>\oobe\html\mouse\images\heidelb.jpg to <SYSTEM32>\oobe\html\mouse\images\heidelb.jpg.ecc
from <SYSTEM32>\config\systemprofile\Templates\excel.xls to <SYSTEM32>\config\systemprofile\Templates\excel.xls.ecc
from %WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\window_up.jpg to %WINDIR%\Help\Tours\htmlTour\window_up.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\unlock_optimized_big.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_optimized_big.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg.ecc
from %WINDIR%\Help\Tours\mmTour\intro.txt to %WINDIR%\Help\Tours\mmTour\intro.txt.ecc
from %WINDIR%\Help\Tours\mmTour\segment4.txt to %WINDIR%\Help\Tours\mmTour\segment4.txt.ecc
from %WINDIR%\Help\Tours\mmTour\segment5.txt to %WINDIR%\Help\Tours\mmTour\segment5.txt.ecc
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Cnt\wmploc.js to %WINDIR%\Help\Tours\WindowsMediaPlayer\Cnt\wmploc.js.ecc
from %WINDIR%\Help\Tours\mmTour\segment3.txt to %WINDIR%\Help\Tours\mmTour\segment3.txt.ecc
from %WINDIR%\Help\Tours\mmTour\nav.txt to %WINDIR%\Help\Tours\mmTour\nav.txt.ecc
from %WINDIR%\Help\Tours\mmTour\segment1.txt to %WINDIR%\Help\Tours\mmTour\segment1.txt.ecc
from %WINDIR%\Help\Tours\mmTour\segment2.txt to %WINDIR%\Help\Tours\mmTour\segment2.txt.ecc
from %WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\safe_easy_faster.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_faster.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\ul_logo.jpg to %WINDIR%\Help\Tours\htmlTour\ul_logo.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\unlock_built.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_built.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg to %WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\taskbar_up.jpg to %WINDIR%\Help\Tours\htmlTour\taskbar_up.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\scripts.js to %WINDIR%\Help\Tours\htmlTour\scripts.js.ecc
from %WINDIR%\Help\Tours\htmlTour\start_up.jpg to %WINDIR%\Help\Tours\htmlTour\start_up.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\style.css to %WINDIR%\Help\Tours\htmlTour\style.css.ecc
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.ecc
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg.ecc
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg.ecc
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.ecc
from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\EULA.rtf to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\EULA.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.dll to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.dll.ecc
from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.tlb to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.tlb.ecc
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\dd_dotnetfx3install.txt to %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\dd_dotnetfx3install.txt.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\VSMsiLog22FD.txt to %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\VSMsiLog22FD.txt.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1025.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1025.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\dd_dotnetfx3error.txt to %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\dd_dotnetfx3error.txt.ecc
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminStyles.css to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminStyles.css.ecc
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll.ecc
from %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.tlb to %WINDIR%\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.tlb.ecc
from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\WebUIValidation.js to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\WebUIValidation.js.ecc
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\tour.js to %WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\tour.js.ecc
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\copycd.wmv to %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\copycd.wmv.ecc
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\mdlib.wmv to %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\mdlib.wmv.ecc
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\events.js to %WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\events.js.ecc
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Css\controls.css to %WINDIR%\Help\Tours\WindowsMediaPlayer\Css\controls.css.ecc
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Css\wmptour.css to %WINDIR%\Help\Tours\WindowsMediaPlayer\Css\wmptour.css.ecc
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\controls.js to %WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\controls.js.ecc
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\nuskin.wmv to %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\nuskin.wmv.ecc
from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU1.txt to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU1.txt.ecc
from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU2.txt to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU2.txt.ecc
from %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\SmartNav.js to %WINDIR%\Microsoft.NET\Framework\v1.1.4322\ASP.NETClientFiles\SmartNav.js.ecc
from %WINDIR%\Microsoft.NET\Framework\sbs_microsoft.jscript.dll to %WINDIR%\Microsoft.NET\Framework\sbs_microsoft.jscript.dll.ecc
