Backdoor.Win32.Farfli_0038282fbf

by malwarelabrobot on July 5th, 2014 in Malware Descriptions.

not-a-virus:AdWare.Win32.Agent.ahdb (Kaspersky), Backdoor.Win32.Farfli.FD, Trojan.NSIS.StartPage.FD, Trojan.Win32.Delphi.FD, Trojan.Win32.Iconomon.FD, Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)
Behaviour: Trojan, Backdoor, VirTool

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: 0038282fbfeb2d10964f756d6ac2b336
SHA1: dde224788ab485532f1c527dff97cad034cfcdde
SHA256: 17749e17ae966d88bda539cf4dd493615ea8a42355f872b4af2ffa0fa5b77d88
SSDeep: 393216:L6Hjv /AWHx4t1b/6JGcnUeW9vO7ka8TqNzBtbGXKMJpG:LizU2jyJlnUeW87V86zBtbgppG
Size: 13100305 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Softonic
Created at: 2008-09-16 17:17:44
Analyzed on: WindowsXP SP3 32-bit

Summary:

Backdoor. Malware that enables a remote control of victim's machine.

Payload

No specific payload has been found.

Process activity

The Backdoor creates the following process(es):

taskkill.exe:612
taskkill.exe:1584
taskkill.exe:1920
taskkill.exe:672
taskkill.exe:508
taskkill.exe:812
taskkill.exe:1380
%original file name%.exe:564
u_rv259510009.exe:1384
KAVD_22_2317.exe:424
XiaobaiSetup.exe:348
Xiaobai.exe:864
dwwin.exe:544
BarBroker.exe:1136
XiaobaiSetup_3.1.1.(soft001).exe:1180
regsvr32.exe:1752
FX_82068094_3.exe:1604
DDGuoServer.exe:872
cacls.exe:1004
cacls.exe:264

The Backdoor injects its code into the following process(es):

FunshionInstall2.4.5.9.exe:1688
DDGuo.exe:1712
DDGuoServer.exe:1408

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process FunshionInstall2.4.5.9.exe:1688 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnPlayList.bmp (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\welcome.bmp (5064 bytes)
%Program Files%\Funshion Online\Funshion\skin\HidePlayInfoBtn.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnNext.bmp (10 bytes)
%Program Files%\Funshion Online\Funshion\Media\Start Funshion.lnk (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetBkgndHover.bmp (118 bytes)
%Program Files%\Funshion Online\Funshion\skin\OptionBtnBk.bmp (1552 bytes)
%Program Files%\Funshion Online\Funshion\skin\imgDrawMenuItem.bmp (14 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetBkgndL.bmp (162 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskListStatSelIcon.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionBkgnd.bmp (170 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarLeftBk.bmp (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Funshion\Funshion Use Help.lnk (256 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskMgnBarRScrollBtn.bmp (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instpath.ini (654 bytes)
%Program Files%\Funshion Online\Funshion\skin\CheckBox_Check.bmp (406 bytes)
%Program Files%\Funshion Online\Funshion\skin\ShowPlayInfoBtn.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\drvc.dll (9608 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarDownArrowL.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarRestore.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerBkgndL.bmp (90 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarPlay.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollLinkBkgnd.bmp (146 bytes)
%Program Files%\Funshion Online\Funshion\Funshion-install.ico (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBarSplidRgn.bmp (654 bytes)
%Program Files%\Funshion Online\Funshion\quality.dll (11048 bytes)
%Program Files%\Funshion Online\Funshion\skin\bmpError_IE.bmp (1856 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBufferInfoWndLeft.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\Dump.dll (11048 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionMenuBtn.bmp (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\installfilesen.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\pndx5032.dll (5 bytes)
%Program Files%\Funshion Online\Funshion\skin\IeToolBarBkgnd.bmp (166 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarHead.bmp (310 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerSimpleBarBk.bmp (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\installpathcn.bmp (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp\KillProcDLL.dll (784 bytes)
%Program Files%\Funshion Online\Funshion\fptassrv.dll (8560 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarSplid.bmp (166 bytes)
%Program Files%\Funshion Online\Funshion\skin\IeToolBarShowPlayerEn.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\UpdateCapCloseBtn.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskBarBtnMenu.bmp (7 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@funshion[2].txt (280 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp\NSISdl.dll (14 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnPauseSmall.bmp (5 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetBkgnd.bmp (182 bytes)
%Program Files%\Funshion Online\Funshion\skin\IntergrateModeBtn.bmp (2392 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayListVerSplid.bmp (78 bytes)
%Program Files%\Funshion Online\Funshion\skin\OptionText.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnMute.bmp (10 bytes)
%Program Files%\Funshion Online\Funshion\skin\bmpPrompt.bmp (7 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetHead.bmp (566 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBufferInfoWndBkgnd.bmp (174 bytes)
%Program Files%\Funshion Online\Funshion\skin\UpdateIconSuc.bmp (354 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBarVolumeBarBkgndRightSmall.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarDownArrow.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBufferInfoWndRight.bmp (894 bytes)
%Program Files%\Funshion Online\Funshion\skin\OptionSplidBarHead.bmp (200 bytes)
%Program Files%\Funshion Online\Funshion\skin\imgFullViewMini.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnPlaySmall.bmp (5 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarMoveUp.bmp (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\welcomekugou.bmp (5064 bytes)
%Program Files%\Funshion Online\Funshion\skin\MainNcRightBtmCorner.bmp (246 bytes)
%Program Files%\Funshion Online\Funshion\skin\PauseAdCloseBtn.bmp (3 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (2892 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoTitle.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoTitleBk.bmp (158 bytes)
%Program Files%\Funshion Online\Funshion\skin\imgStandardMiniEn.bmp (15 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionText.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\UpdateCapBkgnd.bmp (190 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnMuteSmall.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionMaxBtn.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarBkgnd.bmp (222 bytes)
%Program Files%\Funshion Online\Funshion\skin\UpdateBtmIgoreBtn.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionTextEn.bmp (6 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerSimpleBarBkgnd.bmp (166 bytes)
%Program Files%\Funshion Online\Funshion\skin\MainNcFrameLeft.bmp (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp\System.dll (11 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBkgnd.bmp (214 bytes)
%Program Files%\Funshion Online\Funshion\dbghelp.dll (33295 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionMenuF.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\ChangeModeBtn.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\imgCloseMini.bmp (5 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetTrailL.bmp (810 bytes)
%Program Files%\Funshion Online\Funshion\skin\TipTopArrow.bmp (306 bytes)
%Program Files%\Funshion Online\Funshion\skin\bmpCleanFile.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\FunshionService.exe (37025 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarBkgndSmall.bmp (110 bytes)
%Program Files%\Funshion Online\Funshion\skin\IErrorWndBk.bmp (2392 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnStopSmall.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\OptionSplidBarTrail.bmp (200 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetTrail.bmp (694 bytes)
%Documents and Settings%\All Users\Desktop\Funshion.lnk (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\StatusBarSplid.bmp (234 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp\WelcomePage.ini (299 bytes)
%Program Files%\Funshion Online\Funshion\skin\ListHeaderSplid.bmp (154 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetMid.bmp (182 bytes)
%Program Files%\Funshion Online\Funshion\rmoc3260.dll (6584 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsk2.tmp (395850 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarRightBk.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\UpdateBtmUpdateBtn.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoItemTextBk.bmp (10 bytes)
%Program Files%\Funshion Online\Funshion\cook.dll (1856 bytes)
%Program Files%\Funshion Online\Funshion\FunShion.ini (22 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnVolume.bmp (10 bytes)
%Program Files%\Funshion Online\Funshion\skin\PauseFlickerBtn.bmp (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp\nsisXML.dll (11 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionMinBtn.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskMgnTitleRight.bmp (678 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Setup_fengxingtg.exe (14761 bytes)
%Program Files%\Funshion Online\Funshion\skin\imgCleanFileBtn.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\WebCloseBtnRgn.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarThumbSmall.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\OptionTextEn.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskTabBtnPopIcon.bmp (270 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoBtmBar.bmp (226 bytes)
%Program Files%\Funshion Online\Funshion\skin\IeToolBarGamePage.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarTrail.bmp (310 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp\ExecDos.dll (5 bytes)
%Documents and Settings%\%current user%\funshion\cache\Cacheflash\blankFs.swf (80 bytes)
%System%\funshion.ini (2234 bytes)
%Program Files%\Funshion Online\Funshion\skin\IeToolBarBack.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetHeadHover.bmp (258 bytes)
%Program Files%\Funshion Online\Funshion\pncrt.dll (9608 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetTrailHover.bmp (174 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarBefore.bmp (126 bytes)
%Program Files%\Funshion Online\Funshion\skin\OptionSplideBarBkgnd.bmp (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\installfilescn.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\CheckBox_Box.bmp (450 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarStop.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\CoreAAC.ax (20416 bytes)
%Program Files%\Funshion Online\Funshion\skin\bmpPlayBarTip.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoHeaderBkgnd.bmp (798 bytes)
%Program Files%\Funshion Online\Funshion\skin\UpdateCaption.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\pndx5016.dll (6 bytes)
%Documents and Settings%\%current user%\funshion\install.ini (104 bytes)
%Program Files%\Funshion Online\Funshion\skin\MainNcFrameRight.bmp (58 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayListVerSplidMark.bmp (78 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarDelete.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\imgNormalViewMini.bmp (5 bytes)
%Program Files%\Funshion Online\Funshion\GetMACAddress.dll (5520 bytes)
%Program Files%\Funshion Online\Funshion\skin\OptionSplideBarThumb.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\WebToolBarBk.bmp (14 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarBk.bmp (15 bytes)
%Program Files%\Funshion Online\Funshion\FunshionUpgrade.exe (30464 bytes)
%Program Files%\Funshion Online\Funshion\Media\Install Latest Funshion.lnk (316 bytes)
%Program Files%\Funshion Online\Funshion\skin\RadioBtnPt.bmp (576 bytes)
%Documents and Settings%\%current user%\funshion\update\Pop Game.lnk (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskMgnBarBk.bmp (226 bytes)
%Program Files%\Funshion Online\Funshion\skin\bmpError.bmp (6 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarShowWeb.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\IeToolBarHomePage.bmp (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FX_82068094_3.exe (141589 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\licenseen.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionMenuBtnEn.bmp (14 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarDownload.bmp (126 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarTrailSmall.bmp (198 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarUpArrowL.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskMgnBarLScrollBtn.bmp (5 bytes)
%Program Files%\Funshion Online\Funshion\skin\vodPlay.gif (7 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerBkgnd.bmp (98 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnSimple.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionNormalBtn.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnPre.bmp (10 bytes)
%Program Files%\Funshion Online\Funshion\fpsrv.dll (5064 bytes)
%Program Files%\Funshion Online\Funshion\skin\TipRightArrow.bmp (222 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoItemTextHover.bmp (10 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayListRemove.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\nicdescr.dat (1 bytes)
%Program Files%\Funshion Online\Funshion\funshionplugin2.dll (130775 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarBeforeSmall.bmp (102 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetMidL.bmp (162 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBarVolumeBarBkgndSmall.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\MainNcFrameTop.bmp (58 bytes)
%Program Files%\Funshion Online\Funshion\skin\MainNcFrameBtm.bmp (58 bytes)
%Program Files%\Funshion Online\Funshion\skin\bmpTimerClose.bmp (1552 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarSplid.bmp (210 bytes)
%Program Files%\Funshion Online\Funshion\icon\RMVB.ico (1856 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskText.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoBkgnd.bmp (150 bytes)
%Program Files%\Funshion Online\Funshion\skin\SplidBarBkgnd.bmp (70 bytes)
%Program Files%\Funshion Online\Funshion\skin\ListHeaderBkgnd.bmp (154 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskTabBkgnd.bmp (246 bytes)
%Program Files%\Funshion Online\Funshion\skin\LogoMiniEn.bmp (5 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnVolumeSmall.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollLinkFrm.bmp (15 bytes)
%Program Files%\Funshion Online\Funshion\skin\Scroll.gif (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetMidHover.bmp (118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\installpathen.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarDownloadSmall.bmp (102 bytes)
%Program Files%\Funshion Online\Funshion\skin\TextBtnBk.bmp (58 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnNonTop.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnNextSmall.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\Buffering.gif (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBarVolumeBarBkgnd.bmp (5 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerHideBtn.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\LogoMini.bmp (3 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@funshion[1].txt (540 bytes)
%Documents and Settings%\%current user%\funshion\update\Shopping Sites.lnk (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBarVolumeBarBkgndRight.bmp (5 bytes)
%Program Files%\Funshion Online\Funshion\skin\RpcStartDlgBk.bmp (3312 bytes)
%Program Files%\Funshion Online\Funshion\skin\imgNonTopViewMini.bmp (4 bytes)
%Documents and Settings%\All Users\Start Menu\Funshion.lnk (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarUpArrowRound.bmp (114 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskMgnBarCurItem.bmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Dump.dll (11048 bytes)
%Documents and Settings%\%current user%\funshion.ini (6448 bytes)
%Program Files%\Funshion Online\Funshion\LoginServer.dll (11344 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnNormal.bmp (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\funshion.ini (1164 bytes)
%Program Files%\Funshion Online\Funshion\skin\imgMinViewMini.bmp (5 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBarVolumeBarThumb.bmp (3 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Funshion\Uninstall Funshion.lnk (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\MainNcLeftTopCorner.bmp (222 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\config.xml (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\DragCorner.bmp (774 bytes)
%Program Files%\Funshion Online\Funshion\skin\MainNcLeftBtmCorner.bmp (246 bytes)
%Program Files%\Funshion Online\Funshion\skin\imgTopViewMini.bmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\welcomepage.ini (119 bytes)
%Program Files%\Funshion Online\Funshion\skin\DiskWarnning.bmp (950 bytes)
%Program Files%\Funshion Online\Funshion\skin\UpdateBtmBkgnd.bmp (234 bytes)
%Program Files%\Funshion Online\Funshion\coreavc.ax (9608 bytes)
%Program Files%\Funshion Online\Funshion\skin\StatusBarLeft.bmp (234 bytes)
%Program Files%\Funshion Online\Funshion\skin\MainNcRightTopCorner.bmp (246 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskBarTipDownArrow.bmp (306 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarMoveDown.bmp (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Funshion\Update History.lnk (280 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetHeadL.bmp (810 bytes)
%Program Files%\Funshion Online\Funshion\LangResEnAmerican.dll (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp\InstPath.ini (1900 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarShowWebEn.bmp (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\getmacaddress.dll (11040 bytes)
%Program Files%\Funshion Online\Funshion\icon\MP4.ico (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nicdescr.dat (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\OptionBtnArrow.bmp (138 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarHeadSmall.bmp (198 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarThumb.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnFullView.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayListAddBtn.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBarVolumeBarThumbSmall.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskManagerCloseBtn.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBarSplidLineBk.bmp (210 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnSetting.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskBarBtnOpenLcl.bmp (2392 bytes)
%Program Files%\Funshion Online\Funshion\skin\vodWebEn.gif (7 bytes)
%Program Files%\Funshion Online\Funshion\skin\UpdateIconInit.bmp (354 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskListRePlayBtn.bmp (12 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoBtnMenu.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskListBtnShow.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\Uninstall.exe (7966 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarBkgnd.bmp (126 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionCloseBtn.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnPlay.bmp (10 bytes)
%Program Files%\Funshion Online\Funshion\skin\OpenLocalBtnMenu.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskListRightLine.bmp (270 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerHideBtnEn.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\IErrorReshBtn.bmp (142 bytes)
%Program Files%\Funshion Online\Funshion\skin\GetFspFile.gif (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp\ExecCmd.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xml2fspdata.exe (4992 bytes)
%Program Files%\Funshion Online\Funshion\skin\WebCloseBtn.bmp (8 bytes)
%Program Files%\Funshion Online\Funshion\skin\UpdateBtmCloseBtn.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerTipCloseBtn.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\bmpListHeaderBk.bmp (146 bytes)
%Program Files%\Funshion Online\Funshion\Funshion.exe (99795 bytes)
%Program Files%\Funshion Online\Funshion\skin\bmpQuestion.bmp (7 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskMgnTitleBkgnd.bmp (182 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskListStatIcons.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\vodWeb.gif (7 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarDownload.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoTitleEn.bmp (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Funshion.lnk (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\StatusBarBkgnd.bmp (218 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskListBtnHide.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskMgnBarItem.bmp (1552 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnPreSmall.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\SplidBarMark.bmp (634 bytes)
%Program Files%\Funshion Online\Funshion\skin\IeToolBarShowPlayer.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\StatusBarRight.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\Agentd.dll (11048 bytes)
%Program Files%\Funshion Online\Funshion\skin\vodPlayEn.gif (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp\FindProcDLL.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\licensecn.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\RpcLoading.gif (11 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskMgnTitleLeft.bmp (726 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnTop.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\LoadTeleplayWeb.gif (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarBk000.bmp (15 bytes)
%Program Files%\Funshion Online\Funshion\skin\list_expend.bmp (802 bytes)
%Program Files%\Funshion Online\Funshion\skin\IeToolBarForward.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnPause.bmp (10 bytes)
%Program Files%\Funshion Online\Funshion\skin\TipBottomArrow.bmp (246 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskManagerCloseTxtBtn.bmp (15 bytes)
%Program Files%\Funshion Online\Funshion\skin\bmpClearDisk.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskTextEn.bmp (6 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarDownArrowRound.bmp (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp\md5dll.dll (8 bytes)
%Program Files%\Funshion Online\Funshion\skin\IeToolBarRefresh.bmp (1 bytes)
%Documents and Settings%\%current user%\funshion\cache\Cacheflash\donghuanew_18.swf (3616 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskMngBtnIcon.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionMenuFEn.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarDiskClear.bmp (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Funshion\Funshion.lnk (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarUpArrow.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\IeToolBarShopPage.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\TabModeBtn.bmp (2392 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoCurPlay.bmp (342 bytes)
%Program Files%\Funshion Online\Funshion\skin\bmpMenuBk.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\CrashReport.exe (6584 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnStop.bmp (10 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoBkgndSel.bmp (10 bytes)
%Program Files%\Funshion Online\Funshion\skin\imgStandardMini.bmp (12 bytes)
%Program Files%\Funshion Online\Funshion\skin\UpdateIconFail.bmp (354 bytes)
%Program Files%\Funshion Online\Funshion\skin\RadioBtnBox.bmp (576 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\posts.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\post.dat (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@funshion[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\funshion.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instpath.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\welcome.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\installfilescn.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\welcomepage.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xml2fspdata.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\licenseen.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\installfilesen.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp1.tmp (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@funshion[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\installpathcn.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\licensecn.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\welcomekugou.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\installpathen.bmp (0 bytes)

The process %original file name%.exe:564 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

C:\FunshionInstall2.4.5.9.exe (42603 bytes)
C:\XiaobaiSetup_3.1.1.(soft001).exe (27947 bytes)
C:\u_rv259510009.exe (14726 bytes)
C:\KAVD_22_2317.exe (1180 bytes)

The Backdoor deletes the following file(s):

C:\__tmp_rar_sfx_access_check_1198156 (0 bytes)

The process u_rv259510009.exe:1384 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsu6.tmp\Processes.dll (1552 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã‚Â¶Ã‚Â¹Ã‚Â¶Ã‚Â¹Ã‚Â¹ÃƒÂ»\ÃƒÂÃ‚Â¶Ãƒâ€ÃƒËœÃ‚Â¶Ã‚Â¹Ã‚Â¶Ã‚Â¹Ã‚Â¹ÃƒÂ».lnk (657 bytes)
%Program Files%\DDGuo\DDGUOServer.exe (20416 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu6.tmp\services.dll (7 bytes)
%Program Files%\DDGuo\Update.exe (33536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu6.tmp\System.dll (11 bytes)
%Program Files%\DDGuo\decode.dll (18424 bytes)
%Program Files%\DDGuo\uninst.exe (9943 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã‚Â¶Ã‚Â¹Ã‚Â¶Ã‚Â¹Ã‚Â¹ÃƒÂ»\Ã‚Â¶Ã‚Â¹Ã‚Â¶Ã‚Â¹Ã‚Â¹ÃƒÂ».lnk (650 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp (122778 bytes)
%Program Files%\DDGuo\fsx.dat (18 bytes)
%Program Files%\DDGuo\DDGuo.exe (70870 bytes)
%Program Files%\DDGuo\DDGFlash.swf (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu6.tmp\iotemp.ini (448 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsu6.tmp\Processes.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu6.tmp\services.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu6.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu6.tmp\iotemp.ini (0 bytes)

The process KAVD_22_2317.exe:424 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kingsoftkonline\KAVD_22_2317.exe.tmp (1316071 bytes)

The process DDGuo.exe:1712 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\AppData\LocalLow\DDGuo\ADright.xml (26 bytes)
%Documents and Settings%\All Users\Application Data\DDGuo\popset.ini (47 bytes)
%Documents and Settings%\%current user%\AppData\LocalLow\DDGuo\Fav.dat (7 bytes)
%Documents and Settings%\%current user%\AppData\LocalLow\DDGuo\ADleft.xml (26 bytes)

The process XiaobaiSetup.exe:348 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\b185_appcompat.txt (4764 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Setting\Fill.png (149 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\Gradient.png (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MainMenuBtn.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Login\BannerTc.png (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\CaptionMiniEn.png (822 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MoveSoftNotify\Icons\Icon_3.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Notify\Error.gif (631 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails\config.xml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\FlashPlayer (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\.svn\entries (241 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Pentagram.png (548 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\config.xml (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsTransFrm.png (393 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component (32 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActError.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xbie-button-back.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xbie-top-bg.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Caption.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnLanghua.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Blue.png (702 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Doc\Ã¨Âµâ€žÃ¦ÂºÂÃ¥Å’â€¦Ã¥Ë†Â¶Ã¤Â½Å“Ã¦â€¢â„¢Ã§Â¨â€¹\Ã¤Â½Â¿Ã§â€Â¨Ã¨Â¯Â´Ã¦ËœÅ½.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Doc\Ã¨Âµâ€žÃ¦ÂºÂÃ¥Å’â€¦Ã¥Ë†Â¶Ã¤Â½Å“Ã¦â€¢â„¢Ã§Â¨â€¹\Ã¦â€œÂÃ¤Â½Å“Ã¨Â§â€ Ã©Â¢â€˜.url (190 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\SelectedItem.png (164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Xiaobai.exe (18771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\prop-base\setup_left.bmp.svn-base (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails\Details\images\xb_wrap_bg.jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MaximizeBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\MiniTop.png (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\RootCollapse.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\TaskDownloading.png (447 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\text-base\io_finish.bmp.svn-base (283 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\PopupDown.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MoveSoftNotify\Icons\Icon_1.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\DefaultImage16.png (549 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Notify\ViewUpdate.gif (942 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\AppStoreList.png (552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Green.png (748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\.svn\all-wcprops (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnShadowFlower.png (4 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶\Ã¥Â°ÂÃ§â„¢Â½Ã¥Â®ËœÃ¦â€“Â¹Ã§Â½â€˜Ã§Â«â„¢.lnk (645 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Exit\CheckBox.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActUpload.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwarePaused.png (418 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Lang\lang_tc.xml (74 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\SwitchBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsError.png (319 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MoveSoftNotify\config.xml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Logo.png (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\TabBackGnd.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\UpdateUpdating.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\XiaobaiTools.exe (5626 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Shutcut.png (568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\SliderBarSaturation.png (470 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\NumbersMarked.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ItemProperty\Config.xml (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnShadowDef.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwarePending.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\uninst.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\Desktop.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\SizeTag.png (206 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\CheckBox.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\SearchBox.png (202 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\FlashPlayer\config.xml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\TypeInfo\TYPE_SYS (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails\Details\index.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\MyComputer.png (2 bytes)
%System%\drivers\XiaobaiReg.sys (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\FullModeBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\SysButton.png (1 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶\Ã¥ÂÂ¸Ã¨Â½Â½.lnk (590 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\About\BannerTc.png (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Setup\icons\Xunlei7.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Plugins\QQ.dll (1034 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\ResInfo\config.xml (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Cab.dll (3573 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ShortcutPtgCheck.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\TabBtnUnchecked.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\About\config.xml (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopFlower.png (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\TaskUploading.png (461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ShortcutUninstalled.png (830 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Drivers\XiaobaiFsForVista.inf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActDownload.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\io_finish.bmp (283 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopDef.png (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\TextFrame.png (153 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\ResInfo\SpeedBtn.png (841 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\text-base\io_welcome.bmp.svn-base (283 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\7z.dll (11155 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Logo16.png (993 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\setup_left.bmp (141 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\XbpIcon16.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MessageBox\Icon.png (993 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\About\Banner.png (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\CloseBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Task.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopLeaf.png (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsUnzipFrm.png (471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Drivers\XiaobaiReg.sys (670 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\EditBoxEx.png (151 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Run1.png (419 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\NumbersDefault.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Ã§Â¬Â¬Ã¤ÂºÅ’Ã¦Â¬Â¡Ã¥Ë†â€¡Ã¥â€ºÂ¾\4.png (472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\WorkFolder.ico (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareRunning.png (379 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Drivers\XiaobaiFsForVista.sys (292 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Sort.png (467 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\RunAsAdmin.png (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\XbCom.dll (1571 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\Background.png (587 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Red.png (770 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Delete.cur (766 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Start.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareDownloading.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Information.png (645 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\text-base\xb_logo.bmp.svn-base (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Uninstall\config.xml (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\io_welcome.bmp (283 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\TabButton.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActDelete.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xbie-button-forward.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\NameSet\EditBox.png (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xb_failed.gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\prop-base\io_finish.bmp.svn-base (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Congfig.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\CheckBox.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\tan2.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\SwfIcon16.png (885 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Repair.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\Shutdown.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsTrans.png (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Run3.png (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Login\BannerEn.png (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\TaskError.png (418 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Plugins\360se3.dll (127 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Update\UpdateBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ShareToFriend\Config.xml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\.svn (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnShadowLeaf.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\FlashPlayer\RevertShowBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\DesktopTips.exe (267 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Recorder.exe (4505 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MessageBox\Information.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\ResInfo\Delete.png (657 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnShadowStar.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MessageBox\Question.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnShadowNull.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Tasklist.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ShadowSet\config.xml (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SyncImage32.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Games.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\RendItem.png (107 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsStop.png (365 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\lang.xml (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\UpdateCompleted.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenu (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareError.png (418 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Update\config.xml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\tan-bg.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\SearchBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\RedPoint.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Background.png (234 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Drivers\XiaobaiReg.sys (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\InitConfig.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\Console.png (513 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\RestoreBtn.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\CaptionTc.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActInstall.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Drivers (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Ã§Â¬Â¬Ã¤ÂºÅ’Ã¦Â¬Â¡Ã¥Ë†â€¡Ã¥â€ºÂ¾\1.png (419 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsStopFrm.png (471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Net.dll (2530 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Lang\lang_cn.xml (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Drift\back.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\prop-base\xb_logo.bmp.svn-base (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\DrvMgr.dll (811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Background40x68.png (666 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\PackageIcon16.png (759 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Setup\icons (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Gradient.png (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\entries (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ConfigList\config.xml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\MiniRight.png (155 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\CaptionEn.png (871 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶.url (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Update.exe (750 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Drivers\XiaobaiFsForXp.inf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\UpdateError.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ShortcutPopup.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Plugins\TheWorld3.dll (2008 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActPending.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\TaskCompleted.png (355 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xbie-button-forward.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\DropDownBtn.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Slider.png (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Line.png (188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Run2.png (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Unsel.png (335 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Setup\icons\PPStream.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareNormal.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\XbShortcutFolder.ico (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopChriremas.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\RootExpand.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Plugins\Maxthon2.dll (369 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\ResInfo\Add.png (568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Notify\Information.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\CheckBoxI.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\TaskPaused.png (277 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActStart.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopLanghua.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniModeBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\XbUpdate\config.xml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\CaptionMini.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Login\EditBox.png (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenu\TopScrollBar.png (598 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Drift\backDown.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenuBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SendLnkNotify\config.xml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\CheckUpdate.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsUnzip.png (319 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SubCollapse.png (270 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnChriremas.png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\reload.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenu\Separator.png (218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Select.png (464 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Background40x40.png (580 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Setting\SheetPageEx.png (419 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Setting\config.xml (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\UpdatePending.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\prop-base\io_welcome.bmp.svn-base (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Drift\config.xml (486 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Shortcut16.png (306 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\ResInfo\MoveUp.png (650 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Notify\config.xml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\ColorBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopSnow.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ShortcutPopupImage.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\TaskPending.png (395 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\reginit.dat (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\Xiaobai.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Group.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\Dependence.xml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xb_loading.gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails\Details\js\jquery.js (72 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Exit\config.xml (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\MinimizeBtn.png (966 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Login\Background.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\XbNet.dll (3123 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Uninstall.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xbie-button-back.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails\Details\package.xsl (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Setting\SheetPage.png (422 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Tick.png (634 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recommand\config.xml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareDecomPending.png (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MessageBox (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\ColumnHeader.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Button.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\ColorIcon.png (412 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareAct.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Loading.gif (771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ShortcutPtg.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Login\config.xml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Ã§Â¬Â¬Ã¤ÂºÅ’Ã¦Â¬Â¡Ã¥Ë†â€¡Ã¥â€ºÂ¾\2.png (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\ButtomStar.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\UpdatePaused.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Setup\icons\zhiwu.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ShadowSet\Symbol.png (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\DefaultImage32.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ShortcutRunning.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Gray.png (593 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xbie-button-reload.gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\SliderBarThumb.png (600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Update\Button.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\loading.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\CloseBtn.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SubExpand.png (213 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnSnow.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Import\config.xml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Notify (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\About\BannerEn.png (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\prop-base\state.bmp.svn-base (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Setting.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Homepage.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Css\style.css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\HoverItem.png (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\XbSvc.dll (5660 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\SetupPackageInfo.dat (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xbie-button-reload.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsErrorFrm.png (429 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\BtnSwitch.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\ButtomDef.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MoveSoftNotify\Icons\Icon_2.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Setup\icons\zuma.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\EditBox.png (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Run5.png (470 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\MyDocument.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\TabBtnChecked.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\AddGroup.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\tan3.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MessageBox\config.xml (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\ResInfo\MoveDown.png (639 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ShortcutAct.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MessageBox\Error.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Login (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopPrunus.png (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenu\BottomScrollBar.png (590 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Pupop16.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\CellSelState.png (583 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareUninstalled.png (460 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Drivers\XiaobaiFsForVista.sys (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\PackageIcon.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\LogConfig.ini (278 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\SliderBarBrightness.png (465 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\Button.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails\Details\js\jquery.xslt.js (121 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Login.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\ButtonMini.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Purple.png (761 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\SoftwareList.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ProcessList\config.xml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnShadowPrunusMume.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\text-base (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\SliderBarHue.png (681 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MoveSoftNotify\Icons\Icon_4.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Ã§Â¬Â¬Ã¤ÂºÅ’Ã¦Â¬Â¡Ã¥Ë†â€¡Ã¥â€ºÂ¾\3.png (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Notify\Warning.gif (600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SvrMsg\config.xml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwarePopupBtn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\MiniLeft.png (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\tan1.png (809 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\all-wcprops (840 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwarePopupImage.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\text-base\state.bmp.svn-base (220 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\aserror.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\FlashPlayer.exe (2785 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\AddSheet.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Drivers\XiaobaiFsForXp.inf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Lang\lang_en.xml (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\text-base\setup_left.bmp.svn-base (141 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ShareToFriend\Button.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\FlashPlayer\FullScreenBtn.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Setup\icons\Aliww.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\AppStoreListEx.png (450 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\error.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\prop-base (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Background.png (829 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopStar.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Default.png (702 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\Recorder.png (798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Mark.png (795 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Drift\backOver.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\TypeInfo\TYPE_LNK.lnk (327 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶\Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶.lnk (586 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\TasklistEx.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActPause.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Drivers\XiaobaiFsForXp.sys (203 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Magenta.png (734 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\Main\config.xml (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Notify\RunNow.gif (854 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Drivers\XiaobaiFsForXp.sys (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PauseButton.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\GrayPoint.png (460 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Shortcut32.png (175 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Drivers (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Run4.png (472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Brownish.png (766 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MoveSoftNotify\Icons\Icon_0.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\config.xml (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenu\Background.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenu\HoverItem.png (474 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_DeepBlue.png (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\BtnRight.png (1 bytes)
%Documents and Settings%\%current user%\Desktop\Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶.lnk (586 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\NewTask.png (3 bytes)
%System%\drivers\XiaobaiFsForXp.sys (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\xb_logo.bmp (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActStop.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Ã§Â¬Â¬Ã¤ÂºÅ’Ã¦Â¬Â¡Ã¥Ë†â€¡Ã¥â€ºÂ¾\5.png (470 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\FlashPlayer\DoubleShowBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareUnziping.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\BtnLeft.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SyncImage16.png (803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\NameSet\config.xml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\dependencywalker.xml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\SoftwareListEx.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Softbase.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Update.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\EditBox.png (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Uninstall.exe (650 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PentagramCheck.png (715 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Login\Banner.png (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftMove\config.xml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Sound\Notify.wav (119 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Css\asstyle.css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ControlPanel.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenu\DragShadow.png (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Softwares.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\Separator.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\ShutcutEx.png (514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Setup\icons\AngryBird.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\xbp.ico (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\ImageToolbar.png (164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\TabCloseBtn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MessageBox\Warning.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Drivers\XiaobaiFsForVista.inf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\state.bmp (220 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\SwfIcon32.png (2 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\version (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Setting\Fill.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\NameSet (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Lang (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MainMenuBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Login\BannerTc.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\CaptionMiniEn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MoveSoftNotify\Icons\Icon_3.ico (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Notify\Error.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\FlashPlayer (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails\Details\package.xsl (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Pentagram.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\setup.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xbie-button-reload.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActError.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xbie-button-back.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\Gradient.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xbie-top-bg.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Plugins (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\7z.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\.svn\prop-base (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Caption.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnLanghua.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Blue.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Doc\Ã¨Âµâ€žÃ¦ÂºÂÃ¥Å’â€¦Ã¥Ë†Â¶Ã¤Â½Å“Ã¦â€¢â„¢Ã§Â¨â€¹\Ã¤Â½Â¿Ã§â€Â¨Ã¨Â¯Â´Ã¦ËœÅ½.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\SelectedItem.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Mark.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Xiaobai.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\prop-base\setup_left.bmp.svn-base (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails\Details\images\xb_wrap_bg.jpg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MaximizeBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\MiniTop.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\RootCollapse.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\TaskDownloading.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\text-base\io_finish.bmp.svn-base (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\PopupDown.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MoveSoftNotify\Icons\Icon_1.ico (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\DefaultImage16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Notify\ViewUpdate.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\AppStoreList.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Green.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\.svn\all-wcprops (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnShadowFlower.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Exit\CheckBox.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActUpload.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwarePaused.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\SwitchBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsError.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MoveSoftNotify\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Logo.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\props (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\TabBackGnd.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\SysButton.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\UpdateUpdating.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Drift (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\XiaobaiTools.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Setting (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Shutcut.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\SliderBarSaturation.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\NumbersMarked.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ItemProperty\Config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnShadowDef.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwarePending.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Setup.pkg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\uninst.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\tmp\props (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\Desktop.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\SizeTag.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\SearchBox.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\FlashPlayer\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\TypeInfo\TYPE_SYS (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails\Details\index.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\MyComputer.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\FullModeBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnShadowNull.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\About\BannerTc.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Setup\icons\Xunlei7.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Plugins\QQ.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\ResInfo\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Cab.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ShortcutPtgCheck.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Ã§Â¬Â¬Ã¤ÂºÅ’Ã¦Â¬Â¡Ã¥Ë†â€¡Ã¥â€ºÂ¾ (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\TabBtnUnchecked.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\XiaobaiSetup.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\About\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopFlower.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\TaskUploading.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ShortcutUninstalled.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Drivers\XiaobaiFsForVista.inf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActDownload.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\ResInfo\Add.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Doc\Ã¨Âµâ€žÃ¦ÂºÂÃ¥Å’â€¦Ã¥Ë†Â¶Ã¤Â½Å“Ã¦â€¢â„¢Ã§Â¨â€¹\Ã¦â€œÂÃ¤Â½Å“Ã¨Â§â€ Ã©Â¢â€˜.url (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\text-base\setup_left.bmp.svn-base (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopDef.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\TextFrame.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\RendItem.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\text-base\io_welcome.bmp.svn-base (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\7z.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Logo16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\setup_left.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Drivers\XiaobaiReg.sys (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\XbpIcon16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MessageBox\Icon.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\About\Banner.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\CloseBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Task.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopLeaf.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsUnzipFrm.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Drivers\XiaobaiReg.sys (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\EditBoxEx.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Run1.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\NumbersDefault.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Ã§Â¬Â¬Ã¤ÂºÅ’Ã¦Â¬Â¡Ã¥Ë†â€¡Ã¥â€ºÂ¾\4.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\WorkFolder.ico (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareRunning.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Drivers\XiaobaiFsForVista.sys (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Sort.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\RunAsAdmin.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\XbCom.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Login\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Red.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Delete.cur (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Start.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareDownloading.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Information.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\text-base\xb_logo.bmp.svn-base (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Uninstall\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Exit (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\io_welcome.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\TabButton.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActDelete.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xbie-button-forward.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recommand (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\NameSet\EditBox.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xb_failed.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\prop-base\io_finish.bmp.svn-base (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Congfig.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\CheckBox.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\tan2.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\SwfIcon16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Repair.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\Shutdown.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsTrans.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Run3.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Login\BannerEn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\TaskError.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\SetupRes.pkg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Plugins\360se3.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Update\UpdateBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ShareToFriend\Config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\.svn\entries (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnShadowLeaf.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\FlashPlayer\RevertShowBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\DesktopTips.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Recorder.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MessageBox\Information.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\ResInfo\Delete.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnShadowStar.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\tmp\text-base (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\tan3.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\loading.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Tasklist.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ShareToFriend (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ShadowSet\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SyncImage32.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Games.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\ResInfo\SpeedBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsStop.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\lang.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\UpdateCompleted.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenu (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareError.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Update\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\tan-bg.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\SearchBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\RedPoint.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Background.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\InitConfig.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\Console.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\XbUpdate (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\RestoreBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\CaptionTc.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActInstall.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Drivers (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Ã§Â¬Â¬Ã¤ÂºÅ’Ã¦Â¬Â¡Ã¥Ë†â€¡Ã¥â€ºÂ¾\1.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsStopFrm.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Net.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Lang\lang_cn.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\tmp\prop-base (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Drift\back.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\prop-base\xb_logo.bmp.svn-base (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\DrvMgr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Background40x68.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\PackageIcon16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ConfigList (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Setup\icons (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Gradient.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\entries (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ConfigList\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\MiniRight.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\CaptionEn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶.url (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\ResInfo (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Update.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Drivers\XiaobaiFsForXp.inf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\UpdateError.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Background.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\About (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Plugins\TheWorld3.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActPending.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\TaskCompleted.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\.svn\props (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xbie-button-forward.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\DropDownBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Update (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Slider.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Line.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Run2.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Unsel.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Setup\icons\PPStream.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareNormal.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\XbShortcutFolder.ico (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\.svn\tmp\props (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopChriremas.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\RootExpand.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Plugins\Maxthon2.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Lang\lang_tc.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Notify\Information.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\CheckBoxI.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\TaskPaused.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Setup (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActStart.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopLanghua.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniModeBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\XbUpdate\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\CaptionMini.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Login\EditBox.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenu\TopScrollBar.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Drift\backDown.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\Background.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SendLnkNotify\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\CheckUpdate.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsUnzip.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SubCollapse.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnChriremas.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\reload.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenu\Separator.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Select.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Background40x40.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Setting\SheetPageEx.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\io_finish.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Setting\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\UpdatePending.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\prop-base\io_welcome.bmp.svn-base (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Drift\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Shortcut16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ShadowSet (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\ResInfo\MoveUp.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Notify\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\ColorBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopSnow.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Cab.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ShortcutPopupImage.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\TaskPending.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\reginit.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\Xiaobai.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Group.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\Dependence.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xb_loading.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails\Details\js\jquery.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Exit\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\MinimizeBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Login\Background.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\XbNet.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Uninstall.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ProcessList (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xbie-button-back.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SyncImage16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Tick.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\.svn\tmp\text-base (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Purple.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareDecomPending.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\ColumnHeader.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Button.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\ColorIcon.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareAct.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Loading.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftMove (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ShortcutPtg.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails\Details (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Ã§Â¬Â¬Ã¤ÂºÅ’Ã¦Â¬Â¡Ã¥Ë†â€¡Ã¥â€ºÂ¾\2.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MessageBox (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\ButtomStar.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\UpdatePaused.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Doc\Ã¨Âµâ€žÃ¦ÂºÂÃ¥Å’â€¦Ã¥Ë†Â¶Ã¤Â½Å“Ã¦â€¢â„¢Ã§Â¨â€¹ (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Setup\icons\zhiwu.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ShadowSet\Symbol.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\DefaultImage32.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ShortcutRunning.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Gray.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsTransFrm.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\SliderBarThumb.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Update\Button.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Uninstall (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\CloseBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SubExpand.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnSnow.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Import\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Notify (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\About\BannerEn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\prop-base\state.bmp.svn-base (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ItemProperty (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Setting.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Homepage.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Css\style.css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\HoverItem.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\XbSvc.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\SetupPackageInfo.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xbie-button-reload.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsErrorFrm.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MoveSoftNotify\Icons (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\BtnSwitch.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\ButtomDef.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MoveSoftNotify\Icons\Icon_2.ico (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Setup\icons\zuma.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\EditBox.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Run5.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\MyDocument.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\TabBtnChecked.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\AddGroup.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MessageBox\Question.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MessageBox\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\ResInfo\MoveDown.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ShortcutAct.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MessageBox\Error.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Login (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopPrunus.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Setting\SheetPage.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenu\BottomScrollBar.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Pupop16.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\CellSelState.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareUninstalled.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Drivers\XiaobaiFsForVista.sys (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\PackageIcon.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\LogConfig.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\SliderBarBrightness.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SvrMsg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\Button.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails\Details\js\jquery.xslt.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Login.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\ButtonMini.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recommand\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\SoftwareList.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ProcessList\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnShadowPrunusMume.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\text-base (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\SliderBarHue.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MoveSoftNotify\Icons\Icon_4.ico (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Ã§Â¬Â¬Ã¤ÂºÅ’Ã¦Â¬Â¡Ã¥Ë†â€¡Ã¥â€ºÂ¾\3.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Notify\Warning.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SvrMsg\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwarePopupBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\MiniLeft.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\tan1.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\all-wcprops (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwarePopupImage.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\FlashPlayer.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\prop-base (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\aserror.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\text-base\state.bmp.svn-base (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\AddSheet.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Drivers\XiaobaiFsForXp.inf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Lang\lang_en.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Sound (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\.svn (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ShareToFriend\Button.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\FlashPlayer\FullScreenBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\TypeInfo (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Setup\icons\Aliww.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\AppStoreListEx.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\error.html (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenuBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ShortcutPopup.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\.svn\tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopStar.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Default.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\Recorder.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Drift\backOver.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\TypeInfo\TYPE_LNK.lnk (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\TasklistEx.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActPause.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Drivers\XiaobaiFsForXp.sys (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Magenta.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\Main\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Notify\RunNow.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Drivers\XiaobaiFsForXp.sys (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PauseButton.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\GrayPoint.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Shortcut32.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\Main (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Run4.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Brownish.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MoveSoftNotify\Icons\Icon_0.ico (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenu\Background.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails\Details\js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\ShutcutEx.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_DeepBlue.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\BtnRight.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\NewTask.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\xb_logo.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActStop.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Ã§Â¬Â¬Ã¤ÂºÅ’Ã¦Â¬Â¡Ã¥Ë†â€¡Ã¥â€ºÂ¾\5.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai.pkg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\FlashPlayer\DoubleShowBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareUnziping.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\DrvMgr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\ImageToolbar.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\CheckBox.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\.svn\tmp\prop-base (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\NameSet\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\dependencywalker.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\SoftwareListEx.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Softbase.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Update.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\EditBox.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Import (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Uninstall.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PentagramCheck.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\.svn\text-base (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Login\Banner.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftMove\config.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Sound\Notify.wav (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Doc (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Css\asstyle.css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ControlPanel.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenu\DragShadow.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails\Details\images (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MoveSoftNotify (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SendLnkNotify (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Drivers (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Softwares.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\Separator.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenu\HoverItem.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\state.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\xbp.ico (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\BtnLeft.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\TabCloseBtn.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MessageBox\Warning.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Drivers\XiaobaiFsForVista.inf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Setup\icons\AngryBird.png (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\SwfIcon32.png (0 bytes)

The process Xiaobai.exe:864 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

The Backdoor deletes the following file(s):

The process dwwin.exe:544 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\12B9C3.dmp (115046 bytes)

The process XiaobaiSetup_3.1.1.(soft001).exe:1180 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\XiaobaiSetup.exe (1749 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai.pkg (11414 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Setup.pkg (3878 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\SetupRes.pkg (129 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\DrvMgr.dll (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Cab.dll (222 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\7z.dll (6305 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\setup.dat (190 bytes)

The process FX_82068094_3.exe:1604 makes changes in the file system.
The Backdoor creates and/or writes to the following file(s):

%Program Files%\Baidu\Toolbar\BaiduBarX.dll (39372 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â\Ã¥ÂÂ¸Ã¨Â½Â½Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â.lnk (1 bytes)
%Program Files%\Baidu\Toolbar\BaiduBarX_Tmp\rc.dll (17848 bytes)
%Program Files%\Baidu\{9A6E096E-4588-3E32-F06C-69F6B8784825}\AddressBar.dll (7726 bytes)
%Program Files%\Baidu\{9A6E096E-4588-3E32-F06C-69F6B8784825}\conf.xml (335 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â\Ã¥Â±ÂÃ¨â€Â½Ã¥Ë†â€”Ã¨Â¡Â¨.url (60 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â\Ã¨â€¡ÂªÃ¥Â®Å¡Ã¤Â¹â€°Ã¦Å’â€°Ã©â€™Â®.url (171 bytes)
%Program Files%\Baidu\AddressBar.dll (34365 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â\Ã¤Â¿Â®Ã¥Â¤ÂÃ¥Å Å¸Ã¨Æ’Â½.url (63 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â\Ã¥Å¾Æ’Ã¥Å“Â¾Ã¦Â¸â€¦Ã§Ââ€ .url (63 bytes)
%Program Files%\Baidu\{9A6E096E-4588-3E32-F06C-69F6B8784825}\ASBarBroker.exe (673 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â\Ã¤Â¸ÂªÃ¦â‚¬Â§Ã¥Å’â€“Ã©Â¦â€“Ã©Â¡Âµ.url (183 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â\Ã¥Â¹Â¿Ã¥â€˜Å Ã¦â€¹Â¦Ã¦Ë†Âª.url (60 bytes)
%Program Files%\Baidu\Toolbar\BarBroker.exe (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf9.tmp (101326 bytes)
%Program Files%\Baidu\conf.xml (335 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â\Ã©Å¡ÂÃ§Â§ÂÃ¤Â¿ÂÃ¦Å Â¤.url (63 bytes)
%Program Files%\Baidu\Toolbar\BaiduBarX_Tmp\BarBroker.exe (8560 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â\Ã¤Â¼Â´Ã¤Â¾Â£Ã¥Â¯Â¼Ã¨Ë†Âª.url (63 bytes)
%Program Files%\Baidu\Toolbar\rc.dll (3073 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â\Ã¥Â¸Â®Ã¥Å Â©Ã¦Å’â€¡Ã¥Ââ€”.url (64 bytes)
%Program Files%\Baidu\ASBarBroker.exe (5064 bytes)
%Program Files%\Baidu\Toolbar\BaiduBarX_Tmp\BaiduBarX.dll (86195 bytes)

The Backdoor deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsf8.tmp (0 bytes)

Registry activity

The process taskkill.exe:612 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "41 17 CB 02 1F E0 FD 90 1A CF 34 76 58 5A C7 4D"

The process taskkill.exe:1584 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5E 83 68 9E CF EC 5F 19 27 17 C9 82 D3 4B FB F7"

The process taskkill.exe:1920 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D6 90 24 30 7D 63 D2 AE 7E 69 3A 7B 8A 85 9D 99"

The process taskkill.exe:672 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BC 93 70 58 66 56 DF 61 79 DD 09 70 AF 9F 28 62"

The process taskkill.exe:508 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CC 3A A7 C2 7E 8B F2 0F E6 77 79 18 46 1D E4 07"

The process taskkill.exe:812 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7B 54 3B DE 45 26 65 66 3D 79 9A 8E 54 43 F6 09"

The process taskkill.exe:1380 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "26 A5 51 94 73 E2 EA 66 D2 08 5D A9 D6 C8 A4 5F"

The process FunshionInstall2.4.5.9.exe:1688 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKCR\.mp4]
"(Default)" = "FunshionMp4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Ã‚Â·ÃƒÂ§ÃƒÂÃƒÂ]
"Order" = "08 00 00 00 02 00 00 00 DE 02 00 00 01 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Funshion]
"Publisher" = "Ã‚Â±Ã‚Â±Ã‚Â¾Ã‚Â©Ã‚Â·ÃƒÂ§ÃƒÂÃƒÂÃƒâ€ÃƒÅ¡ÃƒÂÃƒÅ¸Ã‚Â¼Ã‚Â¼ÃƒÅ ÃƒÂµÃƒâ€œÃƒÂÃƒÂÃƒÅ¾Ã‚Â¹Ã‚Â«Ãƒâ€¹Ã‚Â¾"

[HKCR\.fc!]
"(Default)" = "Funshion Task"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmvb\OpenWithList]
"MRUList" = "a"

[HKCR\fsp\shell\open\ddeexec]
"(Default)" = "%1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCR\fsp\shell\open]
"(Default)" = "open"

[HKCR\FunshionMp4\shell]
"(Default)" = "open"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Funshion]
"DisplayVersion" = "2.4.5.9"

[HKCR\fsp\shell\open\ddeexec\Topic]
"(Default)" = "FSP"

[HKCR\.fsp]
"(Default)" = "Funshion Task"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\FunshionRMVB\shell]
"(Default)" = "open"

[HKLM\SOFTWARE\Funshion\Funshion]
"Install Path" = "%Program Files%\Funshion Online\Funshion"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Funshion]
"NoRepair" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Funshion]
"Order" = "08 00 00 00 02 00 00 00 26 03 00 00 01 00 00 00"

[HKCR\fsp\shell]
"(Default)" = "open"

[HKLM\SOFTWARE\Funshion\Funshion]
"Version" = "2.4.5.9"

[HKCR\Funshion Task]
"(Default)" = "Funshion file"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Funshion]
"Installer Language" = "1033"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\FunshionMp4\shell\open\command]
"(Default)" = "%Program Files%\Funshion Online\Funshion\Funshion.exe %1"

[HKLM\SOFTWARE\CoreCodec\CoreAVC Pro 2.x]
"serial" = "3TDVPV-XCNFDT-VAZVCD-17JVPC-16DCLL"

[HKCR\Funshion Task\shell\open\Command]
"(Default)" = "%Program Files%\Funshion Online\Funshion\Funshion.exe %1 /dummy"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList]
"MRUList" = "a"

[HKCR\Funshion Task\shell\open\ddeexec]
"(Default)" = "%1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Funshion]
"NoModify" = "1"

[HKLM\SOFTWARE\Funshion\Funshion]
"Sub Version" = ""

[HKCR\fsp]
"URL Protocol" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Funshion]
"DisplayIcon" = "%Program Files%\Funshion Online\Funshion\Funshion.exe"

[HKCR\fsp]
"(Default)" = "URL: fsp Protocol"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCR\fsp\shell\open\ddeexec\Application]
"(Default)" = "Funshion"

[HKCR\.rmvb]
"(Default)" = "FunshionRMVB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCR\fsp\shell\open\command]
"(Default)" = "%Program Files%\Funshion Online\Funshion\Funshion.exe %1"

[HKCR\Funshion\DefaultIcon]
"(Default)" = "%Program Files%\Funshion Online\Funshion\Funshion.exe,1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCR\.mp4]
"FunshionMP4.backup" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 32 FF 34 45 F1 B5 DA F1 6A 68 77 1C 65 CE CB"

[HKCR\Funshion Task\shell\open\ddeexec\Topic]
"(Default)" = "FSP"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Funshion]
"UninstallString" = "%Program Files%\Funshion Online\Funshion\Uninstall.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCR\Funshion Task\shell\open\ddeexec\Application]
"(Default)" = "Funshion"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Funshion]
"DisplayName" = "Funshion"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\CoreCodec\CoreAVC Pro 2.x]
"User" = "[email protected]"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCR\fsp\DefaultIcon]
"(Default)" = "%Program Files%\Funshion Online\Funshion\Funshion.exe"

[HKCR\FunshionRMVB\shell\open\command]
"(Default)" = "%Program Files%\Funshion Online\Funshion\Funshion.exe %1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fsp]
"Application" = "%Program Files%\Funshion Online\Funshion\Funshion.exe %1"

[HKCR\Funshion Task\DefaultIcon]
"(Default)" = "%Program Files%\Funshion Online\Funshion\Funshion.exe,1"

[HKCR\.rmvb]
"FunshionRMVB.backup" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList]
"a" = "Funshion.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmvb\OpenWithList]
"a" = "Funshion.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Funshion]
"URLInfoAbout" = "http://www.Funshion.com/"

To automatically run itself each time Windows is booted, the Backdoor adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Funshion" = "%Program Files%\Funshion Online\Funshion\Funshion.exe startbywindows tray"

The Backdoor deletes the following registry key(s):

[HKCR\.fsp]

The Backdoor deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Command Processor]
"AutoRun"

The Backdoor disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FunPlayer"

"Fun Player"

The process %original file name%.exe:564 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9C 94 DE 90 E1 58 15 4C B1 EC 0D 50 A2 59 58 B4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\WinRAR SFX]
"C%%" = "c:\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\c:]
"KAVD_22_2317.exe" = "Kingsoft Download Module"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\c:]
"XiaobaiSetup_3.1.1.(soft001).exe" = "Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶Ã¥Â®â€°Ã¨Â£â€¦Ã§Â¨â€¹Ã¥ÂºÂ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\c:]
"FunshionInstall2.4.5.9.exe" = "Funshion Installation"

"u_rv259510009.exe" = "DDGuo"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process u_rv259510009.exe:1384 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ã‚Â¶Ã‚Â¹Ã‚Â¶Ã‚Â¹Ã‚Â¹ÃƒÂ»]
"URLInfoAbout" = "http://www.doudouguo.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\DDGuo]
"UID" = "259510009"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\DDGuo.exe]
"(Default)" = "%Program Files%\DDGuo\DDGuo.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ã‚Â¶Ã‚Â¹Ã‚Â¶Ã‚Â¹Ã‚Â¹ÃƒÂ»]
"DisplayName" = "Ã‚Â¶Ã‚Â¹Ã‚Â¶Ã‚Â¹Ã‚Â¹ÃƒÂ»"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\DDGuo]
"SetupId" = "259510009"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "27 AD 93 F2 82 29 54 8E 40 19 7E EE B0 A9 1B DC"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ã‚Â¶Ã‚Â¹Ã‚Â¶Ã‚Â¹Ã‚Â¹ÃƒÂ»]
"DisplayIcon" = "%Program Files%\DDGuo\DDGuo.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ã‚Â¶Ã‚Â¹Ã‚Â¶Ã‚Â¹Ã‚Â¹ÃƒÂ»]
"UninstallString" = "%Program Files%\DDGuo\uninst.exe"
"DisplayVersion" = ""
"Publisher" = "DDGuo, Inc."

To automatically run itself each time Windows is booted, the Backdoor adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DDGuo" = "%Program Files%\DDGuo\DDGuo.exe /A"

The process KAVD_22_2317.exe:424 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B 8A 38 DA 2F 0C 00 C2 CA 2E 9B 34 DE DA 0A C9"

The process DDGuo.exe:1712 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 29 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 55 73 35 A2 89 B9 DB 92 35 DD DA 8B C5 DA 04"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process XiaobaiSetup.exe:348 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\D:\Xiaobai\Shadow\@XB_@data\temp\~XbInit.flg,"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\System\CurrentControlSet\Services\Eventlog\System\XiaobaiFs]
"EventMessageFile" = "%SystemRoot%\System32\drivers\XiaobaiFsForXp.sys"

[HKLM\System\CurrentControlSet\Services\XiaobaiFs\Config]
"Documents" = "%Documents and Settings%\*\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶]
"URLInfoAbout" = "http://www.xiaobai.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶]
"DisplayVersion" = "3.1.0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\XiaobaiFs\Config]
"Users" = "%Documents and Settings%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\System\CurrentControlSet\Services\XiaobaiFs\Config]
"ProgramData" = "%Documents and Settings%\All Users\Application Data"
"Windows" = "%WinDir%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Unnoo\Xiaobai]
"ShadowRoot" = "D:\Xiaobai\Shadow"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\System\CurrentControlSet\Services\XiaobaiFs\Config]
"temp" = "%Documents and Settings%\*\Local Settings\Temp"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Unnoo\Xiaobai]
"InstallPath" = "D:\Xiaobai"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\System\CurrentControlSet\Services\XiaobaiFs\Instances\XiaobaiFs - Top Instance]
"Flags" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\D:\Xiaobai\Bin]
"Xiaobai.exe" = "Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶"

[HKLM\System\CurrentControlSet\Services\XiaobaiFs\Config]
"Desktop" = "%Documents and Settings%\*\Desktop"

"ShadowRoot" = "D:\Xiaobai\Shadow"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶]
"DisplayIcon" = "D:\Xiaobai\Bin\Xiaobai.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\System\CurrentControlSet\Control\GroupOrderList]
"FSFilter Virtualization" = "01 00 00 00 01 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶]
"DisplayName" = "Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶"

[HKLM\System\CurrentControlSet\Services\XiaobaiFs\Instances]
"DefaultInstance" = "XiaobaiFs - Top Instance"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶]
"Publisher" = "xiaobai.com"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B 21 CC D7 19 51 6E 73 DB BC C2 27 45 D9 FF D9"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\System\CurrentControlSet\Services\Eventlog\System\XiaobaiFs]
"TypesSupported" = "7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\System\CurrentControlSet\Services\XiaobaiFs\Config]
"ProgramFiles" = "%Program Files%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
"xbsvc" = "XiaobaiSvc"

[HKLM\System\CurrentControlSet\Services\XiaobaiFs\Instances\XiaobaiFs - Top Instance]
"Altitude" = "131700"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶]
"UninstallString" = "D:\Xiaobai\Bin\Uninstall.exe"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\xbsvc]
"CoInitializeSecurityParam" = "0"

[HKLM\System\CurrentControlSet\Services\XiaobaiSvc\Parameters]
"ServiceDll" = "D:\Xiaobai\Bin\XbSvc.dll"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Backdoor adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Xiaobai" = "D:\Xiaobai\Bin\Xiaobai.exe -auto"

The Backdoor deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW]

The Backdoor deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Unnoo\Xiaobai]
"Windows"
"ProgramFiles"
"Temp"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKLM\SOFTWARE\Unnoo\Xiaobai]
"ProgramData"
"Documents"

[HKLM\System\CurrentControlSet\Services\XiaobaiFs\Config]
"ShadowRoot.New"
"ShadowRoot.Switch"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\DW]
"DWFileTreeRoot"

[HKLM\SOFTWARE\Unnoo\Xiaobai]
"ShadowRoot.New"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKLM\SOFTWARE\Unnoo\Xiaobai]
"SystemPartition"
"ShadowVolumeRecycler"
"ShadowRoot.Switch"
"Users"
"Desktop"

The process Xiaobai.exe:864 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "38 7A 01 17 51 A1 54 A8 B5 D7 A7 8C B6 66 4E 7E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process dwwin.exe:544 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "18 0D 97 C5 8A 53 0C 2E C2 EB F7 C5 6D DB 59 A1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 2A 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process BarBroker.exe:1136 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}]
"Policy" = "3"

[HKCR\CLSID\{5BECD27B-DCF5-4DEF-B066-486A47245C03}]
"AppID" = "{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}"
"(Default)" = "BDBroker Class"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}]
"AppName" = "BarBroker.exe"

[HKCR\TypeLib\{3A8C9D89-3271-45F4-98C0-56B0F5A16172}\1.0\0\win32]
"(Default)" = "%Program Files%\Baidu\Toolbar\BarBroker.exe"

[HKCR\Interface\{2923508C-9425-4A61-B9CE-A98239055916}\TypeLib]
"Version" = "1.0"
"(Default)" = "{3A8C9D89-3271-45F4-98C0-56B0F5A16172}"

[HKCR\TypeLib\{3A8C9D89-3271-45F4-98C0-56B0F5A16172}\1.0\HELPDIR]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}]
"AppPath" = "%ProgramFiles%\Baidu\Toolbar"

[HKCR\AppID\BarBroker.EXE]
"AppID" = "{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}"

[HKCR\CLSID\{5BECD27B-DCF5-4DEF-B066-486A47245C03}\LocalServer32]
"(Default)" = "%Program Files%\Baidu\Toolbar\BarBroker.exe"

[HKCR\CLSID\{5BECD27B-DCF5-4DEF-B066-486A47245C03}\VersionIndependentProgID]
"(Default)" = "BarBroker.BDBroker"

[HKCR\BarBroker.BDBroker\CLSID]
"(Default)" = "{5BECD27B-DCF5-4DEF-B066-486A47245C03}"

[HKCR\CLSID\{5BECD27B-DCF5-4DEF-B066-486A47245C03}\ProgID]
"(Default)" = "BarBroker.BDBroker.1"

[HKCR\Interface\{2923508C-9425-4A61-B9CE-A98239055916}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{3A8C9D89-3271-45F4-98C0-56B0F5A16172}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\BarBroker.BDBroker.1\CLSID]
"(Default)" = "{5BECD27B-DCF5-4DEF-B066-486A47245C03}"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A9 F6 58 FD D4 A2 42 3F 5C F8 DD 25 6E 7D 13 C9"

[HKCR\Interface\{2923508C-9425-4A61-B9CE-A98239055916}]
"(Default)" = "IBDBroker"

[HKCR\CLSID\{5BECD27B-DCF5-4DEF-B066-486A47245C03}\TypeLib]
"(Default)" = "{3A8C9D89-3271-45F4-98C0-56B0F5A16172}"

[HKCR\AppID\{7A33CE9E-4F33-4B4E-B263-6AEEAB6C3DC2}]
"(Default)" = "BarBroker"

[HKCR\BarBroker.BDBroker\CurVer]
"(Default)" = "BarBroker.BDBroker.1"

[HKCR\Interface\{2923508C-9425-4A61-B9CE-A98239055916}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\BarBroker.BDBroker]
"(Default)" = "BDBroker Class"

[HKCR\TypeLib\{3A8C9D89-3271-45F4-98C0-56B0F5A16172}\1.0]
"(Default)" = "BarBroker 1.0 Type Library"

[HKCR\BarBroker.BDBroker.1]
"(Default)" = "BDBroker Class"

The process XiaobaiSetup_3.1.1.(soft001).exe:1180 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CF 4B 3D 3E 9D DE 6F F5 1F E7 E6 8D 7E 89 44 D7"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\~XB_SETUP_0012699F]
"XiaobaiSetup.exe" = "Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶Ã¥Â®â€°Ã¨Â£â€¦Ã§Â¨â€¹Ã¥ÂºÂ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process regsvr32.exe:1752 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKCR\CLSID\{05589FAF-C356-11CE-BF01-00AA0055595A}]
"(Default)" = "Audio Renderer Property Page"

[HKCR\Interface\{211A8766-03AC-11D1-8D13-00AA00BD8339}\NumMethods]
"(Default)" = "29"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}]
"FriendlyName" = "Video Renderer"

[HKCR\CLSID\{D51BD5A0-7548-11CF-A520-0080C77EF58A}]
"(Default)" = "QuickTime Movie Parser"

[HKCR\Interface\{36B73880-C2C8-11CF-8B46-00805F6CEF60}]
"(Default)" = "IMediaSeeking"

[HKCR\CLSID\{D3588AB0-0781-11CE-B03A-0020AF0BA770}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{E436EBB5-524F-11CE-9F53-0020AF0BA770}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{56A868AA-0AD4-11CE-B03A-0020AF0BA770}\NumMethods]
"(Default)" = "11"

[HKCR\CLSID\{99D54F63-1A69-41AE-AA4D-C976EB3F0713}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{22320CB2-D41A-11D2-BF7C-D7CB9DF0BF93}]
"(Default)" = "IAMAudioRendererStats"

[HKCR\Interface\{379A0CF0-C1DE-11D2-ABF5-00A0C905F375}]
"(Default)" = "IMemAllocatorCallbackTemp"

[HKCR\Interface\{C1960960-17F5-11D1-ABE1-00A0C905F375}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{B80AB0A0-7416-11D2-9EEB-006008039E37}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{06B32AEE-77DA-484B-973B-5D64F47201B0}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{B79BB0B1-33C1-11D1-ABE1-00A0C905F375}\NumMethods]
"(Default)" = "8"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}]
"FriendlyName" = "MPEG Video Decoder"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB8B-524F-11CE-9F53-0020AF0BA770}]
"Source Filter" = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKCR\Interface\{56A868AC-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{56A86899-0AD4-11CE-B03A-0020AF0BA770}\NumMethods]
"(Default)" = "10"

[HKCR\Interface\{36B73880-C2C8-11CF-8B46-00805F6CEF60}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{E436EBB7-524F-11CE-9F53-0020AF0BA770}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{211A8760-03AC-11D1-8D13-00AA00BD8339}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{E4979309-7A32-495E-8A92-7B014AAD4961}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{56A86897-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{F938C991-3029-11CF-8C44-00AA006B6814}]
"(Default)" = "IAMPhysicalPinInfo"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}]
"FilterData" = "02 00 00 00 00 00 60 00 02 00 00 00 00 00 00 00"

[HKCR\Interface\{8E1C39A1-DE53-11CF-AA63-0080C744528D}\NumMethods]
"(Default)" = "5"

[HKCR\CLSID\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}]
"(Default)" = "Line 21 Decoder 2"

[HKCR\Interface\{9B496CE1-811B-11CF-8C77-00AA006B6814}]
"(Default)" = "IAMTimecodeReader"

[HKCR\Interface\{B5730A90-1A2C-11CF-8C23-00AA006B6814}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{A70EFE60-E2A3-11D0-A9BE-00AA0061BE93}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{36B73883-C2C8-11CF-8B46-00805F6CEF60}\NumMethods]
"(Default)" = "4"

[HKCR\Interface\{8E1C39A1-DE53-11CF-AA63-0080C744528D}]
"(Default)" = "IAMOpenProgress"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}]
"0" = "0,4,,3C53414d"

[HKCR\Interface\{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}]
"(Default)" = "IDVSplitter"

[HKCR\Interface\{58473A19-2BC8-4663-8012-25F81BABDDD1}\NumMethods]
"(Default)" = "4"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A}]
"FriendlyName" = "Video Renderer"

[HKCR\CLSID\{D51BD5A1-7548-11CF-A520-0080C77EF58A}]
"(Default)" = "Wave Parser"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}]
"FriendlyName" = "AVI Draw"

[HKCR\Interface\{56A8689F-0AD4-11CE-B03A-0020AF0BA770}]
"(Default)" = "IFilterGraph"

[HKCR\Interface\{00855B90-CE1B-11D0-BD4F-00A0C911CE86}\NumMethods]
"(Default)" = "7"

[HKCR\CLSID\{70E102B0-5556-11CE-97C0-00AA0055595A}]
"(Default)" = "Video Renderer"

[HKCR\Interface\{70423839-6ACC-4B23-B079-21DBF08156A5}]
"(Default)" = "IEncoderAPI"

[HKCR\Interface\{5738E040-B67F-11D0-BD4D-00A0C911CE86}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{89C31040-846B-11CE-97D3-00AA0055595A}\NumMethods]
"(Default)" = "7"

[HKCR\Interface\{56A868A2-0AD4-11CE-B03A-0020AF0BA770}\NumMethods]
"(Default)" = "4"

[HKCR\CLSID\{0618AA30-6BC4-11CF-BF36-00AA0055595A}]
"(Default)" = "Full Screen Renderer Property Page"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB87-524F-11CE-9F53-0020AF0BA770}]
"1" = "0, 10, FFFFFFFF000000000000, 494433030080808080"
"0" = "0, 2, FFE0, FFE0"

[HKCR\Interface\{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{211A8761-03AC-11D1-8D13-00AA00BD8339}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{34151510-EEC0-11D2-8201-00A0C9D74842}]
"(Default)" = "IDvdInfo2"

[HKCR\Interface\{A70EFE61-E2A3-11D0-A9BE-00AA0061BE93}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A}]
"CLSID" = "{D51BD5A2-7548-11CF-A520-0080C77EF58A}"

[HKCR\Interface\{C6E13343-30AC-11D0-A18C-00A0C9118956}]
"(Default)" = "IAMVideoCompression"

[HKCR\Interface\{C6E13340-30AC-11D0-A18C-00A0C9118956}\NumMethods]
"(Default)" = "7"

[HKCR\Interface\{8E1C39A1-DE53-11CF-AA63-0080C744528D}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{56A8689D-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{1643E180-90F5-11CE-97D5-00AA0055595A}]
"(Default)" = "Color Space Converter"

[HKCR\Interface\{33BC7430-EEC0-11D2-8201-00A0C9D74842}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{E436EBB7-524F-11CE-9F53-0020AF0BA770}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{418AFB70-F8B8-11CE-AAC6-0020AF0B99A3}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{632105FA-072E-11D3-8AF9-00C04FB6BD3D}]
"(Default)" = "IAMGraphStreams"

[HKCR\Interface\{56A868A3-0AD4-11CE-B03A-0020AF0BA770}\NumMethods]
"(Default)" = "11"

[HKCR\CLSID\{D3588AB0-0781-11CE-B03A-0020AF0BA770}]
"(Default)" = "AVI/WAV File Source"

[HKCR\Interface\{36B73885-C2C8-11CF-8B46-00805F6CEF60}\NumMethods]
"(Default)" = "7"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB8B-524F-11CE-9F53-0020AF0BA770}]
"0" = "0,4,,52494646,8,4,,57415645"

[HKCR\Interface\{86303D6D-1C4A-4087-AB42-F711167048EF}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{944D4C00-DD52-11CE-BF0E-00AA0055595A}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{56ED71A0-AF5F-11D0-B3F0-00AA003761C5}]
"(Default)" = "IAMBufferNegotiation"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{48025243-2D39-11CE-875D-00608CB78066}]
"FriendlyName" = "Internal Script Command Renderer"

[HKCR\Interface\{670D1D20-A068-11D0-B3F0-00AA003761C5}]
"(Default)" = "IAMCopyCaptureFileProgress"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}]
"FriendlyName" = "AVI Decompressor"

[HKCR\Interface\{A70EFE60-E2A3-11D0-A9BE-00AA0061BE93}\NumMethods]
"(Default)" = "26"

[HKCR\Interface\{56A86892-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{70E102B0-5556-11CE-97C0-00AA0055595A}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{C6E13344-30AC-11D0-A18C-00A0C9118956}]
"(Default)" = "IAMDroppedFrames"

[HKCR\CLSID\{D51BD5A3-7548-11CF-A520-0080C77EF58A}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770}]
"CLSID" = "{D3588AB0-0781-11CE-B03A-0020AF0BA770}"

[HKCR\CLSID\{336475D0-942A-11CE-A870-00AA002FEAB5}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{56A8689D-0AD4-11CE-B03A-0020AF0BA770}]
"(Default)" = "IMemInputPin"

[HKCR\CLSID\{1BB05961-5FBF-11D2-A521-44DF07C10000}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{E436EBB3-524F-11CE-9F53-0020AF0BA770}]
"(Default)" = "Filter Graph"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E4 D3 8C 13 78 ED 8C 87 F0 B5 12 A6 FC 76 85 8B"

[HKCR\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\MJPEG Compressor]
"FilterData" = "02 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00"

[HKCR\CLSID\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}]
"(Default)" = "VGA 16 color ditherer"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB84-524F-11CE-9F53-0020AF0BA770}]
"Source Filter" = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKCR\Interface\{C1960960-17F5-11D1-ABE1-00A0C905F375}]
"(Default)" = "IAMStreamSelect"

[HKCR\Interface\{C6E13370-30AC-11D0-A18C-00A0C9118956}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{56A8689C-0AD4-11CE-B03A-0020AF0BA770}\NumMethods]
"(Default)" = "9"

[HKCR\Interface\{56A868A3-0AD4-11CE-B03A-0020AF0BA770}]
"(Default)" = "IFilterMapper"

[HKCR\CLSID\{2D2E24CB-0CD5-458F-86EA-3E6FA22C8E64}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{211A8761-03AC-11D1-8D13-00AA00BD8339}\NumMethods]
"(Default)" = "18"

[HKCR\file]
"Source Filter" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{418AFB70-F8B8-11CE-AAC6-0020AF0B99A3}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{36B73882-C2C8-11CF-8B46-00805F6CEF60}\NumMethods]
"(Default)" = "21"

[HKCR\CLSID\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}]
"(Default)" = "AVI Splitter"

[HKCR\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}]
"(Default)" = "Audio Renderer"

[HKCR\CLSID\{48025243-2D39-11CE-875D-00608CB78066}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{D51BD5A2-7548-11CF-A520-0080C77EF58A}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A}]
"CLSID" = "{70E102B0-5556-11CE-97C0-00AA0055595A}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}]
"CLSID" = "{D51BD5A1-7548-11CF-A520-0080C77EF58A}"

[HKCR\Interface\{670D1D20-A068-11D0-B3F0-00AA003761C5}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{7D8AA343-6E63-4663-BE90-6B80F66540A3}]
"(Default)" = "VMR ImageSync"

[HKCR\Interface\{C6E133B0-30AC-11D0-A18C-00A0C9118956}]
"(Default)" = "IAMAnalogVideoEncoder"

[HKCR\Interface\{6025A880-C0D5-11D0-BD4E-00A0C911CE86}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\https]
"Source Filter" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCR\Interface\{C6545BF0-E76B-11D0-BD52-00A0C911CE86}]
"(Default)" = "IAMDevMemoryAllocator"

[HKCR\Interface\{56A868A4-0AD4-11CE-B03A-0020AF0BA770}\NumMethods]
"(Default)" = "7"

[HKCR\CLSID\{6A08CF80-0E18-11CF-A24D-0020AFD79767}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{02997C3B-8E1B-460E-9270-545E0DE9563E}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{E436EBB1-524F-11CE-9F53-0020AF0BA770}]
"(Default)" = "System Clock"

[HKCR\CLSID\{48025243-2D39-11CE-875D-00608CB78066}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{E436EBB2-524F-11CE-9F53-0020AF0BA770}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770}]
"CLSID" = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKCR\Interface\{C6545BF1-E76B-11D0-BD52-00A0C911CE86}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A}]
"FilterData" = "02 00 00 00 00 00 20 00 01 00 00 00 00 00 00 00"

[HKCR\Interface\{F938C991-3029-11CF-8C44-00AA006B6814}\NumMethods]
"(Default)" = "4"

[HKCR\Interface\{6A2E0670-28E4-11D0-A18C-00A0C9118956}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}]
"CLSID" = "{4A2286E0-7BEF-11CE-9BD9-0000E202599C}"

[HKCR\CLSID\{CC785860-B2CA-11CE-8D2B-0000E202599C}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{C6545BF0-E76B-11D0-BD52-00A0C911CE86}\NumMethods]
"(Default)" = "8"

[HKCR\Interface\{56A8689C-0AD4-11CE-B03A-0020AF0BA770}]
"(Default)" = "IMemAllocator"

[HKCR\CLSID\{99D54F63-1A69-41AE-AA4D-C976EB3F0713}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{1E651CC0-B199-11D0-8212-00C04FC32C45}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}]
"CLSID" = "{1643E180-90F5-11CE-97D5-00AA0055595A}"

[HKCR\Interface\{632105FA-072E-11D3-8AF9-00C04FB6BD3D}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{C6E133B0-30AC-11D0-A18C-00A0C9118956}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}]
"(Default)" = "Default Video Renderer"

[HKCR\CLSID\{59CE6880-ACF8-11CF-B56E-0080C7C4B68A}]
"(Default)" = "Performance Property Page"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A}]
"CLSID" = "{D51BD5A3-7548-11CF-A520-0080C77EF58A}"

[HKCR\CLSID\{7D8AA343-6E63-4663-BE90-6B80F66540A3}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{B8E8BD60-0BFE-11D0-AF91-00AA00B67A42}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{00855B90-CE1B-11D0-BD4F-00A0C911CE86}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{D18E17A0-AACB-11D0-AFB0-00AA00B67A42}]
"(Default)" = "IDVEnc"

[HKCR\Interface\{5A4A97E4-94EE-4A55-9751-74B5643AA27D}\NumMethods]
"(Default)" = "5"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767}]
"CLSID" = "{6A08CF80-0E18-11CF-A24D-0020AFD79767}"

[HKCR\Interface\{901DB4C7-31CE-41A2-85DC-8FA0BF41B8DA}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}]
"FriendlyName" = "File stream renderer"

[HKCR\CLSID\{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}]
"(Default)" = "PSFactoryBuffer"

[HKCR\CLSID\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{C6E13340-30AC-11D0-A18C-00A0C9118956}]
"(Default)" = "IAMStreamConfig"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{D51BD5A3-7548-11CF-A520-0080C77EF58A}]
"0" = "0,4,,3b4d554c"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}]
"CLSID" = "{1B544C20-FD0B-11CE-8C63-00AA0044B51E}"

[HKCR\Interface\{31EFAC30-515C-11D0-A9AA-00AA0061BE93}\NumMethods]
"(Default)" = "6"

[HKCR\Interface\{211A8766-03AC-11D1-8D13-00AA00BD8339}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}]
"CLSID" = "{301056D0-6DFF-11D2-9EEB-006008039E37}"

[HKCR\Interface\{E46A9787-2B71-444D-A4B5-1FAB7B708D6A}]
"(Default)" = "IVideoFrameStep"

[HKCR\CLSID\{D51BD5A2-7548-11CF-A520-0080C77EF58A}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{36B73882-C2C8-11CF-8B46-00805F6CEF60}]
"(Default)" = "IFilterGraph2"

[HKCR\Interface\{A03CD5F0-3045-11CF-8C44-00AA006B6814}\NumMethods]
"(Default)" = "31"

[HKCR\Interface\{C6E13350-30AC-11D0-A18C-00A0C9118956}]
"(Default)" = "IAMAnalogVideoDecoder"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770}]
"FilterData" = "02 00 00 00 00 00 40 00 01 00 00 00 00 00 00 00"

[HKCR\Interface\{9B496CE0-811B-11CF-8C77-00AA006B6814}]
"(Default)" = "IAMTimecodeGenerator"

[HKCR\Interface\{34151510-EEC0-11D2-8201-00A0C9D74842}\NumMethods]
"(Default)" = "42"

[HKCR\Interface\{9FD52741-176D-4B36-8F51-CA8F933223BE}\NumMethods]
"(Default)" = "5"

[HKCR\CLSID\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{56A868AF-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}]
"CLSID" = "{336475D0-942A-11CE-A870-00AA002FEAB5}"

[HKCR\Interface\{33BC7430-EEC0-11D2-8201-00A0C9D74842}]
"(Default)" = "IDvdControl2"

[HKCR\Interface\{5ACD6AA0-F482-11CE-8B67-00AA00A3F1A6}\NumMethods]
"(Default)" = "7"

[HKCR\Interface\{56A86895-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{FDFE9681-74A3-11D0-AFA7-00AA00B67A42}]
"FriendlyName" = "QT Decompressor"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}]
"Source Filter" = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKCR\Interface\{F185FE76-E64E-11D2-B76E-00C04FB6BD3D}]
"(Default)" = "IAMPushSource"

[HKCR\CLSID\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}]
"(Default)" = "AVI Decompressor"

[HKCR\Interface\{C6E13360-30AC-11D0-A18C-00A0C9118956}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{C6E13343-30AC-11D0-A18C-00A0C9118956}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{379A0CF0-C1DE-11D2-ABF5-00A0C905F375}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{56A868A4-0AD4-11CE-B03A-0020AF0BA770}]
"(Default)" = "IEnumRegFilters"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB89-524F-11CE-9F53-0020AF0BA770}]
"1" = "4, 4, , 6d6f6f76"
"0" = "4, 4, , 6d646174"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}]
"FriendlyName" = "Line 21 Decoder 2"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}]
"CLSID" = "{A888DF60-1E90-11CF-AC98-00AA004C0FA9}"

[HKCR\Interface\{56A86895-0AD4-11CE-B03A-0020AF0BA770}]
"(Default)" = "IBaseFilter"

[HKCR\CLSID\{79376820-07D0-11CF-A24D-0020AFD79767}]
"(Default)" = "DirectSound Audio Renderer"

[HKCR\Interface\{C6E13350-30AC-11D0-A18C-00A0C9118956}\NumMethods]
"(Default)" = "12"

[HKCR\CLSID\{E436EBB6-524F-11CE-9F53-0020AF0BA770}]
"(Default)" = "File Source (URL)"

[HKCR\CLSID\{51B4ABF3-748F-4E3B-A276-C828330E926A}]
"(Default)" = "Video Mixing Renderer 9"

[HKCR\Interface\{36B73882-C2C8-11CF-8B46-00805F6CEF60}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{B87BEB7B-8D29-423F-AE4D-6582C10175AC}]
"(Default)" = "Video Mixing Renderer"

[HKCR\Interface\{6A2E0670-28E4-11D0-A18C-00A0C9118956}]
"(Default)" = "IAMVideoControl"

[HKCR\CLSID\{D51BD5A3-7548-11CF-A520-0080C77EF58A}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{5A4A97E4-94EE-4A55-9751-74B5643AA27D}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{56A868A2-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{37E92A92-D9AA-11D2-BF84-8EF2B1555AED}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{56A868AD-0AD4-11CE-B03A-0020AF0BA770}\NumMethods]
"(Default)" = "5"

[HKCR\CLSID\{E436EBB2-524F-11CE-9F53-0020AF0BA770}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{C6E13370-30AC-11D0-A18C-00A0C9118956}\NumMethods]
"(Default)" = "6"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{D51BD5A0-7548-11CF-A520-0080C77EF58A}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{99D54F63-1A69-41AE-AA4D-C976EB3F0713}]
"(Default)" = "VMR Allocator Presenter"

[HKCR\CLSID\{060AF76C-68DD-11D0-8FC1-00C04FD9189D}]
"(Default)" = "Seeking"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A}]
"FriendlyName" = "Video Mixing Renderer 9"

[HKCR\CLSID\{E436EBB3-524F-11CE-9F53-0020AF0BA770}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Media Type\Extensions\.mp3]
"Media Type" = "{E436EB83-524F-11CE-9F53-0020AF0BA770}"

[HKCR\Interface\{86303D6D-1C4A-4087-AB42-F711167048EF}\NumMethods]
"(Default)" = "5"

[HKCR\Interface\{58473A19-2BC8-4663-8012-25F81BABDDD1}]
"(Default)" = "IDVRGB219"

[HKCR\CLSID\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}]
"(Default)" = "Video Port Manager"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB6-524F-11CE-9F53-0020AF0BA770}]
"FilterData" = "02 00 00 00 00 00 40 00 01 00 00 00 00 00 00 00"

[HKCR\Interface\{93E5A4E0-2D50-11D2-ABFA-00A0C9C6E38D}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{BF87B6E0-8C27-11D0-B3F0-00AA003761C5}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A}]
"FriendlyName" = "MIDI Parser"

[HKCR\Interface\{BEE3D220-157B-11D0-BD23-00A0C911CE86}]
"(Default)" = "IConfigInterleaving"

[HKCR\CLSID\{07B65360-C445-11CE-AFDE-00AA006C14F4}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{C6545BF1-E76B-11D0-BD52-00A0C911CE86}\NumMethods]
"(Default)" = "6"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}]
"CLSID" = "{D51BD5A5-7548-11CF-A520-0080C77EF58A}"

[HKCR\Interface\{56A868A3-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Media Type\Extensions\.mp3]
"Source Filter" = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}]
"FriendlyName" = "VGA 16 Color Ditherer"

[HKCR\Interface\{56A86897-0AD4-11CE-B03A-0020AF0BA770}]
"(Default)" = "IReferenceClock"

[HKCR\CLSID\{CDA42200-BD88-11d0-BD4E-00A0C911CE86}]
"(Default)" = "Filter Mapper2"

[HKCR\Interface\{A2104830-7C70-11CF-8BCE-00AA00A3F1A6}]
"(Default)" = "IFileSinkFilter"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB89-524F-11CE-9F53-0020AF0BA770}]
"Source Filter" = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKCR\Interface\{34151510-EEC0-11D2-8201-00A0C9D74842}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{B79BB0B0-33C1-11D1-ABE1-00A0C905F375}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}]
"FilterData" = "02 00 00 00 01 00 68 03 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{D51BD5A1-7548-11CF-A520-0080C77EF58A}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}]
"FriendlyName" = "SAMI (CC) Parser"

[HKCR\CLSID\{FDFE9681-74A3-11D0-AFA7-00AA00B67A42}]
"(Default)" = "QT Decompressor"

[HKCR\CLSID\{E5B4EAA0-B2CA-11CE-8D2B-0000E202599C}]
"(Default)" = "MPEG Video Decoder Property Page"

[HKCR\Interface\{211A8760-03AC-11D1-8D13-00AA00BD8339}]
"(Default)" = "IAMTunerNotification"

[HKCR\CLSID\{CDBD8D00-C193-11D0-BD4E-00A0C911CE86}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{29840822-5B84-11D0-BD3B-00A0C911CE86}]
"(Default)" = "ICreateDevEnum"

[HKCR\Interface\{C6545BF1-E76B-11D0-BD52-00A0C911CE86}]
"(Default)" = "IAMDevMemoryControl"

[HKCR\Interface\{C6E133B0-30AC-11D0-A18C-00A0C9118956}\NumMethods]
"(Default)" = "10"

[HKCR\CLSID\{060AF76C-68DD-11D0-8FC1-00C04FD9189D}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{36B73881-C2C8-11CF-8B46-00805F6CEF60}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{7D8AA343-6E63-4663-BE90-6B80F66540A3}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{22320CB2-D41A-11D2-BF7C-D7CB9DF0BF93}\NumMethods]
"(Default)" = "4"

[HKCR\CLSID\{E436EBB8-524F-11CE-9F53-0020AF0BA770}]
"(Default)" = "Filter Graph no thread"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}]
"FriendlyName" = "MPEG Audio Decoder"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A}]
"CLSID" = "{51B4ABF3-748F-4E3B-A276-C828330E926A}"

[HKCR\CLSID\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{B8E8BD60-0BFE-11D0-AF91-00AA00B67A42}\NumMethods]
"(Default)" = "5"

[HKCR\Interface\{56A868A6-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB84-524F-11CE-9F53-0020AF0BA770}]
"0" = "0, 16, FFFFFFFFF100010001800001FFFFFFFF, 000001BA2100010001800001000001BB"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}]
"CLSID" = "{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}"

[HKCR\Interface\{C6E13360-30AC-11D0-A18C-00A0C9118956}]
"(Default)" = "IAMVideoProcAmp"

[HKCR\CLSID\{FEB50740-7BEF-11CE-9BD9-0000E202599C}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{A03CD5F0-3045-11CF-8C44-00AA006B6814}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{07167665-5011-11CF-BF33-00AA0055595A}]
"CLSID" = "{07167665-5011-11CF-BF33-00AA0055595A}"

[HKCR\CLSID\{1E651CC0-B199-11D0-8212-00C04FC32C45}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB8C-524F-11CE-9F53-0020AF0BA770}]
"Source Filter" = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKCR\Interface\{93E5A4E0-2D50-11D2-ABFA-00A0C9C6E38D}\NumMethods]
"(Default)" = "12"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\Interface\{D18E17A0-AACB-11D0-AFB0-00AA00B67A42}\NumMethods]
"(Default)" = "5"

[HKCR\Interface\{5A4A97E4-94EE-4A55-9751-74B5643AA27D}]
"(Default)" = "IDvdCmd"

[HKCR\Interface\{A3D8CEC0-7E5A-11CF-BBC5-00805F6CEF20}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{9B496CE2-811B-11CF-8C77-00AA006B6814}\NumMethods]
"(Default)" = "7"

[HKCR\Interface\{5738E040-B67F-11D0-BD4D-00A0C911CE86}\NumMethods]
"(Default)" = "7"

[HKCR\CLSID\{D51BD5A5-7548-11CF-A520-0080C77EF58A}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{A2104830-7C70-11CF-8BCE-00AA00A3F1A6}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{E436EBB5-524F-11CE-9F53-0020AF0BA770}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{56A86891-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{CC785860-B2CA-11CE-8D2B-0000E202599C}]
"(Default)" = "MPEG Audio Decoder Property Page"

[HKCR\CLSID\{59CE6880-ACF8-11CF-B56E-0080C7C4B68A}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{36B73885-C2C8-11CF-8B46-00805F6CEF60}]
"(Default)" = "IReferenceClock2"

[HKCR\CLSID\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{93E5A4E0-2D50-11D2-ABFA-00A0C9C6E38D}]
"(Default)" = "ICaptureGraphBuilder2"

[HKCR\Interface\{B79BB0B0-33C1-11D1-ABE1-00A0C905F375}]
"(Default)" = "IFilterMapper2"

[HKCR\Interface\{56A868AF-0AD4-11CE-B03A-0020AF0BA770}\NumMethods]
"(Default)" = "8"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767}]
"FriendlyName" = "ACM Wrapper"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}]
"FriendlyName" = "MJPEG Decompressor"

[HKCR\Interface\{211A8761-03AC-11D1-8D13-00AA00BD8339}]
"(Default)" = "IAMTuner"

[HKCR\CLSID\{944D4C00-DD52-11CE-BF0E-00AA0055595A}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{C6E13344-30AC-11D0-A18C-00A0C9118956}\NumMethods]
"(Default)" = "7"

[HKCR\CLSID\{E436EBB2-524F-11CE-9F53-0020AF0BA770}]
"(Default)" = "Filter Mapper"

[HKCR\Interface\{36B73881-C2C8-11CF-8B46-00805F6CEF60}]
"(Default)" = "IAMStreamControl"

[HKCR\Interface\{56A868AF-0AD4-11CE-B03A-0020AF0BA770}]
"(Default)" = "IDistributorNotify"

[HKCR\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{56A8689C-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A0-7548-11CF-A520-0080C77EF58A}]
"CLSID" = "{D51BD5A0-7548-11CF-A520-0080C77EF58A}"

[HKCR\Interface\{56A86899-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}]
"(Default)" = "MPEG Audio Codec"

[HKCR\Interface\{F185FE76-E64E-11D2-B76E-00C04FB6BD3D}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{6A08CF80-0E18-11CF-A24D-0020AFD79767}]
"(Default)" = "ACM Wrapper"

[HKCR\CLSID\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{56A86892-0AD4-11CE-B03A-0020AF0BA770}\NumMethods]
"(Default)" = "7"

[HKCR\Interface\{C6545BF0-E76B-11D0-BD52-00A0C911CE86}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{06B32AEE-77DA-484B-973B-5D64F47201B0}]
"(Default)" = "VMR Mixer"

[HKCR\Interface\{6025A880-C0D5-11D0-BD4E-00A0C911CE86}]
"(Default)" = "IMediaPropertyBag"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB6-524F-11CE-9F53-0020AF0BA770}]
"CLSID" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A}]
"FilterData" = "02 00 00 00 00 00 40 00 01 00 00 00 00 00 00 00"

[HKCR\Interface\{BF87B6E0-8C27-11D0-B3F0-00AA003761C5}\NumMethods]
"(Default)" = "11"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{07167665-5011-11CF-BF33-00AA0055595A}]
"FilterData" = "02 00 00 00 00 00 20 00 01 00 00 00 00 00 00 00"

[HKCR\Interface\{56A868A9-0AD4-11CE-B03A-0020AF0BA770}]
"(Default)" = "IGraphBuilder"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{48025243-2D39-11CE-875D-00608CB78066}]
"CLSID" = "{48025243-2D39-11CE-875D-00608CB78066}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{07167665-5011-11CF-BF33-00AA0055595A}]
"FriendlyName" = "Full Screen Renderer"

[HKCR\Interface\{56A868AB-0AD4-11CE-B03A-0020AF0BA770}\NumMethods]
"(Default)" = "4"

[HKCR\CLSID\{E436EBB1-524F-11CE-9F53-0020AF0BA770}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{9FD52741-176D-4B36-8F51-CA8F933223BE}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{54C39221-8380-11D0-B3F0-00AA003761C5}]
"(Default)" = "IAMAudioInputMixer"

[HKCR\Interface\{58473A19-2BC8-4663-8012-25F81BABDDD1}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{02997C3B-8E1B-460E-9270-545E0DE9563E}]
"(Default)" = "IVideoEncoder"

[HKCR\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\MJPEG Compressor]
"FriendlyName" = "MJPEG Compressor"

[HKCR\Interface\{9B496CE2-811B-11CF-8C77-00AA006B6814}]
"(Default)" = "IAMTimecodeDisplay"

[HKCR\Interface\{56A868A5-0AD4-11CE-B03A-0020AF0BA770}\NumMethods]
"(Default)" = "5"

[HKCR\CLSID\{E4979309-7A32-495E-8A92-7B014AAD4961}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{56A86892-0AD4-11CE-B03A-0020AF0BA770}]
"(Default)" = "IEnumPins"

[HKCR\CLSID\{336475D0-942A-11CE-A870-00AA002FEAB5}]
"(Default)" = "MPEG-I Stream Splitter"

[HKCR\CLSID\{07B65360-C445-11CE-AFDE-00AA006C14F4}]
"(Default)" = "MIDI Renderer"

[HKCR\Interface\{BF87B6E0-8C27-11D0-B3F0-00AA003761C5}]
"(Default)" = "ICaptureGraphBuilder"

[HKCR\CLSID\{07167665-5011-11CF-BF33-00AA0055595A}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{7364696D-0000-0010-8000-00AA00389B71}]
"Source Filter" = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKCR\Interface\{9B496CE0-811B-11CF-8C77-00AA006B6814}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{62FAE250-7E65-4460-BFC9-6398B322073C}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{36B73885-C2C8-11CF-8B46-00805F6CEF60}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{F90A6130-B658-11D2-AE49-0000F8754B99}]
"(Default)" = "IAMDeviceRemoval"

[HKCR\CLSID\{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}\InProcServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}\NumMethods]
"(Default)" = "4"

[HKCR\Interface\{92980B30-C1DE-11D2-ABF5-00A0C905F375}\NumMethods]
"(Default)" = "4"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}]
"FriendlyName" = "AVI Splitter"

[HKCR\Interface\{E46A9787-2B71-444D-A4B5-1FAB7B708D6A}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB87-524F-11CE-9F53-0020AF0BA770}]
"Source Filter" = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{B87BEB7B-8D29-423F-AE4D-6582C10175AC}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{62EA93BA-EC62-11D2-B770-00C04FB6BD3D}]
"(Default)" = "IAMLatency"

[HKCR\Interface\{A3D8CEC0-7E5A-11CF-BBC5-00805F6CEF20}\NumMethods]
"(Default)" = "5"

[HKCR\CLSID\{48025243-2D39-11CE-875D-00608CB78066}]
"(Default)" = "Internal Text Renderer"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}]
"CLSID" = "{E4206432-01A1-4BEE-B3E1-3702C8EDC574}"

[HKCR\Interface\{901DB4C7-31CE-41A2-85DC-8FA0BF41B8DA}\NumMethods]
"(Default)" = "18"

[HKCR\CLSID\{05589FAF-C356-11CE-BF01-00AA0055595A}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E06D8022-DB46-11CF-B4D1-00805F6CBBEA}]
"Source Filter" = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{944D4C00-DD52-11CE-BF0E-00AA0055595A}]
"(Default)" = "DirectDraw Property Page"

[HKCR\Interface\{BEE3D220-157B-11D0-BD23-00A0C911CE86}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{FEB50740-7BEF-11CE-9BD9-0000E202599C}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{51B4ABF3-748F-4E3B-A276-C828330E926A}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{56ED71A0-AF5F-11D0-B3F0-00AA003761C5}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{4444AC9E-242E-471B-A3C7-45DCD46352BC}]
"(Default)" = "VMR Allocator Presenter DDXcl Mode"

[HKCR\Interface\{5ACD6AA0-F482-11CE-8B67-00AA00A3F1A6}]
"(Default)" = "IConfigAviMux"

[HKCR\CLSID\{301056D0-6DFF-11D2-9EEB-006008039E37}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{56A868AD-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{D51BD5A3-7548-11CF-A520-0080C77EF58A}]
"Source Filter" = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{FDFE9681-74A3-11D0-AFA7-00AA00B67A42}]
"CLSID" = "{FDFE9681-74A3-11D0-AFA7-00AA00B67A42}"

[HKCR\Interface\{6A2E0670-28E4-11D0-A18C-00A0C9118956}\NumMethods]
"(Default)" = "9"

[HKCR\CLSID\{CDA42200-BD88-11d0-BD4E-00A0C911CE86}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{56A86891-0AD4-11CE-B03A-0020AF0BA770}]
"(Default)" = "IPin"

[HKCR\CLSID\{1BB05961-5FBF-11D2-A521-44DF07C10000}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{56A86893-0AD4-11CE-B03A-0020AF0BA770}]
"(Default)" = "IEnumFilters"

[HKCR\Interface\{29840822-5B84-11D0-BD3B-00A0C911CE86}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{56A868A4-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{1BB05961-5FBF-11D2-A521-44DF07C10000}]
"(Default)" = "XML Graphbuilder"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB8C-524F-11CE-9F53-0020AF0BA770}]
"0" = "0,4,,2e736e64"

[HKCR\CLSID\{D51BD5A5-7548-11CF-A520-0080C77EF58A}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{86303D6D-1C4A-4087-AB42-F711167048EF}]
"(Default)" = "IDvdState"

[HKCR\Interface\{C6E13343-30AC-11D0-A18C-00A0C9118956}\NumMethods]
"(Default)" = "14"

[HKCR\CLSID\{2D2E24CB-0CD5-458F-86EA-3E6FA22C8E64}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{33BC7430-EEC0-11D2-8201-00A0C9D74842}\NumMethods]
"(Default)" = "43"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}]
"CLSID" = "{CF49D4E0-1115-11CE-B03A-0020AF0BA770}"

[HKCR\Interface\{C6E13350-30AC-11D0-A18C-00A0C9118956}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{56A868A9-0AD4-11CE-B03A-0020AF0BA770}\NumMethods]
"(Default)" = "18"

[HKCR\CLSID\{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}\InProcServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{670D1D20-A068-11D0-B3F0-00AA003761C5}\NumMethods]
"(Default)" = "4"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB85-524F-11CE-9F53-0020AF0BA770}]
"Source Filter" = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}]
"FilterData" = "02 00 00 00 64 00 60 00 0A 00 00 00 00 00 00 00"

[HKCR\CLSID\{FEB50740-7BEF-11CE-9BD9-0000E202599C}]
"(Default)" = "MPEG Video Codec"

[HKCR\CLSID\{FDFE9681-74A3-11D0-AFA7-00AA00B67A42}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{0618AA30-6BC4-11CF-BF36-00AA0055595A}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{56A868A9-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{89C31040-846B-11CE-97D3-00AA0055595A}]
"(Default)" = "IEnumMediaTypes"

[HKCR\Interface\{56A868AA-0AD4-11CE-B03A-0020AF0BA770}]
"(Default)" = "IAsyncReader"

[HKCR\Interface\{5738E040-B67F-11D0-BD4D-00A0C911CE86}]
"(Default)" = "IPersistMediaPropertyBag"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB86-524F-11CE-9F53-0020AF0BA770}]
"Source Filter" = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{D51BD5A2-7548-11CF-A520-0080C77EF58A}]
"(Default)" = "MIDI Parser"

[HKCR\Interface\{B79BB0B0-33C1-11D1-ABE1-00A0C905F375}\NumMethods]
"(Default)" = "7"

[HKCR\CLSID\{301056D0-6DFF-11D2-9EEB-006008039E37}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{1643E180-90F5-11CE-97D5-00AA0055595A}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{6A08CF80-0E18-11CF-A24D-0020AFD79767}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{A70EFE60-E2A3-11D0-A9BE-00AA0061BE93}]
"(Default)" = "IDvdInfo"

[HKCR\Interface\{56A8689F-0AD4-11CE-B03A-0020AF0BA770}\NumMethods]
"(Default)" = "11"

[HKCR\Interface\{92980B30-C1DE-11D2-ABF5-00A0C905F375}]
"(Default)" = "IMemAllocatorNotifyCallbackTemp"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\Interface\{62FAE250-7E65-4460-BFC9-6398B322073C}\NumMethods]
"(Default)" = "6"

[HKCR\CLSID\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{B80AB0A0-7416-11D2-9EEB-006008039E37}]
"(Default)" = "MJPEG Compressor"

[HKCR\Interface\{36B73883-C2C8-11CF-8B46-00805F6CEF60}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{9B496CE1-811B-11CF-8C77-00AA006B6814}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770}]
"FriendlyName" = "AVI/WAV File Source"

[HKCR\Interface\{9B496CE0-811B-11CF-8C77-00AA006B6814}\NumMethods]
"(Default)" = "9"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB88-524F-11CE-9F53-0020AF0BA770}]
"Source Filter" = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}]
"FriendlyName" = "Color Space Converter"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB85-524F-11CE-9F53-0020AF0BA770}]
"0" = "0, 4, , 52494646, 8, 8, , 43445841666D7420, 36, 20, FFFFFFFF00000000FFFFFFFFFFFFFFFFFFFFFFFF, 646174610000000000FFFFFFFFFFFFFFFFFFFF00"

[HKCR\Interface\{36B73880-C2C8-11CF-8B46-00805F6CEF60}\NumMethods]
"(Default)" = "20"

[HKCR\Interface\{56A8689F-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{56A86897-0AD4-11CE-B03A-0020AF0BA770}\NumMethods]
"(Default)" = "7"

[HKCR\CLSID\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E06D8022-DB46-11CF-B4D1-00805F6CBBEA}]
"0" = "0, 5, FFFFFFFFC0 ,000001BA40"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}]
"FilterData" = "02 00 00 00 02 00 60 00 02 00 00 00 00 00 00 00"

[HKCR\Interface\{56A868A6-0AD4-11CE-B03A-0020AF0BA770}\NumMethods]
"(Default)" = "5"

[HKCR\CLSID\{37E92A92-D9AA-11D2-BF84-8EF2B1555AED}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{00855B90-CE1B-11D0-BD4F-00A0C911CE86}]
"(Default)" = "IFileSinkFilter2"

[HKCR\CLSID\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}]
"(Default)" = "AVI Draw Filter"

[HKCR\Interface\{A70EFE61-E2A3-11D0-A9BE-00AA0061BE93}]
"(Default)" = "IDvdControl"

[HKCR\Interface\{56A86893-0AD4-11CE-B03A-0020AF0BA770}\NumMethods]
"(Default)" = "7"

[HKCR\CLSID\{E5B4EAA0-B2CA-11CE-8D2B-0000E202599C}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}]
"CLSID" = "{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}"

[HKCR\Interface\{56A868A2-0AD4-11CE-B03A-0020AF0BA770}]
"(Default)" = "IMediaEventSink"

[HKCR\CLSID\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}]
"(Default)" = "SAMI (CC) Reader"

[HKCR\CLSID\{D51BD5A3-7548-11CF-A520-0080C77EF58A}]
"(Default)" = "Multi-file Parser"

[HKCR\CLSID\{D3588AB0-0781-11CE-B03A-0020AF0BA770}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{379A0CF0-C1DE-11D2-ABF5-00A0C905F375}\NumMethods]
"(Default)" = "11"

[HKCR\Interface\{C6E13380-30AC-11D0-A18C-00A0C9118956}]
"(Default)" = "IAMCrossbar"

[HKCR\Interface\{22320CB2-D41A-11D2-BF7C-D7CB9DF0BF93}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{1E651CC0-B199-11D0-8212-00C04FC32C45}]
"(Default)" = "Memory Allocator"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}]
"FriendlyName" = "Video Port Manager"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}]
"CLSID" = "{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}"

[HKCR\CLSID\{E436EBB6-524F-11CE-9F53-0020AF0BA770}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{54C39221-8380-11D0-B3F0-00AA003761C5}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{C6E13380-30AC-11D0-A18C-00A0C9118956}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{E436EBB8-524F-11CE-9F53-0020AF0BA770}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{E436EBB3-524F-11CE-9F53-0020AF0BA770}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{56A86899-0AD4-11CE-B03A-0020AF0BA770}]
"(Default)" = "IMediaFilter"

[HKCR\Interface\{9B496CE2-811B-11CF-8C77-00AA006B6814}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}]
"FilterData" = "02 00 00 00 01 00 00 40 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{4444AC9E-242E-471B-A3C7-45DCD46352BC}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{E436EBB8-524F-11CE-9F53-0020AF0BA770}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}]
"CLSID" = "{FEB50740-7BEF-11CE-9BD9-0000E202599C}"

[HKCR\CLSID\{2D2E24CB-0CD5-458F-86EA-3E6FA22C8E64}]
"(Default)" = "VMR Allocator Presenter 9"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB86-524F-11CE-9F53-0020AF0BA770}]
"0" = "0, 4, , 000001B3"

[HKCR\Interface\{C6E13344-30AC-11D0-A18C-00A0C9118956}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{A70EFE61-E2A3-11D0-A9BE-00AA0061BE93}\NumMethods]
"(Default)" = "38"

[HKCR\Interface\{D18E17A0-AACB-11D0-AFB0-00AA00B67A42}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{05589FAF-C356-11CE-BF01-00AA0055595A}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{79376820-07D0-11CF-A24D-0020AFD79767}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{37E92A92-D9AA-11D2-BF84-8EF2B1555AED}]
"(Default)" = "Audio Renderer Advanced Properties"

[HKCR\CLSID\{CC785860-B2CA-11CE-8D2B-0000E202599C}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{07B65360-C445-11CE-AFDE-00AA006C14F4}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{901DB4C7-31CE-41A2-85DC-8FA0BF41B8DA}]
"(Default)" = "ICodecAPI"

[HKCR\Interface\{56A868AC-0AD4-11CE-B03A-0020AF0BA770}\NumMethods]
"(Default)" = "11"

[HKCR\Interface\{C6E13370-30AC-11D0-A18C-00A0C9118956}]
"(Default)" = "IAMCameraControl"

[HKCR\Interface\{56A86891-0AD4-11CE-B03A-0020AF0BA770}\NumMethods]
"(Default)" = "18"

[HKCR\Interface\{54C39221-8380-11D0-B3F0-00AA003761C5}\NumMethods]
"(Default)" = "19"

[HKCR\CLSID\{FDFE9681-74A3-11D0-AFA7-00AA00B67A42}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{56ED71A0-AF5F-11D0-B3F0-00AA003761C5}\NumMethods]
"(Default)" = "5"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}]
"FriendlyName" = "Wave Parser"

[HKCR\CLSID\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{56A868AC-0AD4-11CE-B03A-0020AF0BA770}]
"(Default)" = "IResourceManager"

[HKCR\Interface\{92980B30-C1DE-11D2-ABF5-00A0C905F375}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{56A868AB-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\MJPEG Compressor]
"CLSID" = "{B80AB0A0-7416-11D2-9EEB-006008039E37}"

[HKCR\Interface\{B79BB0B1-33C1-11D1-ABE1-00A0C905F375}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{70E102B0-5556-11CE-97C0-00AA0055595A}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{07167665-5011-11CF-BF33-00AA0055595A}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{9FD52741-176D-4B36-8F51-CA8F933223BE}]
"(Default)" = "IAMClockSlave"

[HKCR\CLSID\{418AFB70-F8B8-11CE-AAC6-0020AF0B99A3}]
"(Default)" = "Quality Management Property Page"

[HKCR\CLSID\{0618AA30-6BC4-11CF-BF36-00AA0055595A}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{A8DFB9A0-8A20-479F-B538-9387C5EEBA2B}]
"(Default)" = "VMR Mixer 9"

[HKCR\CLSID\{336475D0-942A-11CE-A870-00AA002FEAB5}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{B80AB0A0-7416-11D2-9EEB-006008039E37}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{B8E8BD60-0BFE-11D0-AF91-00AA00B67A42}]
"(Default)" = "IIPDVDec"

[HKCR\Interface\{56A868AA-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{E436EBB1-524F-11CE-9F53-0020AF0BA770}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A0-7548-11CF-A520-0080C77EF58A}]
"FriendlyName" = "QuickTime Movie Parser"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}]
"FilterData" = "02 00 00 00 00 00 60 00 03 00 00 00 00 00 00 00"

[HKCR\Interface\{36B73883-C2C8-11CF-8B46-00805F6CEF60}]
"(Default)" = "ISeekingPassThru"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB8D-524F-11CE-9F53-0020AF0BA770}]
"0" = "0,4,,464f524d,8,4,,41494646"
"1" = "0,4,,464f524d,8,4,,41494643"

[HKCR\Interface\{02997C3B-8E1B-460E-9270-545E0DE9563E}\NumMethods]
"(Default)" = "10"

[HKCR\Interface\{211A8766-03AC-11D1-8D13-00AA00BD8339}]
"(Default)" = "IAMTVTuner"

[HKCR\CLSID\{1643E180-90F5-11CE-97D5-00AA0055595A}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{70423839-6ACC-4B23-B079-21DBF08156A5}\NumMethods]
"(Default)" = "10"

[HKCR\CLSID\{CDA42200-BD88-11d0-BD4E-00A0C911CE86}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{060AF76C-68DD-11D0-8FC1-00C04FD9189D}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB88-524F-11CE-9F53-0020AF0BA770}]
"0" = "0,4,,52494646,8,4,,41564920"

[HKCR\Interface\{A03CD5F0-3045-11CF-8C44-00AA006B6814}]
"(Default)" = "IAMExtTransport"

[HKCR\Interface\{C6E13340-30AC-11D0-A18C-00A0C9118956}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{4444AC9E-242E-471B-A3C7-45DCD46352BC}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\HTTP]
"Source Filter" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{D51BD5A5-7548-11CF-A520-0080C77EF58A}]
"(Default)" = "File stream renderer"

[HKCR\Interface\{36B73881-C2C8-11CF-8B46-00805F6CEF60}\NumMethods]
"(Default)" = "6"

[HKCR\CLSID\{A8DFB9A0-8A20-479F-B538-9387C5EEBA2B}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{51B4ABF3-748F-4E3B-A276-C828330E926A}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{C6E13360-30AC-11D0-A18C-00A0C9118956}\NumMethods]
"(Default)" = "6"

[HKCR\Interface\{56A86895-0AD4-11CE-B03A-0020AF0BA770}\NumMethods]
"(Default)" = "15"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}]
"FilterData" = "02 00 00 00 00 00 60 00 03 00 00 00 00 00 00 00"

[HKCR\CLSID\{D51BD5A0-7548-11CF-A520-0080C77EF58A}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{B5730A90-1A2C-11CF-8C23-00AA006B6814}]
"(Default)" = "IAMExtDevice"

[HKCR\Interface\{F90A6130-B658-11D2-AE49-0000F8754B99}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{56A8689D-0AD4-11CE-B03A-0020AF0BA770}\NumMethods]
"(Default)" = "9"

[HKCR\Interface\{56A868AB-0AD4-11CE-B03A-0020AF0BA770}]
"(Default)" = "IGraphVersion"

[HKCR\Interface\{F938C991-3029-11CF-8C44-00AA006B6814}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{B5730A90-1A2C-11CF-8C23-00AA006B6814}\NumMethods]
"(Default)" = "11"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}]
"FilterData" = "02 00 00 00 01 00 80 00 01 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}]
"FilterData" = "02 00 00 00 00 00 60 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{E4979309-7A32-495E-8A92-7B014AAD4961}]
"(Default)" = "VMR ImageSync 9"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}]
"FilterData" = "02 00 00 00 01 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\Interface\{BEE3D220-157B-11D0-BD23-00A0C911CE86}\NumMethods]
"(Default)" = "7"

[HKCR\CLSID\{E5B4EAA0-B2CA-11CE-8D2B-0000E202599C}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{CDBD8D00-C193-11D0-BD4E-00A0C911CE86}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}]
"FilterData" = "02 00 00 00 00 00 40 00 02 00 00 00 00 00 00 00"

[HKCR\Interface\{9B496CE1-811B-11CF-8C77-00AA006B6814}\NumMethods]
"(Default)" = "8"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB8D-524F-11CE-9F53-0020AF0BA770}]
"Source Filter" = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"

[HKCR\Interface\{A2104830-7C70-11CF-8BCE-00AA00A3F1A6}\NumMethods]
"(Default)" = "5"

[HKCR\CLSID\{B87BEB7B-8D29-423F-AE4D-6582C10175AC}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{B79BB0B1-33C1-11D1-ABE1-00A0C905F375}]
"(Default)" = "IFilterMapper3"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{48025243-2D39-11CE-875D-00608CB78066}]
"FilterData" = "02 00 00 00 01 00 80 00 01 00 00 00 00 00 00 00"

[HKCR\CLSID\{07167665-5011-11CF-BF33-00AA0055595A}]
"(Default)" = "Full Screen Renderer"

[HKCR\Interface\{56A868A5-0AD4-11CE-B03A-0020AF0BA770}]
"(Default)" = "IQualityControl"

[HKCR\Interface\{C6E13380-30AC-11D0-A18C-00A0C9118956}\NumMethods]
"(Default)" = "8"

[HKCR\CLSID\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770}]
"FriendlyName" = "File Source (Async.)"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{FDFE9681-74A3-11D0-AFA7-00AA00B67A42}]
"FilterData" = "02 00 00 00 00 00 60 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}]
"FilterData" = "02 00 00 00 00 00 60 00 02 00 00 00 00 00 00 00"

[HKCR\CLSID\{301056D0-6DFF-11D2-9EEB-006008039E37}]
"(Default)" = "MJPEG Decompressor"

[HKCR\CLSID\{E436EBB6-524F-11CE-9F53-0020AF0BA770}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{79376820-07D0-11CF-A24D-0020AFD79767}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{56A86893-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}]
"FriendlyName" = "MPEG-I Stream Splitter"

[HKCR\CLSID\{06B32AEE-77DA-484B-973B-5D64F47201B0}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB6-524F-11CE-9F53-0020AF0BA770}]
"FriendlyName" = "File Source (URL)"

[HKCR\Interface\{A3D8CEC0-7E5A-11CF-BBC5-00805F6CEF20}]
"(Default)" = "IAMovieSetup"

[HKCR\CLSID\{59CE6880-ACF8-11CF-B56E-0080C7C4B68A}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\Interface\{56A868A6-0AD4-11CE-B03A-0020AF0BA770}]
"(Default)" = "IFileSourceFilter"

[HKCR\Interface\{6025A880-C0D5-11D0-BD4E-00A0C911CE86}\NumMethods]
"(Default)" = "6"

[HKCR\Interface\{5ACD6AA0-F482-11CE-8B67-00AA00A3F1A6}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{632105FA-072E-11D3-8AF9-00C04FB6BD3D}\NumMethods]
"(Default)" = "6"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A0-7548-11CF-A520-0080C77EF58A}]
"FilterData" = "02 00 00 00 00 00 60 00 02 00 00 00 00 00 00 00"

[HKCR\Interface\{56A868AD-0AD4-11CE-B03A-0020AF0BA770}]
"(Default)" = "IResourceConsumer"

[HKCR\Interface\{29840822-5B84-11D0-BD3B-00A0C911CE86}\NumMethods]
"(Default)" = "4"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}]
"CLSID" = "{33FACFE0-A9BE-11D0-A520-00A0D10129C0}"

[HKCR\Interface\{31EFAC30-515C-11D0-A9AA-00AA0061BE93}]
"(Default)" = "IKsPropertySet"

[HKCR\Interface\{62EA93BA-EC62-11D2-B770-00C04FB6BD3D}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{CDBD8D00-C193-11D0-BD4E-00A0C911CE86}]
"(Default)" = "CMediaPropertyBag"

[HKCR\CLSID\{D51BD5A1-7548-11CF-A520-0080C77EF58A}\InprocServer32]
"(Default)" = "%System%\quartz.dll"

[HKCR\CLSID\{E436EBB7-524F-11CE-9F53-0020AF0BA770}]
"(Default)" = "IPersistMoniker Plug In Distributor"

[HKCR\gopher]
"Source Filter" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A}]
"FriendlyName" = "Multi-file Parser"

[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767}]
"FilterData" = "02 00 00 00 00 00 60 00 02 00 00 00 00 00 00 00"

[HKCR\Interface\{56A868A5-0AD4-11CE-B03A-0020AF0BA770}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{F185FE76-E64E-11D2-B76E-00C04FB6BD3D}\NumMethods]
"(Default)" = "10"

[HKCR\Interface\{89C31040-846B-11CE-97D3-00AA0055595A}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\CLSID\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{31EFAC30-515C-11D0-A9AA-00AA0061BE93}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\Interface\{62FAE250-7E65-4460-BFC9-6398B322073C}]
"(Default)" = "IAMOverlayFX"

[HKCR\Interface\{62EA93BA-EC62-11D2-B770-00C04FB6BD3D}\NumMethods]
"(Default)" = "4"

[HKCR\Interface\{211A8760-03AC-11D1-8D13-00AA00BD8339}\NumMethods]
"(Default)" = "4"

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{7364696D-0000-0010-8000-00AA00389B71}]
"1" = "0,4,,4D546864"
"0" = "0,4,,52494646,8,4,,524D4944"

[HKCR\CLSID\{A8DFB9A0-8A20-479F-B538-9387C5EEBA2B}\InprocServer32]
"ThreadingModel" = "Both"

[HKCR\Interface\{C1960960-17F5-11D1-ABE1-00A0C905F375}\NumMethods]
"(Default)" = "6"

[HKCR\Interface\{F90A6130-B658-11D2-AE49-0000F8754B99}\NumMethods]
"(Default)" = "6"

[HKCR\Interface\{70423839-6ACC-4B23-B079-21DBF08156A5}\ProxyStubClsid32]
"(Default)" = "{92A3A302-DA7C-4A1F-BA7E-1802BB5D2D02}"

[HKCR\ftp]
"Source Filter" = "{E436EBB6-524F-11CE-9F53-0020AF0BA770}"

[HKCR\Interface\{E46A9787-2B71-444D-A4B5-1FAB7B708D6A}\NumMethods]
"(Default)" = "6"

[HKCR\CLSID\{E436EBB5-524F-11CE-9F53-0020AF0BA770}]
"(Default)" = "File Source (Async.)"

[HKCR\Media Type\Extensions\.mp3]
"SubType" = "{E436EB87-524F-11CE-9F53-0020AF0BA770}"

The Backdoor deletes the following registry key(s):

[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A0-7548-11CF-A520-0080C77EF58A}]
[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB85-524F-11CE-9F53-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{07167665-5011-11CF-BF33-00AA0055595A}]
[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB8B-524F-11CE-9F53-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{33FACFE0-A9BE-11D0-A520-00A0D10129C0}]
[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{D51BD5A3-7548-11CF-A520-0080C77EF58A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6A08CF80-0E18-11CF-A24D-0020AFD79767}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A2-7548-11CF-A520-0080C77EF58A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB5-524F-11CE-9F53-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{51B4ABF3-748F-4E3B-A276-C828330E926A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{336475D0-942A-11CE-A870-00AA002FEAB5}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A3-7548-11CF-A520-0080C77EF58A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}]
[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB88-524F-11CE-9F53-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1DA08500-9EDC-11CF-BC10-00AA00AC74F6}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{CF49D4E0-1115-11CE-B03A-0020AF0BA770}]
[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB87-524F-11CE-9F53-0020AF0BA770}]
[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB89-524F-11CE-9F53-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1B544C20-FD0B-11CE-8C63-00AA0044B51E}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{FDFE9681-74A3-11D0-AFA7-00AA00B67A42}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{1643E180-90F5-11CE-97D5-00AA0055595A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6F26A6CD-967B-47FD-874A-7AED2C9D25A2}]
[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB8C-524F-11CE-9F53-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{70E102B0-5556-11CE-97C0-00AA0055595A}]
[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{7364696D-0000-0010-8000-00AA00389B71}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{6BC1CFFA-8FC1-4261-AC22-CFB4CC38DB50}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{301056D0-6DFF-11D2-9EEB-006008039E37}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{A888DF60-1E90-11CF-AC98-00AA004C0FA9}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E4206432-01A1-4BEE-B3E1-3702C8EDC574}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{E436EBB6-524F-11CE-9F53-0020AF0BA770}]
[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB86-524F-11CE-9F53-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{48025243-2D39-11CE-875D-00608CB78066}]
[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E06D8022-DB46-11CF-B4D1-00805F6CBBEA}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A1-7548-11CF-A520-0080C77EF58A}]
[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB84-524F-11CE-9F53-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{D3588AB0-0781-11CE-B03A-0020AF0BA770}]
[HKCR\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{4A2286E0-7BEF-11CE-9BD9-0000E202599C}]
[HKCR\Media Type\{e436eb83-524f-11ce-9f53-0020af0ba770}\{E436EB8D-524F-11CE-9F53-0020AF0BA770}]

The process FX_82068094_3.exe:1604 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKCR\BaiduBarX.ToolBand\CurVer]
"(Default)" = "BaiduBarX.ToolBand.1"

[HKCR\CLSID\{23A2B2B7-21DE-4B88-AFBA-5A918ABBF463}\TypeLib]
"(Default)" = "{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}"

[HKCR\Interface\{7EF05EFF-0E62-4040-8D81-73A10D8DE60F}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\baidu\BaiduToolbar\NoAD]
"AllPic_State" = "0"

[HKLM\SOFTWARE\Baidu\BaiduToolbar]
"ID" = "82068094_3_cb"

[HKCR\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\InprocServer32]
"(Default)" = "%Program Files%\Baidu\Toolbar\BaiduBarX.dll"

[HKCR\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\ProgID]
"(Default)" = "BaiduBar.Tool.1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BaiduBarX]
"Publisher" = "Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥â€¦Â¬Ã¥ÂÂ¸"

[HKCR\BaiduBarX.BDLogin.1\CLSID]
"(Default)" = "{23A2B2B7-21DE-4B88-AFBA-5A918ABBF463}"

[HKCR\BaiduBarX.ToolBand.1]
"(Default)" = "Ã‚Â°Ãƒâ„¢Ã‚Â¶ÃƒË†Ã‚Â¹Ã‚Â¤Ã‚Â¾ÃƒÅ¸Ãƒâ‚¬Ã‚Â¸"

[HKCR\TypeLib\{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}\1.0]
"(Default)" = "BaiduBarX 1.0 Type Library"

[HKCR\CLSID\{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}\ProgID]
"(Default)" = "BaiduBarEx.BDHomePage.5"

[HKLM\SOFTWARE\Baidu\BaiduToolbar]
"idtmp" = "82068094_3_cb"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{B580CF65-E151-49C3-B73F-70B13FCA8E86}" = "12"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\Interface\{6C773CA2-F142-4B2C-981A-FD3B1BEC1578}\TypeLib]
"(Default)" = "{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}"

[HKCU\Software\baidu\BaiduToolbar\NoAD]
"AllVoice_State" = "0"

[HKCR\Interface\{D158174C-004B-4A2E-9410-5442C10C60D2}]
"(Default)" = "IBandIE"

[HKCR\CLSID\{77FEF28E-EB96-44FF-B511-3185DEA48697}]
"(Default)" = "Baidu Toolbar BHO"

[HKCR\CLSID\{23A2B2B7-21DE-4B88-AFBA-5A918ABBF463}]
"(Default)" = "BDLogin Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BaiduBarX]
"UninstallString" = "%Program Files%\Baidu\Toolbar\BarBroker.exe -runasAdmin -SVCUninstall"

[HKCR\BaiduBarX.BDLogin]
"(Default)" = "BDLogin Class"

[HKCR\CLSID\{23A2B2B7-21DE-4B88-AFBA-5A918ABBF463}\InprocServer32]
"(Default)" = "%Program Files%\Baidu\Toolbar\BaiduBarX.dll"

[HKCR\Interface\{4C2BFEC9-F03C-4F74-932E-5723E603B4AC}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCR\BaiduBarX.BandIE\CurVer]
"(Default)" = "BaiduBarX.BandIE.1"

[HKCR\CLSID\{77FEF28E-EB96-44FF-B511-3185DEA48697}\InprocServer32]
"(Default)" = "%Program Files%\Baidu\Toolbar\BaiduBarX.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BaiduBarX]
"URLUpdateInfo" = "http://toolbar.baidu.com/"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\D:\XIAOBAI\SHADOW\@XB_@DATA\TEMP\~XBINIT.FLG,"

[HKCR\CLSID\{77FEF28E-EB96-44FF-B511-3185DEA48697}\InprocServer32]
"ThreadingModel" = "both"

[HKCR\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\VersionIndependentProgID]
"(Default)" = "BaiduBar.Tool"

[HKCU\Software\Microsoft\Internet Explorer\TypedURLs]
"url1" = "http://www.baidu.com/index.php?tn=baidudg&addresssearch=1"
"url2" = "http://www.baidu.com/index.php?tn=baidudg&addresssearch=2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\baidu\BaiduToolbar\NoAD\Page_Block]
"5" = "*doubleclick.*"

[HKCR\Interface\{D158174C-004B-4A2E-9410-5442C10C60D2}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\BaiduBarEx.BDHomePage.5]
"(Default)" = "Ã‚Â°Ãƒâ„¢Ã‚Â¶ÃƒË†Ã‚Â¹Ã‚Â¤Ã‚Â¾ÃƒÅ¸Ãƒâ‚¬Ã‚Â¸Ã‚Â¸ÃƒÂ¶ÃƒÂÃƒâ€Ã‚Â»Ã‚Â¯ÃƒÅ Ãƒâ€”Ãƒâ€™Ã‚Â³Ãƒâ€“Ã‚Â§Ã‚Â³Ãƒâ€“Ãƒâ€”ÃƒÂ©Ã‚Â¼ÃƒÂ¾"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Baidu\Toolbar]
"BarBroker.exe" = "Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â ÂÃ¨Â¾â€¦Ã¥Å Â©Ã¥Âºâ€Ã§â€Â¨Ã§Â¨â€¹Ã¥ÂºÂÃ£â‚¬â€š"

[HKCU\Software\baidu\BaiduToolbar\NoAD\Page_Block]
"0" = "*/ad.*"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCR\CLSID\{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}\InprocServer32]
"(Default)" = "%Program Files%\Baidu\Toolbar\BaiduBarX.dll"

[HKCR\CLSID\{77FEF28E-EB96-44FF-B511-3185DEA48697}\TypeLib]
"(Default)" = "{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}"

[HKCR\BaiduBarX.ToolBand]
"(Default)" = "Ã‚Â°Ãƒâ„¢Ã‚Â¶ÃƒË†Ã‚Â¹Ã‚Â¤Ã‚Â¾ÃƒÅ¸Ãƒâ‚¬Ã‚Â¸"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\CLSID\{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}]
"(Default)" = "Ã‚Â°Ãƒâ„¢Ã‚Â¶ÃƒË†Ã‚Â¹Ã‚Â¤Ã‚Â¾ÃƒÅ¸Ãƒâ‚¬Ã‚Â¸Ã‚Â¸ÃƒÂ¶ÃƒÂÃƒâ€Ã‚Â»Ã‚Â¯ÃƒÅ Ãƒâ€”Ãƒâ€™Ã‚Â³Ãƒâ€“Ã‚Â§Ã‚Â³Ãƒâ€“Ãƒâ€”ÃƒÂ©Ã‚Â¼ÃƒÂ¾"

[HKCR\Interface\{7EF05EFF-0E62-4040-8D81-73A10D8DE60F}\TypeLib]
"(Default)" = "{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}"

[HKCR\CLSID\{23A2B2B7-21DE-4B88-AFBA-5A918ABBF463}\ProgID]
"(Default)" = "BaiduBarX.BDLogin.1"

[HKLM\SOFTWARE\Baidu\BaiduToolbar]
"qdmcmc" = "5F E2 9C 04 3A CD 90 D0 0B 6A 66 DF AA 01 8B 85"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BaiduBarX]
"DisplayIcon" = "%Program Files%\Baidu\Toolbar\rc.dll,0"

[HKCR\BaiduBar.Tool.1\CLSID]
"(Default)" = "{A7F05EE4-0426-454F-8013-C41E3596E9E9}"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Enable Browser Extensions" = "yes"

[HKLM\SOFTWARE\baidutoolbarinstall]
"silent" = "1"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}]
"URL" = "http://www.baidu.com/s?wd={searchTerms}&ie={inputEncoding}&oe={outputEncoding}&bar=13&tn=82068094_3_cb"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKCR\BaiduBarX.ToolBand\CLSID]
"(Default)" = "{B580CF65-E151-49C3-B73F-70B13FCA8E86}"

[HKLM\SOFTWARE\{78302E8C-3C6F-267C-2E0D-1D37BF7E3D64}\iexp]
"qdmcmc" = "D4 25 85 72 F3 74 6D 0E 41 B4 A6 AF 83 D5 A0 6F"

[HKCU\Software\baidu\BaiduToolbar\NoAD\Page_Block]
"9" = "*cnsmin.3721.com/*"

[HKCR\BaiduBarEx.BDHomePage.1]
"(Default)" = "Ã‚Â°Ãƒâ„¢Ã‚Â¶ÃƒË†Ã‚Â¹Ã‚Â¤Ã‚Â¾ÃƒÅ¸Ãƒâ‚¬Ã‚Â¸Ã‚Â¸ÃƒÂ¶ÃƒÂÃƒâ€Ã‚Â»Ã‚Â¯ÃƒÅ Ãƒâ€”Ãƒâ€™Ã‚Â³Ãƒâ€“Ã‚Â§Ã‚Â³Ãƒâ€“Ãƒâ€”ÃƒÂ©Ã‚Â¼ÃƒÂ¾"

[HKCR\Interface\{7EF05EFF-0E62-4040-8D81-73A10D8DE60F}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{D158174C-004B-4A2E-9410-5442C10C60D2}\TypeLib]
"(Default)" = "{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}"

[HKCR\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\TypeLib]
"(Default)" = "{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}"

[HKCR\Interface\{4C2BFEC9-F03C-4F74-932E-5723E603B4AC}]
"(Default)" = "ITool"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 DD CC C4 C7 E4 D3 AB 86 ED A4 96 5E D8 94 59"

[HKCU\Software\baidu\BaiduToolbar\NoAD\Page_Block]
"16" = "*/adImages/*"

[HKCR\BaiduBarEx.BDHomePage.1\CLSID]
"(Default)" = "{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}"

[HKCR\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}]
"(Default)" = "Ã‚Â°Ãƒâ„¢Ã‚Â¶ÃƒË†Ã‚Â¹Ã‚Â¤Ã‚Â¾ÃƒÅ¸Ãƒâ‚¬Ã‚Â¸"

[HKCR\BaiduBarEx.BDHomePage]
"(Default)" = "Ã‚Â°Ãƒâ„¢Ã‚Â¶ÃƒË†Ã‚Â¹Ã‚Â¤Ã‚Â¾ÃƒÅ¸Ãƒâ‚¬Ã‚Â¸Ã‚Â¸ÃƒÂ¶ÃƒÂÃƒâ€Ã‚Â»Ã‚Â¯ÃƒÅ Ãƒâ€”Ãƒâ€™Ã‚Â³Ãƒâ€“Ã‚Â§Ã‚Â³Ãƒâ€“Ãƒâ€”ÃƒÂ©Ã‚Â¼ÃƒÂ¾"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\Interface\{6C773CA2-F142-4B2C-981A-FD3B1BEC1578}]
"(Default)" = "IBDLogin"

[HKCR\BaiduBarEx.BDHomePage\CurVer]
"(Default)" = "BaiduBarEx.BDHomePage.5"

[HKCR\BaiduBarEx.BDHomePage.4\CLSID]
"(Default)" = "{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}"

[HKCU\Software\baidu\BaiduToolbar\NoAD\Page_Allow]
"30" = "*.hao123.com*"

[HKCR\BaiduBarX.BandIE]
"(Default)" = "Baidu Toolbar BHO"

[HKCR\BaiduBar.Tool]
"(Default)" = "Ã‚Â°Ãƒâ„¢Ã‚Â¶ÃƒË†Ã‚Â¹Ã‚Â¤Ã‚Â¾ÃƒÅ¸Ãƒâ‚¬Ã‚Â¸Ã‚Â¸Ã‚Â¨Ãƒâ€“ÃƒÂºÃ‚Â¶Ãƒâ€ÃƒÂÃƒÂ³"

[HKCR\BaiduBarX.BDLogin\CLSID]
"(Default)" = "{23A2B2B7-21DE-4B88-AFBA-5A918ABBF463}"

[HKCR\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\VersionIndependentProgID]
"(Default)" = "BaiduBarX.ToolBand"

[HKCR\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\InprocServer32]
"(Default)" = "%Program Files%\Baidu\Toolbar\BaiduBarX.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\Interface\{6C773CA2-F142-4B2C-981A-FD3B1BEC1578}\TypeLib]
"Version" = "1.0"

[HKCR\BaiduBarEx.BDHomePage.4]
"(Default)" = "Ã‚Â°Ãƒâ„¢Ã‚Â¶ÃƒË†Ã‚Â¹Ã‚Â¤Ã‚Â¾ÃƒÅ¸Ãƒâ‚¬Ã‚Â¸Ã‚Â¸ÃƒÂ¶ÃƒÂÃƒâ€Ã‚Â»Ã‚Â¯ÃƒÅ Ãƒâ€”Ãƒâ€™Ã‚Â³Ãƒâ€“Ã‚Â§Ã‚Â³Ãƒâ€“Ãƒâ€”ÃƒÂ©Ã‚Â¼ÃƒÂ¾"

[HKCR\CLSID\{23A2B2B7-21DE-4B88-AFBA-5A918ABBF463}\VersionIndependentProgID]
"(Default)" = "BaiduBarX.BDLogin"

[HKCR\BaiduBarX.BDLogin\CurVer]
"(Default)" = "BaiduBarX.BDLogin.1"

[HKCR\CLSID\{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\{78302E8C-3C6F-267C-2E0D-1D37BF7E3D64}\iexp]
"CH" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BaiduBarX]
"DisplayVersion" = "2.2.2"

[HKCR\Interface\{7EF05EFF-0E62-4040-8D81-73A10D8DE60F}\TypeLib]
"Version" = "1.0"

[HKCU\Software\baidu\BaiduToolbar]
"ForceShow" = "1"

[HKLM\SOFTWARE\Baidu\BaiduToolbar]
"CH" = ""

[HKCR\BaiduBarX.ToolBand.1\CLSID]
"(Default)" = "{B580CF65-E151-49C3-B73F-70B13FCA8E86}"

[HKCR\CLSID\{23A2B2B7-21DE-4B88-AFBA-5A918ABBF463}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}]
"DisplayName" = "Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¤Â¸â‚¬Ã¤Â¸â€¹Ã¯Â¼Å’Ã¤Â½Â Ã¥Â°Â±Ã§Å¸Â¥Ã©Ââ€œ"

[HKCR\Interface\{D158174C-004B-4A2E-9410-5442C10C60D2}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\AddressBar\iexp]
"AutoUpdate" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BaiduBarX]
"HelpLink" = "http://www.baidu.com/search/sobar.html"

[HKCU\Software\baidu\BaiduToolbar]
"IEDefaultSearch" = "1"

[HKCR\BaiduBarEx.BDHomePage.5\CLSID]
"(Default)" = "{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}"

[HKCR\BaiduBarEx.BDHomePage.2]
"(Default)" = "Ã‚Â°Ãƒâ„¢Ã‚Â¶ÃƒË†Ã‚Â¹Ã‚Â¤Ã‚Â¾ÃƒÅ¸Ãƒâ‚¬Ã‚Â¸Ã‚Â¸ÃƒÂ¶ÃƒÂÃƒâ€Ã‚Â»Ã‚Â¯ÃƒÅ Ãƒâ€”Ãƒâ€™Ã‚Â³Ãƒâ€“Ã‚Â§Ã‚Â³Ãƒâ€“Ãƒâ€”ÃƒÂ©Ã‚Â¼ÃƒÂ¾"

[HKCR\TypeLib\{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}\1.0\FLAGS]
"(Default)" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BaiduBarX]
"EstimatedSize" = "6925"

[HKCR\BaiduBarEx.BDHomePage.3]
"(Default)" = "Ã‚Â°Ãƒâ„¢Ã‚Â¶ÃƒË†Ã‚Â¹Ã‚Â¤Ã‚Â¾ÃƒÅ¸Ãƒâ‚¬Ã‚Â¸Ã‚Â¸ÃƒÂ¶ÃƒÂÃƒâ€Ã‚Â»Ã‚Â¯ÃƒÅ Ãƒâ€”Ãƒâ€™Ã‚Â³Ãƒâ€“Ã‚Â§Ã‚Â³Ãƒâ€“Ãƒâ€”ÃƒÂ©Ã‚Â¼ÃƒÂ¾"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCR\Interface\{4C2BFEC9-F03C-4F74-932E-5723E603B4AC}\TypeLib]
"(Default)" = "{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}"

[HKCR\BaiduBar.Tool.1]
"(Default)" = "Ã‚Â°Ãƒâ„¢Ã‚Â¶ÃƒË†Ã‚Â¹Ã‚Â¤Ã‚Â¾ÃƒÅ¸Ãƒâ‚¬Ã‚Â¸Ã‚Â¸Ã‚Â¨Ãƒâ€“ÃƒÂºÃ‚Â¶Ãƒâ€ÃƒÂÃƒÂ³"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCR\BaiduBarX.BandIE\CLSID]
"(Default)" = "{77FEF28E-EB96-44FF-B511-3185DEA48697}"

[HKCU\Software\AddressBar\iexp]
"FloatOption" = "0"

[HKCR\TypeLib\{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}\1.0\0\win32]
"(Default)" = "%Program Files%\Baidu\Toolbar\BaiduBarX.dll"

[HKCU\Software\baidu\BaiduToolbar\NoAD]
"AllFlash_State" = "0"

[HKCR\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\TypeLib]
"(Default)" = "{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}"

[HKCR\CLSID\{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}\TypeLib]
"(Default)" = "{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}"

[HKCR\BaiduBar.Tool\CLSID]
"(Default)" = "{A7F05EE4-0426-454F-8013-C41E3596E9E9}"

[HKCR\BaiduBarX.BandIE.1\CLSID]
"(Default)" = "{77FEF28E-EB96-44FF-B511-3185DEA48697}"

[HKCR\CLSID\{77FEF28E-EB96-44FF-B511-3185DEA48697}\ProgID]
"(Default)" = "BaiduBarX.BandIE.1"

[HKCR\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}]
"(Default)" = "Ã‚Â°Ãƒâ„¢Ã‚Â¶ÃƒË†Ã‚Â¹Ã‚Â¤Ã‚Â¾ÃƒÅ¸Ãƒâ‚¬Ã‚Â¸Ã‚Â¸Ã‚Â¨Ãƒâ€“ÃƒÂºÃ‚Â¶Ãƒâ€ÃƒÂÃƒÂ³"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\baidu\BaiduToolbar\NoAD\Page_Block]
"17" = "*.swf[a-z]*"
"14" = "*/banner*"
"15" = "http://ad.*"
"12" = "*/ads/*"
"13" = "*/advlink/*"
"10" = "*/adv/*"
"11" = "*/images_ad/*"

[HKCR\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\baidu\BaiduToolbar\NoAD\Page_Block]
"18" = "*images.sohu.com/cs/button/*"

[HKCR\BaiduBarX.BandIE.1]
"(Default)" = "Baidu Toolbar BHO"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BaiduBarX]
"DisplayName" = "Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKCR\BaiduBarEx.BDHomePage.2\CLSID]
"(Default)" = "{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\CLSID\{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}\VersionIndependentProgID]
"(Default)" = "BaiduBarEx.BDHomePage"

[HKCR\BaiduBarX.BDLogin.1]
"(Default)" = "BDLogin Class"

[HKCU\Software\baidu\BaiduToolbar\NoAD\Page_Block]
"4" = "*/advpic*"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}"

[HKCU\Software\baidu\BaiduToolbar\NoAD\Page_Block]
"6" = "*/ad/*"
"7" = "*/banner_img/*"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\baidu\BaiduToolbar\NoAD\Page_Block]
"1" = "http://ad[0-9].*"
"2" = "http://ads."
"3" = "*banner.*"

[HKCU\Software\baidu\BaiduToolbar\NoAD\Page_Allow]
"34" = "*.skycn.net*"
"35" = "*.baifubao.com*"

[HKCU\Software\baidu\BaiduToolbar\NoAD\Page_Block]
"8" = "*/adbanners*"

[HKCU\Software\baidu\BaiduToolbar\NoAD\Page_Allow]
"31" = "*.baidu.com*"
"32" = "*.youa.com*"
"33" = "*.skycn.com*"

[HKCR\CLSID\{A7F05EE4-0426-454F-8013-C41E3596E9E9}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{77FEF28E-EB96-44FF-B511-3185DEA48697}\VersionIndependentProgID]
"(Default)" = "BaiduBarX.BandIE"

[HKCR\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\ProgID]
"(Default)" = "BaiduBarX.ToolBand.1"

[HKCR\Interface\{6C773CA2-F142-4B2C-981A-FD3B1BEC1578}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\BaiduBarEx.BDHomePage\CLSID]
"(Default)" = "{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\baidu\BaiduToolbar]
"itdate" = "AB 27 14 00 FE 6A B6 53 FE 6A B6 53"

[HKCR\Interface\{4C2BFEC9-F03C-4F74-932E-5723E603B4AC}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{4C2BFEC9-F03C-4F74-932E-5723E603B4AC}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BaiduBarX]
"InstallLocation" = "%Program Files%\Baidu\Toolbar"

[HKCR\Interface\{6C773CA2-F142-4B2C-981A-FD3B1BEC1578}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\BaiduBarEx.BDHomePage.3\CLSID]
"(Default)" = "{E5D5D4A1-17F0-41D7-B1C6-0979F91E6F46}"

[HKCR\TypeLib\{D12F94FA-FC9A-41F7-B808-7FBB419DD7A6}\1.0\HELPDIR]
"(Default)" = ""

[HKCR\Interface\{D158174C-004B-4A2E-9410-5442C10C60D2}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{7EF05EFF-0E62-4040-8D81-73A10D8DE60F}]
"(Default)" = "IBDHomePage"

[HKCR\BaiduBar.Tool\CurVer]
"(Default)" = "BaiduBar.Tool.1"

[HKCU\Software\baidu\BaiduToolbar]
"FirstRun" = "1"

The Backdoor modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77FEF28E-EB96-44FF-B511-3185DEA48697}]
"ID" = "bdbar"

"NoExplorer" = "1"

The Backdoor modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Backdoor modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Backdoor deletes the following registry key(s):

[HKCR\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\VersionIndependentProgID]
[HKCR\CLSID\{23A2B2B7-21DE-4B88-AFBA-5A918ABBF463}\Programmable]
[HKCR\CLSID\{23A2B2B7-21DE-4B88-AFBA-5A918ABBF463}\TypeLib]
[HKCR\CLSID\{23A2B2B7-21DE-4B88-AFBA-5A918ABBF463}]
[HKCR\CLSID\{23A2B2B7-21DE-4B88-AFBA-5A918ABBF463}\ProgID]
[HKCR\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\TypeLib]
[HKCR\CLSID\{23A2B2B7-21DE-4B88-AFBA-5A918ABBF463}\VersionIndependentProgID]
[HKCR\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}]
[HKCR\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\ProgID]
[HKCR\CLSID\{B580CF65-E151-49C3-B73F-70B13FCA8E86}\InprocServer32]
[HKCR\CLSID\{23A2B2B7-21DE-4B88-AFBA-5A918ABBF463}\InprocServer32]

The Backdoor deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Baidu\BaiduToolbar]
"idtmp"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations"

The Backdoor disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"{9A6E096E-4588-3E32-F06C-69F6B8784825}"

"BaidubarXRemove"

"BaidubarXUpdate"

The process DDGuoServer.exe:1408 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 0B 78 01 59 45 26 94 A5 6D 68 3B 96 04 54 20"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Backdoor deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process DDGuoServer.exe:872 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E3 E7 03 46 43 73 A5 61 40 C5 5E E2 DD A2 6E 36"

The process cacls.exe:1004 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4C 6B B2 F7 78 BF 9F EE 61 4C 08 8C 28 85 B4 52"

The process cacls.exe:264 makes changes in the system registry.
The Backdoor creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2F 65 7B 8E C6 50 87 17 D2 CA D7 23 BB D7 39 AA"

Dropped PE files

MD5	File path
170b07cb382aa88703522bef5645d7a6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Dump.dll
7598ba134ae1b92a18f071f5c3f1a7e6	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\getmacaddress.dll
b9380b0bea8854fd9f93cc1fda0dfeac	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsv3.tmp\ExecCmd.dll
a7cd6206240484c8436c66afb12bdfbf	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsv3.tmp\ExecDos.dll
83cd62eab980e3d64c131799608c8371	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsv3.tmp\FindProcDLL.dll
83142eac84475f4ca889c73f10d9c179	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsv3.tmp\KillProcDLL.dll
a5f8399a743ab7f9c88c645c35b1ebb5	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsv3.tmp\NSISdl.dll
c17103ae9072a06da581dec998343fc1	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsv3.tmp\System.dll
a7d710e78711d5ab90e4792763241754	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsv3.tmp\md5dll.dll
13deb9a0f4e4286df01abc85e1895e09	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsv3.tmp\nsisXML.dll
26f3b32e5ebe9de2f6c405242e60bce0	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\~XB_SETUP_0012699F\7z.dll
4831f7c93f282eb126b8e2d75374f945	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\~XB_SETUP_0012699F\Cab.dll
ebb384caa983b5334a4bae43b66639b8	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\~XB_SETUP_0012699F\DrvMgr.dll
911775c97be5495552da42b29c7ecc0b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\~XB_SETUP_0012699F\XiaobaiSetup.exe
954472859b2f4c6a87c0e966ea13baf7	c:\FunshionInstall2.4.5.9.exe
ae0e8416c8cc711fda37c86115d674e1	c:\KAVD_22_2317.exe
19b37ecd1542bff892833a01ec1aaa4b	c:\Program Files\DDGuo\DDGUOServer.exe
57fa0888a8660260f3bcee4a579729f6	c:\Program Files\DDGuo\DDGuo.exe
f8238d0003ad3faa089607d6c24f1451	c:\Program Files\DDGuo\Update.exe
dbab5c840a9f3c8eccb9841a0d4ebda1	c:\Program Files\DDGuo\decode.dll
6367e81f621a121104374a89d89fcb1c	c:\Program Files\DDGuo\uninst.exe
36e3306dd27a50e47d10e69da4d9923d	c:\Program Files\Funshion Online\Funshion\Agentd.dll
6636fd123e77073c1a07d1ec0831334c	c:\Program Files\Funshion Online\Funshion\CoreAAC.ax
d9f9a6ff630d825a2b8523e8650b5b0c	c:\Program Files\Funshion Online\Funshion\CrashReport.exe
170b07cb382aa88703522bef5645d7a6	c:\Program Files\Funshion Online\Funshion\Dump.dll
8d37463aabb0e66f36dde0f7a2f59eb6	c:\Program Files\Funshion Online\Funshion\Funshion.exe
cae4948350c7a0a56aaf983ce2e8af17	c:\Program Files\Funshion Online\Funshion\FunshionService.exe
747234d9018a5c4412005dd89c65c7cb	c:\Program Files\Funshion Online\Funshion\FunshionUpgrade.exe
7598ba134ae1b92a18f071f5c3f1a7e6	c:\Program Files\Funshion Online\Funshion\GetMACAddress.dll
178f016a7cf298fbb7b050d9529c6390	c:\Program Files\Funshion Online\Funshion\LangResEnAmerican.dll
9ebf9867fec67d6bdea4d87aa15304fa	c:\Program Files\Funshion Online\Funshion\LoginServer.dll
c10d50f3774a4a356e4da0c9344b04d1	c:\Program Files\Funshion Online\Funshion\Uninstall.exe
fa220dae3898b8578c34791648321a38	c:\Program Files\Funshion Online\Funshion\cook.dll
a45cfb1f058297ae981f8afeef056b8d	c:\Program Files\Funshion Online\Funshion\coreavc.ax
74edbb03de3291fcf2094af1fb363f1d	c:\Program Files\Funshion Online\Funshion\dbghelp.dll
e9ad4c6feede8ce70a1a21ed1dc0e2ad	c:\Program Files\Funshion Online\Funshion\drvc.dll
71c8256ad54c860eb178a22a8e24c73a	c:\Program Files\Funshion Online\Funshion\fpsrv.dll
a7f08afecd4cd58f7fb43794184010c4	c:\Program Files\Funshion Online\Funshion\fptassrv.dll
d1b8d520e90dc17e8bd30ca4557785d9	c:\Program Files\Funshion Online\Funshion\funshionplugin2.dll
13001eb0a58b4de96126b16ab15fd8cc	c:\Program Files\Funshion Online\Funshion\pncrt.dll
b74e422bc81236042529dc8a42a18423	c:\Program Files\Funshion Online\Funshion\pndx5032.dll
7607a6fa679f2723fad5dede23babefd	c:\Program Files\Funshion Online\Funshion\quality.dll
e4ca4ae71a12198ca9a13835b1ff8a27	c:\Program Files\Funshion Online\Funshion\rmoc3260.dll
26753a9d776cd47c1f4eebd6280abc0f	c:\XiaobaiSetup_3.1.1.(soft001).exe
207422508f2fc9a0e39922936be1fc8c	c:\u_rv259510009.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "%System%\DRIVERS\XiaobaiFsForXp.sys" the Backdoor controls creation and closing of processes by installing the process notifier.

Propagation

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	81920	80384	4.4941	d9c3b0b82d7da6d18b0896fb360cea84
.data	86016	32768	2560	3.41851	568dd221456d807ca821813c84d65e70
.idata	118784	8192	4608	3.31984	bc7806e1c1ce9ebfd00ad834c1f7a647
.rsrc	126976	16384	15360	3.25984	c2941ee253aef92319f64ef6b5fd8bda

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 152
63391efb791bfc61b1e699ee482a17c2
70ea6b79f871deb99f5a3093a2fd708b
006a67306b353f2ba0d4b57b592e12bf
2ff87f043220e6b8b3b714211b4c37fb
ad8d63aa79357797ac7eeb26f424811b
6e18132ef01a80812ff4cadbb68036f5
a4aaef17ffd1cc18c7d3b9394b14d0da
0e3b4926a903f2c757c59e0e2b3bde38
4c6a75a6bbe53d23880cfe86ff494f0b
d41c53c8776ee85af2a3e4d5a3fcdb94
6ffc17436add4309ac00a828ae441854
ac2c94d0aeb86bb7870c2339ea92c852
6a47899d058c526b4603df232b0edf2b
485eefdcc4ab92323a1fd0374af4b5dc
de04b43a526251f451350bffdaf954c8
6b6fba66a1d1acaf60cb1ee7aff5111d
a1aa899f5d31933aaed83f4995d85224
192a6cccd9301a39fa0c159213876b26
03cadb4fd550cb88ae07f06f817e26bd
90e47627bd432fd2307431e805818adc
ffc945c24385ed6e3d78d1b646d34d5a
f0a7629f3b4b25ada5e232e9933bb688
75b39bf0222affe80f7cb31573c2019d
6d094a0be436c7b19849cb3d1c9d8f27
5d1fb785922be2c5fd70c70fd97fb27b

URLs

URL	IP
hxxp://stats.xiaobai.com/packageinfo.php?pid=soft001&timestamp=1404463768
hxxp://display.doudouguo.com/left.xml	111.177.111.77
hxxp://display.doudouguo.com/right.xml	111.177.111.77
hxxp://partner.funshion.com/partner/install_start.php?s=0050563B0E71&id=&idn=103261&c=0217bd5d6a27d32d6a9a3f955f6f2d45&t=first&v=2.4.5.9&mh=1	114.66.198.17
hxxp://partner.funshion.com/partner/install_statistic.php?s=0050563B0E71&id=103261&idn=103261&c=c5401a962b8aff74572e252677b62179&t=first&u=&ov=&v=2.4.5.9&auto=1&other=00000000000&mh=1&guid=534A35715F914A9D8F3BE4D0C3BCE748&rp=4&im=silent	114.66.198.17
hxxp://fs.fspcdn.com/help/soft
hxxp://partner.funshion.com/partner/query_binding_config.php?channel_id=103261	114.66.198.17
hxxp://down.fspcdn.com/download/baidu/FX_82068094_3.exe
hxxp://www.funshion.com/help/soft	115.231.181.33
hxxp://union.xiaobai.com/packageinfo.php?pid=soft001&timestamp=1404463768	110.75.85.63
hxxp://neirong.funshion.com/download/baidu/FX_82068094_3.exe	124.95.136.34
cache.doudouguo.com	125.43.78.110
www.fun.tv	60.31.184.56
guanggao.doudouguo.com	114.112.163.69
www.baidu.com	180.76.3.151
tongji.doudouguo.net	125.43.78.107

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /partner/install_statistic.php?s=0050563B0E71&id=103261&idn=103261&c=c5401a962b8aff74572e252677b62179&t=first&u=&ov=&v=2.4.5.9&auto=1&other=00000000000&mh=1&guid=534A35715F914A9D8F3BE4D0C3BCE748&rp=4&im=silent HTTP/1.0

Host: partner.funshion.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*


HTTP/1.1 302 Found

Date: Fri, 04 Jul 2014 08:48:53 GMT

Server: Apache/2.2.8 (Unix) mod_ssl/2.2.8 OpenSSL/0.9.7k PHP/5.1.6

X-Powered-By: PHP/5.1.6

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Pragma: no-cache

Location: hXXp://VVV.funshion.com/help/soft

Content-Length: 0

Connection: close

Content-Type: text/html

GET /packageinfo.php?pid=soft001×tamp=1404463768 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)

Host: union.xiaobai.com


HTTP/1.1 404 Not Found

Server: Tengine/1.1.2

Date: Fri, 04 Jul 2014 08:49:25 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.10

19..No input file specified....0..HTTP/1.1 404 Not Found..Server: Teng
ine/1.1.2..Date: Fri, 04 Jul 2014 08:49:25 GMT..Content-Type: text/htm
l..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-En
coding..X-Powered-By: PHP/5.3.10..19..No input file specified....0..

GET /partner/query_binding_config.php?channel_id=103261 HTTP/1.0

Host: partner.funshion.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*


HTTP/1.1 200 OK

Date: Fri, 04 Jul 2014 08:48:58 GMT

Server: Apache/2.2.8 (Unix) mod_ssl/2.2.8 OpenSSL/0.9.7k PHP/5.1.6

X-Powered-By: PHP/5.1.6

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Pragma: no-cache

Content-Length: 1797

Connection: close

Content-Type: text/html
<?xml version="1.0" encoding="utf-8" ?>.<root>.<bid>
0</bid>.<install>.<cid>44</cid>.<text_ch>
;...............</text_ch>.<text_en>Browser Baidu</text
_en>.<descript_ch>....................................</de
script_ch>.<descript_en>Installation of Baidu browser, thousa
nds of application experience</descript_en>.<regkey>2</
regkey>.<regsub>Software\baidu\BaiduBrowser</regsub>.&l
t;program_path>installDir,baidubrowser.exe</program_path>.<
;downloadurl>hXXp://w.x.baidu.com/go/mini/8/30000027/BaiduBrowserOn
lineSetupSilent-401-ftn_30000027.exe</downloadurl>.<run_arg&g
t;/s</run_arg>.</install>.<install>.<cid>18<
;/cid>.<text_ch>360............</text_ch>.<text_en&g
t;360Antivirus</text_en>.<descript_ch>...............360..
....</descript_ch>.<descript_en>360Antivirus</descript_
en>.<regkey>2</regkey>.<regsub>SOFTWARE\Microsoft
\Windows\CurrentVersion\App Paths\360safe.exe</regsub>.<progr
am_path>,</program_path>.<downloadurl>hXXp://down.360sa
fe.com/p/Setup_fengxingtg.exe</downloadurl>.<run_arg>/s<
;/run_arg>.</install>.<modify_home_page>.<cid>41&
lt;/cid>.<text_ch>...hao123............</text_ch>.<t
ext_en>The hao123 set home</text_en>.<homepage_url>http
://VVV.hao123.com/?tn=62002018_3_hao_pg</homepage_url>.<s<<< skipped >>>

GET /right.xml HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3

Host: display.doudouguo.com


HTTP/1.1 404 Not Found

Content-Type: text/html

Server: Microsoft-IIS/7.5

Date: Fri, 04 Jul 2014 08:48:59 GMT

Content-Length: 1163
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=gb2312"/>..<title>404 - ..
................</title>..<style type="text/css">..<!--
..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, 
sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} .
.h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0
;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;
} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family
:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#55
5555;}..#content{margin:0 0 0 2%;position:relative;}...content-contain
er{background:#FFF;width:96%;margin-top:8px;padding:10px;position:rela
tive;}..-->..</style>..</head>..<body>..<div i
d="header"><h1>..........</h1></div>..<div id=
"content">.. <div class="content-container"><fieldset>.
.  <h2>404 - ..................</h2>..  <h3>........
..............................................</h3>.. </field
set></div>..</div>..</body>..</html>..HTTP/
1.1 404 Not Found..Content-Type: text/html..Server: Microsoft-IIS/7.5.
.Date: Fri, 04 Jul 2014 08:48:59 GMT..Content-Length: 1163..<!DOCTY
PE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://VVV.w3.o<<< skipped >>>

GET /help/soft HTTP/1.0

Host: VVV.funshion.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*


HTTP/1.1 301 Moved Permanently

Cache-Control: no-cache

Content-length: 0

Location: hXXp://VVV.fun.tv/help/soft

Connection: close

GET /left.xml HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3

Host: display.doudouguo.com


HTTP/1.1 404 Not Found

Content-Type: text/html

Server: Microsoft-IIS/7.5

Date: Fri, 04 Jul 2014 08:48:59 GMT

Content-Length: 1163
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=gb2312"/>..<title>404 - ..
................</title>..<style type="text/css">..<!--
..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, 
sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} .
.h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0
;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;
} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family
:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#55
5555;}..#content{margin:0 0 0 2%;position:relative;}...content-contain
er{background:#FFF;width:96%;margin-top:8px;padding:10px;position:rela
tive;}..-->..</style>..</head>..<body>..<div i
d="header"><h1>..........</h1></div>..<div id=
"content">.. <div class="content-container"><fieldset>.
.  <h2>404 - ..................</h2>..  <h3>........
..............................................</h3>.. </field
set></div>..</div>..</body>..</html>..HTTP/
1.1 404 Not Found..Content-Type: text/html..Server: Microsoft-IIS/7.5.
.Date: Fri, 04 Jul 2014 08:48:59 GMT..Content-Length: 1163..<!DOCTY
PE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://VVV.w3.o<<< skipped >>>

GET /partner/install_start.php?s=0050563B0E71&id=&idn=103261&c=0217bd5d6a27d32d6a9a3f955f6f2d45&t=first&v=2.4.5.9&mh=1 HTTP/1.0

Host: partner.funshion.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*


HTTP/1.1 200 OK

Date: Fri, 04 Jul 2014 08:48:35 GMT

Server: Apache/2.2.8 (Unix) mod_ssl/2.2.8 OpenSSL/0.9.7k PHP/5.1.6

X-Powered-By: PHP/5.1.6

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Pragma: no-cache

Content-Length: 0

Connection: close

Content-Type: text/html

GET /download/baidu/FX_82068094_3.exe HTTP/1.0

Host: neirong.funshion.com

User-Agent: NSISDL/1.2 (Mozilla)

Accept: */*


HTTP/1.1 200 OK

Server: nginx/1.0.15

Date: Fri, 04 Jul 2014 08:49:02 GMT

Content-Type: application/octet-stream

Content-Length: 1348600

Last-Modified: Mon, 16 Jul 2012 18:00:29 GMT

Connection: close

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........}J...$...$.
..$./.{...$...%.=.$.".y...$..?....$.f."...$.Rich..$...................
......PE..L....].B.................Z..........93.......p....@.........
........................a5.......................................r....
.......0..........8...................................................
.............p...............................text....Y.......Z........
.......... ..`.rdata.......p.......^..............@[email protected]...........
.....p..............@....ndata.......P...........................rsrc.
...0.......&...t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Xr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
[email protected]...\[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h ...Pj.h`;B.W..`[email protected]@._^3.
[.....L$...CB...Si.....VW.T.....tO.q.3.;5.CB.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5.CB.r._^[...j.j.......U..QQ.U<<< skipped >>>

The Backdoor connects to the servers at the folowing location(s):

FunshionInstall2.4.5.9.exe_1688:

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

unpacking data: %d%%

... %d%%

http://nsis.sf.net/NSIS_Error

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

\LOCALS~1\Temp\nsv3.tmp\NSISdl.dll

8094_3.exe

ilent-401-ftn_30000027.exe

shion.lnk

ovie.lnk

nd.lnk

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsv3.tmp\NSISdl.dll

ion\Uninstall Funshion.lnk

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsv3.tmp

gtg.exe

2068094_3.exe

FUNSHI~1.LNK

POPGAM~1.LNK

SHOPPI~1.LNK

UNINST~1.LNK

UPDATE~1.LNK

8.swf

|?.Jn

@@@~@@@3@@@

@@@]@@@ @@@

@@@{@@@:@@@

@@@{@@@1@@@

.reloc

OLEAUT32.dll

MSVCRT.dll

nsisXML.dll

-http://crl.thawte.com/ThawteCodeSigningCA.crl0

http://ocsp.thawte.com0

http://www.funshion.com 0

.kHhg

'0z.Gs

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\installmodecn.bmp

hion.lnk

HD Movie.lnk

ch\Funshion.lnk

installmodecn.bmp

Funshion.lnk

FX_82068094_3.exe

FX_820~1.EXE

094_3.exe

61&c=c5401a962b8aff74572e252677b62179&t=first&u=&ov=&v=2.4.5.9&auto=1&other=00000000000&mh=1&guid=534A35715F914A9D8F3BE4D0C3BCE748&rp=4&im=silent

Funshion 2.4.5.9 Setup Wizard

19744344

\"%CurrentUserName%"\LOCALS~1\Temp\nsv3.tmp

19748040

p://www.hao123.com/?tn=62002018_3_hao_pg

X_82068094_3.exe

etup_fengxingtg.exe

FunshionInstall2.4.5.9.exe

Setup_fengxingtg.exe

9.exe

"c:\FunshionInstall2.4.5.9.exe"

%Program Files%\Funshion Online\Funshion

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

c:\FunshionInstall2.4.5.9.exe

%Program Files%\Funshion Online\Funshion\skin

Microsoft Windows XP

%Program Files%\Funshion Online\Funshion\Media

http://www.hao123.com/?tn=62002018_3_hao_pg

Windows XP

%Program Files%\Funshion Online\Funshion\control

2.4.5.9

%WinDir%

00000000000

http://w.x.baidu.com/go/mini/8/30000027/BaiduBrowserOnlineSetupSilent-401-ftn_30000027.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe

http://down.360safe.com/p/Setup_fengxingtg.exe

http://neirong.funshion.com/download/baidu/FX_82068094_3.exe

Software\Microsoft\Windows\CurrentVersion\Uninstall

0050563B0E71,103261,c5401a962b8aff74572e252677b62179,first,,2.4.5.9,1,00000000000,1

%$,,./48;@>/$

%$$$ $$(-.7::

Nullsoft Install System v2.46

%Documents and Settings%\All Users\Start Menu\Programs\Funshion\Uninstall Funshion.lnk

Funshion Use Help.lnk

Pop Game.lnk

Shopping Sites.lnk

Uninstall Funshion.lnk

Update History.lnk

http://www.Funshion.com/

FunshionInstall2.4.5.9.exe_1688_rwx_10004000_00001000:

callback%d

KAVD_22_2317.exe_424:

.text

`.rdata

@.data

.rsrc

KERNEL32.dll

USER32.dll

MSVCP60.dll

WS2_32.dll

MSVCRT.dll

_acmdln

%d.%d.%d.%d

User-Agent:Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)

HTTP/1.1

{Konline_1A4F0F3B-5516-4338-AB9A-3A562A2761FB}

HTTP/1.1 20

http://bo.duba.net:8080/pagetracer2/duba/__utm.gif?

Fhttp://cd001.www.duba.net/duba/install/2011/ever/kavsetups_22_0.exe@/s

2011,09,15,1501

konlineinstaller.exe

9,0,44813,1501

DDGuoServer.exe_1408:

.text

`.itext

`.data

.idata

.rdata

@.reloc

B.rsrc

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

%s[%d]

%s_%d

comctl32.dll

TaskDialogIndirect

EInvalidGraphicOperation

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

uxtheme.dll

USER32.DLL

DWMAPI.DLL

clWebSnow

clWebFloralWhite

clWebLavenderBlush

clWebOldLace

clWebIvory

clWebCornSilk

clWebBeige

clWebAntiqueWhite

clWebWheat

clWebAliceBlue

clWebGhostWhite

clWebLavender

clWebSeashell

clWebLightYellow

clWebPapayaWhip

clWebNavajoWhite

clWebMoccasin

clWebBurlywood

clWebAzure

clWebMintcream

clWebHoneydew

clWebLinen

clWebLemonChiffon

clWebBlanchedAlmond

clWebBisque

clWebPeachPuff

clWebTan

clWebYellow

clWebDarkOrange

clWebRed

clWebDarkRed

clWebMaroon

clWebIndianRed

clWebSalmon

clWebCoral

clWebGold

clWebTomato

clWebCrimson

clWebBrown

clWebChocolate

clWebSandyBrown

clWebLightSalmon

clWebLightCoral

clWebOrange

clWebOrangeRed

clWebFirebrick

clWebSaddleBrown

clWebSienna

clWebPeru

clWebDarkSalmon

clWebRosyBrown

clWebPaleGoldenrod

clWebLightGoldenrodYellow

clWebOlive

clWebForestGreen

clWebGreenYellow

clWebChartreuse

clWebLightGreen

clWebAquamarine

clWebSeaGreen

clWebGoldenRod

clWebKhaki

clWebOliveDrab

clWebGreen

clWebYellowGreen

clWebLawnGreen

clWebPaleGreen

clWebMediumAquamarine

clWebMediumSeaGreen

clWebDarkGoldenRod

clWebDarkKhaki

clWebDarkOliveGreen

clWebDarkgreen

clWebLimeGreen

clWebLime

clWebSpringGreen

clWebMediumSpringGreen

clWebDarkSeaGreen

clWebLightSeaGreen

clWebPaleTurquoise

clWebLightCyan

clWebLightBlue

clWebLightSkyBlue

clWebCornFlowerBlue

clWebDarkBlue

clWebIndigo

clWebMediumTurquoise

clWebTurquoise

clWebCyan

clWebPowderBlue

clWebSkyBlue

clWebRoyalBlue

clWebMediumBlue

clWebMidnightBlue

clWebDarkTurquoise

clWebCadetBlue

clWebDarkCyan

clWebTeal

clWebDeepskyBlue

clWebDodgerBlue

clWebBlue

clWebNavy

clWebDarkViolet

clWebDarkOrchid

clWebMagenta

clWebDarkMagenta

clWebMediumVioletRed

clWebPaleVioletRed

clWebBlueViolet

clWebMediumOrchid

clWebMediumPurple

clWebPurple

clWebDeepPink

clWebLightPink

clWebViolet

clWebOrchid

clWebPlum

clWebThistle

clWebHotPink

clWebPink

clWebLightSteelBlue

clWebMediumSlateBlue

clWebLightSlateGray

clWebWhite

clWebLightgrey

clWebGray

clWebSteelBlue

clWebSlateBlue

clWebSlateGray

clWebWhiteSmoke

clWebSilver

clWebDimGray

clWebMistyRose

clWebDarkSlateBlue

clWebDarkSlategray

clWebGainsboro

clWebDarkGray

clWebBlack

Proportional

SVh<%C

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreviewH

WindowStateT

OnKeyDown

OnKeyPress

OnKeyUp

GlassFrame.Bottom

GlassFrame.Enabled

GlassFrame.Left

GlassFrame.Right

GlassFrame.SheetOfGlass

GlassFrame.Top

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

User32.dll

AutoHotkeys(

AutoHotkeysp

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

TKeyEvent

TKeyPressEvent

HelpKeyword

crSQLWait

%s (%s)

imm32.dll

%s%s%s%s%s%s%s%s%s%s

Password

OnExecutepGF

TSimpleUdpClient

Windows 95

Windows 95 OSR 2

Windows 98

Windows 98 Second Edition

Windows Millenium

Windows NT

Windows NT 3.5

Windows NT 4.0

Windows 2000

Windows XP

Windows XP Service Pack 2

Windows XP x64

Windows Server 2003

Windows Vista

Windows Server Longhorn

Windows 7

egui.exe

ekrn.exe

360sd.exe

360rp.exe

ksafesvc.exe

kxeserv.exe

kxetray.exe

kxesapp.exe

kxescore.exe

rstray.exe

ravmond.exe

avp.exe

Explorer.exe

SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\

%d.%d.%d.%d

%s, ClassID: %s

ole32.dll

olepro32.dll

Heatbeat.ini

popset.ini

ddactive.ini

DDGuo.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

{FA255323-FE62-4823-A43E-06A296ED1ECA}

BHOlogin

TONGJI.DOUDOUGUO.net

TONGJI.DOUDOUGUO.COM

explorer.exe

DDGMini.dat

DDGRight.dat

DDGSet.ini

GUANGGAO.DOUDOUGUO.COM

http://www.baidu.com

ServiceExecute

advapi32.dll

RegOpenKeyExA

RegCloseKey

user32.dll

GetKeyboardType

UnhookWindowsHookEx

SetWindowsHookExA

MsgWaitForMultipleObjects

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutNameA

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

gdi32.dll

SetViewportOrgEx

version.dll

GetCPInfo

ReportEventA

RegQueryInfoKeyA

RegFlushKey

RegEnumKeyExA

RegCreateKeyExA

wininet.dll

shell32.dll

wsock32.dll

ws2_32.dll

wtsapi32.dll

userenv.dll

8 8&8.898

5W5U5^5j5q5

9 9$9(9,9094989<9@9\9|9

; ;$;(;,;0;4;8;<;@;\;|;

7‚8F8M8g8

<'= =/=3=;=

9/:3:;:@:

6-7175797@7

6&6-6}6

/<=,66!%

KWindows

UrlMon

7USimpleUdpClient

%UAdRec

OnExecute

version="11.0.2804.9245"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s
shutdown(Service failed in custom message(%d): %s
Service installed successfully/Service "%s" failed to install with error: "%s" Service uninstalled successfully1Service "%s" failed to uninstall with error: "%s"
- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d."Unable to find a Table of Contents
No help found for %s#No context-sensitive help installed
Alt  Clipboard does not support Icons
Cannot open clipboard/Menu '%s' is already being used by another form
Service failed on %s: %s
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window$Parent given is not a parent of '%s'
$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)
Metafile is not valid!Cannot change the size of an icon Invalid operation on TOleGraphic
Unsupported clipboard format
$''%s'' is not a valid component name
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to get data for '%s'
Failed to set data for '%s'
Resource %s not found
%s.Seek not implemented
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Unable to write to %s
Operation not supported
External exception %x
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
May1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Application Error!'%s' is not a valid integer value('%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid time!'%s' is not a valid date and time
I/O error %d

DDGuo.exe_1712:


.text
`.itext
`.data
.idata
.rdata
@.reloc
B.rsrc
kernel32.dll
Windows
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
EVariantBadIndexError
Uh.qA
ssShift
htKeyword
EInvalidOperation
%s[%d]
%s_%d
USER32.DLL
comctl32.dll
TaskDialogIndirect
EInvalidGraphicOperation
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
uxtheme.dll
DWMAPI.DLL
UrlMon
shell32.dll
PasswordCharX
OnKeyDown
OnKeyPress\CE
OnKeyUp
OnKeyUp0kC
clWebSnow
clWebFloralWhite
clWebLavenderBlush
clWebOldLace
clWebIvory
clWebCornSilk
clWebBeige
clWebAntiqueWhite
clWebWheat
clWebAliceBlue
clWebGhostWhite
clWebLavender
clWebSeashell
clWebLightYellow
clWebPapayaWhip
clWebNavajoWhite
clWebMoccasin
clWebBurlywood
clWebAzure
clWebMintcream
clWebHoneydew
clWebLinen
clWebLemonChiffon
clWebBlanchedAlmond
clWebBisque
clWebPeachPuff
clWebTan
clWebYellow
clWebDarkOrange
clWebRed
clWebDarkRed
clWebMaroon
clWebIndianRed
clWebSalmon
clWebCoral
clWebGold
clWebTomato
clWebCrimson
clWebBrown
clWebChocolate
clWebSandyBrown
clWebLightSalmon
clWebLightCoral
clWebOrange
clWebOrangeRed
clWebFirebrick
clWebSaddleBrown
clWebSienna
clWebPeru
clWebDarkSalmon
clWebRosyBrown
clWebPaleGoldenrod
clWebLightGoldenrodYellow
clWebOlive
clWebForestGreen
clWebGreenYellow
clWebChartreuse
clWebLightGreen
clWebAquamarine
clWebSeaGreen
clWebGoldenRod
clWebKhaki
clWebOliveDrab
clWebGreen
clWebYellowGreen
clWebLawnGreen
clWebPaleGreen
clWebMediumAquamarine
clWebMediumSeaGreen
clWebDarkGoldenRod
clWebDarkKhaki
clWebDarkOliveGreen
clWebDarkgreen
clWebLimeGreen
clWebLime
clWebSpringGreen
clWebMediumSpringGreen
clWebDarkSeaGreen
clWebLightSeaGreen
clWebPaleTurquoise
clWebLightCyan
clWebLightBlue
clWebLightSkyBlue
clWebCornFlowerBlue
clWebDarkBlue
clWebIndigo
clWebMediumTurquoise
clWebTurquoise
clWebCyan
clWebPowderBlue
clWebSkyBlue
clWebRoyalBlue
clWebMediumBlue
clWebMidnightBlue
clWebDarkTurquoise
clWebCadetBlue
clWebDarkCyan
clWebTeal
clWebDeepskyBlue
clWebDodgerBlue
clWebBlue
clWebNavy
clWebDarkViolet
clWebDarkOrchid
clWebMagenta
clWebDarkMagenta
clWebMediumVioletRed
clWebPaleVioletRed
clWebBlueViolet
clWebMediumOrchid
clWebMediumPurple
clWebPurple
clWebDeepPink
clWebLightPink
clWebViolet
clWebOrchid
clWebPlum
clWebThistle
clWebHotPink
clWebPink
clWebLightSteelBlue
clWebMediumSlateBlue
clWebLightSlateGray
clWebWhite
clWebLightgrey
clWebGray
clWebSteelBlue
clWebSlateBlue
clWebSlateGray
clWebWhiteSmoke
clWebSilver
clWebDimGray
clWebMistyRose
clWebDarkSlateBlue
clWebDarkSlategray
clWebGainsboro
clWebDarkGray
clWebBlack
Proportional
OnExecuteT^D
{43826d1e-e718-42ee-bc55-a1e261c37bfe}
%s%s%s%s%s%s%s%s%s%s
AutoHotkeysp
AutoHotkeys
\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\
TKeyEvent
TKeyPressEvent
HelpKeyword
crSQLWait
%s (%s)
imm32.dll
OnExecute$
OnExecute
ssHotTrack
TWindowState
poProportional
TWMKey
KeyPreview$AE
WindowState
tagMSG
GlassFrame.Bottom
GlassFrame.Enabled
GlassFrame.Left
GlassFrame.Right
GlassFrame.SheetOfGlass
GlassFrame.Top
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
User32.dll
%s, ClassID: %s
ole32.dll
olepro32.dll
MAPI32.DLL
msShiftSelect
ArrowKeys
THKInvalidKey
THKInvalidKeys
TCustomHotKey
TCustomHotKeyxNH
THotKey
HotKey
InvalidKeys
msctls_hotkey32
CoXMLHTTPRequest
supports
importNode
%s="%s"
%s%s%s: %d%s%s
gdiplus.dll
GdiplusShutdown
E:\My Dropbox\Works\Components\GDIPlus\GDIPlusAPI.pas
FilterGraph %p pid %x
E:\My Dropbox\Works\Components\DirectX\DSUtil.pas
E:\My Dropbox\Works\Components\DirectX\BaseClass.pas
DestSize (%d) < SourceSize (%d)
decode.dll
decode.dll
ProfilePort
DDGFlash.swf
.mp4?l=
TSimpleUdpClient
%d.%d.%d.%d
ftp://
login error
http://
Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3
HTTP/1.1
TAsyncExecuteThreadU
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Cache.dat
Setup.ini
Update.exe
active.ini
codecs\RealMediaSplitter.ax
LastUrl
youku.com
tudou.com
sina.com.cn
ku6.com
joy.cn
openv.com
56.com
letv.com
,.rm,.rmvb,
chkBossKey
cfHotKey
hkBossKey
chkBossKeyHideTray
chkBossKeyMute
hkOpenUrl
TRegHotKey
ShortCutHotKey{8017344E-8C15-4770-BF13-B88809C37ACA}
ssHorizontal
E:\My Dropbox\Works\Components\superobjectv1.2.4\superobject.pas
Unsuported variant data type: %d
sUrl
http://cache.doudouguo.com/rjson/
Tree.js
popset.ini
Heatbeat.ini
http://www.baidu.com
pop.ini
DDGM.dat
DDGR.dat
DDGSet.ini
GUANGGAO.DOUDOUGUO.COM
EWebBrokerExceptionU
TOnPaintWebICOEvent
ScrollLeftPicH
OnPaintWebICOT
grfKeyState
TComTargetExecEvent
CmdGroup
nCmdID
nCmdexecopt
hhctrl.ocx
URLMON.DLL
SHDOCLC.DLL
IWebBrowser
IWebBrowserApp
IWebBrowser2
TEWBWindowSetResizable
TEWBWindowSetLeft
TEWBWindowSetTop
TEWBWindowSetWidth
TEWBWindowSetHeight
bstrUrlContext
bstrUrl
OnWindowSetResizable
OnWindowSetLeftH~N
OnWindowSetTop
OnWindowSetWidth
OnWindowSetHeight
rcmDefault
rcmDebug
DontExecuteScripts
DontExecuteJava
DontExecuteActiveX
DisableUrlIfEncodingUTF8
EnableUrlIfEncodingUTF8
CheckFontSupportsCodePage
DisableSubmitUrlInUTF8
EnableSubmitUrlInUTF8
lpMsg
PMsg
pguidCmdGroup
TTranslateUrlEvent
pchURLIn
ppchURLOut
CmdID
pszUrl
pszUrlContext
szPassWord
ErrorUrl
OptionKeyPath
OverrideOptionKeyPath
OnTranslateUrl
OnCommandExecTtN
'%s' is not supported.
WebocPopupManagement
ValidateNavigateUrl
HttpUsernamePasswordDisable
GetUrlDomFilePathUnencoded
XmlHttp
https://
AppEvents\Schemes\Apps\Explorer\Navigating\.Current
.Current
\ieframe.dll
\shdocvw.dll
\StringFileInfo\%0.4x%0.4x\%s
TMsgEvent
TKeyEventEx
Port
Password
poPortrait
0.750000
3333333
\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform
User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(
EmbeddedWB http://bsalsa.com/
TmWebbrowser
TmWebbrowserD/O
OnActionExecute
left.xml
http://display.doudouguo.com/left.xml
right.xml
http://display.doudouguo.com/right.xml
imgTopLeftp
act_btnTreeExecute
act_btnHistoryExecute
act_btnFavExecute
act_SerachExecute
act_AddFavExecute
act_PlayExecute
act_StopExecute
act_RefreshExecute
act_CollapsedExecute
act_CollapsedAllExecute
act_AutoCollapsedExecute
act_DeleteExecute
act_DeleteAllExecute
act_Refresh2Execute
edtSearchKeyPress
act_btnLibExecute
His1.dat
His2.dat
Fav.dat
AppPlayUrl:
http://bbs.doudouguo.com/qiupian.html
/search.asp?keyword=
http://search.doudouguo.com/search.asp?keyword=
edtURL
TFormOpenURL
frmOpenURL
lblURL
lblURLClick
http://www.doudouguo.com
btnHotkey
Act_btnHotkey
tsHotkey
chkBossKey8
hkBossKey<
chkBossKeyHideTray@
chkBossKeyMuteD
hkOpenUrlX
Act_btnBaseExecute
Act_btnPlayExecute
Act_btnHotkeyExecute
Act_btnFaceExecute
Act_btnOKExecute
lblMsg
Act_PlayURL
Act_BossKey
URL1(
Act_MaxExecute
Act_MinExecute
Act_TopMostExecute
Act_HomePageExecute
Act_ShowTrayExecute
ActExitExecute
Act_CloseExecute
Act_OpenFileExecute
Act_StopExecute
Act_PlayExecute
Act_FullExecute
Act_MuteExecute
Act_PlayURLExecute
Act_VolumeIncExecute
Act_VolumeDecExecute
Act_VolumeStereoExecute
Act_ShutDownExecute
Act_AboutExecute
Act_ShowRightFrmExecute
Act_ShowConfigFrmExecute
Act_ffsNormalExecute
Act_ffsMiniExecute
Act_ffsR2LExecute
Act_NoTopMostExecute
Act_TopMostOnPlayExecute
Act_CloseOrTrayExecute
Act_ChangeTreeListExecute
Act_BossKeyExecute
FormKeyDown
Act_btnHistoryExecute
Act_PrevExecute
Act_NextExecute
Act_CheckUpdateExecute
Act_ScaleMovieExecute
Act_ScaleWindowExecute
Act_HomeBBSExecute
Act_IdeaExecute
Act_QuestionExecute
Act_PagePlayExecute
Act_PageLibExecute
Act_PageResExecute
Act_PageManExecute
http://bbs.doudouguo.com
http://bbs.doudouguo.com/idea.html
http://bbs.doudouguo.com/faq.html
00:00/00:00
http://cache.doudouguo.com//
...%d%%
http://display.doudouguo.com/zanting.html
http://display.doudouguo.com/huanchong.html
advapi32.dll
RegOpenKeyExA
RegCloseKey
user32.dll
GetKeyboardType
UnregisterHotKey
UnhookWindowsHookEx
SetWindowsHookExA
SetKeyboardState
RegisterHotKey
MsgWaitForMultipleObjects
MapVirtualKeyA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardLayoutNameA
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
ExitWindowsEx
EnumWindows
EnumThreadWindows
EnumChildWindows
ActivateKeyboardLayout
gdi32.dll
SetViewportOrgEx
version.dll
WinExec
GetCPInfo
RegQueryInfoKeyA
RegFlushKey
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
wininet.dll
HttpSendRequestA
HttpQueryInfoA
HttpOpenRequestA
ShellExecuteA
comdlg32.dll
quartz.dll
wsock32.dll
ws2_32.dll
msvcrt.dll
2 2$2(2,2
3?4
0
0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
? ?$?(?,?0?4?8?
11x1
>#>'> >8?\?
;";*;0;~;
1 1$171]1
1*2.22262:2@2
9"9&9.949
: :$:(:,:0:4:
0'0 0/03070;0
3"3&3*3.32363
=!=&= =6=
7 7$7:7]7
1)21252<2
=#='= =/=3=
<'<0<76m6Y6x6
9'9/9@9[9
9#:': :0:
?&?,?1?7?^?
0 0$0(0|0
9 9$9(9,9094989<9@9|9
7 7$7(7,707
? ?$?(?,?0?4?8?333333333333333333
33333833
3333339
3333333333333338
:*"*"$3338
33333333
33333333333
3333333333338
33338?383
333333333333
:*3:"$3338
333333333333333
Hb%U]
@rs%F
KWindows
?HTTPApp
>WebConst
FuTCPTaskControl
7USimpleUdpClient
UrlLinkClass
%UAdRec
GfrmOpenURL
NuRegHotKey
Font.Charset
Font.Color
Font.Height
Font.Name
Font.Style
KeyPreview
Picture.Data
PNGImage.Data
`.aB9
<.NOO
TabPic.Data
ScrollLeftPic.Data
ScrollRightPic.Data
CloseBtnPic.Data
MenuBtnPic.Data
NewBtnPic.Data
Logo.Data
ÊYa
aa$%d
 8.tr
pPi%S
r%C^k
,DNnJ\I%c
2.dp(
BtnImage.Data
BgPic.Data
HotFont.Charset
HotFont.Color
HotFont.Height
HotFont.Name
HotFont.Style
4V.iE
2.ZXA
.mfJS{
c%sVC
HTMLCode.Strings
PrintOptions.Margins.Left
PrintOptions.Margins.Right
PrintOptions.Margins.Top
PrintOptions.Margins.Bottom
PrintOptions.Header
PrintOptions.HTMLHeader.Strings
PrintOptions.Footer
PrintOptions.Orientation
R.KzP
;.y%F
www.doudouguo.com
Items.Strings
Act_cfHotkey
@;.Hz
,G.Mp
0J.MnFV3
DialogBoxes.DisableAll
FormOpenURL
.ON>o
!9999;1;
!99:99;1;
\` W2.Zs#
.rY'6J
|^= ?/'}
Y.ds#
Rc%Xk>
l-2}%S6R
E .cZ
K3
:mH.Pq
.cOL/
.jf-6
1V.Zi
lz
.HLndQ
f.SYVjWd
%dIFfx
%fY~O,^HQ
Z:\HF3s
-a}u.7
%CYe!
mRuJ%d
Y.LJ"zi9
Constraints.MinHeight
OnKeyPress
PicSelectBG.Data
PicUp.Data
PicDown.Data
PicBG.Data
PicThumb.Data
(!\&\&\&\
version="11.0.2902.10471"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
http://www.w3.org/2001/XMLSchema
http://www.w3.org/2000/xmlns/
http://www.w3.org/2001/XMLSchema-instance
Info.Duration
Info.FileLen
Info.MediaWidth
Info.MediaHeight
AddUrl
errorUrl
http://cache.doudouguo.com/
TFORMOPENURL
CRefresh is only supported if the FileName or XML properties are set
Invalid operation in GDI =Error decoding URL style (%%XX) encoded string at position ÑInvalid URL encoded character (%s) at position %d
JPEG Image File)"%s" DOMImplementation already registered
No matching DOM Vendor: "%s"Node "%s" not found
IDOMNode required.Attributes are not supported on this node type
Invalid node type Mismatched paramaters to RegisterChildNodes Element does not contain a single text node4DOM Implementation does not support IDOMParseOptions
%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s
Failed to clear tab control Failed to delete tab at index %d"Failed to retrieve tab at index %d Failed to get object at index %d"Failed to set tab "%s" at index %d Failed to set object at index %dUnable to insert an item %s is already associated with %sE%d is an invalid PageIndex value. PageIndex must be between 0 and %d&Cannot change the size of a JPEG image
JPEG error #%d
UTF-7Ênnot remove shell notification iconÊnnot create shell notification icon"PageControl must first be assigned"%s requires Windows Vista or later$Error creating system registry entry
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
Invalid clipboard format Clipboard does not support Icons
Cannot open clipboard/Menu '%s' is already being used by another form
- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.,Multiselect mode must be on for this feature
Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count
Invalid input value7Invalid input value. Use escape key to abandon changes
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window$Parent given is not a parent of '%s'
%s property out of range
Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic
Unsupported clipboard format
Failed to set data for '%s'
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Thread creation error: %s
Thread Error: %s (%d)"Unable to find a Table of Contents
No help found for %s#No context-sensitive help installed
Unable to write to %s
Invalid stream format$''%s'' is not a valid component name
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Failed to create key %s
Failed to get data for '%s'
Ancestor for '%s' not found
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Operation not supported
External exception %x
Interface not supported
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
!'%s' is not a valid integer value('%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid time!'%s' is not a valid date and time
'%s' is not a valid GUID value
I/O error %d
1.0.0.685
1.0.0.0
2011/10/17 18:08:04

svchost.exe_1652:


.text
`.data
.rsrc
ADVAPI32.dll
KERNEL32.dll
NTDLL.DLL
RPCRT4.dll
NETAPI32.dll
ole32.dll
ntdll.dll
RegCloseKey
RegOpenKeyExW
GetProcessHeap
NtOpenKey
svchost.pdb
\PIPE\
Software\Microsoft\Windows NT\CurrentVersion\Svchost
\Registry\Machine\System\CurrentControlSet\Control\SecurePipeServers\
5.1.2600.5512 (xpsp.080413-2111)
svchost.exe
Windows
Operating System
5.1.2600.5512

Xiaobai.exe_864:


.text
`.rdata
@.data
.rsrc
FtPh
T$%SR
P SShG
@ SShG
j0SSSSSSSh
Rhj%UQP
j%UQP
t%SSPhx
L$.SQf
L$.WQf
O SSh
P SSh
SSSSSh
9^dt%S
 .SUV
SSSSSSh
O SShB
u$SShe
u%SSSS
t'SShl
.VVVVVSRSSj
tGHt.Ht&
FtPW
CCmdTarget
hhctrl.ocx
CNotSupportedException
f:\sp\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp
f:\sp\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp
f:\sp\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
CHttpConnection
CHttpFile
f:\sp\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
f:\sp\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
f:\sp\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp
f:\sp\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp
f:\sp\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp
f:\sp\vctools\vc7libs\ship\atlmfc\src\mfc\viewform.cpp
f:\sp\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
mscoree.dll
kernel32.dll
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
.mixcrt
KERNEL32.DLL
GetProcessWindowStation
USER32.DLL
operator
Unsupported Method
Usage: Client7z.exe [a | l | x ] archive.7z [fileName ...]
Client7z.exe a archive.7z f1.txt f2.txt : compress two files to archive.7z
Client7z.exe l archive.7z : List contents of archive.7z
Client7z.exe x archive.7z : eXtract files from archive.7z
7-Zip 4.65 (7z.dll client) Copyright (c) 1999-2009 Igor Pavlov 2009-02-03
Password is not defined
Dw=%D,3
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
1.2.3
inflate 1.2.3 Copyright 1995-2005 Mark Adler
OLEACC.dll
CMDIChildWnd
CMDIFrameWnd
RICHED20.DLL
%Program Files%\Microsoft Visual Studio 8\VC\atlmfc\include\afxwin2.inl
CImportLinkDlg
CLoginDlg
%y-%m-%d %H-%M
%Program Files%\Microsoft Visual Studio 8\VC\atlmfc\include\afxwin1.inl
CSkinMsgBox
CSvrMsgDlg
CWebStatusDlg
username=%s&password=%s
%y-%m-%d %H:%M:%S
http://www.xiaobai.com/Report/?version=%s&guid=%s&name=%s
http://v.t.qq.com/share/share.php?title=%s&url=%s&site=http://www.xiaobai.com
http://v.t.sina.com.cn/share/share.php?title=%s&url=%s&site=http://www.xiaobai.com
http://t.163.com/article/user/checkLogin.do?link=http://blog.163.com/&source=xiaobai&info=%s%s&1292484962222
http://t.sohu.com/third/post.jsp?title=%s&url=%s&site=http://www.xiaobai.com&content=utf-8
_32.png
%%%X%X
d:\workspace\xiaobai.new\client\trunk\gui\bin\Xiaobai\Xiaobai.pdb
GetWindowsDirectoryW
GetProcessHeap
WaitNamedPipeW
GetCPInfo
GetConsoleOutputCP
WinExec
KERNEL32.dll
EnumWindows
GetAsyncKeyState
LoadKeyboardLayoutW
UnregisterHotKey
RegisterHotKey
GetKeyState
UnhookWindowsHookEx
SetWindowsHookExW
CreateDialogIndirectParamW
USER32.dll
GetViewportExtEx
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
GDI32.dll
MSIMG32.dll
comdlg32.dll
WINSPOOL.DRV
RegOpenKeyExW
RegCloseKey
RegOpenKeyW
RegEnumKeyW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
ADVAPI32.dll
ShellExecuteW
ShellExecuteA
ShellExecuteExW
SHELL32.dll
COMCTL32.dll
UrlUnescapeW
SHLWAPI.dll
oledlg.dll
ole32.dll
OLEAUT32.dll
URLDownloadToFileW
urlmon.dll
Cab.dll
XbNet.dll
DrvMgr.dll
WINMM.dll
PSAPI.DLL
VERSION.dll
WS2_32.dll
HttpQueryInfoW
HttpSendRequestW
HttpOpenRequestW
HttpEndRequestW
HttpSendRequestExW
HttpAddRequestHeadersW
InternetCrackUrlW
InternetCanonicalizeUrlW
WININET.dll
GdiplusShutdown
gdiplus.dll
Xiaobai.exe
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.PAVCUserException@@
.PAVCOleException@@
.PAVCObject@@
.PAVCMemoryException@@
.PAVCSimpleException@@
.PAVCNotSupportedException@@
.PAVCInvalidArgException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.?AVCHttpConnection@@
.?AVCHttpFile@@
.PAVCArchiveException@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@
.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@
.PAVCOleDispatchException@@
zcÁ
.?AUICryptoGetTextPassword2@@
.?AUICryptoGetTextPassword@@
.?AVCMDIFrameWnd@@
.?AVCMDIChildWnd@@
.?AVCCmdTarget@@
.?AVCSkinWebExplorer@@
.PAVCException@@
.?AVCImportLinkDlg@@
.?AVCLoginDlg@@
.PAVCFileException@@
.?AVCSkinMsgBox@@
.?AVCTreeCtrlImport@@
.?AVCSvrMsgDlg@@
.PAVCInternetException@@
.?AVCWebStatusDlg@@
.?AVCXbLoginMgr@@
.?AVCHttpConnect@@
.?AVCPipeClient@@
.?AVCPipe@@
.?AV?$_IDispEventLocator@$0A@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@
.?AV?$IDispEventSimpleImpl@$0A@VCWebPageCtrl@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@
.?AVCWebPageCtrl@@
.?AV?$CMap@PAUHMENU__@@PAU1@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AAV23@@@
.?AV?$CMap@HHV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AAV12@@@
"(&(0$'.
accKeyboardShortcut
Afx:%p:%x:%p:%p:%p
Afx:%p:%x
commctrl_DragListMsg
Ocomctl32.dll
Ocomdlg32.dll
windows
MSH_SCROLL_LINES_MSG
OMSH_WHEELSUPPORT_MSG
MSWHEEL_ROLLMSG
http://
CWININET.DLL
OHTTP/1.0
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
%s%s.dll
mfcm80u.dll
P.INI
user32.dll
Q.\XB7zManager.cpp
X [7Z_MGR] IsTaskValid(): %s!
X [7Z_MGR] ~CXB7zManager(): Destruction complete.
X [7Z_MGR] ~CXB7zManager(): Destruction start...
RX [7Z_MGR] AddFile(): WRONG task type!
X [7Z_MGR] AddFile(): INVALID task!
X [7Z_MGR] AddDirectory(): WRONG task type!
X [7Z_MGR] AddDirectory(): INVALID task!
X [7Z_MGR] CXB7zManager(): Construction complete.
X [7Z_MGR] CXB7zManager(): Construction start....
@X [7Z_MGR] CreateCompressTask(): complete.
X [7Z_MGR] CreateCompressTask(): INVALID Task!
X [7Z_MGR] CreateCompressTask(): Insufficent resource!
X [7Z_MGR] CreateCompressTask(): Start....
X [7Z_MGR] CreateDecompressTask(): complete.
X [7Z_MGR] CreateDecompressTask(): INVALID Task!
X [7Z_MGR] CreateDecompressTask(): Insufficent resource!
X [7Z_MGR] CreateDecompressTask(): "%s" -> "%s" start...
QX [7Z_MGR] C7zCompress(): Cancel() completed....
.\Client7z.cpp
X [7Z_MGR] C7zCompress(): Cancel() start...
X [7Z_MGR] C7zCompress(): WaitForTaskComplete() completed....
X [7Z_MGR] C7zCompress(): WaitForTaskComplete() start...
C7zDecompress::C7zDecompress(): GetProc('%s') failed.
C7zDecompress::C7zDecompress(): Load('%s') failed.
7z.dll
RX [7Z_MGR] C7zDecompress(): WaitForTaskComplete() Completed...
X [7Z_MGR] C7zDecompress(): WaitForTaskComplete() start...
SX [7Z_MGR] C7zDecompress()::DecompressTheadProc(): archive->Extract() failed...
X [7Z_MGR] C7zDecompress()::DecompressTheadProc(): archive->Open() failed...
X [7Z_MGR] C7zDecompress()::DecompressTheadProc(): fileSpec->Open() failed...
X [7Z_MGR] C7zDecompress()::DecompressTheadProc(): createObjectFunc() failed...
X [7Z_MGR] C7zDecompress(): Start() Completed...
X [7Z_MGR] C7zDecompress(): Start() start...
X [7Z_MGR] C7zDecompress(): Cancel() Completed...
X [7Z_MGR] C7zDecompress(): Cancel() start...
CArchiveExtractCallback::GetStream(): _outFileStreamSpec->Open("%s")., %lu
CArchiveExtractCallback::GetStream(): NFile::NDirectory::DeleteFileAlways("%s"), errorcode = %lu
CArchiveExtractCallback::GetStream(): ::CreateFullPath("%s"), errorcode = %lu
X [7Z_MGR] C7zCompress()::DecompressTheadProc(): outArchive->UpdateItems() failed...
X [7Z_MGR] C7zCompress()::DecompressTheadProc(): pCompressObject->createObjectFunc() failed...
X [7Z_MGR] C7zCompress()::DecompressTheadProc(): outFileStreamSpec->Create() failed...
X [7Z_MGR] C7zCompress(): Start() completed....
X [7Z_MGR] C7zCompress(): Start() failed, no dirs and files were added...
X [7Z_MGR] C7zCompress(): Start() start...
X [7Z_MGR] C7zCompress(): AddPath() completed...
X [7Z_MGR] C7zCompress(): AddPath(%s) start...
X [7Z_MGR] C7zCompress(): AddDirectory() completed....
X [7Z_MGR] C7zCompress(): AddDirectory(%s) start...
.\Skins\Default\About\config.xml
20110913
3.1.1
v%s (build %s)
xiaobai %s
HtmlCtrl_WebPage
HtmlCtrl_WebPage_X
%s - %s
ParseUrl
OpenLoginDlg
MINI_CANNOT_SHOW_WEB
.\Skins\Default\Main\MiniExplorer\Wizard\aserror.html
MSGBOX_PROMPT_CLOSE_SOME_MINI_WEB
.\Skins\Default\Main\MiniExplorer\TabBtnChecked.png
.\Skins\Default\Main\MiniExplorer\TabBtnUnchecked.png
.\Skins\Default\Main\MiniExplorer\TabBtnImage.png
CheckBoxEx_Tab_X
.\Skins\Default\Main\MiniExplorer\TabCloseBtn.png
Button_Tab_X
U.\Skins\Default\Color\config.xml
U.\Skins\Default\ShadowSet\config.xml
%s/%s
%c:\%s
U.\Skins\Default\Drift\config.xml
.\Skins\Default\Drift\back.png
.\Skins\Default\Drift\backOver.png
%s (%s:%d)
%s\%s\lnk
.\Skins\Default\Import\Config.xml
IDD_IMPORT_LINK
MSG_CANCEL_TEXT
.\Skins\Default\Component\RootCollapse.png
.\Skins\Default\Component\RootExpand.png
.\Skins\Default\Common\CheckBox.png
%s\%s.url
IMPORT_LINK_FAVORITE
IMPORT_LINK_DESKTOP
%s\%s
CImportLinkDlg::OnCbClickedSelect - m_pCbSelect == NULL
CImportLinkDlg::OnCbClickedSelect - m_pTreeLink == NULL
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
.\Skins\Default\SendLnkNotify\config.xml
U.\Skins\Default\ItemProperty\Config.xml
%s\@XB_@data\temp
.\Skins\Default\Panel\ListMenu\Background.png
.\Skins\Default\Panel\ListMenu\DragShadow.png
.\Skins\Default\Panel\ListMenu\HoverItem.png
.\Skins\Default\Panel\ListMenu\Separator.png
.\Skins\Default\Panel\ListMenu\TopScrollBar.png
.\Skins\Default\Panel\ListMenu\BottomScrollBar.png
CLoginDlg::WriteAccountInfoToReg(): RegCreateKey(HKEY_LOCAL_MACHINE, REG_PATH_XIAOBAI) failed with code: %lu.
CLoginDlg::WriteAccountInfoToReg(): RegWrite(REG_FIELD_USER_NAME) failed with code: %lu.
CLoginDlg::WriteAccountInfoToReg(): RegWrite(REG_FIELD_PASSWORD) failed with code: %lu.
CLoginDlg::ReadAccountInfoFromReg(): IsKeyExists(HKEY_LOCAL_MACHINE, REG_PATH_XIAOBAI) failed.
CLoginDlg::ReadAccountInfoFromReg(): RegRead(REG_FIELD_USER_NAME) failed.
CLoginDlg::ReadAccountInfoFromReg(): RegRead(REG_FIELD_PASSWORD) failed.
.\Skins\Default\Login\config.xml
IDD_LOGIN
20101203
XBMSGBOX_PROMPT_INPUT_ACCOUNT_PASSWORD
GET_PASSWORD_BACK
XB_URL_LOSTPW
U.\Skins\Default\ConfigList\config.xml
.\Skins\Default\Common\ColumnHeader.png
XBMSGBOX_PROMPT_RE_LOGIN
XBMSGBOX_PROMPT_DELETE_SELECT_ITEM
XB_URL_DELETE_CONFIG
OnBnClickedDelete(), GetConnectStatus(), error(%d), error_msg(%s).
XB_URL_RENAME_CONFIG
%s.%s
NOTIFY_ERROR_RENAME_NET_CONFIG_PARSE_SVRMSG_FAILED
NOTIFY_ERROR_RENAME_NET_CONFIG_SVRMSG_RETURN
XB_URL_READ_CONFIG
OnBnClickedSave(), GetConnectStatus(), error(%d), error_msg(%s).
%s\%s\temp_X
XBMSGBOX_PROMPT_CANNOT_APPLY
NOTIFY_ERROR_APPLY_NET_CONFIG_PARSE_SVRMSG_FAILED
NOTIFY_ERROR_APPLY_NET_CONFIG_SVRMSG_RETURN
XBMSGBOX_ERROR_CONFIG_APPLY_DECOMPRESS_FAILED
XB_URL_USER_CONFIG
CManageConfigDlg::UpdateConfigFile(), GetConnectStatus(), err msg: %s
CManageConfigDlg::UpdateConfigFile(), server err msg: %s
apps.xml
config.xml
XBMSGBOX_ERROR_ONFIG_APPLY_LEFT_PART
XBMSGBOX_ERROR_ONFIG_APPLY_CONFIG_BROKEN
J.\Skins\Default\Main\MiniExplorer\Wizard\error.html
.\Skins\Default\Panel\MiniTop.png
.\Skins\Default\Panel\MiniLeft.png
.\Skins\Default\Panel\MiniRight.png
V.\Skins\Default\MoveSoftNotify\config.xml
.\Skins\Default\MoveSoftNotify\Icons\Icon_0.ico
.\Skins\Default\MoveSoftNotify\Icons\Icon_%d.ico
MSG_MY_CONFIG_TEXT
.\Skins\Default\NameSet\config.xml
*.xbp
%s(%s)|%s||
J%s\Skins\Default\Notify
.link:link, .link:visited{ color:#FF660; text-decoration:underline;}
.line{ margin:2px; padding:1px; line-height:22px; padding-left:19px;}
.error{ color:#F00; background:url(@XB_NOTIFY_PATH\Error.gif) left 4px no-repeat;}
.warn{ color:#F60; background:url(@XB_NOTIFY_PATH\Warning.gif) left 4px no-repeat;}
.info{ color:#34508a; background:url(@XB_NOTIFY_PATH\Information.gif) left 4px no-repeat;}
button.s1 {background:url(@XB_NOTIFY_PATH\RunNow.gif) center center no-repeat; }
button.s2 {background:url(@XB_NOTIFY_PATH\ViewUpdate.gif) center center no-repeat;}
button.s3 {background:url(@XB_NOTIFY_PATH\ViewUpdate.gif) center center no-repeat;}
MSG_RUN_SOFTWARE_NOW_TEXT
MSG_VIEW_SOFTWARE_TEXT
 @XB_CANCEL_PROMPT
MSG_NOT_NOTIFY_TEXT
MSG_VIEW_NOW_TEXT
V.\Skins\Default\Notify\config.xml
%s%s
%s%s
%s%s
J.\Skins\Default\Common\Delete.cur
%s\Data\TypeInfo\TYPE_SYS
%s\Data\TypeInfo\TYPE_LNK.lnk
@@PIDL_X
@@LINK_X.lnk
record_Password
password
boss_key
svrmsg_timestamp
svrmsg_url
hotkey
%s\%s%s
%s\%sRestore.Err
%s%s\%s
DirectoryWithPrefix: %s
SpecialPathInShadow: %s
V0xX
(%d, %d)-(%d, %d)
%s%s
.\Skins\Default\ProcessList\Config.xml
.\Skins\Default\Exit\config.xml
.\Skins\Default\Recommand\config.xml
%s\%s\icons\%s
J.\Skins\Default\Panel\RendItem.png
V.\Skins\Default\Setting\config.xml
Number %d
XBMSGBOX_PROMPT_HOTKEY_CLASH
XBMSGBOX_PROMPT_NO_ROOM
XBMSGBOX_PROMPT_WORK_DIR_CHANGED
.\Skins\Default\ShareToFriend\Config.xml
http://www.xiaobai.com/Down/detail/guid/
.html
J.\Skins\Default\Panel\Background.png
.\Skins\Default\Panel\BtnSwitch.png
.\Skins\Default\Panel\AddSheet.png
.\Skins\Default\Panel\BtnLeft.png
.\Skins\Default\Panel\BtnRight.png
.\Skins\Default\Panel\ListMenuBtn.png
.\Skins\Default\Panel\Separator.png
.\Skins\Default\Common\Shortcut32.png
.\Skins\Default\Panel\TabButton.png
.\Skins\Default\Component\DefaultImage32.png
.\Skins\Default\Component\Start.png
.\Skins\Default\Component\RunAsAdmin.png
tips.xml
XBMSGBOX_PROMPT_INVALID_OPERATION_UNINSTALL
XBMSGBOX_PROMPT_CLEAN_CLASS_CONTEXT
TreeCtrlImport
.\Skins\Default\MessageBox\config.xml
.\Skins\Default\MessageBox\Warning.png
.\Skins\Default\MessageBox\Error.png
.\Skins\Default\MessageBox\Question.png
.\Skins\Default\MessageBox\Information.png
%s [%d]
MSG_SKINWIN_POPUP_MENU
MSG_SKINWIN_BEGIN_DOWNLOAD
MSG_SKINWIN_PAUSE_DOWNLOAD
MSG_SKINWIN_DELETE_DOWNLOAD
--:--:--
%H:%M:%S
MSG_SKINWIN_DOWNLOADSPEED_TEXT
MSG_SKINWIN_REMAINTIME_TEXT
%s/s, %s
.\Skins\Default\Component\SyncImage32.png
MSG_UN_START_TEXT
MSG_HIDED_TEXT
MSG_RUNNING_TEXT
MSG_UNINSTALL_TEXT
MSG_SKINWIN_ITEM_INIT
MSG_SKINWIN_RUN_APP_ITEM
MSG_SKINWIN_INSTALL_ITEM
MSG_SKINWIN_ITEM_UNSET_START
MSG_SKINWIN_ITEM_SET_START
MSG_CURRENT_VERSION_TEXT
MSG_CAN_UPDATA_TO_VERSION_TEXT
V.\Skins\Default\Component\CellSelState.png
.\Skins\Default\Component\tan-bg.png
.\Skins\Default\Component\tan1.png
.\Skins\Default\Component\tan2.png
.\Skins\Default\Component\tan3.png
.\Skins\Default\Component\Run1.png
.\Skins\Default\Component\Run2.png
.\Skins\Default\Component\Run3.png
.\Skins\Default\Component\Run4.png
.\Skins\Default\Component\Run5.png
.\Skins\Default\Component\PauseButton.png
.\Skins\Default\Component\CloseBtn.png
MSG_SKINWIN_DELETE_APP_ITEM
.\Skins\Default\SoftDetails\Config.xml
.\Skins\Default\SoftMove\Config.xml
CSoftMoveDlg::AnalysisDll - LoadLibrary == NULL. LastError:%d
CSoftMoveDlg::AnalysisDll-GetProcAddress == NULL. LastError:%d
CSoftMoveDlg::MoveSoftwareTask - GetProcAddress == NULL. LastError:%d
CSoftMoveDlg::MoveSoftwareTask%s transfered %s.
.\Skins\Default\SvrMsg\config.xml
IDD_SVRMSG
MSGBOX_ERROR_SKIN_INIT_START_AGAIN
SvrMsgOnClose
SvrMsgAutoClose
CSvrMsgDlg::OnShowSvrmsgWnd(): "pUrlInfo->wzTimeStamp[0] == L'
CSvrMsgDlg::OnShowSvrmsgWnd(): "pUrlInfo->wzURL[0] == L'
CSvrMsgDlg::OnShowSvrmsgWnd(): unknown nFlag == %d.
SvrMsg - UpdateApp
SvrMsg - InstallApp
SvrMsg - ParseUrl
ShellExe('%s', '%s')
XBMSGBOX_ERROR_INVALID_EXTERN_INVOKE
VCheckBox_Reason%d
.\Skins\Default\Uninstall\Config.xml
VDownloadTaskCallback(): nState = 'UNAVAILABLE', Error = '%d'.
%s\%s\%s\%s.%s
DownloadUpdateTaskCallback() MoveFileEx() failed to '%s'->'%s', error code: %lu.
CUpdateAllSoftDlg::OnDownloadingUpdateTaskNotify(): GetItemData() return NULL, GUID is '%s'.
.\Skins\Default\Update\config.xml
.\Skins\Default\Common\Gradient.png
.\Skins\Default\Update\UpdateBtn.png
.\Skins\Default\Component\UpdateUpdating.png
.\Skins\Default\Component\UpdatePaused.png
.\Skins\Default\Component\UpdateCompleted.png
.\Skins\Default\Component\UpdateError.png
.\Skins\Default\Component\UpdatePending.png
.\Skins\Default\Component\PgrsTransFrm.png
.\Skins\Default\Component\PgrsTrans.png
%s\%s\%s
%s\%s\%s\
XBMSGBOX_PROMPT_SELECT_ONE_UPDATE_AT_LEAST
CUpdateAllSoftDlg::InsertUpdateInfo(): GUID = "%s" has existed.
@XB_@AppFiles\Res\Icons\Icon32.png
%s\%s_X\%s
CUpdateAllSoftDlg::OnReturnUpdateSoftInfo(): after SetAvailableUpdateCount(), m_nCurrUpdateCount = %d, m_dwUncompletedCount = %d
MSG_UPDATA_PUPPER_SOFTWARE_INFO
XB_URL_CHECK_SOFTWARE_UPDATA
SendCheckUpgradeRequestProc(), CheckUpgradeConnect.GetHttpFile() failed.
--%s--
Content-Type: multipart/form-data; boundary=%s
RequsetCheckUpgradeThread(),SendRequestEx(), faield with code %d
NOTIFY_ERROR_CHECK_SOFT_UPDATE_SVRMSG_RETURN
JUpdate - %s
CompareFileTime(): CreateFileW(%s) failed, error: %lu
..\..\common\upgrade.cpp
CheckPathFromXml(): xml.Open(%s) failed.
//package/upgrade/%s
CheckPathFromXml(): Found path %s in %s
@XB_@AppFiles\package.xml
MoveDirectory(): Do not overwrite existing file %s
MoveDirectory(): Do not overwrite newer file %s
.update
StartUpdate(): m_wzXmlFile: %s
StartUpdate(): m_wzSourcePath: %s
StartUpdate(): m_wzTargetPath: %s
StartUpdate(): Set current directory: %s -> %s
StartUpdate(): xml.Open(%s) failed.
StartUpdate(): stop_process_before_upgrade: %s ...
StartUpdate(): stop_process_before_upgrade(%s) succeed
StartUpdate(): stop_process_before_upgrade(%s) failed, error: %lu
StartUpdate(): Set current directory to %s
StartUpdate(): MoveDirectory(%s -> %s) succeed
StartUpdate(): MoveDirectory(%s -> %s) failed, error: %lu
StartUpdate(): rename_file: %s -> %s ...
StartUpdate(): rename_file(%s -> %s) succeed
StartUpdate(): rename_file(%s -> %s) failed, error: %lu
StartUpdate(): delete_file: %s ...
StartUpdate(): delete_file(%s) succeed
StartUpdate(): delete_file(%s) failed, error: %lu
%s\Skins\Default\Main\MiniExplorer\Loading.gif
http://upload.xiaobai.com/
XB_URL_UPLOAD_NOTIFY_DOMAIN
Cookie: %s=%s
Cookie: %s=%s; %s=%s
ParseReturnLoginInfoXML(), Invalid parameter!
ParseReturnLoginInfoXML(), CreateInstance failed.
ParseReturnLoginInfoXML(), loadXML failed.
ParseReturnLoginInfoXML(), selectSingleNode failed.
Content-Disposition: form-data; name="settingfile"; filename="%s"
Error internet port.
Failed to parse URL.
Invalid URL.
faild to get http file.
CHttpConnect::GetHttpFile(): %s
Get http file sucessfully.
CXbNetConfigMgr::UploadConfigProc(), SendRequestEx() failed with code: %d.
CXbNetConfigMgr::UploadConfigProc(), failed to parse returned msg.
CXbNetConfigMgr::UploadConfigProc(), exception error: %s
Content-Type: application/x-www-form-urlencoded
uid=%d&filename=%s
CXbNetConfigMgr::DownloadConfigProc(), SendRequest() failed with code: %d.
PARSE_SER_RETURN_MSG_ERROR
CXbNetConfigMgr::DownloadConfigProc(), exception error: %s
uid=%d&filename=%s&rename=%s
CXbNetConfigMgr::RenameConfigProc(), SendRequest() failed with code: %d.
CXbNetConfigMgr::RenameConfigProc(), failed to parse returned msg.
CXbNetConfigMgr::RenameConfigProc(), exception error: %s
CXbNetConfigMgr::DeleteConfigProc(), SendRequest() failed with code: %d.
CXbNetConfigMgr::DeleteConfigProc(), failed to parse returned msg.
CXbNetConfigMgr::DeleteConfigProc(), exception error: %s
uid=%d
CXbNetConfigMgr::ListConfigProc(), SendRequest() failed with code: %d.
CXbNetConfigMgr::ListConfigProc(), failed to parse returned msg.
CXbNetConfigMgr::ListConfigProc(), exception error: %s
CXbNetConfigMgr::LoginProc(), LoginProc() failed with code: %d.
CXbNetConfigMgr::LoginProc(), failed to parse returned msg.
CXbNetConfigMgr::LoginProc(), exception error: %s
CXbNetConfigMgr::KeepOnlineProc(), SendRequest() failed with code: %d.
.\LogConfig.ini
.\Log\KeepOnline.log
Cookie Data: %s
.\XBConnectToSer.cpp
CXbNetConfigMgr::KeepOnlineProc(), failed to parse returned msg.
CXbNetConfigMgr::KeepOnlineProc(), exception error: %s
CXbNetConfigMgr::LogoutProc(), SendRequest() failed with code: %d.
CXbNetConfigMgr::LogoutProc(), failed to parse returned msg.
CXbNetConfigMgr::LogoutProc(), exception error: %s
guids[]=%s
OCXbNetTask::Start(): GetExitCodeThread() GetExitCodeThread(), dwExitCode == STILL_ACTIVE, identifier is '%s'.
.\XbTask.cpp
CXbNetTask::Abort(): bTerminate = TRUE, m_wzIdentifier = '%s'.
CXbNetTask::Abort(): Thread HANDLE = X, m_wzIdentifier = '%s'
CXbNetTask::Abort(): GetExitCodeThread() failed with code: %lu, m_wzIdentifier = '%s'.
CXbNetTask::Abort(): timeout..., m_wzIdentifier = '%s'
CXbNetTask::SetNetTaskState(): prev state = %d, curr state = %d.
CXbNetTask::NetTaskTransferringThreadProc(): RemoveNetTask('%s').
CDownloadTask::NetTaskTransferring() Start..., Identifier = '%s'
CDownloadTask::NetTaskTransferring(): Start() return code: %d.
CDownloadTask::NetTaskTransferring(): QueryStatus() failed, return code: %d, Identifier = '%s'.
CDownloadTask::NetTaskTransferring(): QueryStatus(), return code: %d, Identifier = '%s',fprogress = %f, nActiveTime = %d, nBytesToTransfer = %d, nBytesDownload = %d, nBytesUpload = %d.,State = %d, ulDownloadRate = %u
CDownloadTask::NetTaskTransferring(): QueryStatus(), State = UNAVAILABLE, Identifier = '%s'.
CDownloadTask::NetTaskTransferring(): QueryInformation() return code: %d, pwzDestLocation = "%s", pwzSrcLocation = "%s", Type = %d, nSize = %d, Identifier = "%s".
CDownloadTask::NetTaskTransferring() Complete..., Identifier = '%s'
X [D] ParseUrl(): recv response data to file('%s')...
X [D] ParseUrl(): QueryItemInformation FAILED.
X [D] ParseUrl(): CoInitialize FAILED, HRESULT: X.
X [D] ParseUrl(): open response file('%s')...
X [D] ParseUrl(): open xml FAILED!
X [D] ParseUrl(): query download url FAILED, information: %s.
X [D] ParseUrl(): read http-url from response file FAILED!
X [D] ParseUrl(): read size from response file FAILED!
X [D] ParseUrl(): parse download url complete - %s.
X [D] ParseUrl(): complete.
res.cdn.xiaobai.com
res.xiaobai.com
%s.%d
CDownloadTask::NetTaskTransferring(): QueryInformation() return code: %d, pwzDestLocation = "%s",
pwzSrcLocation = "%s", Type = %d, nSize = %d, Identifier = "%s".
CUploadTask::NetTaskTransferring() Start..., Identifier = '%s'
CUploadTask::NetTaskTransferring(): XBCreateUploadObject() return NULL, Identifier = '%s'.
CUploadTask::NetTaskTransferring(): Start() return code: %d, Identifier = '%s'.
CUploadTask::NetTaskTransferring(): QueryStatus() failed, return code: %d, Identifier = '%s'.
CUploadTask::NetTaskTransferring(): QueryStatus(), return code: %d, Identifier = '%s',fprogress = %f, nActiveTime = %d, nBytesToTransfer = %d, nBytesDownload = %d, nBytesUpload = %d.,State = %d, ulUploadRate = %u
CUploadTask::NetTaskTransferring(): QueryStatus(), State = UNAVAILABLE, Identifier = '%s'.
CUploadTask::UploadThreadProc() Complete..., Identifier = '%s'
CXbNetTaskMgr::StartPendingNetTask(): pNetTask->Start() failed, Identifier is '%s'.
CXbNetTaskMgr::StartPendingNetTask(): pNetTask->Start() return TRUE, Identifier is '%s'.
CXbNetTaskMgr::StartPendingNetTask(): pNetTask = NULL, list size = %d.
CXbNetTaskMgr::TerminateAllTasksProc(): WaitForMultipleObjects() return WAIT_TIMEOUT, dwMillisecond = %d.
CXbNetTaskMgr::TerminateAllTasksProc(): WaitForMultipleObjects() return WAIT_FAILED, dwMillisecond = %d.
CXbNetTaskMgr::TerminateAllTasksProc(): it spend %ds on terminating all tasks.
CXbNetTaskMgr::SetMaxTaskCount(Max:'%d', DownloadSpeed:'%d', UplpadSpeed:'%d') return %d.
CXbNetTaskMgr::SetMaxTaskCount(Max:'%d', DownloadSpeed:'%d', UplpadSpeed:'%d').
%s%s/?timestamp=%s&softname=%s&softsize=%d
CXbNetTaskMgr::GetDependencePromptText(): CXbNetTaskMgr::ParseXiaobaiURLEx('%s') return FALSE.
%d.%s
CXbNetTaskMgr::QueryDpdcysFromService('%s'): QueryFirstDependence return FALSE.
CXbNetTaskMgr::CheckDownloadDpdcy(): XBCreateNetDependencyWalker('%s') failed.
CXbNetTaskMgr::InsertNetTask(): insert a net task, Identifier is '%s'.
CXbNetTaskMgr::FindNetTask(): find a net task, Identifier is '%s'%s.
CXbNetTaskMgr::RemoveNetTask(): remove a net task, Identifier is '%s'.
CXbNetTaskMgr::CheckAnyPendingTaskCanStart(): 1, dwSize = %d, m_usMaxCount = %d.
CXbNetTaskMgr::CheckAnyPendingTaskCanStart(): 2, nStartedCount = %d, m_usMaxCount = %d.
CXbNetTaskMgr::CheckAnyPendingTaskCanStart(): 3, nStartedCount = %d, m_usMaxCount = %d, return FALSE.
package.xml
XBMSGBOX_ERROR_XB_UPDATE_CONFIG_INEXISTENCE
Update.exe
XBMSGBOX_ERROR_XB_UPDATE_EXE_INEXISTENCE
"%s" "%s" "%s"
ERR:---UpdateEXE:%s, Param:%s, HINSTANCE:%d
.\Skins\Default\XbUpdate\config.xml
MSG_SHOW_UPDATE_TEXT_FALSE
MSG_SHOW_UPDATE_TEXT_BEGIN
Flog\XbpInit.log
TestFileAndDirectory - CreateDirectoryWithCheck() failed: "%s", LastError: %d.
XBMSGBOX_ERROR_CREATE_CONFIG_DIR
XBMSGBOX_ERROR_CREATE_PACKAGE_DIR
XBMSGBOX_ERROR_CREATE_SPEC_DIR
.\@XB_@config\config.xml
.\@XB_@config\apps.xml
.\@XB_@config\task.xml
.\data\InitConfig.xml
CXbXmlContext::Init(), m_AppsData.ReadData() failed. path('%s').
CXbXmlContext::Init(), m_ConfigData.ReadData() failed. path('%s').
CXbXmlContext::Init(), m_TaskData.ReadData() failed. path('%s').
.\Log\Xiaobai.log
.\data\lang.xml
%s\Lang\lang_cn.xml
%s\Skins\Default\Common\SwfIcon16.png
%s\Skins\Default\Common\SwfIcon32.png
X - %s *
.\XiaoBai.cpp
/n,/e,/select,"%s"
explorer.exe
.\Log\DrvMgr.log
XBMSGBOX_ERROR_INIT_DRIVE_MGR_RESTART_COMPUTER_TRY_AGAIN
XBMSGBOX_ERROR_INSTALL_XBSVC_WITH_ADMIN
XBMSGBOX_ERROR_INSTALL_DRIVE_RESTART_COMPUTER_TRY_AGAIN
XBMSGBOX_ERROR_LINK_TO_DRIVE_RESTART_COMPUTER_TRY_AGAIN
XBMSGBOX_ERROR_LINK_TO_DRIVE
XBASYNCMSGBOX_ERROR_START_XB_DRIVE
\\.\pipe\@XIAOBAI_TASK_PIPE
CXiaoBaiApp::PostXiaobaiTask(0xx) - CPipeClient::Init() failed.
CXiaoBaiApp::PostXiaobaiTask(0xx) - CPipeClient::WriteToPipe() failed.
CXiaoBaiApp::PostXiaobaiTask(0xx) - CPipeClient::ReadFromPipe() failed.
CXiaoBaiApp::InstallPuppetApp() - RestorePortableDirectory() failed, dwResult: %lu.
CXiaoBaiApp::InstallPuppetApp(IME) - LoadKeyboardLayout() failed, lpKlid: "%s", error code: %lu.
CXiaoBaiApp::InstallPuppetApp(IME) - invalid KLID, lpKlid: "%s".
CXiaoBaiApp::InstallPuppetApp() - SubmitXiaobaiTask() failed,, dwTaskResult: 0xX.
%s_X
CXiaoBaiApp::InitStatInfo() - Create data directory ("%s") failed.
stat.dat
http://stats.xiaobai.com/stats.php
CXiaoBaiApp::CheckStatInstallList() - RegRead("%s", "%s") failed.
CXiaoBaiApp::CheckStatInstallList() - ModifyRegInfo(MRT_SET_VALUE, "%s", "%s") failed.
Windows
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
XbSvc.dll
CXiaoBaiApp::StartXiaobaiSvc() - LoadLibrary("%s") failed, error code: %lu.
SYSTEM\CurrentControlSet\Services\%s\Parameters
CXiaoBaiApp::CheckXiaobaiSvc() - RegRead("%s\ServiceDll") failed.
XiaobaiSvc.exe
CXiaoBaiApp::CheckXiaobaiSvc() - Found XiaobaiSvc.exe, old version.
CXiaoBaiApp::CheckXiaobaiSvc() - SvcDllPath changed, OldSvcDllPath: "%s", NewSvcDllPath: "%s".
CXiaoBaiApp::CheckXiaobaiSvc() - query version failed, dwTaskResult: %lu, OldSvcVersion: %s, CurrSvcVersion: %s.
CXiaoBaiApp::CheckXiaobaiSvc() - nCurrSvcStatus = -1, KillProcess("%s") failed.
XBMSGBOX_ERROR_INIT_XB_RESTART_WITH_ADMIN
XBMSGBOX_PROMPT_UPGRADE_UNCOMPLETED_RESTART_COMPUTER
XBMSGBOX_ERROR_INIT_XB_RESTART_TRY_AGAIN
XBMSGBOX_ERROR_UNINSTALL_RESTART_WITH_ADMIN
"%s" %s "%%1"
xiaobai.xbp
xiaobai.xbp\shell\open\command
"%s\data\xbp.ico", 0
xiaobai.xbp\DefaultIcon
URL Protocol
"%s" "%%1"
FileOperation
CXiaoBaiDlg::FileOperation() failed,, dwTaskResult: 0xX.
CXiaoBaiApp::ProcessCommandLine() - GetCommandlineInfoToAddTask(XBP_CMD_INSTALL_APP) returned TRUE.
XBMSGBOX_PROMPT_RESTART_COMPUTER_AFTER_UNINSTALL
xb_pkg.xml
Mutex.Xiaobai
XBMSGBOX_ERROR_UNSUPPORTED_OPERATING_SYS_32
Windows XP SP2
XBMSGBOX_ERROR_UNSUPPORTED_OPERATING_SYS__WINDOWSXP_SP2
XBMSGBOX_ERROR_UNSUPPORTED_OPERATING_SYS_SP_PATCH
Mutex.Xiaobai_Commandline
~XbInit.flg
CXiaoBaiApp::InitInstance() - DeleteFile("%s") failed, error code: %lu.
CXiaoBaiApp::InitInstance() - MoveFileEx("%s") failed, error code: %lu.
Mutex.Recorder
XBMSGBOX_ERROR_INIT_CANNOT_RUN_WITH_RECORDER_RESTART_COMPUTER
%s\@XB_@config\tips.xml
.\Log\7z.log
.\Log\Cab.log
XBMSGBOX_ERROR_INIT_DECOMPRESSION
.\Log\XbTask.log
CXiaoBaiDlg::UpdateShadowDirectory() failed,, dwTaskResult: 0xX.
XBMSGBOX_ERROR_SET_WORK_DIR
XBMSGBOX_ERROR_CANNOT_SAVE_WORK_DIR_TO_REG
20100623
20100323
@XB_@AppFiles\Res\Icons\Icon16.ico
@XB_@AppFiles\Res\Icons\Icon16.png
@XB_@AppFiles\Res\Icons\Icon32.ico
20100429
%s\%s\img
%s\@@ICON_X
%s\%s_X%s
"%s" %s
Software\Microsoft\Windows\CurrentVersion\Run
%s\@XB_@config\%s
%s\%s\%s.%s
http://www.ixiaobai.com/
XB_URL_MAIN_DOMAIN
http://baoku.xiaobai.com/
XB_URL_BAOKU_ROOT
XBMSGBOX_ERROR_RUN_SPEC_FILE_INEXISTENCE
MSGBOX_ERROR_SYS_CANNOT_SUPPORT_SPEC_SOFT
MSGBOX_ERROR_CURR_XB_VERSION_CANNOT_SUPPORT_SPEC_SOFT
MSGBOX_ERROR_READ_SPEC_SOFT_CONFIG_ATTEMP_REPAIR
//.XB_Icon_Path//
//.XB_swf_Name//
//.XB_swf_Path//
%s%s%s%s%s%s
%s\FlashPlayer.exe
XBMSGBOX_ERROR_OPEN_FILE
::{20D04FE0-3AEA-1069-A2D8-08002B30309D}
::{450D8FBA-AD25-11D0-98A8-0800361B1103}
::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\::{21EC2020-3AEA-1069-A2DD-08002B30309D}
cmd.exe
url.dll,FileProtocolHandler "%s"
rundll32.exe
@@URL_X.url
%s\%s\%s_X
%s\%s_X
log\upgrade.log
CXiaoBaiDlg::ContinueUncompletedDownloadTask(), '%s' isn't existed.
xb_Task.dat
InstallSoftManagement(), DeleteFile(%s) faild with: %d.
InstallSoftManagement(), ReadDataFromApps('%s') failed.
.\Skins\Default\Common\PackageIcon.png
%s\%s.%s
task.xml
CXiaoBaiDlg::SetPuppetAndComponentDirsIcon(): "%s" isn't existed!
@XB_@data\WorkFolder.ico
%s\data\WorkFolder.ico
CheckAndSetWorkFolderIcon(), "%s" doesn't exist, failed to copy file.
CheckAndSetWorkFolderIcon(), CopyFile() failed with code: %d.
desktop.ini
.\Skins\Default\Main\config.xml
CXiaoBaiDlg::InstallComponentEx('%s', '%s'): RunApp(...) failed with code: %lu.
.\Skins\Default\Component\Uninstall.png
.\Skins\Default\Component\Repair.png
.\Skins\Default\Component\Information.png
GetDownloadTempDir(),CreateDirectory(%s), failed with code: %lu.
SetTaskItemState(), WriteStateToUploadTaskXml('%s', %d) failed.
CXiaoBaiDlg::BeginDownloadFavoritesItem('%s'), Not match favorites item type.
CXiaoBaiDlg::IsItemNeedDownload('%s'): after BeginInstallComponentThread().
CXiaoBaiDlg::IsItemNeedDownload('%s'): pDownloadItem->nCollect != 0.
CXiaoBaiDlg::IsItemNeedDownload('%s'): bDpdcy = TRUE, n = %d.
CXiaoBaiDlg::IsItemNeedDownload('%s'): pstUrlParams->uOp == 2.
UploadTaskCallback(): nState = 'UNAVAILABLE', Error = '%d'.
%s\%s\%s.xbp
DownloadTaskCallback(): DirectoryExists("%s") return TRUE.
DownloadTaskCallback(): DeleteDirectory("%s") return FALSE.
%s -> %s, code = %d
XBMSGBOX_ERROR_MOVE_PKG_TO_WORK_PATH
CXiaoBaiDlg::OnDownloadingTaskNotify(): case D_T_N_C_COMPLETE_DOWNLOAD, pMsgDataTaskInfo->wzPkgFinalPath("%s") doesn't exist!
CXiaoBaiDlg::OnDownloadTaskAndDpdcys(): InsertDownloadItemAndWriteToXml('%s') return FALSE.
CXiaoBaiDlg::OnDownloadTaskAndDpdcys(): strDpdcysInfo.IsEmpty() return TRUE, GUID is '%s'.
CXiaoBaiDlg::CreateAndInsertDownloadTask(): CreateDownloadTask('%s'), failed.
CXiaoBaiDlg::CreateAndInsertDownloadTask(): CheckDownloadDpdcy() return NULL, There isn't any dpdcy with '%s'.
CXiaoBaiDlg::CheckAndGetDpdyThreadProc(): CreateAndInsertDownloadTask('%s') return NULL.
CXiaoBaiDlg::AddDownloadTaskWithUrl('%s') start...
NOTIFY_ERROR_ADD_TASK_INVALID_URL
CXiaoBaiDlg::AddDownloadTaskWithUrl('%s'): IsItemNeedDownload() return FALSE.
CXiaoBaiDlg::AddDownloadTaskWithUrl(): CheckAndWriteDownloadInfoToTaskXml() return FALSE.
GetDownloadDpdceFromService(), ParseXiaobaiURLEx('%s') failed.
GetDownloadDpdceFromService(), XBCreateNetDependencyWalker(%s) failed.
XBCreateNetDependencyWalker(%s).
GetDownloadDpdcyWhenCompleted(), XBCreateLocalDependencyWalker(%s) failed.
ParseXbpCmdLineAndInstallSoft() - Invalid CmdLine("%s") for XBP_CMD_INSTALL_APP.
http://www.xiaobai.com/Com/getPushUrl
Com/getPushUrl
XB_URL_MSG_PUSH
CSvrMsg::InitSvrMsg(): lpSrvUrl = '%s'.
CSvrMsg::InitSvrMsg(): ulMsgElpase = '%lu'.
CSvrMsg::InitSvrMsg(): ulErrorElpase = '%lu'.
CSvrMsg::GetConnectionFile(): AfxParseURL() parse "%s" failed with %d.
CSvrMsg::GetConnectionFile(): url is "%s", GetHttpConnection() failed with %d.
CSvrMsg::GetConnectionFile(): exception!
CSvrMsg::GetConnectionFile(): url is "%s", exception! error is %s.
CSvrMsg::GetConnectionFile(): url is "%s", OpenRequest() failed with %d.
CSvrMsg::GetSrvMsg(): ReadDataFromSvr() return FALSE, wzRecv = "%s".
CSvrMsg::GetSrvMsg(): SendRequest(), exception, try again...., url = "%s".
NOTIFY_PROMPT_NO_SVRMSG
CSvrMsg::SrvMsgThreadProc(): after pSvrMsg->StartRequest(TRUE).
NOTIFY_ERROR_CANNOT_READ_MSGBOX_CONNECTION_FAILED
.\Skins\Default\Common\GrayPoint.png
.\Skins\Default\Common\RedPoint.png
.\Skins\Default\Common\Tick.png
XBMSGBOX_PROMPT_SURE_T0_LOGOUT
http://baoku.xiaobai.com/searchnew/s/code/gb2312/wd/
INPUT_SEARCH_KEY
Recorder.exe
CXiaoBaiDlg::OnUpdateRemind(): ShellExecute(): failed, return code: %d, GUID = %s.
CXiaoBaiDlg::GetSoftItemDescription(): GetPuppetPackageXmlPath() failed, GUID is "%s".
CXiaoBaiDlg::GetSoftItemDescription(): FileExists("%s") return FALSE.
CXiaoBaiDlg::GetSoftItemDescription(): ReadData("%s") return FALSE.
CXiaoBaiDlg::OpenMicroBlog(%d): GetSoftItemDescription() return FALSE, GUID is "%s".
http://baoku.xiaobai.com/s/
XB_URL_SOFT_DETAILS
CXiaoBaiDlg::OpenMicroBlog(%d): ShellExecute(): failed, return code: %d, GUID = %s.
XBMSGBOX_PROMPT_UPLOAD_PKG_AFTER_LOGIN
CXiaoBaiDlg::InsertUploadItem(), GetTaskGroupItemWithName('%s') return NULL.
.\Skins\Default\Common\XbpIcon16.png
CXiaoBaiDlg::CreateAndStartUploadTask(): GetItemData() return NULL, path('%s').
CXiaoBaiDlg::CreateAndStartUploadTask(): InsertUploadItem() return NULL, path('%s').
CXiaoBaiDlg::CreateAndStartUploadTask(): CheckAnyPendingTaskCanStart() return FALSE, path('%s').
CXiaoBaiDlg::ContinuUncompletedUploadTask(), File(%s) does't exist.
%s\%s_d\%s
CXiaoBaiDlg::GetSoftCurrVersion() "%s" doesn't exist.
CXiaoBaiDlg::GetSoftCurrVersion(), objPackageXmlData.ReadData('%s') return FALSE.
CheckUpdateSoft() '%s' doesn't exist.
CXiaoBaiDlg::RequestSoftsUpdateThreadPro(): data group cout: %d.
CXiaoBaiDlg::RequestSoftsUpdateThreadPro(): the last group items' cout: %d.
XBMSGBOX_ERROR_UPGRADE_XB_DECOMPRESS_FAILED
XBMSGBOX_ERROR_UPGRADE_XB_FILE_INEXISTENCE
%s\%s\
GetXBCheckUpgradeThread():CheckUpgradeConnect.GetHttpFile() return NULL, failed with code:%d.
%d%%...
XBMSGBOX_PROMPT_RENAME_AGAIN_WITH_ANOTHER_NAME_UNAPPROPRIATED
XBMSGBOX_PROMPT_CLASS_EXIST_INPUT_AGAIN
XBMSGBOX_PROMPT_KEEP_KEY_INPUT_CLASS_NAME_AGAIN
XBMSGBOX_PROMPT_WHETHER_TO_UPDATE
SetSoftDirIcon(), The dir of "%s" doesn't existed.
SetSoftDirIcon(), The full path of "%s" doesn't existed.
%s\Program Files\%s
%s\Data\XbShortcutFolder.ico
XBMSGBOX_ERROR_INSTALL_DECOMPRESS_FAILED
DecompressLocalPackageCallback2() decompress failed with error: %d.
DeleteFirstSetupPkg() - FileExists(%s) return FALSE, return.
DecompressLocalPackageCallback(), dwError = %d
Software\Unnoo\Xiaobai\.XiaobaiShadow
%s\.XB_%s_X
%s\%s_%s_X
XBMSGBOX_ERROR_INSTALL_LEFT_CONFIG
InstallCallback(): ReadDataFromPackage(%s) failed.
InstallCallback(): CheckPkgExistAndUpdate() return FALSE, then return, path('%s').
InstallCallback(): CreateWorkerFolderItem('%s').
CXiaoBaiDlg::OnBeginInstallPkg(), BeginInstallTaskItem(), begin to install item('%s').
CXiaoBaiDlg::OnBeginInstallPkg(), BeginInstallTaskItem(): Installation of item('%s') is pending.
CXiaoBaiDlg::InsertTempInstallItem(): FileExists("%s") return FALSE.
CXiaoBaiDlg::InsertTempInstallItem(): InsertSoftwareItem() return NULL, path = "%s".
CXiaoBaiDlg::InsertTempInstallItem(): FindGroupItemByItemName("%s") return NULL.
CXiaoBaiDlg::InsertTempInstallItem(): InsertTempInstallItem() return NULL, path("%s").
CXiaoBaiDlg::CheckAndAddPendingDecompressedItem(): add path("%s") and tempguid("%s") exist!
CXiaoBaiDlg::CheckAndAddPendingDecompressedItem(): path("%s") exist!
CXiaoBaiDlg::PrepareToInstallPackage(), GetCompressedFileType() failed with err(%d), nType(%d).
Com/comLogin
XB_URL_LOGIN
MainOnLogin
NOTIFY_PROMPT_ALREADY_LOGINED
NOTIFY_PROMPT_ALREADY_LOGINING
http://baoku.xiaobai.com/Public/register
XB_URL_REGISTER
http://www.PersonalInfo.xiaobai.com
XBMSGBOX_ERROR_CONFIG_SAVE_AS_COMPRESS_FAILED
SaveConfigCompleteCallback() Compress File('%s') faild.
*.cfg
myConfig.%s
XBMSGBOX_ERROR_CONFIG_SAVE_AS_CONFIG_INEXISTENCE
XB_URL_UPLOAD_CONFIG
UploadConfigCompleteCallback() failed to compress file('%s').
XBMSGBOX_PROMPT_MUST_LOGIN_TO_UPLOAD_CONFIG
XBMSGBOX_ERROR_UPDATE_NET_CONFIG
XBMSGBOX_PROMPT_WHETHER_TO_COVER_EXISTED_CONFIG
XBMSGBOX_ERROR_CONFIG_UPLOAD_CONFIG_INEXISTANCE
apps.xml
XBMSGBOX_ERROR_CONFIG_UPLOAD_APPS_INEXISTENCE
config.xml
XBMSGBOX_ERROR_CONFIG_UPLOAD_CONFIG_INEXISTENCE
XBMSGBOX_ERROR_CONFIG_IMPORT_CONFIG_BROKEN
ImportConfigCompletedCallback(), pData = NULL.
XBMSGBOX_PROMPT_CONFIG_IMPORT_TASK_RUNNING
MainOnImportConfig
ImportConfig
XBMSGBOX_ERROR_CONFIG_IMPORT_CONFIG_LEFT_PART
NOTIFY_PROMPT_IMPORT_CONFIG_SUCCESS
XBMSGBOX_PROMPT_MANAGE_NET_CONFIG_AFTER_LOGIN
http://bbs.xiaobai.com/forum-14-1.html
CXiaoBaiDlg::OnStartDownload(): CreateAndInsertDownloadTask('%s') return NULL.
CXiaoBaiDlg::PauseDownLoadTaskThreadProc(): pTask->Abort() failed, Idntifier = '%s'.
CXiaoBaiDlg::OnPauseDownload(): after SetNetTaskState(XB_TASK_STATE_PUASED), GUID = '%s'.
CXiaoBaiDlg::OnPauseDownload(): FindNetTask('%s') return NULL, name is '%s'.
%s\%s\%s\%s
CXiaoBaiDlg::DelDownloadTaskThreadProc(): DeleteFile('%s') failed with code: %lu, Idntifier = '%s'.
CXiaoBaiDlg::DelDownloadTaskThreadProc(): pTask->Abort() failed, Idntifier = '%s'.
CXiaoBaiDlg::PauseUploadTaskThreadProc(): pTask->Abort() failed, Idntifier = '%s'.
(%d/%d)
CXiaoBaiDlg::OnSoftwareMovedHome - %s Not Exists
CXiaoBaiDlg::OnSoftwareMovedHome - %s ReadDataFromPackage Error
CXiaoBaiDlg::OnPauseUpload(): after SetNetTaskState(XB_TASK_STATE_PUASED), name is '%s'.
CXiaoBaiDlg::OnPauseUpload(): FindNetTask('%s') return NULL, name is '%s'.
CXiaoBaiDlg::DeleteUploadTaskThreadProc(): pTask->Abort() failed, Idntifier = '%s'.
MSGBOX_PROMPT_SURE_TO_DELETE_SELECT_ITEM
CXiaoBaiDlg::OnDeleteDownload(): RemoveNetTask('%s') failed.
XBMSGBOX_PROMPT_WHETHER_TO_DELETE_CONTEXT_BY_SELECT
XBMSGBOX_PROMPT_WHETHER_TO_DELETE_SOFTS_BY_SELECT
AddLinkToDesk() - GetWindowsDirectory() failed
CXiaoBaiDlg::AddLinkToDesk() - CreateFullPath() FALSE, dwLastError:%d
XBMSGBOX_PROMPT_WHETHER_TO_REINSTALL_SOFT
XBMSGBOX_PROMPT_WHETHER_TO_UNINSTALL_SOFTS_BY_SELECT
%s%s.html
\Skins\Default\SoftDetails\Details\index.html
file:///%s?%s
DesktopTips.exe
CXiaoBaiDlg::InstallDownloadedPkg('%s', '%s'): File doesn't exist.
CheckCompletedTaskDependency('%s'), DirectoryExists('%s') return FALSE.
CheckExistedComponentInstallThreadProc(): InstallComponentEx("%s", "%s") return FALSE.
CXiaoBaiDlg::CheckCompletedTaskDependency('%s') was called.
CXiaoBaiDlg::InstallComponentProc(), FileExists('%s') return FALSE.
CXiaoBaiDlg::InstallComponentProc(), ReadDataFromPackage('%s') failed.
CXiaoBaiDlg::InstallComponentProc(), unmatched app-type, uInstall(%d).
CXiaoBaiDlg::InstallComponentProc(), InstallComponentEx('%s') failed.
CXiaoBaiDlg::InstallComponentProc(), InstallComponent('%s') failed.
CXiaoBaiDlg::OnInstallDownloadItem(): InstallDownloadedPkg('%s') failed.
CXiaoBaiDlg::OnInstallDownloadItem(): GetTaskItemHandle() return NULL, lpcwzGuid = "%s".
KeepOnlineThreadProc(), GetLoginStatus() != LOGIN_STATUS_SUCCESS.
XB_URL_KEEP_ONLINE
KeepOnlineThreadProc(), Error msg: %s.
http://log.xiaobai.com/heartbeat.php
XB_URL_LOGOUT
NOTIFY_PROMPT_LOGIN_SUCCESS
NOTIFY_PROMPT_LOGIN_FAILED
XBMSGBOX_PROMPT_SELECT_CLASS_NEED_RENAME
XBMSGBOX_PROMPT_WHETHER_TO_REPAIR_SOFTS_BY_SELECT
XBMSGBOX_PROMPT_SELECT_CLASS_NEED_DELETE
TrayOnOpenMsgBox
XBMSGBOX_PROMPT_DELETE_ITEM_BY_UNINSTALL
http://%s
FlashPlayer.exe
.\Skins\Default\Component\SubCollapse.png
.\Skins\Default\Component\SubExpand.png
.\Skins\Default\Component\SoftwareRunning.png
.\Skins\Default\Component\SoftwareUninstalled.png
.\Skins\Default\Component\SoftwareUnziping.png
.\Skins\Default\Component\SoftwareError.png
.\Skins\Default\Component\PentagramCheck.png
.\Skins\Default\Component\Pentagram.png
.\Skins\Default\Component\ActError.png
.\Skins\Default\Component\Pupop16.png
.\Skins\Default\Component\SoftwareAct.png
.\Skins\Default\Component\DefaultImage16.png
.\Skins\Default\Component\ShortcutPtg.png
.\Skins\Default\Component\ShortcutPtgCheck.png
.\Skins\Default\Component\ShortcutPopup.png
.\Skins\Default\Component\ShortcutAct.png
.\Skins\Default\Component\ActPending.png
.\Skins\Default\Component\ActPause.png
.\Skins\Default\Component\ActUpload.png
.\Skins\Default\Component\ActDownload.png
.\Skins\Default\Component\TaskCompleted.png
.\Skins\Default\Component\TaskError.png
.\Skins\Default\Component\TaskPending.png
.\Skins\Default\Component\TaskPaused.png
.\Skins\Default\Component\TaskUploading.png
.\Skins\Default\Component\TaskDownloading.png
InitTaskControl(), InsertTaskParentItem(%s) return NULL.
http://www.xiaobai.com/Public/Uploadfile
%s\%s.png
http://baoku.xiaobai.com/index.html
XB_URL_MAIN_WEB
XB_MAIN_WEB
.\Skins\Default\Main\MiniExplorer\Homepage.png
http://baoku.xiaobai.com/s/index.html
XB_URL_SOFTBASE
.\Skins\Default\Main\MiniExplorer\Softbase.png
http://baoku.xiaobai.com/g/index.html
XB_URL_GAME_AREA
.\Skins\Default\Main\MiniExplorer\Games.png
XB_URL_SYS_CAPACITY_REQUIRED
.\Skins\Default\Main\MiniExplorer\Softwares.png
http://baoku.xiaobai.com/sn/xmlcreate.html
XB_URL_APPSTORE
.\Skins\Default\Main\NumbersMarked.png
.\Skins\Default\Main\NumbersDefault.png
MSG_VERSION_INFO
HTREEITEM CXiaoBaiDlg::FineSoftParentItem
CXiaoBaiDlg::UnzipSoftwareByTreeCtrlItem(), AddDownloadTaskWithUrl('%s'), return FALSE.
[%d/%d]:
CXiaoBaiDlg::RepairSoftwareProc() - FineSoftParentItem() failed.
%s\%s\%s\%s_X
CXiaoBaiDlg::RepairSoftware : FineSoftParentItem() = NULL
CXiaoBaiDlg::CheckRepairItemDpdcyThreadProc(), InstallComponentEx('%s') failed with code: %lu.
\XiaobaiTools.exe
XiaobaiTools.exe
\\.\pipe\@IMPORT_SHADOW_TASK_PIPE
CXiaoBaiDlg::PostImportShadowTask(0xx) - CPipeClient::Init() failed.
CXiaoBaiDlg::PostImportShadowTask(0xx) - CPipeClient::WriteToPipe() failed.
CXiaoBaiDlg::PostImportShadowTask(0xx) - CPipeClient::ReadFromPipe() failed.
NOTIFY_PROMPT_CANNOT_IMPORT_XB_SELF_WORK_DIR
NOTIFY_ERROR_IMPORT_WORK_DIR_FAILED_NO_ROOM
NOTIFY_ERROR_IMPORT_WORK_DIR_FAILED_NO_CONFIG
NOTIFY_ERROR_IMPORT_WORK_DIR_FAILED_READ_CONFIG
%s\%s\%s%s
NOTIFY_PROMPT_WORK_DIR_IMPORT_COMPLETE
CXiaoBaiDlg::CreateDecompressToInstall(), GetSoftItemHandle() return NULL, pkg('%s'.
CXiaoBaiDlg::CreateDecompressToInstall() begin to decompress pkg('%s') to install...
CXiaoBaiDlg::FinishInstallSoftwareProc(), theApp.GetAppPackageVersion('%s') failed.
.\Sound\Notify.wav
XBMSGBOX_PROMPT_WHETHER_TO_DOWNLOAD_FLASH_PLUGIN_NEW_VESION
%s%s?timestamp=%s&softname=%s&softsize=%d
MSG_MORE_SOFTWARE_SEARCH_TEXT
%s\%s\xb_task.xml
%s
/favicon.ico
G\\.\pipe\
Global\MUTEX_PIPE_INITED_%s
Software\Microsoft\Windows\CurrentVersion\Uninstall
ParentKeyName
IShadowRoot.New
ShadowRoot.Switch
~XbUninst.flg
IsSetUninstallFlag() - MoveFileEx("%s") failed, error code: %lu.
dnsapi.dll
%s.tmp
%.1f%s
svchost.exe
okernel32.dll
%d.%d
ntdll.dll
d-d-d d:d:d
CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32
RunApp('%s'): ShellExecuteEx() return FALSE, failed with code: %lu.
RunApp('%s'): ShellExecuteEx(), sei.hProcess = NULL, error code: %lu.
.ShellClassInfo
XbpInit - %s
..\..\common\XbpInit.cpp
StartInit(): m_wzXmlFile: %s
StartInit(): pwzWorkPath: %s
StartInit(): pwzXmlPath: %s
StartInit(): Set current directory: %s -> %s
StartInit(): xml.Open(%s) failed.
StartInit(): %s: %s ...
StartInit(): %s(%s) succeed
StartInit(): %s(%s) failed, error: %lu
..\..\common\logger\Logger.cpp
...%s
%s %s %s: %-100s at %d in %s
%s.bk%d
JStatistics - %s
log\stat.log
..\..\common\logger\Statistics.cpp
X_%s
CStatistics::GetVer(), fopen(%s) fail, error: %lu.
%s (%s)
Statistics.dat
CStatistics::OpenFile(), _wfopen(%s) failed, error: %lu.
CStatistics::SaveFile(), _wfopen(%s) failed, error: %lu.
[email protected]
CStatistics::SendData(), OpenUrl(%s) failed, error: %lu.
CStatistics::SendData(), QueueFile(%s) failed, error: %lu.
CStatistics::Send(), Params is invalid, FileName: %s, Url: %s.
CStatistics::PostHeartBeat(), OpenUrl(%s) failed, error: %lu.
JIDispatch error #%d
XML - %s
log\xml.log
CXml::InitWriterPtr() failed, CreateInstance(MSXML2::MXXMLWriter) error: 0xx
..\..\common\xml\Xml.cpp
CXml::InitReaderPtr() failed, CreateInstance(MSXML2::SAXXMLReader) error: 0xx
CXml::Open(%s) failed: %s
CXml::Create(%s, %s, %s) failed: %s
CXml::LoadXml failed: %s
%s:%s
CXml::CreateNode(%s, %s, %s) failed: %s
CXml::GetRoot failed: %s
CXml::SaveWithFormatted(%s) failed, InitWriterPtr() return FALSE.
CXml::SaveWithFormatted(%s) failed, InitReaderPtr() return FALSE.
http://xml.org/sax/properties/lexical-handler
http://xml.org/sax/properties/declaration-handler
CXml::SaveWithFormatted(%s) failed: %s
CXml::SaveStreamToFile(), failed to write file %s, error: %lu
CXml::SaveStreamToFile(), failed to move file %s -> %s, error: %lu
CXmlNode::_GetValue failed: %s
..\..\common\xml\XmlNode.cpp
CXmlNode::_SetValue failed: %s
CXmlNode::_GetAttribute failed: %s
CXmlNode::_SetAttribute failed: %s
*[local-name(.) = '%s']
CXmlNode::GetChild failed: %s
CXmlNode::NewChild failed: %s
CXmlNode::GetName failed: %s
CXmlNode::GetChildren failed: %s
CXmlNode::SelectSingleNode(%s) failed: %s
CXmlNodes::GetCount failed: %s
..\..\common\xml\XmlNodes.cpp
WebExplorer
ShellExe
X%s=%s
OnBeforeNavigate2() - InternetGetCookie("%s") failed, error code: %lu.
OnBeforeNavigate2() - InternetSetCookie("%s") failed, error code: %lu.
MaskCtrl_X
Odwmapi.dll
LXB.DragImage
CDragImage::Init() - RegisterClassEx() failed, error code: %d(0xX).
CDragImage::Init() - CreateWindowEx() failed, error code: %d(0xX).
burlywood
\winhlp32.exe
.cpp-comment {color:green; font-style:italic}
-.,!:;)}]?
X%C:\...%s
U.\Skins\Default\Main\Texture\TopDef.png
.\Skins\Default\Main\Texture\ButtomDef.png
.\Skins\Default\Main\Texture\TopStar.png
.\Skins\Default\Main\Texture\ButtomStar.png
.\Skins\Default\Main\Texture\TopLeaf.png
.\Skins\Default\Main\Texture\TopFlower.png
.\Skins\Default\Main\Texture\TopPrunus.png
.\Skins\Default\Main\Texture\TopChriremas.png
.\Skins\Default\Main\Texture\TopLanghua.png
.\Skins\Default\Main\Texture\TopSnow.png
HyperLink_Official_Web
TreeCtrl_Import_List
Static_Password
Picture_Password_Left
Picture_Password_Middle
Picture_Password_Right
Edit_Password
HyperLink_LostKey
CheckBox_Remember_Password
CheckBox_AutoLogin
Button_Login
WebExplorer_MiniWeb
CheckBoxEx_HotKey
Container_HotKey
Static_HotKey_Caption
Picture_HotKey_Line
Static_Boss_Key
Picture_Boss_Key_Left
Picture_Boss_Key_Middle
Picture_Boss_Key_Right
Edit_Boss_Key_Val
Button_HotKey_Reset
CheckBox_Notify_Msg
HtmlCtrl_Svrmsg
WebExplorer_AppStore_List
.\Skins\Default\Panel\Xiaobai.png
.\Skins\Default\Panel\MyComputer.png
.\Skins\Default\Panel\MyDocument.png
.\Skins\Default\Panel\ControlPanel.png
.\Skins\Default\Panel\Console.png
.\Skins\Default\Panel\Shutdown.png
UMSN.com.url
Windows.url
Windows Media.url
Hotmail.url
).url
Windows
Marketplace.url
Windows Live Hotmail.url
Windows Live
Windows Live
Windows Live
UPicture Files (*.jpg;*.gif;*.bmp;*.ico;*.png)|*.jpg;*.gif;*.bmp;*.ico;*.png|Execute Files (*.exe;*.dll;*.ocx)|*.exe;*.dll;*.ocx|All Files (*.*)|*.*||
D:\Xiaobai\Bin\Xiaobai.exe
D:\Xiaobai\Bin\Skins\Default\Common\SwfIcon16.png
D:\Xiaobai\Bin\Skins\Default\Common\SwfIcon32.png
D:\Xiaobai\Shadow\.\@XB_@config\apps.xml
D:\Xiaobai\Shadow\.\@XB_@config\task.xml
D:\Xiaobai\Shadow\.\@XB_@config\config.xml
000000002011093000
D:\Xiaobai\Bin\.\data\lang.xml
D:\Xiaobai\Shadow
D:\Xiaobai\Bin
All Files (*.*)
No error message is available.'An unsupported operation was attempted.$A required resource was unavailable.
Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.
Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else..An unexpected error occurred while reading %1..An unexpected error occurred while writing %1.
#Unable to load mail system support.
Access to %1 was denied..An invalid file handle was associated with %1.<%1 could not be removed because it is the current directory.6%1 could not be created because the directory is full.
Seek failed on A hardware I/O error was reported while accessing %1.0A sharing violation occurred while accessing %1.0A locking violation occurred while accessing %1.
Disk full while accessing %1..An attempt was made to access %1 past its end.
No error occurred.-An unknown error occurred while accessing %1./An attempt was made to write to the reading %1..An attempt was made to access %1 past its end.0An attempt was made to read from the writing %1.
xiaobai.com
3.1.1.0
Copyright (C) xiaobai.com, all rights reserved.

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):

taskkill.exe:612
taskkill.exe:1584
taskkill.exe:1920
taskkill.exe:672
taskkill.exe:508
taskkill.exe:812
taskkill.exe:1380
%original file name%.exe:564
u_rv259510009.exe:1384
KAVD_22_2317.exe:424
XiaobaiSetup.exe:348
Xiaobai.exe:864
dwwin.exe:544
BarBroker.exe:1136
XiaobaiSetup_3.1.1.(soft001).exe:1180
regsvr32.exe:1752
FX_82068094_3.exe:1604
DDGuoServer.exe:872
cacls.exe:1004
cacls.exe:264
Delete the original Backdoor file.
Delete or disinfect the following files created/modified by the Backdoor:

%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnPlayList.bmp (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\welcome.bmp (5064 bytes)
%Program Files%\Funshion Online\Funshion\skin\HidePlayInfoBtn.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnNext.bmp (10 bytes)
%Program Files%\Funshion Online\Funshion\Media\Start Funshion.lnk (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetBkgndHover.bmp (118 bytes)
%Program Files%\Funshion Online\Funshion\skin\OptionBtnBk.bmp (1552 bytes)
%Program Files%\Funshion Online\Funshion\skin\imgDrawMenuItem.bmp (14 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetBkgndL.bmp (162 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskListStatSelIcon.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionBkgnd.bmp (170 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarLeftBk.bmp (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Funshion\Funshion Use Help.lnk (256 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskMgnBarRScrollBtn.bmp (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instpath.ini (654 bytes)
%Program Files%\Funshion Online\Funshion\skin\CheckBox_Check.bmp (406 bytes)
%Program Files%\Funshion Online\Funshion\skin\ShowPlayInfoBtn.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\drvc.dll (9608 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarDownArrowL.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarRestore.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerBkgndL.bmp (90 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarPlay.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollLinkBkgnd.bmp (146 bytes)
%Program Files%\Funshion Online\Funshion\Funshion-install.ico (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBarSplidRgn.bmp (654 bytes)
%Program Files%\Funshion Online\Funshion\quality.dll (11048 bytes)
%Program Files%\Funshion Online\Funshion\skin\bmpError_IE.bmp (1856 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBufferInfoWndLeft.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\Dump.dll (11048 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionMenuBtn.bmp (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\installfilesen.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\pndx5032.dll (5 bytes)
%Program Files%\Funshion Online\Funshion\skin\IeToolBarBkgnd.bmp (166 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarHead.bmp (310 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerSimpleBarBk.bmp (166 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\installpathcn.bmp (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp\KillProcDLL.dll (784 bytes)
%Program Files%\Funshion Online\Funshion\fptassrv.dll (8560 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarSplid.bmp (166 bytes)
%Program Files%\Funshion Online\Funshion\skin\IeToolBarShowPlayerEn.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\UpdateCapCloseBtn.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskBarBtnMenu.bmp (7 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@funshion[2].txt (280 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp\NSISdl.dll (14 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnPauseSmall.bmp (5 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetBkgnd.bmp (182 bytes)
%Program Files%\Funshion Online\Funshion\skin\IntergrateModeBtn.bmp (2392 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayListVerSplid.bmp (78 bytes)
%Program Files%\Funshion Online\Funshion\skin\OptionText.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnMute.bmp (10 bytes)
%Program Files%\Funshion Online\Funshion\skin\bmpPrompt.bmp (7 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetHead.bmp (566 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBufferInfoWndBkgnd.bmp (174 bytes)
%Program Files%\Funshion Online\Funshion\skin\UpdateIconSuc.bmp (354 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBarVolumeBarBkgndRightSmall.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarDownArrow.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBufferInfoWndRight.bmp (894 bytes)
%Program Files%\Funshion Online\Funshion\skin\OptionSplidBarHead.bmp (200 bytes)
%Program Files%\Funshion Online\Funshion\skin\imgFullViewMini.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnPlaySmall.bmp (5 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarMoveUp.bmp (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\welcomekugou.bmp (5064 bytes)
%Program Files%\Funshion Online\Funshion\skin\MainNcRightBtmCorner.bmp (246 bytes)
%Program Files%\Funshion Online\Funshion\skin\PauseAdCloseBtn.bmp (3 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (2892 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoTitle.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoTitleBk.bmp (158 bytes)
%Program Files%\Funshion Online\Funshion\skin\imgStandardMiniEn.bmp (15 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionText.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\UpdateCapBkgnd.bmp (190 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnMuteSmall.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionMaxBtn.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarBkgnd.bmp (222 bytes)
%Program Files%\Funshion Online\Funshion\skin\UpdateBtmIgoreBtn.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionTextEn.bmp (6 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerSimpleBarBkgnd.bmp (166 bytes)
%Program Files%\Funshion Online\Funshion\skin\MainNcFrameLeft.bmp (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp\System.dll (11 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBkgnd.bmp (214 bytes)
%Program Files%\Funshion Online\Funshion\dbghelp.dll (33295 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionMenuF.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\ChangeModeBtn.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\imgCloseMini.bmp (5 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetTrailL.bmp (810 bytes)
%Program Files%\Funshion Online\Funshion\skin\TipTopArrow.bmp (306 bytes)
%Program Files%\Funshion Online\Funshion\skin\bmpCleanFile.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\FunshionService.exe (37025 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarBkgndSmall.bmp (110 bytes)
%Program Files%\Funshion Online\Funshion\skin\IErrorWndBk.bmp (2392 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnStopSmall.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\OptionSplidBarTrail.bmp (200 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetTrail.bmp (694 bytes)
%Documents and Settings%\All Users\Desktop\Funshion.lnk (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\StatusBarSplid.bmp (234 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp\WelcomePage.ini (299 bytes)
%Program Files%\Funshion Online\Funshion\skin\ListHeaderSplid.bmp (154 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetMid.bmp (182 bytes)
%Program Files%\Funshion Online\Funshion\rmoc3260.dll (6584 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsk2.tmp (395850 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarRightBk.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\UpdateBtmUpdateBtn.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoItemTextBk.bmp (10 bytes)
%Program Files%\Funshion Online\Funshion\cook.dll (1856 bytes)
%Program Files%\Funshion Online\Funshion\FunShion.ini (22 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnVolume.bmp (10 bytes)
%Program Files%\Funshion Online\Funshion\skin\PauseFlickerBtn.bmp (1552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp\nsisXML.dll (11 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionMinBtn.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskMgnTitleRight.bmp (678 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Setup_fengxingtg.exe (14761 bytes)
%Program Files%\Funshion Online\Funshion\skin\imgCleanFileBtn.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\WebCloseBtnRgn.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarThumbSmall.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\OptionTextEn.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskTabBtnPopIcon.bmp (270 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoBtmBar.bmp (226 bytes)
%Program Files%\Funshion Online\Funshion\skin\IeToolBarGamePage.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarTrail.bmp (310 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp\ExecDos.dll (5 bytes)
%Documents and Settings%\%current user%\funshion\cache\Cacheflash\blankFs.swf (80 bytes)
%System%\funshion.ini (2234 bytes)
%Program Files%\Funshion Online\Funshion\skin\IeToolBarBack.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetHeadHover.bmp (258 bytes)
%Program Files%\Funshion Online\Funshion\pncrt.dll (9608 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetTrailHover.bmp (174 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarBefore.bmp (126 bytes)
%Program Files%\Funshion Online\Funshion\skin\OptionSplideBarBkgnd.bmp (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\installfilescn.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\CheckBox_Box.bmp (450 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarStop.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\CoreAAC.ax (20416 bytes)
%Program Files%\Funshion Online\Funshion\skin\bmpPlayBarTip.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoHeaderBkgnd.bmp (798 bytes)
%Program Files%\Funshion Online\Funshion\skin\UpdateCaption.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\pndx5016.dll (6 bytes)
%Documents and Settings%\%current user%\funshion\install.ini (104 bytes)
%Program Files%\Funshion Online\Funshion\skin\MainNcFrameRight.bmp (58 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayListVerSplidMark.bmp (78 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarDelete.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\imgNormalViewMini.bmp (5 bytes)
%Program Files%\Funshion Online\Funshion\GetMACAddress.dll (5520 bytes)
%Program Files%\Funshion Online\Funshion\skin\OptionSplideBarThumb.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\WebToolBarBk.bmp (14 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarBk.bmp (15 bytes)
%Program Files%\Funshion Online\Funshion\FunshionUpgrade.exe (30464 bytes)
%Program Files%\Funshion Online\Funshion\Media\Install Latest Funshion.lnk (316 bytes)
%Program Files%\Funshion Online\Funshion\skin\RadioBtnPt.bmp (576 bytes)
%Documents and Settings%\%current user%\funshion\update\Pop Game.lnk (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskMgnBarBk.bmp (226 bytes)
%Program Files%\Funshion Online\Funshion\skin\bmpError.bmp (6 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarShowWeb.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\IeToolBarHomePage.bmp (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\FX_82068094_3.exe (141589 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\licenseen.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionMenuBtnEn.bmp (14 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarDownload.bmp (126 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarTrailSmall.bmp (198 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarUpArrowL.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskMgnBarLScrollBtn.bmp (5 bytes)
%Program Files%\Funshion Online\Funshion\skin\vodPlay.gif (7 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerBkgnd.bmp (98 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnSimple.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionNormalBtn.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnPre.bmp (10 bytes)
%Program Files%\Funshion Online\Funshion\fpsrv.dll (5064 bytes)
%Program Files%\Funshion Online\Funshion\skin\TipRightArrow.bmp (222 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoItemTextHover.bmp (10 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayListRemove.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\nicdescr.dat (1 bytes)
%Program Files%\Funshion Online\Funshion\funshionplugin2.dll (130775 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarBeforeSmall.bmp (102 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetMidL.bmp (162 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBarVolumeBarBkgndSmall.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\MainNcFrameTop.bmp (58 bytes)
%Program Files%\Funshion Online\Funshion\skin\MainNcFrameBtm.bmp (58 bytes)
%Program Files%\Funshion Online\Funshion\skin\bmpTimerClose.bmp (1552 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarSplid.bmp (210 bytes)
%Program Files%\Funshion Online\Funshion\icon\RMVB.ico (1856 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskText.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoBkgnd.bmp (150 bytes)
%Program Files%\Funshion Online\Funshion\skin\SplidBarBkgnd.bmp (70 bytes)
%Program Files%\Funshion Online\Funshion\skin\ListHeaderBkgnd.bmp (154 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskTabBkgnd.bmp (246 bytes)
%Program Files%\Funshion Online\Funshion\skin\LogoMiniEn.bmp (5 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnVolumeSmall.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollLinkFrm.bmp (15 bytes)
%Program Files%\Funshion Online\Funshion\skin\Scroll.gif (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetMidHover.bmp (118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\installpathen.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarDownloadSmall.bmp (102 bytes)
%Program Files%\Funshion Online\Funshion\skin\TextBtnBk.bmp (58 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnNonTop.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnNextSmall.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\Buffering.gif (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBarVolumeBarBkgnd.bmp (5 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerHideBtn.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\LogoMini.bmp (3 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@funshion[1].txt (540 bytes)
%Documents and Settings%\%current user%\funshion\update\Shopping Sites.lnk (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBarVolumeBarBkgndRight.bmp (5 bytes)
%Program Files%\Funshion Online\Funshion\skin\RpcStartDlgBk.bmp (3312 bytes)
%Program Files%\Funshion Online\Funshion\skin\imgNonTopViewMini.bmp (4 bytes)
%Documents and Settings%\All Users\Start Menu\Funshion.lnk (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarUpArrowRound.bmp (114 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskMgnBarCurItem.bmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Dump.dll (11048 bytes)
%Documents and Settings%\%current user%\funshion.ini (6448 bytes)
%Program Files%\Funshion Online\Funshion\LoginServer.dll (11344 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnNormal.bmp (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\funshion.ini (1164 bytes)
%Program Files%\Funshion Online\Funshion\skin\imgMinViewMini.bmp (5 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBarVolumeBarThumb.bmp (3 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Funshion\Uninstall Funshion.lnk (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\MainNcLeftTopCorner.bmp (222 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\config.xml (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\DragCorner.bmp (774 bytes)
%Program Files%\Funshion Online\Funshion\skin\MainNcLeftBtmCorner.bmp (246 bytes)
%Program Files%\Funshion Online\Funshion\skin\imgTopViewMini.bmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\welcomepage.ini (119 bytes)
%Program Files%\Funshion Online\Funshion\skin\DiskWarnning.bmp (950 bytes)
%Program Files%\Funshion Online\Funshion\skin\UpdateBtmBkgnd.bmp (234 bytes)
%Program Files%\Funshion Online\Funshion\coreavc.ax (9608 bytes)
%Program Files%\Funshion Online\Funshion\skin\StatusBarLeft.bmp (234 bytes)
%Program Files%\Funshion Online\Funshion\skin\MainNcRightTopCorner.bmp (246 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskBarTipDownArrow.bmp (306 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarMoveDown.bmp (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Funshion\Update History.lnk (280 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarVerWidgetHeadL.bmp (810 bytes)
%Program Files%\Funshion Online\Funshion\LangResEnAmerican.dll (4992 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp\InstPath.ini (1900 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarShowWebEn.bmp (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\getmacaddress.dll (11040 bytes)
%Program Files%\Funshion Online\Funshion\icon\MP4.ico (1856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nicdescr.dat (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\OptionBtnArrow.bmp (138 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarHeadSmall.bmp (198 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarThumb.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnFullView.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayListAddBtn.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBarVolumeBarThumbSmall.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskManagerCloseBtn.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayBarSplidLineBk.bmp (210 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnSetting.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskBarBtnOpenLcl.bmp (2392 bytes)
%Program Files%\Funshion Online\Funshion\skin\vodWebEn.gif (7 bytes)
%Program Files%\Funshion Online\Funshion\skin\UpdateIconInit.bmp (354 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskListRePlayBtn.bmp (12 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoBtnMenu.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskListBtnShow.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\Uninstall.exe (7966 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlaySplidBarBkgnd.bmp (126 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionCloseBtn.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnPlay.bmp (10 bytes)
%Program Files%\Funshion Online\Funshion\skin\OpenLocalBtnMenu.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskListRightLine.bmp (270 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerHideBtnEn.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\IErrorReshBtn.bmp (142 bytes)
%Program Files%\Funshion Online\Funshion\skin\GetFspFile.gif (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp\ExecCmd.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\xml2fspdata.exe (4992 bytes)
%Program Files%\Funshion Online\Funshion\skin\WebCloseBtn.bmp (8 bytes)
%Program Files%\Funshion Online\Funshion\skin\UpdateBtmCloseBtn.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerTipCloseBtn.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\bmpListHeaderBk.bmp (146 bytes)
%Program Files%\Funshion Online\Funshion\Funshion.exe (99795 bytes)
%Program Files%\Funshion Online\Funshion\skin\bmpQuestion.bmp (7 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskMgnTitleBkgnd.bmp (182 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskListStatIcons.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\vodWeb.gif (7 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarDownload.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoTitleEn.bmp (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Funshion.lnk (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\StatusBarBkgnd.bmp (218 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskListBtnHide.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskMgnBarItem.bmp (1552 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnPreSmall.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\SplidBarMark.bmp (634 bytes)
%Program Files%\Funshion Online\Funshion\skin\IeToolBarShowPlayer.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\StatusBarRight.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\Agentd.dll (11048 bytes)
%Program Files%\Funshion Online\Funshion\skin\vodPlayEn.gif (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp\FindProcDLL.dll (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\licensecn.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\RpcLoading.gif (11 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskMgnTitleLeft.bmp (726 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnTop.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\LoadTeleplayWeb.gif (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarBk000.bmp (15 bytes)
%Program Files%\Funshion Online\Funshion\skin\list_expend.bmp (802 bytes)
%Program Files%\Funshion Online\Funshion\skin\IeToolBarForward.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnPause.bmp (10 bytes)
%Program Files%\Funshion Online\Funshion\skin\TipBottomArrow.bmp (246 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskManagerCloseTxtBtn.bmp (15 bytes)
%Program Files%\Funshion Online\Funshion\skin\bmpClearDisk.bmp (4 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskTextEn.bmp (6 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarDownArrowRound.bmp (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsv3.tmp\md5dll.dll (8 bytes)
%Program Files%\Funshion Online\Funshion\skin\IeToolBarRefresh.bmp (1 bytes)
%Documents and Settings%\%current user%\funshion\cache\Cacheflash\donghuanew_18.swf (3616 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskMngBtnIcon.bmp (3 bytes)
%Program Files%\Funshion Online\Funshion\skin\CaptionMenuFEn.bmp (784 bytes)
%Program Files%\Funshion Online\Funshion\skin\TaskToolBarDiskClear.bmp (1 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Funshion\Funshion.lnk (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\ScrollBarUpArrow.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\skin\IeToolBarShopPage.bmp (2 bytes)
%Program Files%\Funshion Online\Funshion\skin\TabModeBtn.bmp (2392 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoCurPlay.bmp (342 bytes)
%Program Files%\Funshion Online\Funshion\skin\bmpMenuBk.bmp (1 bytes)
%Program Files%\Funshion Online\Funshion\CrashReport.exe (6584 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayerBarBtnStop.bmp (10 bytes)
%Program Files%\Funshion Online\Funshion\skin\PlayInfoBkgndSel.bmp (10 bytes)
%Program Files%\Funshion Online\Funshion\skin\imgStandardMini.bmp (12 bytes)
%Program Files%\Funshion Online\Funshion\skin\UpdateIconFail.bmp (354 bytes)
%Program Files%\Funshion Online\Funshion\skin\RadioBtnBox.bmp (576 bytes)
C:\FunshionInstall2.4.5.9.exe (42603 bytes)
C:\XiaobaiSetup_3.1.1.(soft001).exe (27947 bytes)
C:\u_rv259510009.exe (14726 bytes)
C:\KAVD_22_2317.exe (1180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu6.tmp\Processes.dll (1552 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã‚Â¶Ã‚Â¹Ã‚Â¶Ã‚Â¹Ã‚Â¹ÃƒÂ»\ÃƒÂÃ‚Â¶Ãƒâ€ÃƒËœÃ‚Â¶Ã‚Â¹Ã‚Â¶Ã‚Â¹Ã‚Â¹ÃƒÂ».lnk (657 bytes)
%Program Files%\DDGuo\DDGUOServer.exe (20416 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu6.tmp\services.dll (7 bytes)
%Program Files%\DDGuo\Update.exe (33536 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu6.tmp\System.dll (11 bytes)
%Program Files%\DDGuo\decode.dll (18424 bytes)
%Program Files%\DDGuo\uninst.exe (9943 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã‚Â¶Ã‚Â¹Ã‚Â¶Ã‚Â¹Ã‚Â¹ÃƒÂ»\Ã‚Â¶Ã‚Â¹Ã‚Â¶Ã‚Â¹Ã‚Â¹ÃƒÂ».lnk (650 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nse5.tmp (122778 bytes)
%Program Files%\DDGuo\fsx.dat (18 bytes)
%Program Files%\DDGuo\DDGuo.exe (70870 bytes)
%Program Files%\DDGuo\DDGFlash.swf (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu6.tmp\iotemp.ini (448 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\kingsoftkonline\KAVD_22_2317.exe.tmp (1316071 bytes)
%Documents and Settings%\%current user%\AppData\LocalLow\DDGuo\ADright.xml (26 bytes)
%Documents and Settings%\All Users\Application Data\DDGuo\popset.ini (47 bytes)
%Documents and Settings%\%current user%\AppData\LocalLow\DDGuo\Fav.dat (7 bytes)
%Documents and Settings%\%current user%\AppData\LocalLow\DDGuo\ADleft.xml (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\b185_appcompat.txt (4764 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Setting\Fill.png (149 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\Gradient.png (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MainMenuBtn.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Login\BannerTc.png (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\CaptionMiniEn.png (822 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MoveSoftNotify\Icons\Icon_3.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Notify\Error.gif (631 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails\config.xml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\FlashPlayer (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\.svn\entries (241 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Pentagram.png (548 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\config.xml (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsTransFrm.png (393 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActError.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xbie-button-back.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xbie-top-bg.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Caption.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnLanghua.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Blue.png (702 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Doc\Ã¨Âµâ€žÃ¦ÂºÂÃ¥Å’â€¦Ã¥Ë†Â¶Ã¤Â½Å“Ã¦â€¢â„¢Ã§Â¨â€¹\Ã¤Â½Â¿Ã§â€Â¨Ã¨Â¯Â´Ã¦ËœÅ½.txt (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Doc\Ã¨Âµâ€žÃ¦ÂºÂÃ¥Å’â€¦Ã¥Ë†Â¶Ã¤Â½Å“Ã¦â€¢â„¢Ã§Â¨â€¹\Ã¦â€œÂÃ¤Â½Å“Ã¨Â§â€ Ã©Â¢â€˜.url (190 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\SelectedItem.png (164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Xiaobai.exe (18771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\prop-base\setup_left.bmp.svn-base (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails\Details\images\xb_wrap_bg.jpg (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MaximizeBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\MiniTop.png (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\RootCollapse.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\TaskDownloading.png (447 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\text-base\io_finish.bmp.svn-base (283 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\PopupDown.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MoveSoftNotify\Icons\Icon_1.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\DefaultImage16.png (549 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Notify\ViewUpdate.gif (942 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\AppStoreList.png (552 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Green.png (748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\.svn\all-wcprops (114 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnShadowFlower.png (4 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶\Ã¥Â°ÂÃ§â„¢Â½Ã¥Â®ËœÃ¦â€“Â¹Ã§Â½â€˜Ã§Â«â„¢.lnk (645 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Exit\CheckBox.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActUpload.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwarePaused.png (418 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Lang\lang_tc.xml (74 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\SwitchBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsError.png (319 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MoveSoftNotify\config.xml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Logo.png (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\TabBackGnd.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\UpdateUpdating.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\XiaobaiTools.exe (5626 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Shutcut.png (568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\SliderBarSaturation.png (470 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\NumbersMarked.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ItemProperty\Config.xml (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnShadowDef.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwarePending.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\uninst.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\Desktop.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\SizeTag.png (206 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\CheckBox.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\SearchBox.png (202 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\FlashPlayer\config.xml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\TypeInfo\TYPE_SYS (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails\Details\index.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\MyComputer.png (2 bytes)
%System%\drivers\XiaobaiReg.sys (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\FullModeBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\SysButton.png (1 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶\Ã¥ÂÂ¸Ã¨Â½Â½.lnk (590 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\About\BannerTc.png (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Setup\icons\Xunlei7.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Plugins\QQ.dll (1034 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\ResInfo\config.xml (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Cab.dll (3573 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ShortcutPtgCheck.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\TabBtnUnchecked.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\About\config.xml (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopFlower.png (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\TaskUploading.png (461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ShortcutUninstalled.png (830 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Drivers\XiaobaiFsForVista.inf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActDownload.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\io_finish.bmp (283 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopDef.png (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\TextFrame.png (153 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\ResInfo\SpeedBtn.png (841 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\text-base\io_welcome.bmp.svn-base (283 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\7z.dll (11155 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Logo16.png (993 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\setup_left.bmp (141 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\XbpIcon16.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MessageBox\Icon.png (993 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\About\Banner.png (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\CloseBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Task.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopLeaf.png (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsUnzipFrm.png (471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Drivers\XiaobaiReg.sys (670 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\EditBoxEx.png (151 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Run1.png (419 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\NumbersDefault.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Ã§Â¬Â¬Ã¤ÂºÅ’Ã¦Â¬Â¡Ã¥Ë†â€¡Ã¥â€ºÂ¾\4.png (472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\WorkFolder.ico (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareRunning.png (379 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Drivers\XiaobaiFsForVista.sys (292 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Sort.png (467 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\RunAsAdmin.png (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\XbCom.dll (1571 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\Background.png (587 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Red.png (770 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Delete.cur (766 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Start.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareDownloading.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Information.png (645 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\text-base\xb_logo.bmp.svn-base (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Uninstall\config.xml (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\io_welcome.bmp (283 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\TabButton.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActDelete.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xbie-button-forward.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\NameSet\EditBox.png (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xb_failed.gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\prop-base\io_finish.bmp.svn-base (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Congfig.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\CheckBox.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\tan2.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\SwfIcon16.png (885 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Repair.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\Shutdown.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsTrans.png (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Run3.png (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Login\BannerEn.png (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\TaskError.png (418 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Plugins\360se3.dll (127 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Update\UpdateBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ShareToFriend\Config.xml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnShadowLeaf.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\FlashPlayer\RevertShowBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\DesktopTips.exe (267 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Recorder.exe (4505 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MessageBox\Information.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\ResInfo\Delete.png (657 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnShadowStar.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MessageBox\Question.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnShadowNull.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Tasklist.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ShadowSet\config.xml (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SyncImage32.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Games.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\RendItem.png (107 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsStop.png (365 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\lang.xml (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\UpdateCompleted.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenu (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareError.png (418 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Update\config.xml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\tan-bg.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\SearchBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\RedPoint.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Background.png (234 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Drivers\XiaobaiReg.sys (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\InitConfig.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\Console.png (513 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\RestoreBtn.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\CaptionTc.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActInstall.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Ã§Â¬Â¬Ã¤ÂºÅ’Ã¦Â¬Â¡Ã¥Ë†â€¡Ã¥â€ºÂ¾\1.png (419 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsStopFrm.png (471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Net.dll (2530 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Lang\lang_cn.xml (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Drift\back.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\prop-base\xb_logo.bmp.svn-base (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\DrvMgr.dll (811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Background40x68.png (666 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\PackageIcon16.png (759 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Gradient.png (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\entries (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ConfigList\config.xml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\MiniRight.png (155 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\CaptionEn.png (871 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶.url (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Update.exe (750 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Drivers\XiaobaiFsForXp.inf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\UpdateError.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ShortcutPopup.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Plugins\TheWorld3.dll (2008 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActPending.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\TaskCompleted.png (355 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xbie-button-forward.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\DropDownBtn.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Slider.png (170 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Line.png (188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Run2.png (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Unsel.png (335 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Setup\icons\PPStream.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareNormal.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\XbShortcutFolder.ico (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopChriremas.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\RootExpand.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Plugins\Maxthon2.dll (369 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\ResInfo\Add.png (568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Notify\Information.gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\CheckBoxI.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\TaskPaused.png (277 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActStart.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopLanghua.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniModeBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\XbUpdate\config.xml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\CaptionMini.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Login\EditBox.png (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenu\TopScrollBar.png (598 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Drift\backDown.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenuBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SendLnkNotify\config.xml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\CheckUpdate.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsUnzip.png (319 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SubCollapse.png (270 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnChriremas.png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\reload.gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenu\Separator.png (218 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Select.png (464 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Background40x40.png (580 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Setting\SheetPageEx.png (419 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Setting\config.xml (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\UpdatePending.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\prop-base\io_welcome.bmp.svn-base (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Drift\config.xml (486 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Shortcut16.png (306 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\ResInfo\MoveUp.png (650 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Notify\config.xml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\ColorBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopSnow.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ShortcutPopupImage.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\TaskPending.png (395 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\reginit.dat (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\Xiaobai.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Group.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\Dependence.xml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xb_loading.gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails\Details\js\jquery.js (72 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Exit\config.xml (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\MinimizeBtn.png (966 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Login\Background.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\XbNet.dll (3123 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Uninstall.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xbie-button-back.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails\Details\package.xsl (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Setting\SheetPage.png (422 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Tick.png (634 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recommand\config.xml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareDecomPending.png (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\ColumnHeader.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Button.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\ColorIcon.png (412 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareAct.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Loading.gif (771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ShortcutPtg.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Login\config.xml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Ã§Â¬Â¬Ã¤ÂºÅ’Ã¦Â¬Â¡Ã¥Ë†â€¡Ã¥â€ºÂ¾\2.png (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\ButtomStar.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\UpdatePaused.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Setup\icons\zhiwu.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ShadowSet\Symbol.png (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\DefaultImage32.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ShortcutRunning.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Gray.png (593 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xbie-button-reload.gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\SliderBarThumb.png (600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Update\Button.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\loading.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\CloseBtn.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SubExpand.png (213 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnSnow.png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Import\config.xml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\About\BannerEn.png (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\prop-base\state.bmp.svn-base (53 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Setting.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Homepage.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Css\style.css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\HoverItem.png (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\XbSvc.dll (5660 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\SetupPackageInfo.dat (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Images\xbie-button-reload.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PgrsErrorFrm.png (429 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\BtnSwitch.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\ButtomDef.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MoveSoftNotify\Icons\Icon_2.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Setup\icons\zuma.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\EditBox.png (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Run5.png (470 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\MyDocument.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\TabBtnChecked.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\AddGroup.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\tan3.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MessageBox\config.xml (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\ResInfo\MoveDown.png (639 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ShortcutAct.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MessageBox\Error.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopPrunus.png (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenu\BottomScrollBar.png (590 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Pupop16.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\CellSelState.png (583 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareUninstalled.png (460 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Drivers\XiaobaiFsForVista.sys (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\PackageIcon.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\LogConfig.ini (278 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\SliderBarBrightness.png (465 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\Button.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftDetails\Details\js\jquery.xslt.js (121 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Login.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\ButtonMini.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Purple.png (761 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\SoftwareList.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ProcessList\config.xml (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\BtnShadowPrunusMume.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\SliderBarHue.png (681 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MoveSoftNotify\Icons\Icon_4.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Ã§Â¬Â¬Ã¤ÂºÅ’Ã¦Â¬Â¡Ã¥Ë†â€¡Ã¥â€ºÂ¾\3.png (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Notify\Warning.gif (600 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SvrMsg\config.xml (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwarePopupBtn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\MiniLeft.png (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\tan1.png (809 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\all-wcprops (840 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwarePopupImage.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\text-base\state.bmp.svn-base (220 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\aserror.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\FlashPlayer.exe (2785 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\AddSheet.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Drivers\XiaobaiFsForXp.inf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Lang\lang_en.xml (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\.svn\text-base\setup_left.bmp.svn-base (141 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\ShareToFriend\Button.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\FlashPlayer\FullScreenBtn.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Setup\icons\Aliww.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\AppStoreListEx.png (450 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\error.html (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Background.png (829 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Texture\TopStar.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Default.png (702 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\Recorder.png (798 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Mark.png (795 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Drift\backOver.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\TypeInfo\TYPE_LNK.lnk (327 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶\Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶.lnk (586 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\TasklistEx.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActPause.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Drivers\XiaobaiFsForXp.sys (203 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Magenta.png (734 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\Main\config.xml (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Notify\RunNow.gif (854 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Drivers\XiaobaiFsForXp.sys (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PauseButton.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\GrayPoint.png (460 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\Shortcut32.png (175 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Run4.png (472 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_Brownish.png (766 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MoveSoftNotify\Icons\Icon_0.ico (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\config.xml (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenu\Background.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenu\HoverItem.png (474 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Color\Btn_DeepBlue.png (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\BtnRight.png (1 bytes)
%Documents and Settings%\%current user%\Desktop\Ã¥Â°ÂÃ§â„¢Â½Ã¨Â½Â¯Ã¤Â»Â¶Ã§Â®Â¡Ã¥Â®Â¶.lnk (586 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\NewTask.png (3 bytes)
%System%\drivers\XiaobaiFsForXp.sys (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\xb_logo.bmp (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\ActStop.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\Ã§Â¬Â¬Ã¤ÂºÅ’Ã¦Â¬Â¡Ã¥Ë†â€¡Ã¥â€ºÂ¾\5.png (470 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\FlashPlayer\DoubleShowBtn.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SoftwareUnziping.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\BtnLeft.png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\SyncImage16.png (803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\NameSet\config.xml (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\dependencywalker.xml (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\SoftwareListEx.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Softbase.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\Update.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Recorder\EditBox.png (145 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Uninstall.exe (650 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Component\PentagramCheck.png (715 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Login\Banner.png (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\SoftMove\config.xml (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Sound\Notify.wav (119 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Wizard\Css\asstyle.css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ControlPanel.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\ListMenu\DragShadow.png (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\Softwares.png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Panel\Separator.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\ShutcutEx.png (514 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Setup\icons\AngryBird.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Data\xbp.ico (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\ImageToolbar.png (164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Main\MiniExplorer\TabCloseBtn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\MessageBox\Warning.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Drivers\XiaobaiFsForVista.inf (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\res\state.bmp (220 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai\Bin\Skins\Default\Common\SwfIcon32.png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\12B9C3.dmp (115046 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\XiaobaiSetup.exe (1749 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Xiaobai.pkg (11414 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\Setup.pkg (3878 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Pkg\SetupRes.pkg (129 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\DrvMgr.dll (165 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\Cab.dll (222 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\7z.dll (6305 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~XB_SETUP_0012699F\setup.dat (190 bytes)
%Program Files%\Baidu\Toolbar\BaiduBarX.dll (39372 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â\Ã¥ÂÂ¸Ã¨Â½Â½Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â.lnk (1 bytes)
%Program Files%\Baidu\Toolbar\BaiduBarX_Tmp\rc.dll (17848 bytes)
%Program Files%\Baidu\{9A6E096E-4588-3E32-F06C-69F6B8784825}\AddressBar.dll (7726 bytes)
%Program Files%\Baidu\{9A6E096E-4588-3E32-F06C-69F6B8784825}\conf.xml (335 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â\Ã¥Â±ÂÃ¨â€Â½Ã¥Ë†â€”Ã¨Â¡Â¨.url (60 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â\Ã¨â€¡ÂªÃ¥Â®Å¡Ã¤Â¹â€°Ã¦Å’â€°Ã©â€™Â®.url (171 bytes)
%Program Files%\Baidu\AddressBar.dll (34365 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â\Ã¤Â¿Â®Ã¥Â¤ÂÃ¥Å Å¸Ã¨Æ’Â½.url (63 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â\Ã¥Å¾Æ’Ã¥Å“Â¾Ã¦Â¸â€¦Ã§Ââ€ .url (63 bytes)
%Program Files%\Baidu\{9A6E096E-4588-3E32-F06C-69F6B8784825}\ASBarBroker.exe (673 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â\Ã¤Â¸ÂªÃ¦â‚¬Â§Ã¥Å’â€“Ã©Â¦â€“Ã©Â¡Âµ.url (183 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â\Ã¥Â¹Â¿Ã¥â€˜Å Ã¦â€¹Â¦Ã¦Ë†Âª.url (60 bytes)
%Program Files%\Baidu\Toolbar\BarBroker.exe (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf9.tmp (101326 bytes)
%Program Files%\Baidu\conf.xml (335 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â\Ã©Å¡ÂÃ§Â§ÂÃ¤Â¿ÂÃ¦Å Â¤.url (63 bytes)
%Program Files%\Baidu\Toolbar\BaiduBarX_Tmp\BarBroker.exe (8560 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â\Ã¤Â¼Â´Ã¤Â¾Â£Ã¥Â¯Â¼Ã¨Ë†Âª.url (63 bytes)
%Program Files%\Baidu\Toolbar\rc.dll (3073 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Ã§â„¢Â¾Ã¥ÂºÂ¦Ã¥Â·Â¥Ã¥â€¦Â·Ã¦Â Â\Ã¥Â¸Â®Ã¥Å Â©Ã¦Å’â€¡Ã¥Ââ€”.url (64 bytes)
%Program Files%\Baidu\ASBarBroker.exe (5064 bytes)
%Program Files%\Baidu\Toolbar\BaiduBarX_Tmp\BaiduBarX.dll (86195 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Funshion" = "%Program Files%\Funshion Online\Funshion\Funshion.exe startbywindows tray"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DDGuo" = "%Program Files%\DDGuo\DDGuo.exe /A"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Xiaobai" = "D:\Xiaobai\Bin\Xiaobai.exe -auto"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Permalink

Back to the blog

e-mail

Google+

Twitter

Facebook

Backdoor.Win32.Farfli_0038282fbf

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet

Backdoor.Win32.Farfli_0038282fbf

E-mail

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet