Technical Information
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Okl' = '<Full path to virus>'
- <SYSTEM32>\dllcache\wordpad.exe with <SYSTEM32>\dllcache\wordpad.exe.new
- <SYSTEM32>\dllcache\dialer.exe with <SYSTEM32>\dllcache\dialer.exe.new
- <SYSTEM32>\dllcache\pinball.exe with <SYSTEM32>\dllcache\pinball.exe.new
- %WINDIR%\NOTEPAD.EXE with %WINDIR%\notepad.exe.new
- %WINDIR%\hh.exe with %WINDIR%\hh.exe.new
- <SYSTEM32>\dllcache\wmplayer.exe with <SYSTEM32>\dllcache\wmplayer.exe.new
- <SYSTEM32>\dllcache\wabmig.exe with <SYSTEM32>\dllcache\wabmig.exe.new
- <SYSTEM32>\dllcache\wab.exe with <SYSTEM32>\dllcache\wab.exe.new
- <SYSTEM32>\dllcache\migrate.exe with <SYSTEM32>\dllcache\migrate.exe.new
- <SYSTEM32>\dllcache\setup_wm.exe with <SYSTEM32>\dllcache\setup_wm.exe.new
- <SYSTEM32>\dllcache\mplayer2.exe with <SYSTEM32>\dllcache\mplayer2.exe.new
- %WINDIR%\regedit.exe with %WINDIR%\regedit.exe.new
- <SYSTEM32>\dllcache\twunk_32.exe with <SYSTEM32>\dllcache\twunk_32.exe.new
- <SYSTEM32>\dllcache\taskman.exe with <SYSTEM32>\dllcache\taskman.exe.new
- <SYSTEM32>\dllcache\winhlp32.exe with <SYSTEM32>\dllcache\winhlp32.exe.new
- %WINDIR%\inf\unregmp2.exe with %WINDIR%\inf\unregmp2.exe.new
- %WINDIR%\Help\Tours\mmTour\tour.exe with %WINDIR%\Help\Tours\mmTour\tour.exe.new
- <SYSTEM32>\dllcache\regedit.exe with <SYSTEM32>\dllcache\regedit.exe.new
- %WINDIR%\twunk_32.exe with %WINDIR%\twunk_32.exe.new
- %WINDIR%\TASKMAN.EXE with %WINDIR%\taskman.exe.new
- %WINDIR%\winhlp32.exe with %WINDIR%\winhlp32.exe.new
- <SYSTEM32>\dllcache\notepad.exe with <SYSTEM32>\dllcache\notepad.exe.new
- <SYSTEM32>\dllcache\hh.exe with <SYSTEM32>\dllcache\hh.exe.new
- <SYSTEM32>\dllcache\icwtutor.exe with <SYSTEM32>\dllcache\icwtutor.exe.new
- <SYSTEM32>\dllcache\icwrmind.exe with <SYSTEM32>\dllcache\icwrmind.exe.new
- <SYSTEM32>\dllcache\inetwiz.exe with <SYSTEM32>\dllcache\inetwiz.exe.new
- <SYSTEM32>\dllcache\moviemk.exe with <SYSTEM32>\dllcache\moviemk.exe.new
- <SYSTEM32>\dllcache\isignup.exe with <SYSTEM32>\dllcache\isignup.exe.new
- <SYSTEM32>\dllcache\icwconn2.exe with <SYSTEM32>\dllcache\icwconn2.exe.new
- <SYSTEM32>\dllcache\sapisvr.exe with <SYSTEM32>\dllcache\sapisvr.exe.new
- <SYSTEM32>\dllcache\msinfo32.exe with <SYSTEM32>\dllcache\msinfo32.exe.new
- <SYSTEM32>\dllcache\iedw.exe with <SYSTEM32>\dllcache\iedw.exe.new
- <SYSTEM32>\dllcache\icwconn1.exe with <SYSTEM32>\dllcache\icwconn1.exe.new
- <SYSTEM32>\dllcache\iexplore.exe with <SYSTEM32>\dllcache\iexplore.exe.new
- <SYSTEM32>\dllcache\bckgzm.exe with <SYSTEM32>\dllcache\bckgzm.exe.new
- <SYSTEM32>\dllcache\wb32.exe with <SYSTEM32>\dllcache\wb32.exe.new
- <SYSTEM32>\dllcache\conf.exe with <SYSTEM32>\dllcache\conf.exe.new
- <SYSTEM32>\dllcache\msimn.exe with <SYSTEM32>\dllcache\msimn.exe.new
- <SYSTEM32>\dllcache\setup50.exe with <SYSTEM32>\dllcache\setup50.exe.new
- <SYSTEM32>\dllcache\oemig50.exe with <SYSTEM32>\dllcache\oemig50.exe.new
- <SYSTEM32>\dllcache\cb32.exe with <SYSTEM32>\dllcache\cb32.exe.new
- <SYSTEM32>\dllcache\hrtzzm.exe with <SYSTEM32>\dllcache\hrtzzm.exe.new
- <SYSTEM32>\dllcache\chkrzm.exe with <SYSTEM32>\dllcache\chkrzm.exe.new
- <SYSTEM32>\dllcache\rvsezm.exe with <SYSTEM32>\dllcache\rvsezm.exe.new
- <SYSTEM32>\dllcache\zclientm.exe with <SYSTEM32>\dllcache\zclientm.exe.new
- <SYSTEM32>\dllcache\shvlzm.exe with <SYSTEM32>\dllcache\shvlzm.exe.new
- <SYSTEM32>\dllcache\migrate.exe.new
- <SYSTEM32>\dllcache\wabmig.exe.new
- <SYSTEM32>\dllcache\setup_wm.exe.new
- <SYSTEM32>\dllcache\mplayer2.exe.new
- <SYSTEM32>\dllcache\wab.exe.new
- <SYSTEM32>\dllcache\msimn.exe.new
- <SYSTEM32>\dllcache\wb32.exe.new
- <SYSTEM32>\dllcache\setup50.exe.new
- <SYSTEM32>\dllcache\oemig50.exe.new
- <SYSTEM32>\dllcache\wmplayer.exe.new
- <SYSTEM32>\dllcache\taskman.exe.new
- <SYSTEM32>\dllcache\regedit.exe.new
- <SYSTEM32>\dllcache\winhlp32.exe.new
- <SYSTEM32>\dllcache\twunk_32.exe.new
- <SYSTEM32>\dllcache\notepad.exe.new
- <SYSTEM32>\dllcache\wordpad.exe.new
- <SYSTEM32>\dllcache\dialer.exe.new
- <SYSTEM32>\dllcache\hh.exe.new
- <SYSTEM32>\dllcache\pinball.exe.new
- <SYSTEM32>\dllcache\icwrmind.exe.new
- <SYSTEM32>\dllcache\icwconn2.exe.new
- <SYSTEM32>\dllcache\inetwiz.exe.new
- <SYSTEM32>\dllcache\icwtutor.exe.new
- <SYSTEM32>\dllcache\icwconn1.exe.new
- <SYSTEM32>\dllcache\sapisvr.exe.new
- <SYSTEM32>\dllcache\msinfo32.exe.new
- <SYSTEM32>\dllcache\iexplore.exe.new
- <SYSTEM32>\dllcache\iedw.exe.new
- <SYSTEM32>\dllcache\isignup.exe.new
- <SYSTEM32>\dllcache\zclientm.exe.new
- <SYSTEM32>\dllcache\shvlzm.exe.new
- <SYSTEM32>\dllcache\conf.exe.new
- <SYSTEM32>\dllcache\cb32.exe.new
- <SYSTEM32>\dllcache\rvsezm.exe.new
- <SYSTEM32>\dllcache\bckgzm.exe.new
- <SYSTEM32>\dllcache\moviemk.exe.new
- <SYSTEM32>\dllcache\hrtzzm.exe.new
- <SYSTEM32>\dllcache\chkrzm.exe.new
- %TEMP%\38696.dmp
- %TEMP%\dw.log
- %WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg
- %WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg
- %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big.jpg
- %WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg
- %WINDIR%\Help\Tours\htmlTour\question_icon.jpg
- %WINDIR%\Help\Tours\htmlTour\pen_icon.jpg
- %WINDIR%\Help\Tours\htmlTour\safe_easy_better.jpg
- %WINDIR%\Help\Tours\htmlTour\read_icon.jpg
- %WINDIR%\Help\Tours\htmlTour\taskbar_up.jpg
- %WINDIR%\Help\Tours\htmlTour\start_up.jpg
- %WINDIR%\Help\Tours\htmlTour\unlock_built.jpg
- %WINDIR%\Help\Tours\htmlTour\ul_logo.jpg
- %WINDIR%\Help\Tours\htmlTour\safe_easy_faster.jpg
- %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg
- %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg
- %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg
- %WINDIR%\Help\Tours\htmlTour\logo.jpg
- %WINDIR%\Help\Tours\htmlTour\img100.jpg
- %WINDIR%\Help\Tours\htmlTour\img089.jpg
- %WINDIR%\Help\Tours\htmlTour\img109.jpg
- %WINDIR%\Help\Tours\htmlTour\img103.jpg
- %WINDIR%\Help\Tours\htmlTour\img068.jpg
- %WINDIR%\Help\Tours\htmlTour\img060.jpg
- %WINDIR%\Help\Tours\htmlTour\img074a.jpg
- %WINDIR%\Help\Tours\htmlTour\img072.jpg
- %WINDIR%\Help\Tours\htmlTour\img136.jpg
- %WINDIR%\Help\Tours\htmlTour\img126.jpg
- %WINDIR%\Help\Tours\htmlTour\intro_logo.jpg
- %WINDIR%\Help\Tours\htmlTour\img149.jpg
- %WINDIR%\Help\Tours\htmlTour\img116.jpg
- %WINDIR%\Help\Tours\htmlTour\img110.jpg
- %WINDIR%\Help\Tours\htmlTour\img123.jpg
- %WINDIR%\Help\Tours\htmlTour\img121.jpg
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg
- %WINDIR%\inf\unregmp2.exe
- %WINDIR%\Help\Tours\mmTour\tour.exe
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
- %WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\Microsoft.Workflow.Compiler.exe
- %WINDIR%\pchealth\helpctr\System\DVDUpgrd\stripe.jpg
- <SYSTEM32>\MsDtc\Trace\msdtcvtr.bat
- %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\greendot.jpg
- %WINDIR%\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\XPSViewer_X86.exe
- %WINDIR%\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\PresentationHost_X86.exe
- %WINDIR%\Microsoft.NET\NETFXRepair.exe
- %WINDIR%\Installer\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}\places.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg
- %WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg
- %WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg
- %WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg
- %WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg
- %WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg
- %WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg
- %WINDIR%\Help\Tours\htmlTour\unlock_optimized_big.jpg
- %WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
- %WINDIR%\assembly\NativeImages_v4.0.30319_32\dfsvc\b9b6069e6da06eb57e89cc544397f735\dfsvc.ni.exe
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
- %WINDIR%\ocx\_reg_all.bat
- %WINDIR%\Help\Tours\htmlTour\window_up.jpg
- %WINDIR%\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\51819c709096229ee187a7feee395d9f\ComSvcConfig.ni.exe
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\WsatConfig\7d2a3adbdcb675f872eb2dbf21f73596\WsatConfig.ni.exe
- %WINDIR%\Help\Tours\htmlTour\img046.jpg
- %WINDIR%\Santa Fe Stucco.bmp
- %WINDIR%\River Sumida.bmp
- %WINDIR%\Zapotec.bmp
- %WINDIR%\Soap Bubbles.bmp
- %WINDIR%\Greenstone.bmp
- %WINDIR%\Gone Fishing.bmp
- %WINDIR%\Rhododendron.bmp
- %WINDIR%\Prairie Wind.bmp
- %WINDIR%\Help\Tours\htmlTour\best_road.jpg
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\9469981a17c01dd154c540127e678b35\PresentationFontCache.ni.exe
- %WINDIR%\Help\Tours\htmlTour\best_road_big.jpg
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\6781b87c8d3b55e6120b1e86bea6e040\ServiceModelReg.ni.exe
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\19b50dd470540911fc5cc65331a769e4\ComSvcConfig.ni.exe
- %WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\MSBuild\87c84ffaaad81d8d106a9aa9d68b5926\MSBuild.ni.exe
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\dfsvc\a2865dcec9c5d3cc9c55f026cbad6fcc\dfsvc.ni.exe
- %WINDIR%\FeatherTexture.bmp
- %WINDIR%\sleep.exe
- %WINDIR%\sfk.exe
- %WINDIR%\twunk_16.exe
- %WINDIR%\TASKMAN.EXE
- %WINDIR%\hh.exe
- %WINDIR%\explorer.exe
- %WINDIR%\regedit.exe
- %WINDIR%\NOTEPAD.EXE
- %WINDIR%\$NtUninstallWIC$\spuninst\spuninst.exe
- %WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.exe
- %WINDIR%\Coffee Bean.bmp
- %WINDIR%\Blue Lace 16.bmp
- %WINDIR%\winhelp.exe
- %WINDIR%\twunk_32.exe
- %WINDIR%\$NtUninstallKB942288-v3$\msiexec.exe
- %WINDIR%\winhlp32.exe
- %WINDIR%\Help\Tours\htmlTour\desktop_up.jpg
- %WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg
- %WINDIR%\Help\Tours\htmlTour\folder_up.jpg
- %WINDIR%\Help\Tours\htmlTour\end_up.jpg
- %WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg
- %WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg
- %WINDIR%\Help\Tours\htmlTour\control_up.jpg
- %WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg
- %WINDIR%\Help\Tours\htmlTour\img033a.jpg
- %WINDIR%\Help\Tours\htmlTour\img033.jpg
- %WINDIR%\Help\Tours\htmlTour\img040.jpg
- %WINDIR%\Help\Tours\htmlTour\img034.jpg
- %WINDIR%\Help\Tours\htmlTour\icon_up.jpg
- %WINDIR%\Help\Tours\htmlTour\gradient.jpg
- %WINDIR%\Help\Tours\htmlTour\img014.jpg
- %WINDIR%\Help\Tours\htmlTour\img004b.jpg
- %WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg
- %WINDIR%\Help\Tours\htmlTour\best_secure.jpg
- %WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg
- %WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg
- %WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg
- %WINDIR%\Help\Tours\htmlTour\best_robust.jpg
- %WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg
- %WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg
- %WINDIR%\assembly\NativeImages_v2.0.50727_32\SMSvcHost\b9c1a29e684bc02e49226ff1e9eec253\SMSvcHost.ni.exe
- %WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg
- %WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg
- %WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg
- %WINDIR%\Help\Tours\htmlTour\connected_networks.jpg
- %WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg
- %WINDIR%\Help\Tours\htmlTour\connected_data.jpg
- %WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg
- %WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg
- from %PROGRAM_FILES%\Windows NT\dialer.exe.new to %PROGRAM_FILES%\Windows NT\dialer.exe
- from %PROGRAM_FILES%\Windows Media Player\wmplayer.exe.new to %PROGRAM_FILES%\Windows Media Player\wmplayer.exe
- from %PROGRAM_FILES%\Windows NT\Accessories\wordpad.exe.new to %PROGRAM_FILES%\Windows NT\Accessories\wordpad.exe
- from <SYSTEM32>\dllcache\iedw.exe.new to <SYSTEM32>\dllcache\iedw.exe
- from %PROGRAM_FILES%\Windows NT\Pinball\pinball.exe.new to %PROGRAM_FILES%\Windows NT\Pinball\pinball.exe
- from %PROGRAM_FILES%\Windows Media Player\setup_wm.exe.new to %PROGRAM_FILES%\Windows Media Player\setup_wm.exe
- from %PROGRAM_FILES%\Outlook Express\wab.exe.new to %PROGRAM_FILES%\Outlook Express\wab.exe
- from %PROGRAM_FILES%\Outlook Express\setup50.exe.new to %PROGRAM_FILES%\Outlook Express\setup50.exe
- from %PROGRAM_FILES%\Outlook Express\wabmig.exe.new to %PROGRAM_FILES%\Outlook Express\wabmig.exe
- from %PROGRAM_FILES%\Windows Media Player\mplayer2.exe.new to %PROGRAM_FILES%\Windows Media Player\mplayer2.exe
- from %PROGRAM_FILES%\Windows Media Player\migrate.exe.new to %PROGRAM_FILES%\Windows Media Player\migrate.exe
- from <SYSTEM32>\dllcache\moviemk.exe.new to <SYSTEM32>\dllcache\moviemk.exe
- from <SYSTEM32>\dllcache\isignup.exe.new to <SYSTEM32>\dllcache\isignup.exe
- from <SYSTEM32>\dllcache\bckgzm.exe.new to <SYSTEM32>\dllcache\bckgzm.exe
- from <SYSTEM32>\dllcache\hrtzzm.exe.new to <SYSTEM32>\dllcache\hrtzzm.exe
- from <SYSTEM32>\dllcache\chkrzm.exe.new to <SYSTEM32>\dllcache\chkrzm.exe
- from <SYSTEM32>\dllcache\inetwiz.exe.new to <SYSTEM32>\dllcache\inetwiz.exe
- from <SYSTEM32>\dllcache\icwconn1.exe.new to <SYSTEM32>\dllcache\icwconn1.exe
- from <SYSTEM32>\dllcache\iexplore.exe.new to <SYSTEM32>\dllcache\iexplore.exe
- from <SYSTEM32>\dllcache\icwconn2.exe.new to <SYSTEM32>\dllcache\icwconn2.exe
- from <SYSTEM32>\dllcache\icwtutor.exe.new to <SYSTEM32>\dllcache\icwtutor.exe
- from <SYSTEM32>\dllcache\icwrmind.exe.new to <SYSTEM32>\dllcache\icwrmind.exe
- from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwtutor.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwtutor.exe
- from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwrmind.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwrmind.exe
- from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\inetwiz.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\inetwiz.exe
- from %PROGRAM_FILES%\Movie Maker\moviemk.exe.new to %PROGRAM_FILES%\Movie Maker\moviemk.exe
- from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\isignup.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\isignup.exe
- from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn2.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn2.exe
- from %CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe.new to %CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe
- from %CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe.new to %CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe
- from %PROGRAM_FILES%\Internet Explorer\iedw.exe.new to %PROGRAM_FILES%\Internet Explorer\iedw.exe
- from %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn1.exe.new to %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn1.exe
- from %PROGRAM_FILES%\Internet Explorer\iexplore.exe.new to %PROGRAM_FILES%\Internet Explorer\iexplore.exe
- from %PROGRAM_FILES%\NetMeeting\conf.exe.new to %PROGRAM_FILES%\NetMeeting\conf.exe
- from %PROGRAM_FILES%\NetMeeting\cb32.exe.new to %PROGRAM_FILES%\NetMeeting\cb32.exe
- from %PROGRAM_FILES%\NetMeeting\wb32.exe.new to %PROGRAM_FILES%\NetMeeting\wb32.exe
- from %PROGRAM_FILES%\Outlook Express\oemig50.exe.new to %PROGRAM_FILES%\Outlook Express\oemig50.exe
- from %PROGRAM_FILES%\Outlook Express\msimn.exe.new to %PROGRAM_FILES%\Outlook Express\msimn.exe
- from %PROGRAM_FILES%\MSN Gaming Zone\Windows\zclientm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\zclientm.exe
- from %PROGRAM_FILES%\MSN Gaming Zone\Windows\chkrzm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\chkrzm.exe
- from %PROGRAM_FILES%\MSN Gaming Zone\Windows\bckgzm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\bckgzm.exe
- from %PROGRAM_FILES%\MSN Gaming Zone\Windows\hrtzzm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\hrtzzm.exe
- from %PROGRAM_FILES%\MSN Gaming Zone\Windows\shvlzm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\shvlzm.exe
- from %PROGRAM_FILES%\MSN Gaming Zone\Windows\rvsezm.exe.new to %PROGRAM_FILES%\MSN Gaming Zone\Windows\rvsezm.exe
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'Indicator' WindowName: '(null)'