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\rtuner.wmv to %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\rtuner.wmv.ecc
from %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\viz.wmv to %WINDIR%\Help\Tours\WindowsMediaPlayer\Video\viz.wmv.ecc
from %WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll to %WINDIR%\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll.ecc
from %WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\connected_networks.jpg to %WINDIR%\Help\Tours\htmlTour\connected_networks.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg to %WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg to %WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg to %WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg to %WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg to %WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\desktop_up.jpg to %WINDIR%\Help\Tours\htmlTour\desktop_up.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\end_up.jpg to %WINDIR%\Help\Tours\htmlTour\end_up.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\control_up.jpg to %WINDIR%\Help\Tours\htmlTour\control_up.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg to %WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg to %WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\connected_data.jpg to %WINDIR%\Help\Tours\htmlTour\connected_data.jpg.ecc
from %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\7d61e63dea85f4f77ea4c13df7651ec7\Microsoft.JScript.ni.dll to %WINDIR%\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\7d61e63dea85f4f77ea4c13df7651ec7\Microsoft.JScript.ni.dll.ecc
from %WINDIR%\clock.avi to %WINDIR%\clock.avi.ecc
from %WINDIR%\Help\Tours\htmlTour\best_road.jpg to %WINDIR%\Help\Tours\htmlTour\best_road.jpg.ecc
from %WINDIR%\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll to %WINDIR%\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll.ecc
from %WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.txt to %WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.txt.ecc
from %WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt to %WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt.ecc
from %WINDIR%\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.JScript.dll to %WINDIR%\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.JScript.dll.ecc
from %WINDIR%\Help\Tours\htmlTour\best_road_big.jpg to %WINDIR%\Help\Tours\htmlTour\best_road_big.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\best_secure.jpg to %WINDIR%\Help\Tours\htmlTour\best_secure.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg to %WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg to %WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\best_robust.jpg to %WINDIR%\Help\Tours\htmlTour\best_robust.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg to %WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img121.jpg to %WINDIR%\Help\Tours\htmlTour\img121.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img123.jpg to %WINDIR%\Help\Tours\htmlTour\img123.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img126.jpg to %WINDIR%\Help\Tours\htmlTour\img126.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img116.jpg to %WINDIR%\Help\Tours\htmlTour\img116.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img103.jpg to %WINDIR%\Help\Tours\htmlTour\img103.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img109.jpg to %WINDIR%\Help\Tours\htmlTour\img109.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img110.jpg to %WINDIR%\Help\Tours\htmlTour\img110.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img136.jpg to %WINDIR%\Help\Tours\htmlTour\img136.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\question_icon.jpg to %WINDIR%\Help\Tours\htmlTour\question_icon.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\read_icon.jpg to %WINDIR%\Help\Tours\htmlTour\read_icon.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\safe_easy_better.jpg to %WINDIR%\Help\Tours\htmlTour\safe_easy_better.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\pen_icon.jpg to %WINDIR%\Help\Tours\htmlTour\pen_icon.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img149.jpg to %WINDIR%\Help\Tours\htmlTour\img149.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\intro_logo.jpg to %WINDIR%\Help\Tours\htmlTour\intro_logo.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\logo.jpg to %WINDIR%\Help\Tours\htmlTour\logo.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img100.jpg to %WINDIR%\Help\Tours\htmlTour\img100.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img014.jpg to %WINDIR%\Help\Tours\htmlTour\img014.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img033.jpg to %WINDIR%\Help\Tours\htmlTour\img033.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img033a.jpg to %WINDIR%\Help\Tours\htmlTour\img033a.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img004b.jpg to %WINDIR%\Help\Tours\htmlTour\img004b.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\folder_up.jpg to %WINDIR%\Help\Tours\htmlTour\folder_up.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\gradient.jpg to %WINDIR%\Help\Tours\htmlTour\gradient.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\icon_up.jpg to %WINDIR%\Help\Tours\htmlTour\icon_up.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img034.jpg to %WINDIR%\Help\Tours\htmlTour\img034.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img072.jpg to %WINDIR%\Help\Tours\htmlTour\img072.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img074a.jpg to %WINDIR%\Help\Tours\htmlTour\img074a.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img089.jpg to %WINDIR%\Help\Tours\htmlTour\img089.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img068.jpg to %WINDIR%\Help\Tours\htmlTour\img068.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img040.jpg to %WINDIR%\Help\Tours\htmlTour\img040.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img046.jpg to %WINDIR%\Help\Tours\htmlTour\img046.jpg.ecc
from %WINDIR%\Help\Tours\htmlTour\img060.jpg to %WINDIR%\Help\Tours\htmlTour\img060.jpg.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1028.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1028.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\eula.rtf.ecc
from %WINDIR%\OEWABLog.txt to %WINDIR%\OEWABLog.txt.ecc
from %WINDIR%\pchealth\helpctr\System\css\Behaviors.css to %WINDIR%\pchealth\helpctr\System\css\Behaviors.css.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\eula.rtf.ecc
from %WINDIR%\pchealth\helpctr\System\css\Layout.css to %WINDIR%\pchealth\helpctr\System\css\Layout.css.ecc
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\constants.js to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\constants.js.ecc
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Css\RAChat.css to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Css\RAChat.css.ecc
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Css\rc.css to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Css\rc.css.ecc
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\common.js to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Common\common.js.ecc
from %WINDIR%\pchealth\helpctr\System\dialogs\DlgLib.js to %WINDIR%\pchealth\helpctr\System\dialogs\DlgLib.js.ecc
from %WINDIR%\pchealth\helpctr\System\DVDUpgrd\dvdupgrd.js to %WINDIR%\pchealth\helpctr\System\DVDUpgrd\dvdupgrd.js.ecc
from %WINDIR%\pchealth\helpctr\System\DVDUpgrd\stripe.jpg to %WINDIR%\pchealth\helpctr\System\DVDUpgrd\stripe.jpg.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\eula.rtf.ecc
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Css\RAChat.css to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Css\RAChat.css.ecc
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Css\rc.css to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Css\rc.css.ecc
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Css\rcbuddy.css to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Css\rcbuddy.css.ecc
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\constants.js to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\constants.js.ecc
from %WINDIR%\pchealth\helpctr\System\sysinfo\wmi_data.js to %WINDIR%\pchealth\helpctr\System\sysinfo\wmi_data.js.ecc
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\PSS.css to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\PSS.css.ecc
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\common.js to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\common.js.ecc
from %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Remote_Assistance_Graphic.png to %WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Remote_Assistance_Graphic.png.ecc
from <SYSTEM32>\config\system.sav to <SYSTEM32>\config\system.sav.ecc
from <SYSTEM32>\config\systemprofile\Application Data\Microsoft\Internet Explorer\brndlog.txt to <SYSTEM32>\config\systemprofile\Application Data\Microsoft\Internet Explorer\brndlog.txt.ecc
from <SYSTEM32>\config\systemprofile\SendTo\Mail Recipient.MAPIMail to <SYSTEM32>\config\systemprofile\SendTo\Mail Recipient.MAPIMail.ecc
from <SYSTEM32>\config\software.sav to <SYSTEM32>\config\software.sav.ecc
from %WINDIR%\setuplog.txt to %WINDIR%\setuplog.txt.ecc
from <SYSTEM32>\CatRoot2\dberr.txt to <SYSTEM32>\CatRoot2\dberr.txt.ecc
from <SYSTEM32>\config\default.sav to <SYSTEM32>\config\default.sav.ecc
from %WINDIR%\pchealth\helpctr\System\sysinfo\sysSoftwareInfo.js to %WINDIR%\pchealth\helpctr\System\sysinfo\sysSoftwareInfo.js.ecc
from %WINDIR%\pchealth\helpctr\System\scripts\Common.js to %WINDIR%\pchealth\helpctr\System\scripts\Common.js.ecc
from %WINDIR%\pchealth\helpctr\System\scripts\HomePage__DESKTOP.js to %WINDIR%\pchealth\helpctr\System\scripts\HomePage__DESKTOP.js.ecc
from %WINDIR%\pchealth\helpctr\System\scripts\HomePage__SERVER.js to %WINDIR%\pchealth\helpctr\System\scripts\HomePage__SERVER.js.ecc
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\RAServer.js to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\RAServer.js.ecc
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Css\rcbuddy.css to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Css\rcbuddy.css.ecc
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAClient.js to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAClient.js.ecc
from %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\RAControl.js to %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\RAControl.js.ecc
from %WINDIR%\pchealth\helpctr\System\scripts\HomePage__SHARED.js to %WINDIR%\pchealth\helpctr\System\scripts\HomePage__SHARED.js.ecc
from %WINDIR%\pchealth\helpctr\System\sysinfo\RSoP.js to %WINDIR%\pchealth\helpctr\System\sysinfo\RSoP.js.ecc
from %WINDIR%\pchealth\helpctr\System\sysinfo\sysComponentInfo.js to %WINDIR%\pchealth\helpctr\System\sysinfo\sysComponentInfo.js.ecc
