Trojan.Encoder.4454

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'servrakex' = '<SYSTEM32>\CMD.EXE /C START "" "%HOMEPATH%\My Documents\wlrmdr.exe"'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\!RecoveR!-rakex++.PNG
%HOMEPATH%\Start Menu\Programs\Startup\!RecoveR!-rakex++.TXT
%HOMEPATH%\Start Menu\Programs\Startup\!RecoveR!-rakex++.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\!RecoveR!-rakex++.HTML

Malicious functions:

Executes the following:

'<SYSTEM32>\cmd.exe' /c DEL <Full path to virus> >> NUL
'%HOMEPATH%\My Documents\wlrmdr.exe'

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cmd.exe

the following user processes:

ecmd.exe

Modifies file system:

Creates the following files:

%APPDATA%\Microsoft\Windows\Themes\!RecoveR!-rakex++.PNG
%APPDATA%\Microsoft\SystemCertificates\!RecoveR!-rakex++.HTML
%APPDATA%\Microsoft\Windows\Themes\!RecoveR!-rakex++.HTML
%APPDATA%\Microsoft\Windows\Themes\!RecoveR!-rakex++.TXT
%APPDATA%\Microsoft\SystemCertificates\!RecoveR!-rakex++.TXT
%APPDATA%\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.TXT
%APPDATA%\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.PNG
%APPDATA%\Microsoft\SystemCertificates\!RecoveR!-rakex++.PNG
%APPDATA%\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.HTML
%APPDATA%\Mozilla\Extensions\!RecoveR!-rakex++.PNG
%APPDATA%\Microsoft\!RecoveR!-rakex++.HTML
%APPDATA%\Mozilla\Extensions\!RecoveR!-rakex++.HTML
%APPDATA%\Mozilla\Extensions\!RecoveR!-rakex++.TXT
%APPDATA%\Microsoft\!RecoveR!-rakex++.TXT
%APPDATA%\Microsoft\Windows\!RecoveR!-rakex++.TXT
%APPDATA%\Microsoft\Windows\!RecoveR!-rakex++.PNG
%APPDATA%\Microsoft\!RecoveR!-rakex++.PNG
%APPDATA%\Microsoft\Windows\!RecoveR!-rakex++.HTML
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.HTML
%APPDATA%\Microsoft\Media Player\!RecoveR!-rakex++.HTML
%APPDATA%\Microsoft\Media Player\!RecoveR!-rakex++.TXT
%APPDATA%\Microsoft\MMC\!RecoveR!-rakex++.TXT
%APPDATA%\Microsoft\MMC\!RecoveR!-rakex++.PNG
%APPDATA%\Microsoft\Media Player\!RecoveR!-rakex++.PNG
%APPDATA%\Microsoft\Internet Explorer\!RecoveR!-rakex++.PNG
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\!RecoveR!-rakex++.HTML
%APPDATA%\Microsoft\Internet Explorer\!RecoveR!-rakex++.HTML
%APPDATA%\Microsoft\Internet Explorer\!RecoveR!-rakex++.TXT
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.HTML
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.TXT
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.TXT
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.PNG
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.PNG
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.PNG
%APPDATA%\Microsoft\MMC\!RecoveR!-rakex++.HTML
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.HTML
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.TXT
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\!RecoveR!-rakex++.PNG
%HOMEPATH%\Favorites\Links\!RecoveR!-rakex++.HTML
%HOMEPATH%\Favorites\Links\!RecoveR!-rakex++.TXT
%HOMEPATH%\Favorites\!RecoveR!-rakex++.TXT
%HOMEPATH%\Favorites\!RecoveR!-rakex++.PNG
%HOMEPATH%\Favorites\Links\!RecoveR!-rakex++.PNG
%HOMEPATH%\Cookies\!RecoveR!-rakex++.PNG
%APPDATA%\!RecoveR!-rakex++.HTML
%HOMEPATH%\Cookies\!RecoveR!-rakex++.HTML
%HOMEPATH%\Cookies\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\!RecoveR!-rakex++.PNG
%HOMEPATH%\Favorites\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\!RecoveR!-rakex++.TXT
%APPDATA%\!RecoveR!-rakex++.TXT
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\!RecoveR!-rakex++.TXT
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\!RecoveR!-rakex++.PNG
%APPDATA%\Mozilla\Firefox\Profiles\!RecoveR!-rakex++.PNG
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\!RecoveR!-rakex++.HTML
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\!RecoveR!-rakex++.HTML
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\!RecoveR!-rakex++.HTML
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\!RecoveR!-rakex++.TXT
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\!RecoveR!-rakex++.TXT
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\!RecoveR!-rakex++.PNG
%APPDATA%\Mozilla\!RecoveR!-rakex++.TXT
%APPDATA%\Mozilla\!RecoveR!-rakex++.PNG
%APPDATA%\!RecoveR!-rakex++.PNG
%APPDATA%\Mozilla\!RecoveR!-rakex++.HTML
%APPDATA%\Mozilla\Firefox\!RecoveR!-rakex++.HTML
%APPDATA%\Mozilla\Firefox\Profiles\!RecoveR!-rakex++.HTML
%APPDATA%\Mozilla\Firefox\Profiles\!RecoveR!-rakex++.TXT
%APPDATA%\Mozilla\Firefox\!RecoveR!-rakex++.TXT
%APPDATA%\Mozilla\Firefox\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Local Settings\Application Data\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Local Settings\Application Data\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Local Settings\Application Data\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Local Settings\Temp\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Local Settings\Temp\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Local Settings\History\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Local Settings\History\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Local Settings\Temp\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Local Settings\History\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Application Data\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Application Data\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Cookies\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Cookies\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Application Data\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Application Data\Microsoft\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Application Data\Microsoft\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Cookies\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\!RecoveR!-rakex++.PNG
%APPDATA%\Identities\!RecoveR!-rakex++.HTML
%APPDATA%\Identities\!RecoveR!-rakex++.TXT
%APPDATA%\Microsoft\Address Book\!RecoveR!-rakex++.TXT
%APPDATA%\Microsoft\Address Book\!RecoveR!-rakex++.PNG
%APPDATA%\Identities\!RecoveR!-rakex++.PNG
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\!RecoveR!-rakex++.HTML
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\!RecoveR!-rakex++.HTML
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\!RecoveR!-rakex++.TXT
%APPDATA%\Microsoft\Credentials\!RecoveR!-rakex++.HTML
%APPDATA%\Microsoft\Credentials\!RecoveR!-rakex++.TXT
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\!RecoveR!-rakex++.TXT
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\!RecoveR!-rakex++.PNG
%APPDATA%\Microsoft\Credentials\!RecoveR!-rakex++.PNG
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\!RecoveR!-rakex++.PNG
%APPDATA%\Microsoft\Address Book\!RecoveR!-rakex++.HTML
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\!RecoveR!-rakex++.HTML
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Local Settings\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Local Settings\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Local Settings\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\!RecoveR!-rakex++.PNG
%HOMEPATH%\Local Settings\History\History.IE5\!RecoveR!-rakex++.PNG
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\!RecoveR!-rakex++.HTML
%HOMEPATH%\Local Settings\History\History.IE5\!RecoveR!-rakex++.HTML
%HOMEPATH%\Local Settings\History\History.IE5\!RecoveR!-rakex++.TXT
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\!RecoveR!-rakex++.TXT
<LS_APPDATA>\!RecoveR!-rakex++.TXT
<LS_APPDATA>\!RecoveR!-rakex++.PNG
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\!RecoveR!-rakex++.PNG
<LS_APPDATA>\!RecoveR!-rakex++.HTML
%HOMEPATH%\Local Settings\!RecoveR!-rakex++.PNG
%TEMP%\!RecoveR!-rakex++.HTML
%HOMEPATH%\Local Settings\!RecoveR!-rakex++.HTML
%HOMEPATH%\Local Settings\!RecoveR!-rakex++.TXT
%TEMP%\!RecoveR!-rakex++.TXT
%HOMEPATH%\Local Settings\History\!RecoveR!-rakex++.TXT
%HOMEPATH%\Local Settings\History\!RecoveR!-rakex++.PNG
%TEMP%\!RecoveR!-rakex++.PNG
%HOMEPATH%\Local Settings\History\!RecoveR!-rakex++.HTML
<LS_APPDATA>\VMware\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Mozilla\Firefox\Profiles\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Mozilla\Firefox\Profiles\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Mozilla\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\!RecoveR!-rakex++.TXT
<LS_APPDATA>\VMware\!RecoveR!-rakex++.TXT
<LS_APPDATA>\VMware\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\Firefox\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\Firefox\Profiles\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\!RecoveR!-rakex++.TXT
%HOMEPATH%\My Documents\Downloads\!RecoveR!-rakex++.PNG
%HOMEPATH%\SendTo\!RecoveR!-rakex++.HTML
%HOMEPATH%\SendTo\!RecoveR!-rakex++.TXT
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\!RecoveR!-rakex++.TXT
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\!RecoveR!-rakex++.PNG
%HOMEPATH%\SendTo\!RecoveR!-rakex++.PNG
%HOMEPATH%\Recent\!RecoveR!-rakex++.PNG
%HOMEPATH%\PrintHood\!RecoveR!-rakex++.HTML
%HOMEPATH%\Recent\!RecoveR!-rakex++.HTML
%HOMEPATH%\Recent\!RecoveR!-rakex++.TXT
%HOMEPATH%\Start Menu\Programs\Accessories\!RecoveR!-rakex++.HTML
%HOMEPATH%\Start Menu\Programs\Accessories\!RecoveR!-rakex++.TXT
%HOMEPATH%\Start Menu\Programs\!RecoveR!-rakex++.TXT
%HOMEPATH%\Start Menu\Programs\!RecoveR!-rakex++.PNG
%HOMEPATH%\Start Menu\Programs\Accessories\!RecoveR!-rakex++.PNG
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\!RecoveR!-rakex++.PNG
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\!RecoveR!-rakex++.HTML
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\!RecoveR!-rakex++.HTML
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\!RecoveR!-rakex++.TXT
%HOMEPATH%\PrintHood\!RecoveR!-rakex++.TXT
%HOMEPATH%\My Documents\My Pictures\!RecoveR!-rakex++.TXT
%HOMEPATH%\My Documents\My Pictures\!RecoveR!-rakex++.PNG
%HOMEPATH%\My Documents\My Received Files\!RecoveR!-rakex++.PNG
%HOMEPATH%\My Documents\My Pictures\!RecoveR!-rakex++.HTML
%HOMEPATH%\My Documents\My Music\!RecoveR!-rakex++.HTML
%HOMEPATH%\My Documents\Downloads\!RecoveR!-rakex++.HTML
%HOMEPATH%\My Documents\Downloads\!RecoveR!-rakex++.TXT
%HOMEPATH%\My Documents\My Music\!RecoveR!-rakex++.TXT
%HOMEPATH%\My Documents\My Music\!RecoveR!-rakex++.PNG
%HOMEPATH%\NetHood\!RecoveR!-rakex++.TXT
%HOMEPATH%\NetHood\!RecoveR!-rakex++.PNG
%HOMEPATH%\PrintHood\!RecoveR!-rakex++.PNG
%HOMEPATH%\NetHood\!RecoveR!-rakex++.HTML
%HOMEPATH%\My Documents\!RecoveR!-rakex++.HTML
%HOMEPATH%\My Documents\My Received Files\!RecoveR!-rakex++.HTML
%HOMEPATH%\My Documents\My Received Files\!RecoveR!-rakex++.TXT
%HOMEPATH%\My Documents\!RecoveR!-rakex++.TXT
%HOMEPATH%\My Documents\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Microsoft\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Microsoft\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Microsoft\Windows Media\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Microsoft\Windows Media\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Microsoft\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Microsoft\Windows Media\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Microsoft\Windows Media\9.0\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Microsoft\Credentials\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Microsoft\Credentials\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Identities\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Identities\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Identities\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Microsoft\Windows\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Microsoft\Windows\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Microsoft\Windows Media\9.0\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Microsoft\Windows Media\9.0\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Microsoft\Windows\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Microsoft\Media Player\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Microsoft\Credentials\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Microsoft\Media Player\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Microsoft\Media Player\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\!RecoveR!-rakex++.PNG
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\!RecoveR!-rakex++.HTML
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\!RecoveR!-rakex++.TXT
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Cookies\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Application Data\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Cookies\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Cookies\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Application Data\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Application Data\Microsoft\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Application Data\Microsoft\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Application Data\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Application Data\Microsoft\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Favorites\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Favorites\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Favorites\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Local Settings\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Local Settings\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Local Settings\Application Data\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Local Settings\Application Data\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Local Settings\Application Data\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Local Settings\Temp\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Local Settings\Temp\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Local Settings\Temp\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Local Settings\History\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Local Settings\History\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Local Settings\History\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Documents\My Pictures\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\!RecoveR!-rakex++.HTML
%ALLUSERSPROFILE%\Documents\My Pictures\!RecoveR!-rakex++.HTML
%ALLUSERSPROFILE%\Documents\My Pictures\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\Documents\My Music\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\Documents\My Music\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Documents\My Music\!RecoveR!-rakex++.HTML
%ALLUSERSPROFILE%\DRM\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Documents\!RecoveR!-rakex++.HTML
%ALLUSERSPROFILE%\DRM\!RecoveR!-rakex++.HTML
%ALLUSERSPROFILE%\DRM\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\Documents\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\Documents\My Videos\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\Documents\My Videos\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Documents\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Documents\My Videos\!RecoveR!-rakex++.HTML
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\!RecoveR!-rakex++.HTML
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\!RecoveR!-rakex++.PNG
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\_ini[1].htm
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\!RecoveR!-rakex++.HTML
<Current directory>\!RecoveR!-rakex++.HTML
%HOMEPATH%\My Documents\-!recover!-!file!-.txt
%HOMEPATH%\My Documents\wlrmdr.exe
<Current directory>\!RecoveR!-rakex++.TXT
<Current directory>\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\!RecoveR!-rakex++.HTML
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\phpinc[1].htm
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\!RecoveR!-rakex++.HTML
%ALLUSERSPROFILE%\Favorites\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Start Menu\Programs\!RecoveR!-rakex++.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\Start Menu\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\Start Menu\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Start Menu\Programs\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Start Menu\Programs\Games\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\!RecoveR!-rakex++.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Games\!RecoveR!-rakex++.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Games\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\!RecoveR!-rakex++.HTML
%ALLUSERSPROFILE%\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Templates\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Start Menu\!RecoveR!-rakex++.HTML
%ALLUSERSPROFILE%\Templates\!RecoveR!-rakex++.HTML
%ALLUSERSPROFILE%\Templates\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\!RecoveR!-rakex++.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\!RecoveR!-rakex++.HTML
%ALLUSERSPROFILE%\Favorites\!RecoveR!-rakex++.HTML
%ALLUSERSPROFILE%\Favorites\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\!RecoveR!-rakex++.PNG
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\!RecoveR!-rakex++.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\!RecoveR!-rakex++.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\!RecoveR!-rakex++.HTML
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\!RecoveR!-rakex++.TXT
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Local Settings\Temp\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BGGTYMH1\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Local Settings\Temp\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Local Settings\History\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Local Settings\History\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Local Settings\Temp\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Local Settings\History\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MOE00UY1\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\LBMMC3H3\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJCTQ25G\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Cookies\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Local Settings\Application Data\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Local Settings\Application Data\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Local Settings\Application Data\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Local Settings\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Local Settings\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Local Settings\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\!RecoveR!-rakex++.PNG
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.HTML
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\!RecoveR!-rakex++.TXT
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Templates\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Start Menu\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Templates\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Templates\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Start Menu\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Start Menu\Programs\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Start Menu\Programs\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Start Menu\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Start Menu\Programs\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\NetHood\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\NetHood\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\PrintHood\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\PrintHood\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\NetHood\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\My Documents\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Local Settings\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\My Documents\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\My Documents\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\SendTo\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\SendTo\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\SendTo\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\Recent\!RecoveR!-rakex++.PNG
C:\Documents and Settings\Default User\PrintHood\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Recent\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\Recent\!RecoveR!-rakex++.TXT
C:\Documents and Settings\Default User\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Application Data\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Application Data\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Cookies\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Cookies\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Application Data\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Application Data\Microsoft\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Application Data\Microsoft\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Application Data\Microsoft\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\!RecoveR!-rakex++.HTML
C:\Documents and Settings\Default User\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\!RecoveR!-rakex++.PNG
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\!RecoveR!-rakex++.HTML
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.TXT
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\!RecoveR!-rakex++.PNG

Sets the 'hidden' attribute to the following files:

%HOMEPATH%\My Documents\wlrmdr.exe

Deletes itself.

Network activity:

Connects to:

'hy#####seyourself.co.uk':80
'la####inique.com.mx':80
'gm##ae.com':80
'www.te####rassist.info':80
'be###nghana.com':80
'fa#####ike.makkie.com':80

TCP:

HTTP POST requests:

http://hy#####seyourself.co.uk/_ini.php
http://la####inique.com.mx/_ini.php
http://gm##ae.com/phpinc.php
http://www.te####rassist.info/_ini.php
http://be###nghana.com/wp-content/plugins/_ini.php
http://fa#####ike.makkie.com/tmp/yoo_master2_j32/warp/systems/joomla/config/layouts/fields/_ini.php

UDP:

DNS ASK hy#####seyourself.co.uk
DNS ASK la####inique.com.mx
DNS ASK gm##ae.com
DNS ASK www.te####rassist.info
DNS ASK be###nghana.com
DNS ASK fa#####ike.makkie.com

Miscellaneous:

Searches for the following windows:

ClassName: 'Indicator' WindowName: ''

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial