Gen.Trojan.Heur.DqWrHOCt1pif_2306813bc2 – Adaware

UDS:DangerousObject.Multi.Generic (Kaspersky), Gen:Trojan.Heur.DqW@rHOCt1pif (B) (Emsisoft), Gen:Trojan.Heur.DqW@rHOCt1pif (AdAware), ZeroAccess.YR (Lavasoft MAS)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 2306813bc237cf7655ed3ebc0cc79b40

SHA1: 061defb8f6cfd9ec8f107eea84698dc0a48ad364

SHA256: 4b8c4b03bd78f2cc8dd00e14721e07daecfeac0994faef1a2edaf4490ce8dd72

SSDeep: 12288:udCD1uwO1QaPQQ04E4STX/DQcvPJgB15sC7Clip4gU2j0fVsVe:udCD1uw7eK4WDhLlFgU2jaVH

Size: 484864 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2015-01-06 02:36:08

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:216
%original file name%.exe:1788
%original file name%.exe:1140
%original file name%.exe:212
%original file name%.exe:1264
%original file name%.exe:132
%original file name%.exe:492
%original file name%.exe:1948
%original file name%.exe:1776
%original file name%.exe:1836
%original file name%.exe:1220
%original file name%.exe:544
%original file name%.exe:1376
%original file name%.exe:280
%original file name%.exe:548
%original file name%.exe:1916
%original file name%.exe:284
%original file name%.exe:816
%original file name%.exe:408
%original file name%.exe:716
%original file name%.exe:1156
%original file name%.exe:1152
%original file name%.exe:1620
%original file name%.exe:332
%original file name%.exe:1016
%original file name%.exe:1064
%original file name%.exe:928
%original file name%.exe:828
%original file name%.exe:296
%original file name%.exe:824
%original file name%.exe:376
%original file name%.exe:1080
%original file name%.exe:1480
%original file name%.exe:396
%original file name%.exe:268
%original file name%.exe:1716
%original file name%.exe:1520
%original file name%.exe:368
%original file name%.exe:364
%original file name%.exe:916
%original file name%.exe:1392
%original file name%.exe:1236
%original file name%.exe:1232
%original file name%.exe:1336
%original file name%.exe:304
%original file name%.exe:1252
%original file name%.exe:240
%original file name%.exe:388
%original file name%.exe:1436
%original file name%.exe:900
%original file name%.exe:1432
%original file name%.exe:1840
%original file name%.exe:788
%original file name%.exe:1648
%original file name%.exe:1240
%original file name%.exe:1244
%original file name%.exe:516
%original file name%.exe:620
%original file name%.exe:624
%original file name%.exe:1228
%original file name%.exe:1980
%original file name%.exe:1988
%original file name%.exe:652
%original file name%.exe:636
%original file name%.exe:1860
%original file name%.exe:1596
%original file name%.exe:1864
%original file name%.exe:228
%original file name%.exe:1676
%original file name%.exe:220
%original file name%.exe:868
%original file name%.exe:1992
%original file name%.exe:1996
%original file name%.exe:1028
%original file name%.exe:2024
%original file name%.exe:1104
%original file name%.exe:1672
%original file name%.exe:1452
%original file name%.exe:2012
%original file name%.exe:2028
%original file name%.exe:728
%original file name%.exe:1164
%original file name%.exe:1160
%original file name%.exe:884
%original file name%.exe:1816
%original file name%.exe:1056
%original file name%.exe:1536
%original file name%.exe:1964
%original file name%.exe:1960
%original file name%.exe:2036
%original file name%.exe:1792
%original file name%.exe:644
%original file name%.exe:1176
%original file name%.exe:1272
%original file name%.exe:616
%original file name%.exe:1052
%original file name%.exe:1276
%original file name%.exe:1888
%original file name%.exe:484
%original file name%.exe:1608
%original file name%.exe:1604
%original file name%.exe:1472
%original file name%.exe:356
%original file name%.exe:2000
%original file name%.exe:260
%original file name%.exe:352
%original file name%.exe:2004
%original file name%.exe:804
cscript.exe:1788
cscript.exe:216
cscript.exe:1140
cscript.exe:212
cscript.exe:1264
cscript.exe:132
cscript.exe:1300
cscript.exe:1948
cscript.exe:1776
cscript.exe:1836
cscript.exe:1076
cscript.exe:624
cscript.exe:1072
cscript.exe:344
cscript.exe:544
cscript.exe:1376
cscript.exe:1520
cscript.exe:1676
cscript.exe:220
cscript.exe:816
cscript.exe:408
cscript.exe:1792
cscript.exe:1156
cscript.exe:1796
cscript.exe:364
cscript.exe:1824
cscript.exe:1064
cscript.exe:928
cscript.exe:828
cscript.exe:824
cscript.exe:376
cscript.exe:1080
cscript.exe:584
cscript.exe:1920
cscript.exe:396
cscript.exe:1252
cscript.exe:1016
cscript.exe:916
cscript.exe:1392
cscript.exe:1236
cscript.exe:1336
cscript.exe:1136
cscript.exe:240
cscript.exe:388
cscript.exe:1436
cscript.exe:1432
cscript.exe:1840
cscript.exe:788
cscript.exe:1648
cscript.exe:1536
cscript.exe:1244
cscript.exe:432
cscript.exe:516
cscript.exe:1220
cscript.exe:252
cscript.exe:1632
cscript.exe:1980
cscript.exe:1988
cscript.exe:652
cscript.exe:188
cscript.exe:1036
cscript.exe:632
cscript.exe:636
cscript.exe:1860
cscript.exe:1596
cscript.exe:228
cscript.exe:780
cscript.exe:1916
cscript.exe:1992
cscript.exe:1996
cscript.exe:1028
cscript.exe:1104
cscript.exe:1672
cscript.exe:1452
cscript.exe:2012
cscript.exe:728
cscript.exe:1512
cscript.exe:1164
cscript.exe:1160
cscript.exe:884
cscript.exe:1168
cscript.exe:232
cscript.exe:1816
cscript.exe:1056
cscript.exe:1240
cscript.exe:1960
cscript.exe:2032
cscript.exe:716
cscript.exe:1176
cscript.exe:776
cscript.exe:612
cscript.exe:616
cscript.exe:1276
cscript.exe:484
cscript.exe:1976
cscript.exe:1288
cscript.exe:940
cscript.exe:1472
cscript.exe:2000
cscript.exe:476
cscript.exe:352
cscript.exe:1368
cscript.exe:804

The Trojan injects its code into the following process(es):

fGAwoYMM.exe:772
reIEcoQI.exe:556
NesIMIQs.exe:560

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process fGAwoYMM.exe:772 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp.exe (2321 bytes)
C:\totalcmd\TCUNINST.EXE.exe (3073 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe (7726 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe (3073 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe (2321 bytes)
C:\totalcmd\TOTALCMD.EXE.exe (30812 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe (2321 bytes)
C:\totalcmd\TCMADMIN.EXE.exe (3073 bytes)
C:\totalcmd\TcUsbRun.exe (3073 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\KAAo.txt (55978 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe (3073 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe (3073 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe (3361 bytes)
C:\totalcmd\TCMDX32.EXE.exe (3361 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe (3361 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe (5441 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe (7433 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe (2321 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe (2321 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp (0 bytes)
C:\totalcmd\TCUNINST.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp (0 bytes)
C:\totalcmd\TCMADMIN.EXE (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\adm.bmp (0 bytes)
%Documents and Settings%\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (0 bytes)
C:\totalcmd\TCMDX32.EXE (0 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (0 bytes)
C:\totalcmd\TOTALCMD.EXE (0 bytes)

The process %original file name%.exe:216 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\hoIEkYIc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wycsYQow.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HYIcAQYI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oOkEkAww.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vEIEQYgE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BkEoEMMs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oiQYwgAE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HQAQcUIc.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vEIEQYgE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BkEoEMMs.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oiQYwgAE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HQAQcUIc.bat (0 bytes)

The process %original file name%.exe:1788 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MeQQwwEo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dKcIgYcY.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MeQQwwEo.bat (0 bytes)

The process %original file name%.exe:1140 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PYMosgcY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pawkkYMY.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PYMosgcY.bat (0 bytes)

The process %original file name%.exe:212 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RAsQAkoA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qussMUkI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NyMAQQIQ.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZwEIsoso.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\RAsQAkoA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NyMAQQIQ.bat (0 bytes)

The process %original file name%.exe:1264 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OWUUsoco.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QuMokwgs.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\QuMokwgs.bat (0 bytes)

The process %original file name%.exe:132 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jCkAwwEs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RIEYAQcM.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jCkAwwEs.bat (0 bytes)

The process %original file name%.exe:492 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XooEMsUM.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The process %original file name%.exe:1948 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IqMgsAww.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DcIcIscw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bukgwwsY.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BcsQkUEU.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IqMgsAww.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BcsQkUEU.bat (0 bytes)

The process %original file name%.exe:1776 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\rMwEYcUI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eeYIUQYg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZKYocIws.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AywAwkoQ.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\rMwEYcUI.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eeYIUQYg.bat (0 bytes)

The process %original file name%.exe:1836 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\fKAkscsI.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rmYMUkEA.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\fKAkscsI.bat (0 bytes)

The process %original file name%.exe:1220 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IkAEUwIE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FQUQQwkY.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IkAEUwIE.bat (0 bytes)

The process %original file name%.exe:544 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\rkQUAoAs.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eEwsocMc.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eEwsocMc.bat (0 bytes)

The process %original file name%.exe:1376 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\goAsAAEw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PSEMMgsA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kikoAUsU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uWcsQAss.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PSEMMgsA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uWcsQAss.bat (0 bytes)

The process %original file name%.exe:280 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XUIAEIkY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qiEQcsQY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JMcwUkkY.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VukAwUYs.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XUIAEIkY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JMcwUkkY.bat (0 bytes)

The process %original file name%.exe:548 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\McYAswoA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GeQsUcEg.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (120 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wsQskIYk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ygUMYowU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xiMQMQUI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gmUQQYAY.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wsQskIYk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xiMQMQUI.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gmUQQYAY.bat (0 bytes)

The process %original file name%.exe:1916 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YqYIUIsc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dEkoAQMg.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YqYIUIsc.bat (0 bytes)

The process %original file name%.exe:284 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gOUQMUIE.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TGEAIYMo.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\TGEAIYMo.bat (0 bytes)

The process %original file name%.exe:816 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\HYgMkgUE.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PUMQcUkg.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\HYgMkgUE.bat (0 bytes)

The process %original file name%.exe:408 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jOgsAsUQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JIAIYgsc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KkYYUEUk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qqcoosYI.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WMYkkwUA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RScYAkAc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pIIsssgg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VoAookMI.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\WMYkkwUA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qqcoosYI.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RScYAkAc.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VoAookMI.bat (0 bytes)

The process %original file name%.exe:716 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GSMMIIwo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UyMUIogo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fmUoYsQE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CqgEgsQg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oigUcUAM.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oecIMUYI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HMYkMEoU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hAQAAUMw.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GSMMIIwo.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UyMUIogo.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CqgEgsQg.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fmUoYsQE.bat (0 bytes)

The process %original file name%.exe:1156 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xkUkoQoo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FSkwcgww.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IcosAoow.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\lyskkcQQ.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FSkwcgww.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IcosAoow.bat (0 bytes)

The process %original file name%.exe:1152 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CwckksIE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MSwAgoEQ.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CwckksIE.bat (0 bytes)

The process %original file name%.exe:1620 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cywQEoQE.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\neQkkAMo.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cywQEoQE.bat (0 bytes)

The process %original file name%.exe:332 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YOEcwYYI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dcsEYcsM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ReQIcokI.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TcgUEQws.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\dcsEYcsM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TcgUEQws.bat (0 bytes)

The process %original file name%.exe:1016 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ukwkcIMQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PyYAUAQQ.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PyYAUAQQ.bat (0 bytes)

The process %original file name%.exe:1064 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KCcgoEgQ.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HcIsoEEg.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\HcIsoEEg.bat (0 bytes)

The process %original file name%.exe:928 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EWoAQogI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OKcoAQoA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wgUcUIQI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nWEMkQcs.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\OKcoAQoA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nWEMkQcs.bat (0 bytes)

The process %original file name%.exe:828 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FWAEwIoY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JCwMokEs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xwIYwgEQ.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BeIkoggo.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xwIYwgEQ.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FWAEwIoY.bat (0 bytes)

The process %original file name%.exe:296 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AGIoEMYQ.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hUQwcwoI.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AGIoEMYQ.bat (0 bytes)

The process %original file name%.exe:824 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KyQEgcYo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qYYgwgks.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KyQEgcYo.bat (0 bytes)

The process %original file name%.exe:376 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FGUIYcgo.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XyEEQwcY.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FGUIYcgo.bat (0 bytes)

The process %original file name%.exe:1080 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xekAIgkM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qWUQoAwQ.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (120 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\riIYkwUc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XuAwwAII.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YEEcQcoU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jeEQsEgw.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xekAIgkM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\riIYkwUc.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XuAwwAII.bat (0 bytes)

The process %original file name%.exe:1480 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vkwAIsYw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pkQYQAsA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GewgAEEg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pIUkMskg.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (120 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FcoUAEIk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\luoMoAwo.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FcoUAEIk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pkQYQAsA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pIUkMskg.bat (0 bytes)

The process %original file name%.exe:396 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JYsogQYE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iSkwcYUQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JGIwMokQ.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LEsEcMkQ.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JYsogQYE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JGIwMokQ.bat (0 bytes)

The process %original file name%.exe:268 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VoQUYcEE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aqIsUoUk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rioQUUwY.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (120 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IkwUkosk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wEwwgcQE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hugwQQgU.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wEwwgcQE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aqIsUoUk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rioQUUwY.bat (0 bytes)

The process %original file name%.exe:1716 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\mMsUoEMk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gesQIQEs.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (120 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FcIYokYE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\heoUsIIU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sIsQAkAs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ReQkEkoc.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\heoUsIIU.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sIsQAkAs.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mMsUoEMk.bat (0 bytes)

The process %original file name%.exe:1520 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\YkAMowko.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VoEIQooY.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VoEIQooY.bat (0 bytes)

The process %original file name%.exe:368 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KqAkwkQE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MycMUcEs.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MycMUcEs.bat (0 bytes)

The process %original file name%.exe:364 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KMgsQYMc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JcwQEgMI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WQcYwAYQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iyckwoUY.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (120 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XeMkEogA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TuEksMss.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XeMkEogA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TuEksMss.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WQcYwAYQ.bat (0 bytes)

The process %original file name%.exe:916 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\yykMIcQQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DCoUMoMY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sWYUMUQw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HGMooMQY.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DCoUMoMY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sWYUMUQw.bat (0 bytes)

The process %original file name%.exe:1392 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lSYUEcEE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uMIEgscc.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lSYUEcEE.bat (0 bytes)

The process %original file name%.exe:1236 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VaYEgYAw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LiAYggcA.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LiAYggcA.bat (0 bytes)

The process %original file name%.exe:1232 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\hysoMkEU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PiIIsYMA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JMMcIwkQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gmEMEsMM.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ciYQIAUo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yowMIEYk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uQcsccYk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wuQoYMQI.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ciYQIAUo.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JMMcIwkQ.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wuQoYMQI.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uQcsccYk.bat (0 bytes)

The process %original file name%.exe:1336 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PagowEkw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bOQIUMQk.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GiEgIUsY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fOAYoYMo.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PagowEkw.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GiEgIUsY.bat (0 bytes)

The process %original file name%.exe:304 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\iKcYYIYM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xagcMYQk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ogkIwEww.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hwcwowkE.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\iKcYYIYM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hwcwowkE.bat (0 bytes)

The process %original file name%.exe:1252 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Rcgkwcso.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xqYgsEIM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RAQwAMkA.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jyMMwYEA.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Rcgkwcso.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jyMMwYEA.bat (0 bytes)

The process %original file name%.exe:240 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\oqcwQAcM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JuwYIYog.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IIIkcMoY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\HWEMIQso.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JuwYIYog.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IIIkcMoY.bat (0 bytes)

The process %original file name%.exe:388 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ueUMwMQw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yocskgkU.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ueUMwMQw.bat (0 bytes)

The process %original file name%.exe:1436 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xiwMUwQE.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NMIEccIk.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\NMIEccIk.bat (0 bytes)

The process %original file name%.exe:900 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xSgMgYgc.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TsAsAggU.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\xSgMgYgc.bat (0 bytes)

The process %original file name%.exe:1432 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CCwcssgw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cGsoAMos.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GiwAUIUs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mqssEMMI.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CCwcssgw.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mqssEMMI.bat (0 bytes)

The process %original file name%.exe:1840 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\eosYAEUU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FgksMgsw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SmkkUcgA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PIAcMoEw.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FgksMgsw.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SmkkUcgA.bat (0 bytes)

The process %original file name%.exe:788 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CmMcgwoM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NigccAQQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JoIMwgMQ.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (120 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qWwkQAEY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TSsEYkMQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\muwgcQsg.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CmMcgwoM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JoIMwgMQ.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TSsEYkMQ.bat (0 bytes)

The process %original file name%.exe:1648 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EOkUsocg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xYcMwgME.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GGgIEEkw.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XIEcwkwE.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EOkUsocg.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\GGgIEEkw.bat (0 bytes)

The process %original file name%.exe:1240 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zoskEgUE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EUAcEkAw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AKskwIkM.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JcckccAY.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\zoskEgUE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AKskwIkM.bat (0 bytes)

The process %original file name%.exe:1244 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FcIEEEQk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\keQcwQwc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\reYEkcEs.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fiIkgAgM.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\FcIEEEQk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\keQcwQwc.bat (0 bytes)

The process %original file name%.exe:516 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XwYQAAoA.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rGQEIAgs.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XwYQAAoA.bat (0 bytes)

The process %original file name%.exe:620 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\JuwEIgUE\reIEcoQI.exe (3849 bytes)
%Documents and Settings%\%current user%\dUskcAww\fGAwoYMM.exe (3681 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\swcoMkgc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JaoMIIAs.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\All Users\hcYYccwo\NesIMIQs.exe (3729 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JaoMIIAs.bat (0 bytes)

The process %original file name%.exe:624 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jKgcQkMI.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PecAEscg.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PecAEscg.bat (0 bytes)

The process %original file name%.exe:1228 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aeEocYcA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hGIAUUgA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tkoUsQcs.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DkUcwwws.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aeEocYcA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DkUcwwws.bat (0 bytes)

The process %original file name%.exe:1980 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lCooQoIk.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\vsEgMgcc.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vsEgMgcc.bat (0 bytes)

The process %original file name%.exe:1988 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\buYcAQEQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fkAksQoY.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\buYcAQEQ.bat (0 bytes)

The process %original file name%.exe:652 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GEEYYooc.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ByYwEQYk.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GEEYYooc.bat (0 bytes)

The process %original file name%.exe:636 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\hqQIIwQU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PuAsoIgM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LqcQAQMM.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RMAkkUkI.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\LqcQAQMM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hqQIIwQU.bat (0 bytes)

The process %original file name%.exe:1860 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qQQYYEAo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DYQQkwUQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rWQAwMsI.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JOkcAMAQ.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qQQYYEAo.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JOkcAMAQ.bat (0 bytes)

The process %original file name%.exe:1596 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\tmIsQwcI.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\myokMoYM.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\myokMoYM.bat (0 bytes)

The process %original file name%.exe:1864 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pEsgkQkg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cYMEIUcs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OkkIEYUw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\geUQMUgo.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cYMEIUcs.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OkkIEYUw.bat (0 bytes)

The process %original file name%.exe:228 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lWokYEUY.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (120 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CYggkQQA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\moAoQQgQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DIIkUsEU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cWsgwIgU.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zYcEwAMo.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DIIkUsEU.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cWsgwIgU.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\zYcEwAMo.bat (0 bytes)

The process %original file name%.exe:1676 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\yAYMwIUc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DQgcEUgs.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DQgcEUgs.bat (0 bytes)

The process %original file name%.exe:220 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VIQUwIYY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NqYkUUsM.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uoMkIUME.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hWwYEIkI.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cuIsUIws.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UOMwsQYA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\BGIQMoMo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WQUIwgAY.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uoMkIUME.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hWwYEIkI.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VIQUwIYY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cuIsUIws.bat (0 bytes)

The process %original file name%.exe:868 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\NkwAwYQE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wmkooIIE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UsUcgsQo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LcAAsIsk.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MsUQcMgQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CuMkIgcU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\eysoEMUw.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ciEYoUws.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WGEMooIs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SkkEMYkc.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MsUQcMgQ.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LcAAsIsk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wmkooIIE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WGEMooIs.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SkkEMYkc.bat (0 bytes)

The process %original file name%.exe:1992 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AUoAcEss.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CqssYIQU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kEAAsggk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\roQUEQIk.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\roQUEQIk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kEAAsggk.bat (0 bytes)

The process %original file name%.exe:1996 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UqkoQsss.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\guEMkwAw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\voIIoogY.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\veMUcAoA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pgEgEogk.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UIEcEcsE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\WMIkUUMI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\heccSowR.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PgUYEwAM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yGgIoAMY.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\guEMkwAw.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\yGgIoAMY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PgUYEwAM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\voIIoogY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UqkoQsss.bat (0 bytes)

The process %original file name%.exe:1028 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\mgsgAcUY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MSEYIYUA.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\mgsgAcUY.bat (0 bytes)

The process %original file name%.exe:2024 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wMcUkEQE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UckgQUgU.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UckgQUgU.bat (0 bytes)

The process %original file name%.exe:1104 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\mmYQcIAE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZoIkMUQQ.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IgsAwooE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dukEQYUE.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\mmYQcIAE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IgsAwooE.bat (0 bytes)

The process %original file name%.exe:1672 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DkMUUkYk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\wyskIYkw.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DkMUUkYk.bat (0 bytes)

The process %original file name%.exe:1452 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MgUEsgEo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\quMsQsAQ.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uSMUEgYA.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FiQgswIs.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MgUEsgEo.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FiQgswIs.bat (0 bytes)

The process %original file name%.exe:2012 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\MAkoAoAI.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (120 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jYIEEocg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PqocAQww.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CukQUEgA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RAsoAMIY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cEYMEwwA.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CukQUEgA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PqocAQww.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\MAkoAoAI.bat (0 bytes)

The process %original file name%.exe:2028 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jyYowsAw.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NiMUIUEc.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\NiMUIUEc.bat (0 bytes)

The process %original file name%.exe:728 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gUYskwoE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TckYUckQ.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gUYskwoE.bat (0 bytes)

The process %original file name%.exe:1164 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CkgkQAoE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FGkEIwYc.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CkgkQAoE.bat (0 bytes)

The process %original file name%.exe:1160 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CCckQAEM.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QWEQcgwE.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TasoQwAE.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bmscYwAs.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\CCckQAEM.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TasoQwAE.bat (0 bytes)

The process %original file name%.exe:884 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\okswAEEU.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\DmoUwAsY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nWYgIscM.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RkUsEEAg.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DmoUwAsY.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RkUsEEAg.bat (0 bytes)

The process %original file name%.exe:1816 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JEwkEMsw.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ZSMMgAAM.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JEwkEMsw.bat (0 bytes)

The process %original file name%.exe:1056 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vgIwIcEg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uKggogMM.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uKggogMM.bat (0 bytes)

The process %original file name%.exe:1536 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SCggQwMg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XiwkUMYk.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SCggQwMg.bat (0 bytes)

The process %original file name%.exe:1964 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VaoUwUgk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kckkYAIs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OawQcAoU.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (120 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\XsoUkIck.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\oiwIgAsM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\locowwYc.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VaoUwUgk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OawQcAoU.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\locowwYc.bat (0 bytes)

The process %original file name%.exe:1960 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kOgwkcAA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gQoscYIE.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gQoscYIE.bat (0 bytes)

The process %original file name%.exe:2036 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kGEAIgkY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\AGUkAsMY.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kGEAIgkY.bat (0 bytes)

The process %original file name%.exe:1792 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SAMkogoo.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\NkQUQggU.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\NkQUQggU.bat (0 bytes)

The process %original file name%.exe:644 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aUAgcAwo.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bEkEgIAo.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xgUkwMcw.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pSYskgQA.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\bEkEgIAo.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pSYskgQA.bat (0 bytes)

The process %original file name%.exe:1176 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ToUEQEAY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\IyYMgwAA.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\IyYMgwAA.bat (0 bytes)

The process %original file name%.exe:1272 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AUsAkoEA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aKoUMQEI.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CqYkUwAA.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hWIksAcs.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\AUsAkoEA.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\CqYkUwAA.bat (0 bytes)

The process %original file name%.exe:616 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\EWgcgIgI.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LukgsQAc.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KkosYYkE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FKYoYEUs.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KkosYYkE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\LukgsQAc.bat (0 bytes)

The process %original file name%.exe:1052 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\GkwwUMYg.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\faAQsIAQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\EqcgkIMs.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JyYoYQII.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\faAQsIAQ.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JyYoYQII.bat (0 bytes)

The process %original file name%.exe:1276 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DuUEkQMY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jEMMcwwU.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QEYgEgAs.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\bKsIgccs.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jEMMcwwU.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\QEYgEgAs.bat (0 bytes)

The process %original file name%.exe:1888 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\sqoMkgIE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uGEgYwcg.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\sqoMkgIE.bat (0 bytes)

The process %original file name%.exe:484 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kKcgEMQA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\YQEgYowM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gyMwYMgk.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VIgwcYIc.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (80 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\gyMwYMgk.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VIgwcYIc.bat (0 bytes)

The process %original file name%.exe:1608 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\wqMUAAMc.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ywEAAQgM.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ywEAAQgM.bat (0 bytes)

The process %original file name%.exe:1604 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\leEkwgks.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qUgIkcgM.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\sMIsksIs.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nukMYMYg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KcYAMokE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\RqkkgQEs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\McYAUMEE.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\tQIggUkA.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nukMYMYg.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\McYAUMEE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KcYAMokE.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\leEkwgks.bat (0 bytes)

The process %original file name%.exe:1472 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lGssYIsg.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SOgsQoYQ.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pMQEwEIs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\iSAYwwQI.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (120 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\hqckckAY.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UIwMEEsw.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\lGssYIsg.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UIwMEEsw.bat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SOgsQoYQ.bat (0 bytes)

The process %original file name%.exe:356 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XKEIMckw.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\leQYMIEY.bat (112 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\XKEIMckw.bat (0 bytes)

The process %original file name%.exe:2000 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nuEggAsU.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JGkwYQYY.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\JGkwYQYY.bat (0 bytes)

The process %original file name%.exe:260 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\ssYYYcMs.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\VmMwsAwI.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\VmMwsAwI.bat (0 bytes)

The process %original file name%.exe:352 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uGcwoEQA.bat (112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rgIUggwE.bat (4 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\rgIUggwE.bat (0 bytes)

The process %original file name%.exe:2004 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cykYAckU.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qaooUIIo.bat (4 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\qaooUIIo.bat (0 bytes)

The process %original file name%.exe:804 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vqoEgUUY.bat (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\mSwUAIkc.bat (112 bytes)
C:\2306813bc237cf7655ed3ebc0cc79b40 (40 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\vqoEgUUY.bat (0 bytes)

Registry activity

The process fGAwoYMM.exe:772 makes changes in the system registry.