from %WINDIR%\pchealth\helpctr\System\sysinfo\sysHealthInfo.js to %WINDIR%\pchealth\helpctr\System\sysinfo\sysHealthInfo.js.ecc
from %WINDIR%\pchealth\helpctr\System\sysinfo\msinfohss.css to %WINDIR%\pchealth\helpctr\System\sysinfo\msinfohss.css.ecc
from %WINDIR%\pchealth\helpctr\System\scripts\wrapperparam.js to %WINDIR%\pchealth\helpctr\System\scripts\wrapperparam.js.ecc
from %WINDIR%\pchealth\helpctr\System\sysinfo\commonFunc.js to %WINDIR%\pchealth\helpctr\System\sysinfo\commonFunc.js.ecc
from %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\greendot.jpg to %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\greendot.jpg.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2070.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2070.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.3082.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.3082.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\dd_dotnetfx35error.txt to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\dd_dotnetfx35error.txt.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2052.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2052.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1049.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1049.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1053.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1053.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1055.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1055.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\dd_dotnetfx35install.txt to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\dd_dotnetfx35install.txt.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\WebAdminStyles.css to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\WebAdminStyles.css.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\defaults\preferences\defaults.js to %WINDIR%\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\defaults\preferences\defaults.js.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1046.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1046.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1033.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1033.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1035.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1035.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1036.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1036.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1032.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1032.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1029.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1029.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1030.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1030.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1031.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1031.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1037.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1037.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1043.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1043.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1044.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1044.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1045.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1045.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1042.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1042.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1038.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1038.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1040.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1040.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1041.rtf to %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1041.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.JScript.dll to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.JScript.dll.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.JScript.tlb to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.JScript.tlb.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\eula.rtf.ecc
from %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\eula.rtf to %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\eula.rtf.ecc

Moves the following files:

from <Auxiliary element> to <Auxiliary element>

Deletes itself.

Network activity:

Connects to:

'7t######47vlep5o.2kjb9.net':80
'ip##fo.io':80

TCP:

HTTP GET requests:

http://7t######47vlep5o.2kjb9.net/state1.php?U3##################################################################################################################################################################################################################################################################################################################
http://7t######47vlep5o.2kjb9.net/state1.php?U3######################################################################################################################################################################################################################################################################################################
http://ip##fo.io/ip

UDP:

DNS ASK 7t######47vlep5o.2kjb9.net
DNS ASK ip##fo.io

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial