Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '<SYSTEM32>\3PLANE~1.SCR'
Malicious functions:
Executes the following:
- '<SYSTEM32>\3Planesoft\Screensaver Manager\Configurator.exe'
- '%TEMP%\is-IT4IN.tmp\screensavermanager.tmp' /SL5="$10140,1884149,53248,%TEMP%\is-8R4FD.tmp\screensavermanager.exe" /VERYSILENT /LANG=en
- '<SYSTEM32>\taskkill.exe' /F /IM 3Planesoft_Screensaver_Manager.scr /T
- '<SYSTEM32>\3Planesoft_Screensaver_Manager.scr' /c
- '%TEMP%\RarSFX0\ring.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- '%TEMP%\7ZipSfx.000\x86-x64.exe' /s
- '%TEMP%\is-8R4FD.tmp\screensavermanager.exe' /VERYSILENT /LANG=en
- '%TEMP%\is-BSAO0.tmp\ring.tmp' /SL5="$10108,3391414,74240,%TEMP%\RarSFX0\ring.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
Modifies file system:
Creates the following files:
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9DR59.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-1MFHQ.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-TE8MM.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JRJM7.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9HJT2.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JAL9N.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-5QNJ8.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-HIEEE.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-QU1D4.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-T1O73.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GO374.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-NCOD0.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-0GR1C.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-ESHDB.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-1EUBD.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9RP6L.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2J8J1.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-SJS01.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-J5M28.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-J7MGS.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GINB4.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-F9IHK.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-065D9.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-KSGUA.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-RMQFA.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-5ATBI.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-1J6GV.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-I26CT.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-EMCT5.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-5TT9O.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-NPUC8.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-TCDB6.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-N1I62.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-TR8T4.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-DK6R6.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-L1EUT.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-ICELO.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-AFKDQ.tmp
- %ProgramFiles%\3Planesoft Screensaver Manager\unins000.dat
- <SYSTEM32>\ScreensaverManager.log
- %TEMP%\~DFC2EA.tmp
- %HOMEPATH%\Desktop\3Planesoft Screensaver Manager.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\Screensaver Manager\Open 3Planesoft Screensaver Manager.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\Screensaver Manager\License.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\Screensaver Manager\Uninstall 3Planesoft Screensaver Manager.lnk
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-THO42.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-PROMI.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-74846.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-M0A3K.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-S0UUK.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GA989.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-P62TP.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-PNRUK.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2N9HF.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-0SIFH.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-4NMF3.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-DO5PT.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-968I3.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-V2UVN.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-VEC11.tmp
- %TEMP%\is-IT4IN.tmp\screensavermanager.tmp
- %TEMP%\is-NA1JU.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-NA1JU.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-8R4FD.tmp\screensavermanager.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\The One Ring 3D Screensaver\License.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\The One Ring 3D Screensaver\Uninstall The One Ring 3D Screensaver.lnk
- %ProgramFiles%\The One Ring 3D Screensaver\unins000.dat
- %ProgramFiles%\3Planesoft Screensaver Manager\is-OL97I.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\is-9B18T.tmp
- <SYSTEM32>\is-P6VH0.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-P6FJL.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\is-3SO1U.tmp
- <SYSTEM32>\is-LTO21.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\is-TPLVH.tmp
- %ProgramFiles%\3Planesoft Screensaver Manager\is-HUMHD.tmp
- %TEMP%\is-8R4FD.tmp\_isetup\_shfoldr.dll
- %ProgramFiles%\The One Ring 3D Screensaver\is-4HMOH.tmp
- %ProgramFiles%\The One Ring 3D Screensaver\is-L67SA.tmp
- %TEMP%\is-8R4FD.tmp\_isetup\_RegDLL.tmp
- %TEMP%\7ZipSfx.000\x86-x64.exe
- %TEMP%\RarSFX0\ring.exe
- %TEMP%\is-BSAO0.tmp\ring.tmp
- <SYSTEM32>\is-MTHUG.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\The One Ring 3D Screensaver\Take a look at more 3D screensavers from 3Planesoft.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\The One Ring 3D Screensaver\Open The One Ring 3D Screensaver.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\3Planesoft\The One Ring 3D Screensaver\The One Ring 3D Screensaver on the Web.lnk
- <SYSTEM32>\is-VJRMG.tmp
- <SYSTEM32>\is-VSILN.tmp
- %ProgramFiles%\The One Ring 3D Screensaver\is-D0670.tmp
- %ProgramFiles%\The One Ring 3D Screensaver\is-H1VFN.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-OJ43J.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-FNRMR.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JLIJE.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-M6JIP.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-UIPR8.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-Q0768.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-CA5TF.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-PCHFM.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GC53P.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2Q4LP.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-1OJ43.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-G3V4Q.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-U0HV5.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9KQNP.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-FUEB2.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-70O2U.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-1QN3S.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-BLP5O.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JB3OD.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-39445.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-3R76U.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-U6D65.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-80E1E.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-NUFD8.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-KUBDC.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-P8T3A.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-K4RKF.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-E0J72.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-HR5BE.tmp
- <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-6H1AI.tmp
Deletes the following files:
- %TEMP%\is-8R4FD.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-8R4FD.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-BSAO0.tmp\ring.tmp
- %TEMP%\is-8R4FD.tmp\screensavermanager.exe
- %TEMP%\is-NA1JU.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-NA1JU.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-IT4IN.tmp\screensavermanager.tmp
Moves the following files:
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9DR59.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fireside_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-1MFHQ.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\valentine.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-TE8MM.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\valentine_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JAL9N.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\iceclock.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-5QNJ8.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\iceclock_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JRJM7.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fireside.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-1EUBD.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\waterfall_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-NCOD0.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\deepspace.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-QU1D4.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\deepspace_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-HIEEE.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\koifish.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-0GR1C.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\koifish_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-ESHDB.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\waterfall.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-065D9.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\earth_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-I26CT.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\coralclock.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-EMCT5.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\coralclock_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9RP6L.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\tower.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2J8J1.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\tower_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-SJS01.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\earth.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-RMQFA.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\cuckooclock_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-5ATBI.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\lagoon.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9HJT2.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\lagoon_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-5TT9O.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\columbus.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-1J6GV.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\columbus_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-KSGUA.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\cuckooclock.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-T1O73.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\waterclock.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-4NMF3.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\dutchwindmills.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-DK6R6.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\dutchwindmills_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-L1EUT.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\hauntedhouse.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-DO5PT.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\coralreef_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2N9HF.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\lighthousepoint.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-0SIFH.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\lighthousepoint_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-TCDB6.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\snowvillage.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-N1I62.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\snowvillage_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-AFKDQ.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\updates.xml
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-ICELO.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\hauntedhouse_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-TR8T4.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\crystalfireplace.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-NPUC8.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\crystalfireplace_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-P62TP.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\railway.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-M0A3K.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\railway_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-THO42.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\bells.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GO374.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\waterclock_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-S0UUK.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\koipond.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GA989.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\koipond_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-968I3.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\zodiacclock.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-V2UVN.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\zodiacclock_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-VEC11.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\coralreef.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-PROMI.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\bells_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-74846.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\sweethearts.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-PNRUK.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\sweethearts_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-39445.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\sofire.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-3R76U.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\sof_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-U6D65.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fmoon.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\is-9B18T.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Configurator.exe
- from <SYSTEM32>\is-P6VH0.tmp to <SYSTEM32>\ScreensaverManager.log
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-P6FJL.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\screensavers.xml
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-BLP5O.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\watermill.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-80E1E.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\watermill_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-E0J72.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\nautilus.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JB3OD.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fmoon_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-70O2U.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\galleon.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-1QN3S.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\galleon_screen.jpg
- from <SYSTEM32>\is-VSILN.tmp to <SYSTEM32>\The One Ring 3D Screensaver.exe
- from %ProgramFiles%\The One Ring 3D Screensaver\is-D0670.tmp to %ProgramFiles%\The One Ring 3D Screensaver\The screensaver on the Web.url
- from %ProgramFiles%\The One Ring 3D Screensaver\is-H1VFN.tmp to %ProgramFiles%\The One Ring 3D Screensaver\license.txt
- from %ProgramFiles%\The One Ring 3D Screensaver\is-4HMOH.tmp to %ProgramFiles%\The One Ring 3D Screensaver\unins000.exe
- from %ProgramFiles%\The One Ring 3D Screensaver\is-L67SA.tmp to %ProgramFiles%\The One Ring 3D Screensaver\Take a look at more 3D screensavers from 3Planesoft.url
- from <SYSTEM32>\is-MTHUG.tmp to <SYSTEM32>\The_One_Ring_3D_Screensaver.scr
- from <SYSTEM32>\3Planesoft\Screensaver Manager\is-TPLVH.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Screensavers Updater.exe
- from %ProgramFiles%\3Planesoft Screensaver Manager\is-HUMHD.tmp to %ProgramFiles%\3Planesoft Screensaver Manager\license.txt
- from <SYSTEM32>\3Planesoft\Screensaver Manager\is-3SO1U.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Help.chm
- from <SYSTEM32>\is-VJRMG.tmp to <SYSTEM32>\The One Ring.log
- from %ProgramFiles%\3Planesoft Screensaver Manager\is-OL97I.tmp to %ProgramFiles%\3Planesoft Screensaver Manager\unins000.exe
- from <SYSTEM32>\is-LTO21.tmp to <SYSTEM32>\3Planesoft_Screensaver_Manager.scr
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-HR5BE.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\nautilus_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-FUEB2.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\clock_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-G3V4Q.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\flag.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GC53P.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\flag_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-PCHFM.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\nature.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-U0HV5.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\nature_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-9KQNP.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\clock.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-GINB4.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fish_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-F9IHK.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fireplace.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-J5M28.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fireplace_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-2Q4LP.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\watch.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-1OJ43.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\watch_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-J7MGS.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\fish.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-KUBDC.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\castle_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-P8T3A.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\halloween.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-UIPR8.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\halloween_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-6H1AI.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\discovery.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-K4RKF.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\discovery_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-NUFD8.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\castle.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-OJ43J.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\lantern_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-FNRMR.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\theonering.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-JLIJE.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\ring_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-Q0768.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\christmas.ico
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-CA5TF.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\christmas_screen.jpg
- from <SYSTEM32>\3Planesoft\Screensaver Manager\Data\is-M6JIP.tmp to <SYSTEM32>\3Planesoft\Screensaver Manager\Data\lantern.ico
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'Display Properties'
- ClassName: '' WindowName: 'Screen Saver Settings'
- ClassName: '' WindowName: '3Planesoft Screensaver Manager'
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
