Analysis Date2015-07-22 18:57:39
MD55e9ad8985cc0e50cbd071f76e078e0f7
SHA103ca61b9f1398a8cef4c5cf6d0a6c88bb556a2dd

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: eba1289852e36fe740eb03ce480a738f sha1: a7e7a0bc332c7f576e169a63921037159f666a43 size: 12288
Section.data md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.rsrc md5: dee69447b57373ecd67a6ac2153ba536 sha1: 41d5f30568f46b6a339fe0d599c9ef241e6d91e9 size: 4096
Timestamp2008-05-23 01:17:07
PackerMicrosoft Visual Basic v5.0
PEhash63d401725009edf0203d51f7f9c60be9fec9e441
IMPhash96e57d09efd03a48c83f1349e435734e
AVRisingTrojan.Agent!5630
AVCA (E-Trust Ino)Win32/Pcclient.FZ
AVF-SecureGen:Trojan.Heur.bmX@s1ArQPcaf
AVDr. WebWin32.HLLP.Reverse.1
AVClamAVTrojan.VB-4603
AVArcabit (arcavir)Gen:Trojan.Heur.bmX@s1ArQPcaf
AVBullGuardGen:Trojan.Heur.bmX@s1ArQPcaf
AVPadvishMalware.Trojan.VB-4603
AVVirusBlokAda (vba32)Trojan.VB
AVCAT (quickheal)Worm.Autorun.NC3
AVTrend MicroTROJ_VB.IXR
AVKasperskyTrojan.Win32.Fsysna.akyk
AVZillya!Backdoor.CPEX.Win32.27772
AVEmsisoftGen:Trojan.Heur.bmX@s1ArQPcaf
AVIkarusTrojan.Win32.VB
AVFrisk (f-prot)W32/Trojan2.FYIY
AVAuthentiumW32/Trojan.YEBW-4863
AVMalwareBytesno_virus
AVMicroWorld (escan)Gen:Trojan.Heur.bmX@s1ArQPcaf
AVMicrosoft Security EssentialsWorm:Win32/Autorun.XFV
AVK7Riskware ( 0040eff71 )
AVBitDefenderGen:Trojan.Heur.bmX@s1ArQPcaf
AVFortinetW32/Dropper.HSK!tr
AVSymantecTrojan Horse
AVGrisoft (avg)Generic10.AUGU
AVEset (nod32)Win32/AutoRun.VB.AMP worm
AVAlwil (avast)GenMalicious-HRY [Trj]
AVAd-AwareGen:Trojan.Heur.bmX@s1ArQPcaf
AVTwisterTrojan.DAA5B433F31BA52B
AVAvira (antivir)TR/VB.dbi
AVMcafeeW32/Autorun.worm.fb

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Program Files\Common Files\SpeechEngines\Microsoft\TTS\1033\sam.spd
Creates FileC:\WINDOWS\inf\atimpab.PNF
Creates FileC:\Documents and Settings\NetworkService\Local Settings\History\desktop.ini
Creates FileC:\WINDOWS\inf\display.inf
Creates FileC:\WINDOWS\Cursors\fillitup.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\desktop.ini
Creates FileC:\Program Files\NetMeeting\rrcm.dll
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0019E545\Plylst2.wpl
Creates FileC:\WINDOWS\Help\freecell.chm
Creates FileC:\WINDOWS\inf\keyboard.PNF
Creates FileC:\WINDOWS\Fonts\trebucbd.ttf
Creates FileC:\WINDOWS\inf\mdmcrtix.PNF
Creates FileC:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\thumbnailview.gif
Creates FileC:\Program Files\Windows NT\Pinball\SOUND36.WAV
Creates FileC:\WINDOWS\inf\mdmcxsf2.PNF
Creates FileC:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
Creates FileC:\WINDOWS\Help\tapi.hlp
Creates FileC:\WINDOWS\inf\adm_mult.PNF
Creates FileC:\WINDOWS\Cursors\size2_il.cur
Creates FileC:\WINDOWS\inf\bda.inf
Creates FileC:\WINDOWS\Cursors\pen_m.cur
Creates FileC:\Program Files\Windows NT\Pinball\SOUND13.WAV
Creates FileC:\WINDOWS\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
Creates FileC:\WINDOWS\Help\drwtsn32.hlp
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf
Creates FileC:\Documents and Settings\Administrator\Recent\signatures.pdf.lnk
Creates FileC:\WINDOWS\inf\mdmlasno.PNF
Creates FileC:\WINDOWS\inf\mdmhayes.inf
Creates FileC:\WINDOWS\Help\regedit.chm
Creates FileC:\WINDOWS\Fonts\frank.ttf
Creates FileC:\WINDOWS\Fonts\vga857.fon
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins3d\tesselate.x3d
Creates FileC:\WINDOWS\inf\digirprt.PNF
Creates FileC:\WINDOWS\Cursors\barber.exe
Creates FileC:\WINDOWS\inf\mdmiodat.inf
Creates FileC:\WINDOWS\Help\rsm.chm
Creates FileC:\WINDOWS\inf\mdmltsft.inf
Creates FileC:\WINDOWS\Cursors\up_il.cur
Creates FileC:\WINDOWS\Fonts\couree.fon
Creates FileC:\WINDOWS\ime\imkr6_1\applets\hwxkor.dll
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\icwhelp.dll
Creates FileC:\WINDOWS\Help\safer.chm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML
Creates FileC:\WINDOWS\Help\Tours\htmlTour\spacer.exe
Creates FileC:\WINDOWS\Fonts\lvnm.ttf
Creates FileC:\WINDOWS\Cursors\move_m.cur
Creates FileC:\WINDOWS\Help\Tours\htmlTour\img136.exe
Creates FileC:\Program Files\MSN Gaming Zone\Windows\zClientm.exe
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\icwconn.dll
Creates FileC:\Documents and Settings\Administrator\Templates\lotus.wk4
Creates FileC:\WINDOWS\Help\scarddlg.hlp
Creates FileC:\WINDOWS\inf\mdmgl004.PNF
Creates FileC:\WINDOWS\Fonts\vgaf1255.fon
Creates FileC:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\desktop.ini
Creates FileC:\WINDOWS\ime\imkr6_1\HELP\imkr61.hlp
Creates FileC:\WINDOWS\Help\Tours\htmlTour\taskbar_up.exe
Creates FileC:\WINDOWS\Help\update.cnt
Creates FileC:\WINDOWS\Cursors\hwe.cur
Creates FileC:\Documents and Settings\Administrator\Recent\shared on Samba 3.6.9-151.el6 (192.168.1.1).lnk
Creates FileC:\WINDOWS\inf\mdmgsm.inf
Creates FileC:\WINDOWS\Fonts\tahoma.ttf
Creates FileC:\WINDOWS\ime\imjp8_1\applets\voicesub.dll
Creates FileC:\WINDOWS\Fonts\8514syse.fon
Creates FileC:\Program Files\Common Files\System\msadc\msdaremr.dll
Creates FileC:\WINDOWS\Help\newfeat2.hlp
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp
Creates FileC:\WINDOWS\Fonts\ANGSAUI.TTF
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\AcroForm.api
Creates FileC:\WINDOWS\Fonts\smallet.fon
Creates FileC:\WINDOWS\ime\imjp8_1\HELP\imjpsm.chm
Creates FileC:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\desktop.ini
Creates FileC:\Program Files\Windows NT\Pinball\SOUND108.WAV
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Deployment\5a78c44122904d49aaeb4c49caa66478\System.Deployment.ni.dll
Creates FileC:\WINDOWS\AppPatch\drvmain.sdb
Creates FileC:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Windows Movie Maker.lnk
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\setup.ini
Creates FileC:\WINDOWS\Fonts\smaf1256.fon
Creates FileC:\WINDOWS\ime\imjp8_1\HELP\imjpdt.chm
Creates FileC:\WINDOWS\Help\hypertrm.hlp
Creates FileC:\WINDOWS\Help\Tours\htmlTour\best_robust.exe
Creates FileC:\WINDOWS\Fonts\courbd.ttf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\ul_logo.exe
Creates FileC:\WINDOWS\Fonts\ega40866.fon
Creates FileC:\WINDOWS\Fonts\hvgafix.fon
Creates FileC:\WINDOWS\AppPatch\apph_sp.sdb
Creates FileC:\Program Files\Common Files\System\Ole DB\msdaora.dll
Creates FileC:\WINDOWS\inf\mdmarch.inf
Creates FileC:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\xjis.nlp
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm9.exe
Creates FileC:\WINDOWS\Help\ratings.cnt
Creates FileC:\WINDOWS\Fonts\cga40850.fon
Creates FileC:\WINDOWS\Help\Tours\htmlTour\nav_blank.exe
Creates FileC:\B1uv3nth3x1.diz
Creates FileC:\WINDOWS\Fonts\hvgasys.fon
Creates FileC:\WINDOWS\Help\Tours\mmTour\intro.swf
Creates FileC:\WINDOWS\Help\rktools.chm
Creates FileC:\WINDOWS\Help\msconfig.chm
Creates FileC:\WINDOWS\Fonts\vga775.fon
Creates FileC:\WINDOWS\Help\recycle.chm
Creates FileC:\WINDOWS\inf\mdmdgitn.PNF
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe\Updater6\aum.log
Creates FileC:\WINDOWS\Fonts\vgasysr.fon
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Desktop.ini
Creates FileC:\WINDOWS\Help\Tours\htmlTour\img068.exe
Creates FileC:\WINDOWS\Help\access.chm
Creates FileC:\WINDOWS\Fonts\comic.ttf
Creates FileC:\WINDOWS\inf\communic.PNF
Creates FileC:\WINDOWS\Fonts\cga40woa.fon
Creates FileC:\WINDOWS\inf\mdmdyna.PNF
Creates FileC:\WINDOWS\Fonts\ega80857.fon
Creates FileC:\WINDOWS\Cursors\arrow_r.cur
Creates FileC:\WINDOWS\inf\brmfcsto.PNF
Creates FileC:\WINDOWS\Help\winime.chm
Creates FileC:\WINDOWS\Help\agt0c0a.hlp
Creates FileC:\Program Files\Common Files\System\ado\msado26.tlb
Creates FileC:\Program Files\Common Files\Microsoft Shared\web server extensions\40\bin\fp4autl.dll
Creates FileC:\WINDOWS\Help\Tours\mmTour\segment2.txt
Creates FileC:\WINDOWS\inf\mdmaiwa.PNF
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Pie Charts Bkgrd.jpg
Creates FileC:\WINDOWS\Fonts\arialbd.ttf
Creates FileC:\Program Files\Windows NT\Pinball\SOUND68.WAV
Creates FileC:\WINDOWS\Help\gpedit.hlp
Creates FileC:\WINDOWS\Fonts\cga40866.fon
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\1abf0e.msp
Creates FileC:\WINDOWS\inf\adm_mult.inf
Creates FileC:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\IIQ3LGTM\desktop.ini
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\WERfd9e.dir00\wuauclt.exe.hdmp
Creates FileC:\WINDOWS\Help\pinball.hlp
Creates FileC:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
Creates FileC:\Program Files\Windows NT\Pinball\SOUND6.WAV
Creates FileC:\WINDOWS\Help\mouse.chm
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0019E545\Plylst11.wpl
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp
Creates FileC:\WINDOWS\CSC\csc1.tmp
Creates FileC:\WINDOWS\inf\ksfilter.PNF
Creates FileC:\WINDOWS\Fonts\cga80850.fon
Creates FileC:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
Creates FileC:\WINDOWS\Cursors\3dwnesw.cur
Creates FileC:\Program Files\MSN Gaming Zone\Windows\ZCorem.dll
Creates FileC:\WINDOWS\Help\Tours\mmTour\segment1.swf
Creates FileC:\WINDOWS\Fonts\seriffg.fon
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\DigSig.api
Creates FileC:\WINDOWS\inf\input.inf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\desktop_up.exe
Creates FileC:\WINDOWS\Fonts\85f874.fon
Creates FileC:\Program Files\Windows NT\Pinball\SOUND9.WAV
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Maize.htm
Creates FileC:\Program Files\Windows NT\Pinball\SOUND104.WAV
Creates FileC:\WINDOWS\Fonts\trebucit.ttf
Creates FileC:\WINDOWS\inf\1394.inf
Creates FileC:\Program Files\Common Files\System\msadc\msadcer.dll
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\attach_comment.gif
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
Creates FileC:\Documents and Settings\Default User\Local Settings\History\desktop.ini
Creates FileC:\WINDOWS\ime\imjp8_1\HELP\imjpcl.chm
Creates FileC:\WINDOWS\Fonts\85f1255.fon
Creates FileC:\WINDOWS\Fonts\ega40869.fon
Creates FileC:\WINDOWS\Fonts\times.ttf
Creates FileC:\WINDOWS\Help\cpanel.chm
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\Annots.api
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\desktop.ini
Creates FileC:\WINDOWS\Help\Tours\htmlTour\best_robust_big.exe
Creates FileC:\WINDOWS\Cursors\hnodrop.cur
Creates FileC:\WINDOWS\Help\hypertrm.chm
Creates FileC:\WINDOWS\inf\fp40ext.PNF
Creates FileC:\WINDOWS\Fonts\ssef1257.fon
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\layerisvisible.gif
Creates FileC:\WINDOWS\inf\brmfcmf.inf
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\1abf0c.msp
Creates FileC:\Program Files\Common Files\System\msadc\msadcor.dll
Creates FileC:\WINDOWS\Help\Tours\htmlTour\img149.exe
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Fiesta Bkgrd.jpg
Creates FileC:\WINDOWS\Fonts\mriamc.ttf
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\desktop.ini
Creates FileC:\WINDOWS\inf\enum1394.PNF
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\VDKHome\ENU\acro20.lng
Creates FileC:\WINDOWS\Help\Tours\mmTour\nav.swf
Creates FileC:\WINDOWS\netfxocm.log
Creates FileC:\WINDOWS\Help\agt0410.hlp
Creates FileC:\WINDOWS\inf\irstusb.inf
Creates FileC:\WINDOWS\inf\mdmaiwat.PNF
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Btn\cntd.exe
Creates FileC:\WINDOWS\Help\rrc.chm
Creates FileC:\WINDOWS\inf\mdmgl006.PNF
Creates FileC:\WINDOWS\Cursors\3dgwe.cur
Creates FileC:\WINDOWS\Help\nocontnt.cnt
Creates FileC:\WINDOWS\Fonts\85855.fon
Creates FileC:\WINDOWS\REGLOCS.OLD
Creates FileC:\Documents and Settings\Administrator\Application Data\Adobe\Acrobat\7.0\JavaScripts\glob.settings.js
Creates FileC:\RECYCLER\S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-500\INFO2
Creates FileC:\WINDOWS\Help\windows.chq
Creates FileC:\WINDOWS\inf\mdmintel.PNF
Creates FileC:\Documents and Settings\Default User\Local Settings\History\History.IE5\index.dat
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\C_MoreTopics_Lg_N.gif
Creates FileC:\WINDOWS\Help\Tours\htmlTour\safe_faster.htm
Creates FileC:\Documents and Settings\Default User\Cookies\index.dat
Creates FileC:\WINDOWS\inf\kdkscan.PNF
Creates FileC:\WINDOWS\inf\mdmatt.inf
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0019E545\Plylst7.wpl
Creates FileC:\WINDOWS\inf\mdmgl001.PNF
Creates FileC:\WINDOWS\inf\brmfport.inf
Creates FileC:\WINDOWS\Help\password.chm
Creates FileC:\WINDOWS\Cursors\size3_rl.cur
Creates FileC:\WINDOWS\Cursors\size2_im.cur
Creates FileC:\WINDOWS\Fonts\vgas1257.fon
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Help\ENU\Reader.pdf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\safe_easy_easier_ghost.exe
Creates FileC:\WINDOWS\Cursors\wait_rm.cur
Creates FileC:\WINDOWS\Cursors\no_il.cur
Creates FileC:\WINDOWS\inf\dwup.inf
Creates FileC:\Documents and Settings\Administrator\Templates\presenta.shw
Creates FileC:\WINDOWS\Help\Tours\htmlTour\footer.htm
Creates FileC:\WINDOWS\Fonts\vga865.fon
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\ebookonline.gif
Creates FileC:\WINDOWS\Help\winchat.chm
Creates FileC:\WINDOWS\Help\wscript.chm
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Video\viz.wmv
Creates FileC:\WINDOWS\Help\mshearts.hlp
Creates FileC:\Program Files\Windows NT\Pinball\PINBALL2.MID
Creates FileC:\Documents and Settings\All Users\Documents\desktop.ini
Creates FileC:\WINDOWS\inf\epstw2k.inf
Creates FileC:\WINDOWS\Help\winhlp32.hlp
Creates FileC:\Program Files\Messenger\online.wav
Creates FileC:\WINDOWS\Fonts\framdit.ttf
Creates FileC:\Program Files\Movie Maker\WMM2FXB.dll
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\AdobeARM_NotLocked.log
Creates FileC:\WINDOWS\Fonts\c8514oem.fon
Creates FileC:\WINDOWS\inf\mdmcomp.PNF
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Btn\tplayh.exe
Creates FileC:\Documents and Settings\Administrator\Favorites\Links\Windows.url
Creates FileC:\WINDOWS\inf\au.PNF
Creates FileC:\Documents and Settings\Administrator\SendTo\desktop.ini
Creates FileC:\WINDOWS\inf\mdm3cpcm.PNF
Creates FileC:\WINDOWS\Cursors\arrow_rl.cur
Creates FileC:\WINDOWS\Prairie Wind.exe
Creates FileC:\WINDOWS\Help\Glossary.chm
Creates FileC:\WINDOWS\Fonts\georgia.ttf
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\distancetool.gif
Creates FileC:\WINDOWS\Help\Tours\htmlTour\img033.exe
Creates FileC:\WINDOWS\Help\Tours\htmlTour\connected_multiple.exe
Creates FileC:\WINDOWS\Help\dkconcepts.chm
Creates FileC:\WINDOWS\Fonts\ANGSAUZ.TTF
Creates FileC:\WINDOWS\ocgen.log
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Setup Files\RdrBig709\ENU\setup.exe
Creates FileC:\WINDOWS\Cursors\handno.exe
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\icwdl.dll
Creates FileC:\WINDOWS\Fonts\wst_span.fon
Creates FileC:\WINDOWS\inf\irstusb.PNF
Creates FileC:\WINDOWS\Fonts\batang.ttc
Creates FileC:\WINDOWS\Help\sysrestore.hlp
Creates FileC:\WINDOWS\Help\sigverif.hlp
Creates FileC:\WINDOWS\winnt.exe
Creates FileC:\WINDOWS\Fonts\ega80852.fon
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\WERfd9e.dir00\appcompat.txt
Creates FileC:\WINDOWS\inf\irnsc.inf
Creates FileC:\WINDOWS\ime\imjp8_1\HELP\imjpcl.hlp
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\Themes\Custom.theme
Creates FileC:\Program Files\Windows NT\Pinball\SOUND827.WAV
Creates FileC:\WINDOWS\Fonts\simhei.ttf
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Games\Solitaire.lnk
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\Messages\ENU\RdrMsgENU.pdf
Creates FileC:\WINDOWS\inf\mdmke.inf
Creates FileC:\WINDOWS\inf\biosinfo.inf
Creates FileC:\WINDOWS\inf\asynceqn.PNF
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Windows Media Player.lnk
Creates FileC:\WINDOWS\Help\aclui.hlp
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Disk Cleanup.lnk
Creates FileC:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
Creates FileC:\WINDOWS\Cursors\banana.exe
Creates FileC:\Program Files\MSN\MSNCoreFiles\OOBE\obemetal.dll
Creates FileC:\WINDOWS\ime\chsime\applets\PINTLCSD.DLL
Creates FileC:\WINDOWS\inf\cyclad-z.PNF
Creates FileC:\WINDOWS\inf\mdmgl002.PNF
Creates FileC:\WINDOWS\inf\mdmgl007.PNF
Creates FileC:\Program Files\Common Files\Microsoft Shared\Speech\sapi.dll
Creates FileC:\WINDOWS\Help\telnet.chm
Creates FileC:\WINDOWS\Cursors\size1_l.cur
Creates FileC:\WINDOWS\Help\newfeat2.chm
Creates FileC:\WINDOWS\vb.ini
Creates FileC:\Program Files\Outlook Express\wabimp.dll
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf
Creates FileC:\WINDOWS\inf\3dfxvs2k.PNF
Creates FileC:\Program Files\Common Files\System\Ole DB\msdaorar.dll
Creates FileC:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\225ba1a2ab6a9a479344d4cb1fb2cf4d\System.DirectoryServices.ni.dll
Creates FileC:\WINDOWS\inf\bthprint.inf
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Security\e159fddf60aee34e9a66ec6ba913b752\System.Security.ni.dll
Creates FileC:\WINDOWS\Help\wbemtest.chm
Creates FileC:\Program Files\Common Files\System\msadc\msdaprsr.dll
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Games\Pinball.lnk
Creates FileC:\WINDOWS\inf\mdmess.PNF
Creates FileC:\Documents and Settings\All Users\DRM\drmv2.lic
Creates FileC:\Program Files\Messenger\msgslang.dll
Creates FileC:\WINDOWS\Fonts\sseriffg.fon
Creates FileC:\Program Files\Common Files\SpeechEngines\Microsoft\TTS\1033\sam.sdf
Creates FileC:\WINDOWS\Help\supp_ed.chm
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\icwres.dll
Creates FileC:\WINDOWS\inf\dimaps.inf
Creates FileC:\WINDOWS\Fonts\UPCII.TTF
Creates FileC:\WINDOWS\Help\whatsnew.chm
Creates FileC:\Program Files\Common Files\System\Ole DB\msdadc.dll
Creates FileC:\WINDOWS\ime\imjp8_1\HELP\imjpsme.chm
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\distance.gif
Creates FileC:\WINDOWS\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\PictureTasks\Howto\images\sharephoto.gif
Creates FileC:\WINDOWS\ime\shared\imlang.dll
Creates FileC:\WINDOWS\Help\Tours\htmlTour\logo.exe
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\262de2c26ed52c4a967a1c31ef64127b\Microsoft.Build.Utilities.ni.dll
Creates FileC:\WINDOWS\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
Creates FileC:\WINDOWS\Help\mplayer2.cnt
Creates FileC:\WINDOWS\inf\camdsh20.inf
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Ivy.gif
Creates FileC:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
Creates FileC:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Creates FileC:\WINDOWS\Fonts\CORDIAB.TTF
Creates FileC:\WINDOWS\Help\blutooth.chm
Creates FileC:\Program Files\MSN Gaming Zone\Windows\chkrzm.exe
Creates FileC:\WINDOWS\ime\CHTIME\Applets\CHTAPT.HLP
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Nature.htm
Creates FileC:\WINDOWS\Fonts\palab.ttf
Creates FileC:\WINDOWS\Cursors\pen_i.cur
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\readebook.gif
Creates FileC:\WINDOWS\Help\modem.hlp
Creates FileC:\WINDOWS\AppPatch\AcSpecfc.dll
Creates FileC:\WINDOWS\inf\mdmeiger.inf
Creates FileC:\WINDOWS\vbaddin.ini
Creates FileC:\WINDOWS\inf\ims.PNF
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Component Services.lnk
Creates FileC:\WINDOWS\ime\imjp8_1\applets\imskdic.dll
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp
Creates FileC:\WINDOWS\Help\eudcedit.hlp
Creates FileC:\WINDOWS\inf\digimps.inf
Creates FileC:\Program Files\Windows NT\dialer.exe
Creates FileC:\WINDOWS\inf\mdmc26a.INF
Creates FileC:\WINDOWS\Help\Tours\mmTour\segment5.swf
Creates FileC:\WINDOWS\Help\agt0414.hlp
Creates FileC:\WINDOWS\Fonts\app936.fon
Creates FileC:\Program Files\Common Files\Microsoft Shared\Web Folders\MSONSEXT.DLL
Creates FileC:\WINDOWS\inf\mdmhaeu.PNF
Creates FileC:\WINDOWS\Help\wpa.chm
Creates FileC:\WINDOWS\Fonts\ANGSAU.TTF
Creates FileC:\WINDOWS\Help\keyb.chm
Creates FileC:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileC:\WINDOWS\Help\charmap.hlp
Creates FileC:\WINDOWS\Fonts\symbole.fon
Creates FileC:\WINDOWS\Cursors\wait_i.cur
Creates FileC:\WINDOWS\Fonts\j8514oem.fon
Creates FileC:\WINDOWS\Cursors\busy_rm.cur
Creates FileC:\WINDOWS\Help\audit.chm
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Btn\cloapph.exe
Creates FileC:\WINDOWS\Fonts\UPCIBI.TTF
Creates FileC:\WINDOWS\Fonts\UPCDL.TTF
Creates FileC:\Program Files\Windows NT\Pinball\SOUND12.WAV
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\Acrofx32.dll
Creates FileC:\Program Files\MSN\MSNCoreFiles\Install\MSN9Components\digreqEx.msi
Creates FileC:\WINDOWS\Help\netcfg.chm
Creates FileC:\WINDOWS\Fonts\trado.ttf
Creates FileC:\WINDOWS\Help\addremov.chm
Creates FileC:\WINDOWS\inf\dshowext.inf
Creates FileC:\WINDOWS\Fonts\cga80852.fon
Creates FileC:\WINDOWS\inf\mdm3mini.PNF
Creates FileC:\Program Files\Common Files\System\Ole DB\msdatl3.dll
Creates FileC:\WINDOWS\Help\iewebhlp.chm
Creates FileC:\WINDOWS\Fonts\ega80866.fon
Creates FileC:\WINDOWS\win.ini
Creates FileC:\WINDOWS\inf\mdmbsb.inf
Creates FileC:\WINDOWS\Help\icwdial.chm
Creates FileC:\WINDOWS\Fonts\courer.fon
Creates FileC:\Program Files\Common Files\System\Ole DB\msdaurl.dll
Creates FileC:\Documents and Settings\LocalService\Local Settings\History\History.IE5\desktop.ini
Creates FileC:\WINDOWS\Help\progman.cnt
Creates FileC:\WINDOWS\Help\els.chm
Creates FileC:\WINDOWS\Debug\PASSWD.LOG
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\Search5.api
Creates FileC:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\7VNNFHVS\desktop.ini
Creates FileC:\WINDOWS\inf\mdmhay2.PNF
Creates FileC:\WINDOWS\inf\mdmetech.PNF
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\addfile.gif
Creates FileC:\WINDOWS\Help\ade.hlp
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\2.gif
Creates FileC:\WINDOWS\inf\corelist.PNF
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Css\controls.css
Creates FileC:\Program Files\Common Files\System\Ole DB\msdaosp.dll
Creates FileC:\WINDOWS\inf\mdmdcm5.PNF
Creates FileC:\WINDOWS\Help\tshoot.dll
Creates FileC:\WINDOWS\inf\bthpan.PNF
Creates FileC:\WINDOWS\inf\dvd.inf
Creates FileC:\WINDOWS\Help\dskquoui.hlp
Creates FileC:\Documents and Settings\Administrator\Application Data\Adobe\Acrobat\7.0\AdobeCMapFnt07.lst
Creates FileC:\WINDOWS\Fonts\david.ttf
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Program Files\MSN\MSNCoreFiles\Install\msnms.ico
Creates FileC:\WINDOWS\inf\mdmairte.inf
Creates FileC:\WINDOWS\Help\agt0419.hlp
Creates FileC:\WINDOWS\Fonts\UPCEI.TTF
Creates FileC:\WINDOWS\Fonts\CORDIAZ.TTF
Creates FileC:\Program Files\Windows NT\Pinball\SOUND19.WAV
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\rt3d.dll
Creates FileC:\Program Files\NetMeeting\nmcom.dll
Creates FileC:\WINDOWS\Help\wingb.chm
Creates FileC:\Documents and Settings\Default User\Templates\winword.doc
Creates FileC:\WINDOWS\Cursors\handnwse.exe
Creates FileC:\WINDOWS\Help\sndvol32.chm
Creates FileC:\Documents and Settings\All Users\DRM\drmv2.sst
Creates FileC:\WINDOWS\Help\signin.hlp
Creates FileC:\WINDOWS\inf\mdmhandy.PNF
Creates FileC:\WINDOWS\Help\agt0816.hlp
Creates FileC:\WINDOWS\Fonts\msmincho.ttc
Creates FileC:\WINDOWS\Help\find.chm
Creates FileC:\WINDOWS\ime\imkr6_1\imekrcic.dll
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm3.exe
Creates FileC:\WINDOWS\Help\winhlp32.cnt
Creates FileC:\WINDOWS\inf\mdmcxsft.inf
Creates FileC:\WINDOWS\Cursors\size2_m.cur
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\d42cc0c3858a58db2db37658219e6400_666939c9-243b-475e-9504-51724db22670
Creates FileC:\WINDOWS\ehome\custsat.dll
Creates FileC:\WINDOWS\inf\divac.inf
Creates FileC:\WINDOWS\imsins.log
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Citrus Punch.htm
Creates FileC:\WINDOWS\inf\inetcorp.adm
Creates FileC:\Program Files\Windows NT\Pinball\SOUND181.WAV
Creates FileC:\WINDOWS\inf\fxsocm.PNF
Creates FileC:\WINDOWS\inf\mdmltleo.inf
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\icwx25c.dun
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\IA32.api
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\VDKHome\VDK10.LIC
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\c65e862783686947bd1f8bc0c492c593\System.Web.ni.dll
Creates FileC:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\Windows Media Player.lnk
Creates FileC:\Program Files\MSN Gaming Zone\Windows\zonelibM.dll
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\cac3915cde29fb45a994ab2e7cef3cc8\CustomMarshalers.ni.dll
Creates FileC:\WINDOWS\inf\mdmbw561.INF
Creates FileC:\WINDOWS\Help\Tours\htmlTour\nav_gray.exe
Creates FileC:\WINDOWS\Fonts\cga80woa.fon
Creates FileC:\WINDOWS\Help\Tours\mmTour\segment3.swf
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\icwtutor.exe
Creates FileC:\WINDOWS\Help\ntchowto.chm
Creates FileC:\Program Files\NetMeeting\nmft.dll
Creates FileC:\WINDOWS\Help\Tours\htmlTour\start_up.exe
Creates FileC:\WINDOWS\inf\mdmcxsft.PNF
Creates FileC:\WINDOWS\Fonts\UPCDI.TTF
Creates FileC:\WINDOWS\Fonts\dosapp.fon
Creates FileC:\WINDOWS\Cursors\beam_il.cur
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.DTD
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\VDKHome\ENU\Vdk10.rst
Creates FileC:\WINDOWS\inf\divasrv.PNF
Creates FileC:\WINDOWS\Help\newfeat3.chm
Creates FileC:\WINDOWS\inf\mdmadc.inf
Creates FileC:\WINDOWS\inf\AER_1036.ADM
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IIQ3LGTM\desktop.ini
Creates FileC:\WINDOWS\inf\AER_1042.ADM
Creates FileC:\WINDOWS\Zapotec.exe
Creates FileC:\WINDOWS\Cursors\size4_rl.cur
Creates FileC:\Program Files\Common Files\Microsoft Shared\DW\1028\DWINTL20.DLL
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\icwutil.dll
Creates FileC:\WINDOWS\Help\agt0406.hlp
Creates FileC:\WINDOWS\Fonts\wst_ital.fon
Creates FileC:\WINDOWS\Fonts\s8514oem.fon
Creates FileC:\WINDOWS\inf\drvindex.PNF
Creates FileC:\WINDOWS\inf\apps.PNF
Creates FileC:\WINDOWS\Fonts\wst_engl.fon
Creates FileC:\WINDOWS\Fonts\vga860.fon
Creates FileC:\Program Files\Windows NT\Accessories\mswrd6.wpc
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\55d81ae8e2706c4f808e758269014887\Microsoft.VisualBasic.ni.dll
Creates FileC:\WINDOWS\ime\imjp8_1\imjpmig.exe
Creates FileC:\WINDOWS\ime\imkr6_1\imekrmig.exe
Creates FileC:\WINDOWS\Help\Tours\htmlTour\start_menu.htm
Creates FileC:\WINDOWS\Fonts\palai.ttf
Creates FileC:\WINDOWS\Help\newfeat4.hlp
Creates FileC:\WINDOWS\inf\mdmdsi.inf
Creates FileC:\WINDOWS\Cursors\size3_rm.cur
Creates FileC:\Program Files\Windows NT\Pinball\SOUND22.WAV
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Blank.htm
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Creates FileC:\WINDOWS\inf\dgasync.PNF
Creates FileC:\WINDOWS\inf\icminst.PNF
Creates FileC:\boot.ini
Creates FileC:\WINDOWS\inf\enum1394.inf
Creates FileC:\Program Files\Common Files\Microsoft Shared\Web Folders\MSOWS409.DLL
Creates FileC:\WINDOWS\Fonts\85s1257.fon
Creates FileC:\WINDOWS\inf\eqnport.inf
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk
Creates FileC:\WINDOWS\Help\cdmedia.hlp
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Sunflower.htm
Creates FileC:\WINDOWS\Fonts\verdanaz.ttf
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Clear Day Bkgrd.jpg
Creates FileC:\WINDOWS\inf\digirprt.inf
Creates FileC:\WINDOWS\Help\fxsshare.chm
Creates FileC:\Program Files\Windows NT\Pinball\SOUND50.WAV
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\desktop.ini
Creates FileC:\WINDOWS\Help\wmplayer.chm
Creates FileC:\WINDOWS\Help\msorcl32.chm
Creates FileC:\WINDOWS\WMSysPr9.prx
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp
Creates FileC:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini
Creates FileC:\WINDOWS\inf\drm.inf
Creates FileC:\WINDOWS\Cursors\arrow_il.cur
Creates FileC:\Program Files\MSN\MSNCoreFiles\Install\MSN9Components\Msncli.exe
Creates FileC:\WINDOWS\Cursors\beam_i.cur
Creates FileC:\Program Files\Common Files\Services\Msvbvm60.dll
Creates FileC:\Documents and Settings\LocalService\ntuser.ini
Creates FileC:\WINDOWS\Cursors\hcross.cur
Creates FileC:\Program Files\Common Files\SpeechEngines\Microsoft\Lexicon\1033\ltts1033.lxa
Creates FileC:\Program Files\Windows NT\Pinball\PINBALL.DAT
Creates FileC:\WINDOWS\Help\key.chm
Creates FileC:\WINDOWS\Fonts\jsmalle.fon
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Design\ddfc3d6c168910428333e28a94f8da83\System.Design.ni.dll
Creates FileC:\WINDOWS\Fonts\wst_fren.fon
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Accessibility\Accessibility Wizard.lnk
Creates FileC:\WINDOWS\Fonts\rod.ttf
Creates FileC:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
Creates FileC:\WINDOWS\Help\winmine.hlp
Creates FileC:\WINDOWS\Help\Tours\htmlTour\unlock_built.exe
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\tip.gif
Creates FileC:\WINDOWS\Cursors\3dgno.cur
Creates FileC:\WINDOWS\Cursors\size4_il.cur
Creates FileC:\WINDOWS\ime\imjp8_1\applets\softkey.dll
Creates FileC:\WINDOWS\Fonts\cga40737.fon
Creates FileC:\WINDOWS\Fonts\app866.fon
Creates FileC:\Program Files\Common Files\System\Ole DB\msxactps.dll
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\Annotations\Stamps\Msvbvm60.dll
Creates FileC:\WINDOWS\inf\mdmdp2.inf
Creates FileC:\WINDOWS\Fonts\symbol.ttf
Creates FileC:\WINDOWS\inf\mdmdsi.PNF
Creates FileC:\WINDOWS\Help\filefold.chm
Creates FileC:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Windows Explorer.lnk
Creates FileC:\WINDOWS\Help\charmap.chm
Creates FileC:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\ksc.nlp
Creates FileC:\WINDOWS\Fonts\8514fixt.fon
Creates FileC:\WINDOWS\ime\imjp8_1\imjpdct.dll
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\AcroForm\PMP\QRCode.pmp
Creates FileC:\WINDOWS\inf\mdmdigi.inf
Creates FileC:\WINDOWS\Help\calc.hlp
Creates FileC:\WINDOWS\inf\agp.inf
Creates FileC:\WINDOWS\inf\irtos4mo.inf
Creates FileC:\Documents and Settings\Administrator\Recent\test.pdf.lnk
Creates FileC:\WINDOWS\Cursors\3dsns.cur
Creates FileC:\Program Files\Messenger\Msvbvm60.dll
Creates FileC:\WINDOWS\Help\hardware.hlp
Creates FileC:\WINDOWS\inf\genprint.inf
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\WERfd9e.dir00\manifest.txt
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\desktop.ini
Creates FileC:\WINDOWS\inf\HidDigi.inf
Creates FileC:\WINDOWS\inf\mdmcxsf2.inf
Creates FileC:\WINDOWS\inf\font.PNF
Creates FileC:\WINDOWS\Fonts\ANGSA.TTF
Creates FileC:\WINDOWS\inf\mdmgl010.PNF
Creates FileC:\WINDOWS\Fonts\arialbi.ttf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\intro_logo.exe
Creates FileC:\Documents and Settings\Administrator\Favorites\Links\Windows Media.url
Creates FileC:\WINDOWS\Help\plyr_err.chm
Creates FileC:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\prc.nlp
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Communications\HyperTerminal.lnk
Creates FileC:\WINDOWS\inf\mdmgcs.inf
Creates FileC:\Program Files\Common Files\Microsoft Shared\DW\1041\DWINTL20.DLL
Creates FileC:\Program Files\NetMeeting\wb32.exe
Creates FileC:\WINDOWS\Help\intellimirror.chm
Creates FileC:\WINDOWS\Debug\UserMode\gptext.log
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp
Creates FileC:\WINDOWS\inf\camvid20.PNF
Creates FileC:\WINDOWS\Fonts\sserife.fon
Creates FileC:\WINDOWS\Cursors\up_rl.cur
Creates FileC:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\desktop.ini
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\Magnifier.lnk
Creates FileC:\WINDOWS\Help\Tours\htmlTour\desktop_screen_shot.exe
Creates FileC:\WINDOWS\Cursors\cross_m.cur
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\VDKHome\ENU\VDK10.RSD
Creates FileC:\WINDOWS\Fonts\vgas874.fon
Creates FileC:\Documents and Settings\Administrator\SendTo\My Documents.mydocs
Creates FileC:\WINDOWS\Help\diagboot.chm
Creates FileC:\WINDOWS\inf\epcfw2k.PNF
Creates FileC:\WINDOWS\Fonts\s8514sys.fon
Creates FileC:\Program Files\Common Files\System\ado\msado27.tlb
Creates FileC:\WINDOWS\Help\filemgmt.hlp
Creates FileC:\WINDOWS\Fonts\sere1256.fon
Creates FileC:\Program Files\MSN\MSNCoreFiles\OOBE\market.mar
Creates FileC:\WINDOWS\Fonts\8514oemt.fon
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\WebSearch\WebSearchENU.pdf
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Btn\cnth.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp
Creates FileC:\WINDOWS\inf\epcfw2k.inf
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\AdbeRdrUpd933_all_incr.msp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_20130508_125854937.html
Creates FileC:\WINDOWS\Fonts\serf1255.fon
Creates FileC:\WINDOWS\Help\Tours\htmlTour\default.htm
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\4.gif
Creates FileC:\WINDOWS\Help\eudcedit.chm
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Blank Bkgrd.gif
Creates FileC:\WINDOWS\monitor.exe
Creates FileC:\Documents and Settings\Default User\Templates\quattro.wb2
Creates FileC:\WINDOWS\Help\tcpmon.hlp
Creates FileC:\WINDOWS\Help\fonts.chm
Creates FileC:\WINDOWS\Help\Tours\htmlTour\scripts.js
Creates FileC:\WINDOWS\Cursors\size1_rm.cur
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Msvbvm60.dll
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\PictureTasks\Howto\images\shareproject.gif
Creates FileC:\WINDOWS\Fonts\vgasysg.fon
Creates FileC:\WINDOWS\Help\admtools.chm
Creates FileC:\WINDOWS\Cursors\help_m.cur
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Windows Explorer.lnk
Creates FileC:\WINDOWS\Fonts\timesbd.ttf
Creates FileC:\WINDOWS\inf\mdmdigi.PNF
Creates FileC:\WINDOWS\inf\appmig.inf
Creates FileC:\WINDOWS\inf\mdmaiwa5.PNF
Creates FileC:\WINDOWS\inf\atirage3.PNF
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\office_review.gif
Creates FileC:\WINDOWS\Help\magnify.hlp
Creates FileC:\WINDOWS\inf\mdmgl002.inf
Creates FileC:\WINDOWS\Blue Lace 16.exe
Creates FileC:\WINDOWS\inf\irbus.inf
Creates FileC:\WINDOWS\Cursors\dinosau2.exe
Creates FileC:\WINDOWS\msmqinst.log
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\BIB.dll
Creates FileC:\WINDOWS\Help\cdmedia.chm
Creates FileC:\Documents and Settings\Administrator\My Documents\My Music\Desktop.ini
Creates FileC:\WINDOWS\inf\dtcnt5.inf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\img033a.exe
Creates FileC:\WINDOWS\Fonts\cour.ttf
Creates FileC:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\Utility Manager.lnk
Creates FileC:\WINDOWS\Help\display.chm
Creates FileC:\WINDOWS\Fonts\8514fix.fon
Creates FileC:\WINDOWS\Help\hardware.chm
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm6.exe
Creates FileC:\Program Files\MSN Gaming Zone\Windows\ZNetM.dll
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\MSN.lnk
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\PictureTasks\Howto\images\edit.gif
Creates FileC:\WINDOWS\Help\display.hlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\dd_netfx20MSI3716.txt
Creates FileC:\WINDOWS\ime\SPGRMR.dll
Creates FileC:\Documents and Settings\LocalService\Application Data\Adobe\Acrobat\9.0\AdobeSysFnt09.lst
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Program Compatibility Wizard.lnk
Creates FileC:\Program Files\Common Files\Microsoft Shared\DW\DWDCW20.DLL
Creates FileC:\WINDOWS\Cursors\size1_rl.cur
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud4.exe
Creates FileC:\WINDOWS\Help\ntshrui.hlp
Creates FileC:\WINDOWS\Help\chnscsvr.hlp
Creates FileC:\WINDOWS\Fonts\UPCLL.TTF
Creates FileC:\WINDOWS\inf\AER_1041.ADM
Creates FileC:\WINDOWS\ime\imjp8_1\HELP\imjpdte.chm
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm2.exe
Creates FileC:\WINDOWS\Help\agt0411.hlp
Creates FileC:\WINDOWS\Help\Tours\htmlTour\connected_wizard_ghost.exe
Creates FileC:\WINDOWS\Cursors\move_im.cur
Creates FileC:\WINDOWS\Cursors\handwe.exe
Creates FileC:\WINDOWS\inf\mdmc26a.PNF
Creates FileC:\WINDOWS\Help\fxsclnt.chm
Creates FileC:\WINDOWS\Fonts\CORDIA.TTF
Creates FileC:\WINDOWS\Cursors\lwe.cur
Creates FileC:\WINDOWS\Help\gptext.hlp
Creates FileC:\WINDOWS\Cursors\cross_i.cur
Creates FileC:\Documents and Settings\Default User\Templates\Msvbvm60.dll
Creates FileC:\WINDOWS\inf\mdmlasat.PNF
Creates FileC:\WINDOWS\ime\imjp8_1\applets\multibox.dll
Creates FileC:\WINDOWS\Help\Tours\mmTour\segment4.swf
Creates FileC:\WINDOWS\Help\sc.chm
Creates FileC:\WINDOWS\Help\ciquery.htm
Creates FileC:\WINDOWS\Cursors\move_l.cur
Creates FileC:\Program Files\Common Files\System\msadc\msdarem.dll
Creates FileC:\WINDOWS\Fonts\85s874.fon
Creates FileC:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
Creates FileC:\Documents and Settings\Administrator\SendTo\Mail Recipient.MAPIMail
Creates FileC:\Program Files\Windows Media Player\npdsplay.dll
Creates FileC:\WINDOWS\inf\dwup.PNF
Creates FileC:\WINDOWS\ime\imkr6_1\HELP\imkren61.chm
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\Msvbvm60.dll
Creates FileC:\Program Files\NetMeeting\callcont.dll
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\perimeter.gif
Creates FileC:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
Creates FileC:\WINDOWS\Help\ixqlang.htm
Creates FileC:\WINDOWS\Help\hschelp.chm
Creates FileC:\WINDOWS\inf\mdmatt.PNF
Creates FileC:\WINDOWS\Help\input.hlp
Creates FileC:\WINDOWS\Help\drwtsn32.chm
Creates FileC:\Documents and Settings\Administrator\My Documents\My Pictures\Sample Pictures.lnk
Creates FileC:\WINDOWS\Help\diskmgmt.chm
Creates FileC:\WINDOWS\Debug\blastcln.log
Creates FileC:\WINDOWS\Gone Fishing.exe
Creates FileC:\WINDOWS\inf\mdmelsa.inf
Creates FileC:\WINDOWS\Fonts\vga863.fon
Creates FileC:\WINDOWS\inf\mdmbcmsm.PNF
Creates FileC:\WINDOWS\Cursors\beam_rl.cur
Creates FileC:\WINDOWS\inf\ccdecode.inf
Creates FileC:\WINDOWS\Fonts\ANGSAUB.TTF
Creates FileC:\WINDOWS\twain.dll
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D4Z32ED8\desktop.ini
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\snapshot.gif
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\desktop.ini
Creates FileC:\WINDOWS\Cursors\3dwno.cur
Creates FileC:\WINDOWS\Help\remasst.chm
Creates FileC:\WINDOWS\Help\colormgt.chm
Creates FileC:\WINDOWS\Help\newfeat3.hlp
Creates FileC:\WINDOWS\inf\mdmgl010.inf
Creates FileC:\WINDOWS\inf\irmk7w2k.PNF
Creates FileC:\WINDOWS\Fonts\ega80850.fon
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\reflow.api
Creates FileC:\WINDOWS\ime\chsime\applets\PINTLCSA.DLL
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\listview.gif
Creates FileC:\WINDOWS\Fonts\verdanai.ttf
Creates FileC:\Program Files\Windows NT\Pinball\SOUND112.WAV
Creates FileC:\WINDOWS\inf\mdmeiger.PNF
Creates FileC:\WINDOWS\Cursors\3dsnwse.cur
Creates FileC:\WINDOWS\Fonts\serifft.fon
Creates FileC:\WINDOWS\Fonts\vga950.fon
Creates FileC:\WINDOWS\Fonts\seriffe.fon
Creates FileC:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
Creates FileC:\WINDOWS\inf\games.inf
Creates FileC:\Program Files\Common Files\Microsoft Shared\Speech\sapi.cpl
Creates FileC:\WINDOWS\inf\mchgr.inf
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Maize Bkgrd.jpg
Creates FileC:\Program Files\Common Files\Microsoft Shared\VGX\vgx.dll
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\System Restore.lnk
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Entertainment\desktop.ini
Creates FileC:\WINDOWS\Fonts\courfr.fon
Creates FileC:\WINDOWS\Cursors\horse.exe
Creates FileC:\WINDOWS\Help\Tours\htmlTour\safe_better.htm
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Windows Messenger.lnk
Creates FileC:\RECYCLER\S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-500\desktop.ini
Creates FileC:\WINDOWS\Help\windows.cnt
Creates FileC:\WINDOWS\inf\mdmgcs.PNF
Creates FileC:\WINDOWS\Fonts\svgafix.fon
Creates FileC:\WINDOWS\Cursors\move_r.cur
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\selecttext.gif
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\VDKHome\VDK10.CMP
Creates FileC:\Program Files\Common Files\System\Ole DB\oledbvbs.inc
Creates FileC:\WINDOWS\Help\Tours\htmlTour\best_secure_ghost.exe
Creates FileC:\WINDOWS\Cursors\sizewe.exe
Creates FileC:\Program Files\Common Files\SpeechEngines\Microsoft\TTS\1033\spttseng.dll
Creates FileC:\WINDOWS\Fonts\smaller.fon
Creates FileC:\WINDOWS\inf\disk.PNF
Creates FileC:\WINDOWS\Help\rdesktop.chm
Creates FileC:\WINDOWS\inf\flash.inf
Creates FileC:\WINDOWS\ime\SPTIP.dll
Creates FileC:\WINDOWS\inf\image.PNF
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Btn\taoffh.exe
Creates FileC:\WINDOWS\Help\sounds.chm
Creates FileC:\WINDOWS\Help\Tours\htmlTour\img126.exe
Creates FileC:\WINDOWS\inf\INFCACHE.1
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\dd_netfx20UI3716.txt
Creates FileC:\WINDOWS\inf\mdmdp2.PNF
Creates FileC:\Program Files\Common Files\Microsoft Shared\DAO\dao360.dll
Creates FileC:\WINDOWS\ime\imjp8_1\DICTS\imjpcd.dic
Creates FileC:\WINDOWS\Cursors\up_m.cur
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Character Map.lnk
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\sunbannA.gif
Creates FileC:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
Creates FileC:\WINDOWS\ime\shared\imepadsm.dll
Creates FileC:\WINDOWS\inf\fltmgr.PNF
Creates FileC:\WINDOWS\Help\pwrmn.chm
Creates FileC:\Documents and Settings\Administrator\Favorites\Links\Customize Links.url
Creates FileC:\Documents and Settings\Administrator\Favorites\Links\Free Hotmail.url
Creates FileC:\WINDOWS\ime\imjp8_1\HELP\voiceeng.chm
Creates FileC:\WINDOWS\Fonts\sserifeg.fon
Creates FileC:\Documents and Settings\Default User\NTUSER.DAT.LOG
Creates FileC:\WINDOWS\inf\mdmaus.inf
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins3d\drvSOFT.x3d
Creates FileC:\Program Files\MSN Gaming Zone\Windows\rvse.dll
Creates FileC:\WINDOWS\inf\mdmcpv.inf
Creates FileC:\Documents and Settings\Administrator\Application Data\Adobe\Acrobat\7.0\Updater\udstore.js
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\office_email.gif
Creates FileC:\WINDOWS\ime\imjp8_1\imjpcic.dll
Creates FileC:\WINDOWS\inf\mdmgen.inf
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini
Creates FileC:\WINDOWS\Help\agt0416.hlp
Creates FileC:\WINDOWS\Fonts\ega40737.fon
Creates FileC:\WINDOWS\inf\digimps.PNF
Creates FileC:\Program Files\Common Files\System\msadc\adcjavas.inc
Creates FileC:\WINDOWS\Fonts\h8514oem.fon
Creates FileC:\WINDOWS\Fonts\lsansd.ttf
Creates FileC:\WINDOWS\Fonts\gulim.ttc
Creates FileC:\WINDOWS\Fonts\ANGSAI.TTF
Creates FileC:\WINDOWS\Fonts\script.fon
Creates FileC:\WINDOWS\Help\Tours\htmlTour\connected_networks_ghost.exe
Creates FileC:\Documents and Settings\Administrator\Recent\Desktop.ini
Creates FileC:\WINDOWS\inf\brmfcumd.PNF
Creates FileC:\WINDOWS\Help\hs.chm
Creates FileC:\WINDOWS\Fonts\timesbi.ttf
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\sharedaccess.ini
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Games\Hearts.lnk
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Setup Files\RdrBig709\ENU\Setup.ini
Creates FileC:\Program Files\Windows Media Player\Skins\Msvbvm60.dll
Creates FileC:\Program Files\MSN Gaming Zone\Windows\Cmnresm.dll
Creates FileC:\WINDOWS\Help\ident.hlp
Creates FileC:\WINDOWS\inf\brmfport.PNF
Creates FileC:\WINDOWS\Fonts\kartika.ttf
Creates FileC:\WINDOWS\inf\mdmkortx.inf
Creates FileC:\WINDOWS\Fonts\vga866.fon
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
Creates FileC:\WINDOWS\twunk_32.exe
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Video\rtuner.wmv
Creates FileC:\WINDOWS\Cursors\busy_l.cur
Creates FileC:\WINDOWS\Fonts\ega40woa.fon
Creates FileC:\WINDOWS\Help\Tours\htmlTour\connected_multiple.htm
Creates FileC:\Program Files\Common Files\Microsoft Shared\DW\1025\DWINTL20.DLL
Creates FileC:\WINDOWS\Help\fonts.hlp
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Services\8f12b75c02ea2243b7d8a51574454ef6\System.Web.Services.ni.dll
Creates FileC:\WINDOWS\system32\drivers\winlogon.exe
Creates FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg
Creates FileC:\WINDOWS\Help\ixhelp.hlp
Creates FileC:\WINDOWS\CSC\00000001
Creates FileC:\WINDOWS\Help\camera.hlp
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\desktop.ini
Creates FileC:\Program Files\Common Files\System\directdb.dll
Creates FileC:\Documents and Settings\Default User\Templates\presenta.shw
Creates FileC:\WINDOWS\Help\nusrmgr.chm
Creates FileC:\WINDOWS\twunk_16.exe
Creates FileC:\Program Files\Common Files\System\ado\adojavas.inc
Creates FileC:\WINDOWS\inf\mdmlucnt.inf
Creates FileC:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
Creates FileC:\WINDOWS\Fonts\andlso.ttf
Creates FileC:\WINDOWS\inf\mdm5674a.inf
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\inetwiz.exe
Creates FileC:\WINDOWS\Help\folderop.chm
Creates FileC:\WINDOWS\Cursors\help_rm.cur
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Calculator.lnk
Creates FileC:\WINDOWS\inf\dgasync.inf
Creates FileC:\WINDOWS\inf\mdmlucnt.PNF
Creates FileC:\WINDOWS\inf\ie.inf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\nav_connected_down.exe
Creates FileC:\Program Files\Common Files\System\msadc\msadcf.dll
Creates FileC:\Program Files\Movie Maker\Shared\Filters.xml
Creates FileC:\WINDOWS\inf\irdaalif.inf
Creates FileC:\WINDOWS\AppPatch\apphelp.sdb
Creates FileC:\Program Files\MSN\MSNCoreFiles\Install\msnsusii.exe
Creates FileC:\WINDOWS\Help\accessib.chm
Creates FileC:\WINDOWS\Fonts\ega40852.fon
Creates FileC:\Program Files\Common Files\SpeechEngines\Microsoft\spcommon.dll
Creates FileC:\WINDOWS\Help\ntart.chm
Creates FileC:\WINDOWS\inf\mdmlasno.inf
Creates FileC:\WINDOWS\inf\fxsocm.inf
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Synchronize.lnk
Creates FileC:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
Creates FileC:\WINDOWS\Help\Tours\htmlTour\nav_safe_easy.exe
Creates FileC:\WINDOWS\setupact.log
Creates FileC:\WINDOWS\inf\1394vdbg.PNF
Creates FileC:\Program Files\NetMeeting\MST123.DLL
Creates FileC:\Documents and Settings\Administrator\Recent\2013_China_Report_FINAL.pdf.lnk
Creates FileC:\WINDOWS\inf\atividin.PNF
Creates FileC:\WINDOWS\Cursors\handwait.exe
Creates FileC:\WINDOWS\Fonts\simsun.ttc
Creates FileC:\Program Files\MSN Gaming Zone\Windows\bckgres.dll
Creates FileC:\WINDOWS\Help\Tours\htmlTour\best_road.htm
Creates FileC:\WINDOWS\Fonts\8514oeme.fon
Creates FileC:\WINDOWS\inf\lwngmadi.PNF
Creates FileC:\WINDOWS\inf\ks.PNF
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\6f96ccfaf3c66b42a07af6e488a58439\mscorlib.ni.dll
Creates FileC:\WINDOWS\inf\mdmdf56F.inf
Creates FileC:\Documents and Settings\LocalService\Application Data\Adobe\Acrobat\7.0\UserCache.bin
Creates FileC:\WINDOWS\tsoc.log
Creates FileC:\WINDOWS\Help\Tours\htmlTour\nav_safe_easy_down.exe
Creates Filec:\B1uv3nth3x1.diz
Creates FileC:\Program Files\Messenger\lvback.gif
Creates FileC:\WINDOWS\Help\snmpconcepts.chm
Creates FileC:\Program Files\Windows NT\Pinball\SOUND528.WAV
Creates FileC:\Documents and Settings\Default User\NTUSER.DAT
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Btn\tpauseh.exe
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud7.exe
Creates FileC:\WINDOWS\Help\Tours\htmlTour\folder_up.exe
Creates FileC:\WINDOWS\Fonts\8514oemg.fon
Creates FileC:\WINDOWS\Fonts\UPCEB.TTF
Creates FileC:\WINDOWS\Help\Tours\htmlTour\img089.exe
Creates FileC:\Program Files\Windows NT\Accessories\write.wpc
Creates FileC:\WINDOWS\Fonts\mvboli.ttf
Creates FileC:\WINDOWS\Cursors\wait_im.cur
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\desktop.ini
Creates FileC:\Documents and Settings\Default User\Templates\excel.xls
Creates FileC:\Program Files\Outlook Express\wabfind.dll
Creates FileC:\WINDOWS\inf\gameport.PNF
Creates FileC:\Documents and Settings\Default User\SendTo\Mail Recipient.MAPIMail
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\f1460401f0e5ba4a8809c993a690c461\System.Configuration.ni.dll
Creates FileC:\WINDOWS\Help\sysdm.hlp
Creates FileC:\WINDOWS\inf\fjtscan.inf
Creates FileC:\Program Files\Windows Media Player\Skins\Revert.wmz
Creates FileC:\WINDOWS\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
Creates FileC:\WINDOWS\inf\au.inf
Creates FileC:\WINDOWS\Help\scm.chm
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\PictureTasks\Howto\images\orderprints.gif
Creates FileC:\WINDOWS\inf\kscaptur.inf
Creates FileC:\WINDOWS\Help\conf.chm
Creates FileC:\Program Files\Common Files\System\Ole DB\msdatt.dll
Creates FileC:\Program Files\MSN\MSNCoreFiles\OOBE\signup.mar
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm1.exe
Creates FileC:\WINDOWS\inf\mdmgen.PNF
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Games\desktop.ini
Creates FileC:\WINDOWS\Help\win_dos.chm
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\PictureTasks.api
Creates FileC:\WINDOWS\Cursors\up_i.cur
Creates FileC:\WINDOWS\Fonts\smaf1255.fon
Creates FileC:\WINDOWS\Fonts\ANGSAZ.TTF
Creates FileC:\WINDOWS\Fonts\BROWAUZ.TTF
Creates FileC:\WINDOWS\inf\mdmkortx.PNF
Creates FileC:\Documents and Settings\Administrator\Templates\winword2.doc
Creates FileC:\Documents and Settings\Default User\Templates\winword2.doc
Creates FileC:\WINDOWS\inf\HidDigi.PNF
Creates FileC:\WINDOWS\Cursors\pen_im.cur
Creates FileC:\WINDOWS\Help\spider.chm
Creates FileC:\WINDOWS\inf\mdm5674a.PNF
Creates FileC:\Program Files\Windows NT\Pinball\SOUND24.WAV
Creates FileC:\WINDOWS\Cursors\no_im.cur
Creates FileC:\WINDOWS\inf\font.inf
Creates FileC:\Program Files\Outlook Express\msoe.txt
Creates FileC:\WINDOWS\Fonts\BROWAB.TTF
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\Accessibility.api
Creates FileC:\WINDOWS\Fonts\CORDIAU.TTF
Creates FileC:\Program Files\Common Files\System\msadc\msadcs.dll
Creates FileC:\WINDOWS\Help\Tours\mmTour\segment3.txt
Creates FileC:\WINDOWS\Help\webpub.chm
Creates FileC:\WINDOWS\Fonts\ega40850.fon
Creates FileC:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE
Creates FileC:\WINDOWS\inf\cyclom-y.PNF
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\fieruled.gif
Creates FileC:\WINDOWS\Help\apps.chm
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\replycomments.gif
Creates FileC:\WINDOWS\Help\Tours\htmlTour\start_control.htm
Creates FileC:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
Creates FileC:\WINDOWS\inf\brmfcmdm.PNF
Creates FileC:\WINDOWS\Help\sniffpol.dll
Creates FileC:\WINDOWS\Help\Tours\htmlTour\start_windows.htm
Creates FileC:\WINDOWS\ime\imkr6_1\HELP\impdko61.chm
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\highlighter.gif
Creates FileC:\WINDOWS\Cursors\no_r.cur
Creates FileC:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\WT6FC96J\desktop.ini
Creates FileC:\WINDOWS\Help\mshearts.cnt
Creates FileC:\WINDOWS\Help\taskmgr.hlp
Creates FileC:\WINDOWS\Help\shvl.chm
Creates FileC:\Program Files\Windows NT\Pinball\table.bmp
Creates FileC:\WINDOWS\ime\imjp8_1\HELP\voicejp.chm
Creates FileC:\Program Files\Movie Maker\WMM2FILT.dll
Creates FileC:\WINDOWS\inf\epsnscan.PNF
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp
Creates FileC:\WINDOWS\inf\accessor.PNF
Creates FileC:\Program Files\NetMeeting\nmoldwb.dll
Creates FileC:\WINDOWS\Fonts\ariblk.ttf
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Games\Internet Hearts.lnk
Creates FileC:\Documents and Settings\All Users\Start Menu\desktop.ini
Creates FileC:\Documents and Settings\Administrator\Templates\amipro.sam
Creates FileC:\WINDOWS\inf\cdrom.inf
Creates FileC:\WINDOWS\Help\sce.chm
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Command Prompt.lnk
Creates FileC:\Program Files\Messenger\newemail.wav
Creates FileC:\WINDOWS\Help\lpe.chm
Creates FileC:\WINDOWS\Fonts\couri.ttf
Creates FileC:\WINDOWS\Fonts\smalle.fon
Creates FileC:\Program Files\Windows Media Player\wmpns.dll
Creates FileC:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
Creates FileC:\WINDOWS\Help\Tours\htmlTour\start_desktop.htm
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Setup Files\RdrBig709\ENU\0x0409.ini
Creates FileC:\WINDOWS\0.log
Creates FileC:\Documents and Settings\Administrator\Templates\powerpnt.ppt
Creates FileC:\WINDOWS\Help\spad.chm
Creates FileC:\Program Files\NetMeeting\TestSnd.wav
Creates FileC:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
Creates FileC:\WINDOWS\Cursors\piano.exe
Creates FileC:\Documents and Settings\Administrator\Favorites\Radio Station Guide.url
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\Updater.api
Creates FileC:\WINDOWS\ime\imjp8_1\HELP\imjpcle.chm
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud5.exe
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\anabnr2.gif
Creates FileC:\Documents and Settings\Default User\Templates\sndrec.wav
Creates FileC:\Program Files\Common Files\Microsoft Shared\TextConv\mswrd832.cnv
Creates FileC:\WINDOWS\Help\is.chm
Creates FileC:\WINDOWS\Help\dialer.chm
Creates FileC:\WINDOWS\inf\agtinst.inf
Creates FileC:\WINDOWS\Help\clipbrd.hlp
Creates FileC:\Documents and Settings\Administrator\Templates\quattro.wb2
Creates FileC:\WINDOWS\Help\Tours\htmlTour\unlock_built.htm
Creates FileC:\WINDOWS\Fonts\desktop.ini
Creates FileC:\WINDOWS\Help\rsopsnp.chm
Creates FileC:\WINDOWS\Fonts\UPCKI.TTF
Creates FileC:\WINDOWS\Help\devmgr.hlp
Creates FileC:\WINDOWS\inf\disk.inf
Creates FileC:\WINDOWS\Fonts\wst_germ.fon
Creates FileC:\WINDOWS\Fonts\vgas1256.fon
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\vidsamp.exe
Creates FileC:\WINDOWS\Fonts\georgiaz.ttf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\window_up.exe
Creates FileC:\WINDOWS\Help\mmc_dlg.hlp
Creates FileC:\WINDOWS\ime\imkr6_1\dicts\hanjadic.dll
Creates FileC:\Program Files\MSN\MSNCoreFiles\OOBE\obelog.dll
Creates FileC:\Program Files\Windows NT\Pinball\SOUND25.WAV
Creates FileC:\WINDOWS\Help\phowto.chm
Creates FileC:\WINDOWS\ime\imjp8_1\HELP\imjpsm.hlp
Creates FileC:\WINDOWS\Help\Tours\htmlTour\control_up.exe
Creates FileC:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll
Creates FileC:\WINDOWS\Help\wshconcepts.chm
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Leaves Bkgrd.jpg
Creates FileC:\WINDOWS\inf\mdmcrtix.inf
Creates FileC:\Program Files\Movie Maker\Shared\Sample2.jpg
Creates FileC:\WINDOWS\Fonts\lsansdi.ttf
Creates FileC:\Documents and Settings\Default User\SendTo\Desktop (create shortcut).DeskLink
Creates FileC:\WINDOWS\inf\hidbth.inf
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Video\nuskin.wmv
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\Multimedia\MPP\Real.mpp
Creates FileC:\WINDOWS\Fonts\smae1255.fon
Creates FileC:\WINDOWS\Help\nwdoc.chm
Creates FileC:\WINDOWS\Cursors\help_il.cur
Creates FileC:\WINDOWS\inf\mdmaiwa3.PNF
Creates FileC:\WINDOWS\Help\file_srv.chm
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Notepad.lnk
Creates FileC:\Program Files\Movie Maker\WMM2EXT.dll
Creates FileC:\WINDOWS\inf\dot4.inf
Creates FileC:\WINDOWS\Cursors\size4_i.cur
Creates FileC:\WINDOWS\inf\mdmaiwa4.inf
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\dimensionlinetool.gif
Creates FileC:\WINDOWS\Help\usercpl.chm
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\Updater\acroaum.exe
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\stamp.gif
Creates FileC:\WINDOWS\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
Creates FileC:\Documents and Settings\Administrator\SendTo\Compressed (zipped) Folder.ZFSendToTarget
Creates FileC:\WINDOWS\inf\input.PNF
Creates FileC:\WINDOWS\Fonts\davidtr.ttf
Creates FileC:\WINDOWS\inf\defltwk.PNF
Creates FileC:\WINDOWS\Help\sysprop.chm
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\6f645a90cf0f1d44b2dc11a5e82e973c\Accessibility.ni.dll
Creates FileC:\WINDOWS\Help\Tours\htmlTour\img121.exe
Creates FileC:\WINDOWS\Cursors\wait_r.cur
Creates FileC:\Program Files\NetMeeting\Msvbvm60.dll
Creates FileC:\Program Files\Windows Media Player\npwmsdrm.dll
Creates FileC:\WINDOWS\inf\atiixpag.PNF
Creates FileC:\WINDOWS\inf\atiixpaa.inf
Creates FileC:\WINDOWS\Fonts\modern.fon
Creates FileC:\Program Files\MSN Gaming Zone\Windows\chkr.dll
Creates FileC:\WINDOWS\Cursors\move_il.cur
Creates FileC:\WINDOWS\Cursors\pen_r.cur
Creates FileC:\WINDOWS\ime\imjp8_1\DICTS\imjpst.dic
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Internet Explorer.lnk
Creates FileC:\WINDOWS\Help\Tours\htmlTour\img100.exe
Creates FileC:\WINDOWS\ime\imjp8_1\applets\hwxjpn.dll
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\icwrmind.exe
Creates FileC:\WINDOWS\Help\Tours\htmlTour\safe_easy_easier.exe
Creates FileC:\WINDOWS\inf\mdmgatew.PNF
Creates FileC:\WINDOWS\Fonts\vgafix.fon
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Video\copycd.wmv
Creates FileC:\WINDOWS\Cursors\beam_r.cur
Creates FileC:\WINDOWS\Fonts\smae1256.fon
Creates FileC:\WINDOWS\Cursors\busy_m.cur
Creates FileC:\WINDOWS\inf\bth.PNF
Creates FileC:\WINDOWS\Fonts\courft.fon
Creates FileC:\WINDOWS\Fonts\cga80857.fon
Creates FileC:\Program Files\Common Files\System\Ole DB\sqlsoldb.chm
Creates FileC:\Program Files\NetMeeting\nac.dll
Creates FileC:\WINDOWS\inf\irmk7w2k.inf
Creates FileC:\WINDOWS\Help\mouse.hlp
Creates FileC:\Documents and Settings\Administrator\Favorites\Desktop.ini
Creates FileC:\Program Files\NetMeeting\nmchat.dll
Creates FileC:\WINDOWS\Help\agt040c.hlp
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\f93d64b45751f545907f53a6480ef020\Microsoft.Build.Framework.ni.dll
Creates FileC:\WINDOWS\Help\sysdm.chm
Creates FileC:\WINDOWS\Help\evconcepts.chm
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp
Creates FileC:\WINDOWS\Help\iexplore.chm
Creates FileC:\WINDOWS\inf\corelist.inf
Creates FileC:\WINDOWS\Fonts\8514sys.fon
Creates FileC:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_59R.wmdb
Creates FileC:\WINDOWS\Help\halftone.hlp
Creates FileC:\WINDOWS\Help\shell.hlp
Creates FileC:\WINDOWS\Help\notepad.hlp
Creates FileC:\WINDOWS\inf\bthprint.PNF
Creates FileC:\WINDOWS\Help\agt0405.hlp
Creates FileC:\WINDOWS\Fonts\8514sysg.fon
Creates FileC:\Program Files\Common Files\Microsoft Shared\MSInfo\IEINFO5.OCX
Creates FileC:\WINDOWS\inf\biosinfo.PNF
Creates FileC:\WINDOWS\inf\hidserv.inf
Creates FileC:\WINDOWS\Fonts\UPCJL.TTF
Creates FileC:\WINDOWS\Cursors\help_im.cur
Creates FileC:\WINDOWS\Help\PINTLPAE.CHM
Creates FileC:\WINDOWS\Cursors\pen_l.cur
Creates FileC:\WINDOWS\Cursors\cross_r.cur
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\aswrule.gif
Creates FileC:\Program Files\Movie Maker\Shared\Empty.txt
Creates FileC:\WINDOWS\inf\battery.inf
Creates FileC:\Program Files\Windows NT\Pinball\SOUND30.WAV
Creates FileC:\WINDOWS\Help\Tours\htmlTour\icon_up.exe
Creates FileC:\WINDOWS\Help\brief.chm
Creates FileC:\WINDOWS\Help\netcfg.hlp
Creates FileC:\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT
Creates FileC:\WINDOWS\inf\ati1xwdm.PNF
Creates FileC:\WINDOWS\Help\Tours\htmlTour\bot_bar.exe
Creates FileC:\WINDOWS\Fonts\artro.ttf
Creates FileC:\WINDOWS\Driver Cache\i386\driver.cab
Creates FileC:\WINDOWS\inf\mdmatm2k.PNF
Creates FileC:\WINDOWS\inf\communic.inf
Creates FileC:\Program Files\Common Files\Microsoft Shared\TextConv\html32.cnv
Creates FileC:\Program Files\Common Files\System\msadc\msadcfr.dll
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins3d\2d.x3d
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Disk Defragmenter.lnk
Creates FileC:\WINDOWS\Help\nofts.chm
Creates FileC:\WINDOWS\Cursors\libeam.cur
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\Javascripts\JSByteCodeWin.bin
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\1.gif
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Setup Files\RdrBig709\ENU\instmsiw.exe
Creates FileC:\WINDOWS\Help\conf.cnt
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Outlook Express.lnk
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data\bd58ebbf657b4440b8f86b8c2bfbf417\System.Data.ni.dll
Creates FileC:\Documents and Settings\Administrator\Application Data\Adobe\Acrobat\7.0\UserCache.bin
Creates FileC:\WINDOWS\inf\asynceqn.inf
Creates FileC:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini
Creates FileC:\WINDOWS\inf\brmfcwia.inf
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Communications\Network Setup Wizard.lnk
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Network Blitz.htm
Creates FileC:\Documents and Settings\Administrator\Favorites\Links\Windows Marketplace.url
Creates FileC:\WINDOWS\inf\bthspp.inf
Creates FileC:\WINDOWS\Help\dxdiag.chm
Creates FileC:\WINDOWS\Cursors\size3_i.cur
Creates FileC:\Documents and Settings\Default User\SendTo\desktop.ini
Creates FileC:\WINDOWS\inf\mdmarn.PNF
Creates FileC:\WINDOWS\Help\wordpad.hlp
Creates FileC:\WINDOWS\Help\joy.chm
Creates FileC:\WINDOWS\ime\imjp8_1\imjputy.exe
Creates FileC:\WINDOWS\Fonts\UPCKBI.TTF
Creates FileC:\WINDOWS\Fonts\cga40852.fon
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\phone.icw
Creates FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\desktop.ini
Creates FileC:\WINDOWS\inf\cpu.inf
Creates FileC:\WINDOWS\inf\fsvgadel.PNF
Creates FileC:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
Creates FileC:\WINDOWS\inf\mdmisdn.inf
Creates FileC:\WINDOWS\Fonts\gautami.ttf
Creates FileC:\WINDOWS\ime\imjp8_1\HELP\imjptu.chm
Creates FileC:\WINDOWS\Fonts\coure.fon
Creates FileC:\WINDOWS\inf\atividin.inf
Creates FileC:\WINDOWS\Help\connect.hlp
Creates FileC:\WINDOWS\Help\pwrmn.hlp
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\icwconn2.exe
Creates FileC:\WINDOWS\Help\smlogcfg.chm
Creates FileC:\WINDOWS\Help\agt0413.hlp
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\weblink.api
Creates FileC:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe
Creates FileC:\WINDOWS\inf\fsvgadel.inf
Creates FileC:\WINDOWS\Fonts\85f1257.fon
Creates FileC:\WINDOWS\Help\ntshared.chm
Creates FileC:\WINDOWS\Help\Tours\htmlTour\nav_unlock_down.exe
Creates FileC:\WINDOWS\Help\defrag.hlp
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Entertainment\Windows Media Player.lnk
Creates FileC:\Program Files\Windows NT\Pinball\SOUND17.WAV
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\msicw.isp
Creates FileC:\WINDOWS\inf\banshee.inf
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Computer Management.lnk
Creates FileC:\WINDOWS\Cursors\wait_rl.cur
Creates FileC:\WINDOWS\Cursors\size2_i.cur
Creates FileC:\WINDOWS\Help\filefold.hlp
Creates FileC:\WINDOWS\inf\hpscan.PNF
Creates FileC:\WINDOWS\inf\drvindex.inf
Creates FileC:\WINDOWS\Help\Ipv6.chm
Creates FileC:\Documents and Settings\All Users\Documents\My Pictures\Desktop.ini
Creates FileC:\WINDOWS\ime\imjp8_1\DICTS\imjptk.dic
Creates FileC:\WINDOWS\inf\avc.PNF
Creates FileC:\WINDOWS\inf\atiixpaa.PNF
Creates FileC:\WINDOWS\Help\winchat.hlp
Creates FileC:\WINDOWS\Help\secsettings.chm
Creates FileC:\WINDOWS\Cursors\hmove.cur
Creates FileC:\WINDOWS\MedCtrOC.log
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\Msvbvm60.dll
Creates FileC:\WINDOWS\vmmreg32.dll
Creates FileC:\Program Files\Common Files\System\ado\msadrh15.dll
Creates FileC:\Program Files\MSN Gaming Zone\Windows\Rvseres.dll
Creates FileC:\WINDOWS\Help\Tours\htmlTour\connected_multiple_big.exe
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\SaveAsRTF.api
Creates FileC:\Program Files\Common Files\System\msadc\adcvbs.inc
Creates FileC:\WINDOWS\Help\Tours\htmlTour\start_icons.htm
Creates FileC:\WINDOWS\inf\ie.PNF
Creates FileC:\WINDOWS\inf\atixpwdm.inf
Creates FileC:\WINDOWS\Fonts\BROWAZ.TTF
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp
Creates FileC:\Documents and Settings\Administrator\Application Data\Adobe\Acrobat\7.0\Collab\RSS
Creates FileC:\WINDOWS\Help\Tours\htmlTour\style.css
Creates FileC:\WINDOWS\Help\mode.chm
Creates FileC:\WINDOWS\Cursors\cross_l.cur
Creates FileC:\WINDOWS\inf\ibmvcap.PNF
Creates FileC:\Program Files\Windows NT\htrn_jis.dll
Creates FileC:\WINDOWS\inf\g400.PNF
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\underlinetxt.gif
Creates FileC:\Program Files\Windows Media Player\Skins\compact.wmz
Creates FileC:\WINDOWS\winnt256.exe
Creates FileC:\WINDOWS\Help\agt0401.hlp
Creates FileC:\WINDOWS\inf\kdkscan.inf
Creates FileC:\WINDOWS\Help\newfeat5.chm
Creates FileC:\WINDOWS\Fonts\vga737.fon
Creates FileC:\WINDOWS\Fonts\CORDIAUZ.TTF
Creates FileC:\WINDOWS\ime\imjp8_1\DICTS\imjpln.dic
Creates FileC:\WINDOWS\Cursors\wagtail.exe
Creates FileC:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp
Creates FileC:\WINDOWS\inf\mdmdcm6.inf
Creates FileC:\WINDOWS\inf\dot4prt.PNF
Creates FileC:\WINDOWS\ime\imjp8_1\DICTS\imjpzp.dic
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\Checkers.api
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Btzhsepa.gif
Creates FileC:\WINDOWS\inf\mdmgl009.inf
Creates FileC:\Program Files\Common Files\System\ado\msado20.tlb
Creates FileC:\WINDOWS\Cursors\3dwns.cur
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Desktop.htt
Creates FileC:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\prcp.nlp
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Tour Windows XP.lnk
Creates FileC:\Program Files\Outlook Express\oemig50.exe
Creates FileC:\Documents and Settings\Administrator\Application Data\Adobe\Acrobat\7.0\AdobeSysFnt07.lst
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\state.icw
Creates FileC:\WINDOWS\Fonts\BROWAUI.TTF
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0019E545\Plylst1.wpl
Creates FileC:\WINDOWS\inf\dot4prt.inf
Creates FileC:\WINDOWS\Cursors\lnodrop.cur
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\videobg.exe
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\dfsvc\d35c221f74db5d48b3aa3ad663400c85\dfsvc.ni.exe
Creates FileC:\WINDOWS\Help\Tours\htmlTour\img060.exe
Creates FileC:\WINDOWS\inf\mdmcomp.inf
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Games\Internet Spades.lnk
Creates FileC:\WINDOWS\inf\mdmaiwat.inf
Creates FileC:\WINDOWS\Help\sceconcepts.chm
Creates FileC:\WINDOWS\inf\avc.inf
Creates FileC:\WINDOWS\Help\infrared.chm
Creates FileC:\Program Files\Windows NT\Pinball\SOUND240.WAV
Creates FileC:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
Creates FileC:\WINDOWS\Cursors\hourgla3.exe
Creates FileC:\WINDOWS\inf\mdmgl003.inf
Creates FileC:\WINDOWS\inf\asroc.PNF
Creates FileC:\WINDOWS\Help\Tours\htmlTour\best_secure.htm
Creates FileC:\WINDOWS\Downloaded Program Files\desktop.ini
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileC:\WINDOWS\inf\mdmbw561.PNF
Creates FileC:\WINDOWS\Help\ieeula.chm
Creates FileC:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst
Creates FileC:\Program Files\Common Files\Services\whowhere.bmp
Creates FileC:\WINDOWS\inf\flpydisk.PNF
Creates FileC:\WINDOWS\Help\evntwin.hlp
Creates FileC:\WINDOWS\inf\apcompat.PNF
Creates FileC:\WINDOWS\Cursors\3dgarro.cur
Creates FileC:\WINDOWS\inf\mdmgatew.inf
Creates FileC:\WINDOWS\inf\fsvgaadd.PNF
Creates FileC:\Documents and Settings\Default User\SendTo\Compressed (zipped) Folder.ZFSendToTarget
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\crossouttxt.gif
Creates FileC:\WINDOWS\inf\mdmbug3.PNF
Creates FileC:\WINDOWS\Fonts\cga80737.fon
Creates FileC:\WINDOWS\inf\fjtscan.PNF
Creates FileC:\WINDOWS\Fonts\85s1255.fon
Creates FileC:\WINDOWS\ime\imjp8_1\imjpcus.dll
Creates FileC:\WINDOWS\Help\msmq.chm
Creates FileC:\WINDOWS\inf\bthspp.PNF
Creates FileC:\WINDOWS\inf\avmisdn.inf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\nav_start_here_down.exe
Creates FileC:\WINDOWS\inf\camdsh20.PNF
Creates FileC:\WINDOWS\inf\1394vdbg.inf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\img040.exe
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp
Creates FileC:\Program Files\Internet Explorer\HMMAPI.DLL
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Nature Bkgrd.jpg
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Btn\cnt.exe
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\5c5b04f7f35e9346a6c0620b8b6b96d4\System.ni.dll
Creates FileC:\WINDOWS\Fonts\smallfg.fon
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\WERfd9e.dir00\wuauclt.exe.mdmp
Creates FileC:\WINDOWS\Help\mfcuix.hlp
Creates FileC:\Program Files\Movie Maker\Shared\news.png
Creates FileC:\Documents and Settings\Administrator\Start Menu\desktop.ini
Creates FileC:\WINDOWS\inf\mdmeric.PNF
Creates FileC:\WINDOWS\Cursors\lcross.cur
Creates FileC:\Program Files\Movie Maker\WMM2RES.dll
Creates FileC:\WINDOWS\inf\agtinst.PNF
Creates FileC:\Program Files\Movie Maker\MUI\0409\moviemk.chm
Creates FileC:\WINDOWS\Fonts\sserifee.fon
Creates FileC:\WINDOWS\Help\qosconcepts.chm
Creates FileC:\WINDOWS\Help\scmconcepts.chm
Creates FileC:\WINDOWS\Cursors\sizens.exe
Creates FileC:\WINDOWS\Cursors\arrow_im.cur
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
Creates FileC:\WINDOWS\Help\timesrv.chm
Creates FileC:\WINDOWS\inf\mdmcommu.inf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\best_robust.htm
Creates FileC:\WINDOWS\Fonts\UPCFL.TTF
Creates FileC:\WINDOWS\inf\brmfcmf.PNF
Creates FileC:\WINDOWS\inf\mdmcommu.PNF
Creates FileC:\WINDOWS\inf\hidserv.PNF
Creates FileC:\WINDOWS\Help\certmgr.hlp
Creates FileC:\WINDOWS\Help\sendcmsg.chm
Creates FileC:\WINDOWS\inf\mdmaus.PNF
Creates FileC:\WINDOWS\Fonts\svgasys.fon
Creates FileC:\WINDOWS\Help\Tours\htmlTour\img034.exe
Creates FileC:\WINDOWS\ime\imkr6_1\dicts\hanja.lex
Creates FileC:\WINDOWS\TASKMAN.EXE
Creates FileC:\WINDOWS\inf\epsnmfp.inf
Creates FileC:\WINDOWS\Help\winpy.chm
Creates FileC:\WINDOWS\inf\mdmfj2.inf
Creates FileC:\WINDOWS\inf\axant5.inf
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\LegalPDF.api
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\snd.htm
Creates FileC:\Documents and Settings\Administrator\Templates\excel.xls
Creates FileC:\WINDOWS\Fonts\tradbdo.ttf
Creates FileC:\WINDOWS\AppPatch\AcLayers.dll
Creates FileC:\WINDOWS\Help\splash.chm
Creates FileC:\WINDOWS\Cursors\beam_l.cur
Creates FileC:\WINDOWS\Fonts\lvnmbd.ttf
Creates FileC:\WINDOWS\Fonts\BROWAI.TTF
Creates FileC:\WINDOWS\Help\cscui.hlp
Creates FileC:\WINDOWS\Help\wmifltr.chm
Creates FileC:\WINDOWS\Help\inetres.chm
Creates FileC:\WINDOWS\Help\bootcons.chm
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Scr\tour.js
Creates FileC:\WINDOWS\Help\diskmgmt.hlp
Creates FileC:\Program Files\NetMeeting\nmwb.dll
Creates FileC:\Program Files\Windows NT\Pinball\SOUND20.WAV
Creates FileC:\Program Files\Windows NT\Pinball\SOUND54.WAV
Creates FileC:\WINDOWS\Fonts\sere1257.fon
Creates FileC:\WINDOWS\Cursors\size3_m.cur
Creates FileC:\WINDOWS\inf\banshee.PNF
Creates FileC:\WINDOWS\Help\atm.chm
Creates FileC:\WINDOWS\inf\mdmhandy.inf
Creates FileC:\Program Files\Common Files\Microsoft Shared\DW\1040\DWINTL20.DLL
Creates FileC:\WINDOWS\ime\imkr6_1\imkrinst.exe
Creates FileC:\WINDOWS\Help\wsecedit.hlp
Creates FileC:\WINDOWS\Fonts\serf1256.fon
Creates FileC:\WINDOWS\Help\sysmon.chm
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\mplogoh.exe
Creates FileC:\Program Files\Windows NT\Pinball\SOUND243.WAV
Creates FileC:\Program Files\Windows Media Player\wmplayer.exe
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\Optional\README.TXT
Creates FileC:\WINDOWS\winhlp32.exe
Creates FileC:\WINDOWS\Help\Tours\htmlTour\connected_wizard_big.exe
Creates FileC:\WINDOWS\Cursors\stopwtch.exe
Creates FileC:\WINDOWS\inf\mdmadc.PNF
Creates FileC:\WINDOWS\Help\mmc.chm
Creates FileC:\Program Files\Windows NT\Pinball\SOUND21.WAV
Creates FileC:\Program Files\MSN Gaming Zone\Windows\Hrtzres.dll
Creates FileC:\Program Files\Outlook Express\msoeres.dll
Creates FileC:\WINDOWS\inf\divac.PNF
Creates FileC:\WINDOWS\Fonts\rodtr.ttf
Creates FileC:\WINDOWS\Help\secedit.chm
Creates FileC:\WINDOWS\Fonts\webdings.ttf
Creates FileC:\WINDOWS\Cursors\3dgmove.cur
Creates FileC:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
Creates FileC:\WINDOWS\Cursors\move_rl.cur
Creates FileC:\WINDOWS\inf\digirp.PNF
Creates FileC:\WINDOWS\inf\kscaptur.PNF
Creates FileC:\WINDOWS\Fonts\msgothic.ttc
Creates FileC:\Program Files\Common Files\Microsoft Shared\DW\1033\DWINTL20.DLL
Creates FileC:\WINDOWS\inf\mdmatm2k.inf
Creates FileC:\WINDOWS\inf\fsvga.PNF
Creates FileC:\WINDOWS\Cursors\up_im.cur
Creates FileC:\WINDOWS\Fonts\smalleg.fon
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\measure_loop.gif
Creates FileC:\WINDOWS\inf\dimaps.PNF
Creates FileC:\WINDOWS\Fonts\sseriff.fon
Creates FileC:\WINDOWS\inf\machine.inf
Creates FileC:\WINDOWS\ime\imjp8_1\DICTS\imjpnm.dic
Creates FileC:\WINDOWS\inf\legcydrv.inf
Creates FileC:\WINDOWS\Help\mstsc.chm
Creates FileC:\WINDOWS\Fonts\sylfaen.ttf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\nav_start_here.exe
Creates FileC:\WINDOWS\Help\Tours\htmlTour\start_files.htm
Creates FileC:\WINDOWS\Help\rsmconcepts.chm
Creates FileC:\WINDOWS\inf\mdmhay2.inf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\safe_easy_better_big.exe
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\wmptour.hta
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Communications\Wireless Network Setup Wizard.lnk
Creates FileC:\WINDOWS\inf\devxprop.inf
Creates FileC:\AUTOEXEC.BAT
Creates FileC:\WINDOWS\inf\gameport.inf
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\5.gif
Creates FileC:\Program Files\NetMeeting\nmasnt.dll
Creates FileC:\WINDOWS\Help\printing.chm
Creates FileC:\WINDOWS\Fonts\UPCFBI.TTF
Creates FileC:\Program Files\Common Files\Microsoft Shared\DW\2052\DWINTL20.DLL
Creates FileC:\WINDOWS\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
Creates FileC:\WINDOWS\ime\imjp8_1\HELP\imjppd.chm
Creates FileC:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
Creates FileC:\WINDOWS\Cursors\up_l.cur
Creates FileC:\WINDOWS\ime\CHTIME\Applets\CHTPADEN.CHM
Creates FileC:\Program Files\Common Files\MSSoap\Binaries\mssoap1.dll
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\icwx25a.dun
Creates FileC:\WINDOWS\Help\Tours\htmlTour\unlock_optimized.exe
Creates FileC:\WINDOWS\Help\reader.chm
Creates FileC:\Program Files\MSN\MSNCoreFiles\Install\MSN9Components\msnmsgs.msi
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Glacier Bkgrd.jpg
Creates FileC:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
Creates FileC:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
Creates FileC:\WINDOWS\Cursors\beam_m.cur
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\IMJP8_1\imjp81u.dic
Creates FileC:\WINDOWS\Help\Tours\htmlTour\connected_fr.htm
Creates FileC:\WINDOWS\Help\soundrec.chm
Creates FileC:\WINDOWS\inf\3dfxvs2k.inf
Creates FileC:\WINDOWS\Help\cmconcepts.chm
Creates FileC:\WINDOWS\inf\i81xnt5.inf
Creates FileC:\WINDOWS\Help\conf.hlp
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\touchupobj.gif
Creates FileC:\Program Files\Common Files\System\Ole DB\msdasc.dll
Creates FileC:\WINDOWS\Fonts\vrinda.ttf
Creates FileC:\WINDOWS\Fonts\impact.ttf
Creates FileC:\WINDOWS\Fonts\j8514sys.fon
Creates FileC:\WINDOWS\Fonts\app950.fon
Creates FileC:\WINDOWS\Help\sysmon.hlp
Creates FileC:\Documents and Settings\Default User\Start Menu\Programs\desktop.ini
Creates FileC:\WINDOWS\Help\twclient.chm
Creates FileC:\Program Files\Internet Explorer\iedw.exe
Creates FileC:\WINDOWS\Help\ipsecconcepts.chm
Creates FileC:\WINDOWS\Help\iis.chm
Creates FileC:\WINDOWS\Fonts\couret.fon
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Btn\bktrh.exe
Creates FileC:\WINDOWS\Help\Tours\htmlTour\safe_easy_faster_big.exe
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0019E545\Plylst13.wpl
Creates FileC:\WINDOWS\inf\g200.PNF
Creates FileC:\WINDOWS\bootstat.dat
Creates FileC:\WINDOWS\Fonts\vgas1255.fon
Creates FileC:\WINDOWS\inf\mdmcpq2.PNF
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Sweets.htm
Creates FileC:\WINDOWS\inf\iereset.inf
Creates FileC:\WINDOWS\Cursors\coin.exe
Creates FileC:\WINDOWS\Help\Tours\htmlTour\img004b.exe
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\PictureTasks\Howto\images\howto.gif
Creates FileC:\Program Files\Windows NT\Pinball\SOUND131.WAV
Creates FileC:\WINDOWS\Cursors\size3_il.cur
Creates FileC:\WINDOWS\Cursors\size4_r.cur
Creates FileC:\Program Files\Windows NT\Pinball\SOUND55.WAV
Creates FileC:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\desktop.ini
Creates FileC:\WINDOWS\Help\Tours\htmlTour\best_road.exe
Creates FileC:\WINDOWS\inf\brmfcumd.inf
Creates FileC:\Program Files\MSN\MSNCoreFiles\Install\xfp.xml
Creates FileC:\WINDOWS\Help\Tours\htmlTour\img074a.exe
Creates FileC:\WINDOWS\inf\hal.inf
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Startup\desktop.ini
Creates FileC:\WINDOWS\Cursors\3dwnwse.cur
Creates FileC:\WINDOWS\inf\apcompat.inf
Creates FileC:\Program Files\Windows Media Player\migrate.exe
Creates FileC:\WINDOWS\Rhododendron.exe
Creates FileC:\WINDOWS\Cursors\size1_im.cur
Creates FileC:\WINDOWS\Fonts\app857.fon
Creates FileC:\WINDOWS\Cursors\lnwse.cur
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\Browser\nppdf32.dll
Creates FileC:\WINDOWS\Fonts\8514oem.fon
Creates FileC:\WINDOWS\Help\taskbar.chm
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0019E545\Plylst10.wpl
Creates FileC:\Documents and Settings\Default User\Start Menu\Programs\Accessories\desktop.ini
Creates FileC:\WINDOWS\Fonts\vgaoem.fon
Creates FileC:\WINDOWS\inf\agp.PNF
Creates FileC:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
Creates FileC:\Program Files\Common Files\Microsoft Shared\Triedit\TRIEDIT.DLL
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012013061320130614\index.dat
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Paint.lnk
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\PictureTasks\Howto\images\slideshow.gif
Creates FileC:\Documents and Settings\Administrator\Application Data\Adobe\Acrobat\9.0\AdobeCMapFnt09.lst
Creates FileC:\Program Files\Windows NT\Pinball\SOUND16.WAV
Creates FileC:\WINDOWS\inf\mdmcodex.inf
Creates FileC:\WINDOWS\Cursors\3dgnwse.cur
Creates FileC:\Program Files\Common Files\Microsoft Shared\DW\1042\DWINTL20.DLL
Creates FileC:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
Creates FileC:\WINDOWS\Fonts\h8514sys.fon
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf
Creates FileC:\WINDOWS\Cursors\cross_im.cur
Creates FileC:\WINDOWS\inf\camvid30.PNF
Creates FileC:\WINDOWS\Help\mobsync.chm
Creates FileC:\WINDOWS\Cursors\no_l.cur
Creates FileC:\WINDOWS\Help\certmgr.chm
Creates FileC:\WINDOWS\Help\Tours\htmlTour\question_icon.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe\Acrobat\9.0\Updater\updater.log
Creates FileC:\WINDOWS\inf\eqnport.PNF
Creates FileC:\WINDOWS\Help\ntbackup.hlp
Creates FileC:\Documents and Settings\All Users\DRM\Msvbvm60.dll
Creates FileC:\WINDOWS\inf\lwngmadi.inf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\start_fr.htm
Creates FileC:\WINDOWS\Cursors\rainbow.exe
Creates FileC:\Documents and Settings\Administrator\My Documents\My Music\Sample Music.lnk
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp
Creates FileC:\Program Files\Messenger\newalert.wav
Creates FileC:\WINDOWS\ime\imjp8_1\HELP\jpnpaden.chm
Creates FileC:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Command Prompt.lnk
Creates FileC:\WINDOWS\Help\reskit.chm
Creates FileC:\WINDOWS\hh.exe
Creates FileC:\WINDOWS\Fonts\cvgafix.fon
Creates FileC:\WINDOWS\Help\Tours\htmlTour\connected_data_ghost.exe
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Event Viewer.lnk
Creates FileC:\WINDOWS\inf\dtcnt5.PNF
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\ASPNETSetup_00000.log
Creates FileC:\WINDOWS\Help\Tours\htmlTour\connected_networks.htm
Creates FileC:\WINDOWS\inf\hdaudbus.inf
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Msvbvm60.dll
Creates FileC:\WINDOWS\Cursors\hns.cur
Creates FileC:\WINDOWS\Fonts\trebuc.ttf
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Sunflower Bkgrd.jpg
Creates FileC:\WINDOWS\Fonts\seriff.fon
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\sendemailreview.gif
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Address Book.lnk
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\b558c6b7e062a14eaf30d90a763ddb2c\System.Drawing.ni.dll
Creates FileC:\WINDOWS\Fonts\serife.fon
Creates FileC:\WINDOWS\Help\Tours\htmlTour\img014.exe
Creates FileC:\WINDOWS\ime\CHTIME\Applets\CHTMBX.DLL
Creates FileC:\WINDOWS\inf\mdmgl006.inf
Creates FileC:\WINDOWS\Help\sendcmsg.hlp
Creates FileC:\WINDOWS\Driver Cache\i386\sp3.cab
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Scr\events.js
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Setup Files\RdrBig709\ENU\Data1.cab
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\SendMail.api
Creates FileC:\WINDOWS\inf\ati1xwdm.inf
Creates FileC:\WINDOWS\inf\icam5usb.inf
Creates FileC:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
Creates FileC:\Program Files\Common Files\System\msadc\msdfmap.dll
Creates FileC:\WINDOWS\Fonts\UPCDBI.TTF
Creates FileC:\WINDOWS\Fonts\smallf.fon
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp
Creates FileC:\WINDOWS\Cursors\arrow_m.cur
Creates FileC:\Documents and Settings\Administrator\Application Data\Adobe\Acrobat\7.0\JSADM.exv
Creates FileC:\WINDOWS\ime\CHTIME\Applets\CHTAPTEN.HLP
Creates FileC:\WINDOWS\Fonts\ssef1256.fon
Creates FileC:\WINDOWS\Cursors\busy_il.cur
Creates FileC:\WINDOWS\Help\ddeshare.hlp
Creates FileC:\WINDOWS\inf\mdac.PNF
Creates FileC:\WINDOWS\Cursors\lns.cur
Creates FileC:\WINDOWS\Fonts\vga852.fon
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe\Color\ACECache10.lst
Creates FileC:\Program Files\Common Files\System\Ole DB\sqloledb.rll
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\66e9399c9a54b041a5caa3b1643b61d2\System.Windows.Forms.ni.dll
Creates FileC:\WINDOWS\Fonts\ega80869.fon
Creates FileC:\WINDOWS\inf\mdmcm28.PNF
Creates FileC:\WINDOWS\inf\inetset.adm
Creates FileC:\WINDOWS\Help\mpnetwrk.hlp
Creates FileC:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\desktop.ini
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0019E545\Plylst5.wpl
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\obj_data.gif
Creates FileC:\WINDOWS\ODBCINST.INI
Creates FileC:\Documents and Settings\Default User\Local Settings\History\History.IE5\desktop.ini
Creates FileC:\WINDOWS\inf\AER_1040.ADM
Creates FileC:\WINDOWS\inf\brmfcsto.inf
Creates FileC:\WINDOWS\ime\shared\res\PADRS404.DLL
Creates FileC:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\desktop.ini
Creates FileC:\WINDOWS\msdfmap.ini
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\brndlog.txt
Creates FileC:\Program Files\Windows Media Player\mplayer2.exe
Creates FileC:\WINDOWS\inf\conf.adm
Creates FileC:\WINDOWS\inf\iis.inf
Creates FileC:\WINDOWS\Cursors\handnesw.exe
Creates FileC:\WINDOWS\Help\aclui.chm
Creates FileC:\WINDOWS\inf\mdmess.inf
Creates FileC:\WINDOWS\inf\fp40ext.inf
Creates FileC:\WINDOWS\inf\camvid30.inf
Creates FileC:\WINDOWS\Cursors\pen_il.cur
Creates FileC:\WINDOWS\setuperr.log
Creates FileC:\WINDOWS\Cursors\size3_r.cur
Creates FileC:\WINDOWS\Fonts\UPCJI.TTF
Creates FileC:\WINDOWS\ime\imjp8_1\imjputyc.dll
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Ivy.htm
Creates FileC:\WINDOWS\Santa Fe Stucco.exe
Creates FileC:\Program Files\Messenger\xpmsgr.chm
Creates FileC:\Program Files\Common Files\System\msadc\handsafe.reg
Creates FileC:\Program Files\MSN Gaming Zone\Windows\shvl.dll
Creates FileC:\WINDOWS\inf\cyclad-z.inf
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\PictureTasks\Howto\images\export.gif
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\citbannA.gif
Creates FileC:\WINDOWS\inf\fltmgr.inf
Creates FileC:\WINDOWS\inf\mdmchipv.PNF
Creates FileC:\WINDOWS\Fonts\cga40857.fon
Creates FileC:\WINDOWS\Help\ntbackup.chm
Creates FileC:\WINDOWS\inf\atirage3.inf
Creates FileC:\Program Files\Common Files\Microsoft Shared\web server extensions\40\bin\1033\FPEXT.MSG
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Css\wmptour.css
Creates FileC:\Program Files\Windows NT\Pinball\SOUND57.WAV
Creates FileC:\Program Files\Common Files\System\Ole DB\msdaer.dll
Creates FileC:\WINDOWS\Cursors\drum.exe
Creates FileC:\WINDOWS\inf\koc.inf
Creates FileC:\WINDOWS\Help\Tours\mmTour\intro.txt
Creates FileC:\WINDOWS\inf\defltwk.inf
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\handtool.gif
Creates FileC:\WINDOWS\AppPatch\sysmain.sdb
Creates FileC:\WINDOWS\Help\secsetconcepts.chm
Creates FileC:\WINDOWS\inf\mdm656n5.inf
Creates FileC:\WINDOWS\ime\imkr6_1\HELP\imkren61.hlp
Creates FileC:\WINDOWS\Fonts\ssee1255.fon
Creates FileC:\WINDOWS\Help\Tours\mmTour\nav.txt
Creates FileC:\WINDOWS\Fonts\couf1256.fon
Creates FileC:\WINDOWS\Cursors\up_r.cur
Creates FileC:\WINDOWS\Fonts\ega80woa.fon
Creates FileC:\WINDOWS\Fonts\vgafixg.fon
Creates FileC:\WINDOWS\inf\mdmmc288.inf
Creates FileC:\WINDOWS\inf\mdmdyna.inf
Creates FileC:\WINDOWS\inf\atimpab.inf
Creates FileC:\WINDOWS\inf\machine.PNF
Creates FileC:\WINDOWS\Cursors\arrow_i.cur
Creates FileC:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt
Creates FileC:\WINDOWS\Cursors\move_i.cur
Creates FileC:\WINDOWS\Help\wab.hlp
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud2.exe
Creates FileC:\WINDOWS\Help\Tours\htmlTour\img116.exe
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\aleabanr.gif
Creates FileC:\Program Files\NetMeeting\netmeet.htm
Creates FileC:\WINDOWS\Help\Tours\htmlTour\safe_easy_faster_ghost.exe
Creates FileC:\WINDOWS\Cursors\size4_m.cur
Creates FileC:\WINDOWS\Fonts\tunga.ttf
Creates FileC:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
Creates FileC:\WINDOWS\Cursors\dinosaur.exe
Creates FileC:\WINDOWS\ime\imjp8_1\imjpdadm.exe
Creates FileC:\Program Files\MSN Gaming Zone\Windows\zoneclim.dll
Creates FileC:\WINDOWS\inf\mdmarn.inf
Creates FileC:\WINDOWS\inf\mdmgl005.PNF
Creates FileC:\WINDOWS\Help\sndvol32.hlp
Creates FileC:\WINDOWS\Cursors\appstart.exe
Creates FileC:\WINDOWS\Fonts\vgaf1257.fon
Creates FileC:\WINDOWS\Help\keyshort.chm
Creates FileC:\Documents and Settings\Administrator\Application Data\Adobe\Acrobat\9.0\AdobeSysFnt09.lst
Creates FileC:\WINDOWS\Fonts\timesi.ttf
Creates FileC:\WINDOWS\Fonts\BROWAU.TTF
Creates FileC:\WINDOWS\Fonts\ega40857.fon
Creates FileC:\WINDOWS\inf\irdasmc.PNF
Creates FileC:\WINDOWS\ime\imjp8_1\imjpinst.ini
Creates FileC:\WINDOWS\Cursors\handns.exe
Creates FileC:\WINDOWS\Help\wuau.chm
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\cad564e303c6b24b86151da863a0e830\Microsoft.Build.Tasks.ni.dll
Creates FileC:\WINDOWS\inf\mdmhamrw.inf
Creates FileC:\WINDOWS\WindowsUpdate.log
Creates FileC:\WINDOWS\inf\ibmvcap.inf
Creates FileC:\WINDOWS\Cursors\no_rl.cur
Creates FileC:\WINDOWS\inf\epsnmfp.PNF
Creates FileC:\WINDOWS\Fonts\wst_swed.fon
Creates FileC:\WINDOWS\inf\digiasyn.inf
Creates FileC:\WINDOWS\inf\flpydisk.inf
Creates FileC:\WINDOWS\Fonts\ssef1255.fon
Creates FileC:\WINDOWS\inf\mdmhaeu.inf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\unlock_built_ghost.exe
Creates FileC:\WINDOWS\Fonts\serifee.fon
Creates FileC:\WINDOWS\Fonts\BROWAUB.TTF
Creates FileC:\WINDOWS\msgsocm.log
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\AcroRead.msi
Creates FileC:\Program Files\Common Files\MSSoap\Binaries\wisc10.dll
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db
Creates FileC:\WINDOWS\Help\input.chm
Creates FileC:\WINDOWS\Help\sfmmgr.hlp
Creates FileC:\WINDOWS\Help\Tours\htmlTour\connected_data.exe
Creates FileC:\WINDOWS\Help\Tours\htmlTour\img046.exe
Creates FileC:\WINDOWS\Help\newfeat1.chm
Creates FileC:\WINDOWS\Fonts\vga850.fon
Creates FileC:\WINDOWS\Fonts\85775.fon
Creates FileC:\WINDOWS\Help\suptools.chm
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\Messages\ENU\Msvbvm60.dll
Creates FileC:\WINDOWS\inf\mdmgsm.PNF
Creates FileC:\WINDOWS\Fonts\UPCLBI.TTF
Creates FileC:\WINDOWS\Help\sstub.dll
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud1.exe
Creates FileC:\WINDOWS\Fonts\UPCIL.TTF
Creates FileC:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe\Color\ACECache10.lst
Creates FileC:\Program Files\Windows NT\Pinball\SOUND26.WAV
Creates FileC:\WINDOWS\ime\imkr6_1\dicts\imekr.lex
Creates FileC:\Program Files\Windows NT\Pinball\SOUND3.WAV
Creates FileC:\WINDOWS\Help\Tours\htmlTour\nav_best.exe
Creates FileC:\Program Files\Windows NT\Pinball\SOUND53.WAV
Creates FileC:\WINDOWS\inf\cyzport.inf
Creates FileC:\Program Files\Messenger\custsat.dll
Creates FileC:\WINDOWS\inf\hpojscan.PNF
Creates FileC:\WINDOWS\Fonts\c8514fix.fon
Creates FileC:\Program Files\Windows NT\Pinball\SOUND4.WAV
Creates FileC:\WINDOWS\Fonts\verdana.ttf
Creates FileC:\WINDOWS\Fonts\latha.ttf
Creates FileC:\WINDOWS\Help\nwdoc.hlp
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp
Creates FileC:\WINDOWS\Help\cyycoins.chm
Creates FileC:\WINDOWS\Fonts\courfe.fon
Creates FileC:\Program Files\NetMeeting\dcap32.dll
Creates FileC:\Program Files\Windows NT\Pinball\SOUND713.WAV
Creates FileC:\WINDOWS\inf\hpdigwia.inf
Creates FileC:\WINDOWS\inf\brmfcmdm.inf
Creates FileC:\WINDOWS\Cursors\lnesw.cur
Creates FileC:\WINDOWS\inf\mdmgl005.inf
Creates FileC:\WINDOWS\Cursors\no_i.cur
Creates FileC:\WINDOWS\Help\regopt.chm
Creates FileC:\WINDOWS\Cursors\size2_r.cur
Creates FileC:\WINDOWS\Help\audiocdc.hlp
Creates FileC:\WINDOWS\Help\mail.chm
Creates FileC:\Program Files\Windows NT\Pinball\SOUND65.WAV
Creates FileC:\WINDOWS\inf\display.PNF
Creates FileC:\WINDOWS\Fonts\mingliu.ttc
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Games\Internet Reversi.lnk
Creates FileC:\WINDOWS\inf\camvid20.inf
Creates FileC:\WINDOWS\Help\cpanel.chq
Creates FileC:\WINDOWS\Fonts\CORDIAUI.TTF
Creates FileC:\WINDOWS\Help\ieos.chm
Creates FileC:\Program Files\Windows NT\Pinball\SOUND42.WAV
Creates FileC:\WINDOWS\inf\inetres.adm
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud8.exe
Creates FileC:\WINDOWS\inf\LAYOUT.PNF
Creates FileC:\Program Files\Windows NT\Pinball\PINBALL.MID
Creates FileC:\WINDOWS\Help\pinball.chm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe\Color\ACECache4.lst
Creates FileC:\WINDOWS\Help\agt040e.hlp
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Citrus Punch Bkgrd.gif
Creates FileC:\WINDOWS\Fonts\UPCKB.TTF
Creates FileC:\WINDOWS\Help\Tours\htmlTour\connected_wizard.exe
Creates FileC:\WINDOWS\Fonts\smae1257.fon
Creates FileC:\WINDOWS\Fonts\UPCFB.TTF
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\VDKHome\ENU\Vdk10.lng
Creates FileC:\WINDOWS\Help\sr_ui.chm
Creates FileC:\WINDOWS\Help\wschelp.chm
Creates FileC:\WINDOWS\ime\imjp8_1\imjpdsvr.exe
Creates FileC:\Program Files\Windows NT\Pinball\SOUND5.WAV
Creates FileC:\Documents and Settings\Default User\Start Menu\Programs\Windows Media Player.lnk
Creates FileC:\WINDOWS\Fonts\mriamtr.ttf
Creates FileC:\Program Files\Common Files\System\Ole DB\oledbjvs.inc
Creates FileC:\Program Files\Windows Media Player\npdrmv2.zip
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\AdbeRdrUpd934_all_incr.msp
Creates FileC:\Program Files\Common Files\System\msadc\msadds.dll
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\zoomintool.gif
Creates FileC:\WINDOWS\Help\dialer.hlp
Creates FileC:\Program Files\Common Files\System\Ole DB\MSDAPML.DLL
Creates FileC:\WINDOWS\Help\utilmgr.hlp
Creates FileC:\WINDOWS\Cursors\lappstrt.cur
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\PictureTasks\Howto\images\try.gif
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\VDKHome\ENU\VDK10.STP
Creates FileC:\WINDOWS\inf\i740nt5.PNF
Creates FileC:\WINDOWS\Help\twclient.hlp
Creates FileC:\WINDOWS\Help\msnauth.cnt
Creates FileC:\WINDOWS\inf\lwusbhid.inf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\connected_networks.exe
Creates FileC:\WINDOWS\inf\dgaport.PNF
Creates FileC:\WINDOWS\Help\newfeat5.hlp
Creates FileC:\WINDOWS\Help\oe_msgr.chm
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\PPKLite.api
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Communications\New Connection Wizard.lnk
Creates FileC:\WINDOWS\ime\shared\res\padrs412.dll
Creates FileC:\WINDOWS\Fonts\smallfr.fon
Creates FileC:\WINDOWS\Help\gpedit.chm
Creates FileC:\WINDOWS\inf\ctmaport.PNF
Creates FileC:\WINDOWS\Help\Tours\htmlTour\safe_fr.htm
Creates FileC:\Program Files\Common Files\System\msadc\msaddsr.dll
Creates FileC:\WINDOWS\inf\AER_1033.ADM
Creates FileC:\WINDOWS\iis6.log
Creates FileC:\WINDOWS\Help\mqsnap.hlp
Creates FileC:\WINDOWS\Help\ratings.hlp
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Setup Files\RdrBig709\ENU\Adobe Reader 7.0.9.msi
Creates FileC:\WINDOWS\Help\migwiz2.htm
Creates FileC:\WINDOWS\inf\AER_2052.ADM
Creates FileC:\Program Files\Internet Explorer\SIGNUP\INSTALL.INS
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0019E545\Plylst9.wpl
Creates FileC:\WINDOWS\_default.pif
Creates FileC:\WINDOWS\Help\langbar.chm
Creates FileC:\Documents and Settings\All Users\Start Menu\Set Program Access and Defaults.lnk
Creates FileC:\WINDOWS\inf\layout.inf
Creates FileC:\WINDOWS\Cursors\wait_l.cur
Creates FileC:\WINDOWS\Cursors\beam_im.cur
Creates FileC:\WINDOWS\Fonts\UPCJB.TTF
Creates FileC:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\734413e6d8aa6c4c800023385ad7bee7\System.Xml.ni.dll
Creates FileC:\WINDOWS\Help\notepad.chm
Creates FileC:\WINDOWS\inf\dfrg.inf
Creates FileC:\WINDOWS\Fonts\ahronbd.ttf
Creates FileC:\WINDOWS\Help\ipsecsnp.chm
Creates FileC:\WINDOWS\Help\msdasc.chm
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp
Creates FileC:\WINDOWS\Help\magnify.chm
Creates FileC:\WINDOWS\inf\image.inf
Creates FileC:\WINDOWS\twain_32.dll
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\7.gif
Creates FileC:\Program Files\MSN Gaming Zone\Windows\bckgzm.exe
Creates FileC:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
Creates FileC:\WINDOWS\Fonts\app850.fon
Creates FileC:\WINDOWS\Cursors\3dwmove.cur
Creates FileC:\WINDOWS\Help\ieshared.chm
Creates FileC:\Program Files\MSN Gaming Zone\Windows\hrtz.dll
Creates FileC:\WINDOWS\Cursors\hnesw.cur
Creates FileC:\WINDOWS\Fonts\serifet.fon
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\VDKHome\VDK10.THD
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Btn\taon.exe
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\EWH32.api
Creates FileC:\Program Files\Common Files\System\ado\MDACReadme.htm
Creates FileC:\WINDOWS\inf\icam5usb.PNF
Creates FileC:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe
Creates FileC:\WINDOWS\Fonts\8514fixg.fon
Creates FileC:\WINDOWS\inf\mdmgl003.PNF
Creates FileC:\WINDOWS\Fonts\sserifer.fon
Creates FileC:\WINDOWS\ime\mscandui.dll
Creates FileC:\Program Files\MSN Gaming Zone\Windows\bckg.dll
Creates FileC:\WINDOWS\Help\agt0415.hlp
Creates FileC:\WINDOWS\Cursors\cross.cur
Creates FileC:\WINDOWS\ime\imjp8_1\DICTS\imjpgn.grm
Creates FileC:\WINDOWS\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
Creates FileC:\Program Files\MSN\MSNCoreFiles\Install\MSN9Components\Digcore.exe
Creates FileC:\Program Files\MSN Gaming Zone\Windows\Cmnclim.dll
Creates FileC:\WINDOWS\Help\Tours\htmlTour\safe_easier.htm
Creates FileC:\WINDOWS\inf\mdmcm28.inf
Creates FileC:\WINDOWS\Help\digiras.chm
Creates FileC:\WINDOWS\Help\Tours\htmlTour\img123.exe
Creates FileC:\WINDOWS\Help\Tours\htmlTour\unlock_built_big.exe
Creates FileC:\WINDOWS\Help\rvse.chm
Creates FileC:\WINDOWS\Fonts\jvgasys.fon
Creates FileC:\WINDOWS\inf\irbus.PNF
Creates FileC:\Program Files\Outlook Express\oeimport.dll
Creates FileC:\Documents and Settings\Administrator\ntuser.ini
Creates FileC:\WINDOWS\Help\Tours\htmlTour\nav_best_down.exe
Creates FileC:\WINDOWS\Help\spolsconcepts.chm
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Resource\ENUtxt.pdf
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp
Creates FileC:\WINDOWS\Fonts\couf1255.fon
Creates FileC:\WINDOWS\Fonts\simpfxo.ttf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\best_road_big.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012013052720130603\index.dat
Creates FileC:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Creates FileC:\WINDOWS\Help\sys_srv.chm
Creates FileC:\WINDOWS\Help\Tours\htmlTour\safe_easy_easier_big.exe
Creates FileC:\WINDOWS\inf\icam4usb.PNF
Creates FileC:\Program Files\Outlook Express\oemiglib.dll
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm7.exe
Creates FileC:\WINDOWS\Cursors\pen_rl.cur
Creates FileC:\WINDOWS\inf\AER_1028.ADM
Creates FileC:\WINDOWS\Help\mobsync.hlp
Creates FileC:\WINDOWS\inf\hpojscan.inf
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\eBook.api
Creates FileC:\WINDOWS\inf\mdmirmdm.PNF
Creates FileC:\WINDOWS\inf\mdmar1.inf
Creates FileC:\WINDOWS\inf\mdm3com.inf
Creates FileC:\WINDOWS\inf\61883.inf
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\MakeAccessible.api
Creates FileC:\WINDOWS\Fonts\pala.ttf
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\msn.isp
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Performance.lnk
Creates FileC:\WINDOWS\inf\mdmlasat.inf
Creates FileC:\WINDOWS\Help\sol.hlp
Creates FileC:\WINDOWS\Help\winzm.chm
Creates FileC:\WINDOWS\Fonts\8514fixe.fon
Creates FileC:\WINDOWS\Fonts\georgiai.ttf
Creates FileC:\Program Files\Common Files\System\Ole DB\oledb32r.dll
Creates FileC:\Program Files\Windows Media Player\wmpband.dll
Creates FileC:\WINDOWS\Fonts\smaf1257.fon
Creates FileC:\WINDOWS\inf\mdmcom1.PNF
Creates FileC:\Program Files\Common Files\System\ado\adovbs.inc
Creates FileC:\WINDOWS\inf\mdmbsb.PNF
Creates FileC:\Program Files\Messenger\msmsgs.exe
Creates FileC:\Program Files\Windows NT\Pinball\SOUND735.WAV
Creates FileC:\WINDOWS\Help\agt0804.hlp
Creates FileC:\WINDOWS\Help\Tours\mmTour\tour.exe
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Games\Freecell.lnk
Creates FileC:\WINDOWS\inf\ks.inf
Creates FileC:\WINDOWS\Fonts\BROWA.TTF
Creates FileC:\Program Files\Windows NT\Pinball\SOUND38.WAV
Creates FileC:\WINDOWS\inf\mdmfj2.PNF
Creates FileC:\WINDOWS\Help\Tours\mmTour\segment4.txt
Creates FileC:\WINDOWS\Help\Tours\htmlTour\unlock_optimized_big.exe
Creates FileC:\Program Files\Windows NT\Pinball\SOUND49.WAV
Creates FileC:\WINDOWS\ime\imjp8_1\applets\voicepad.dll
Creates FileC:\WINDOWS\ime\imjp8_1\DICTS\imjpch.dic
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Setup Files\RdrBig709\ENU\Abcpy.ini
Creates FileC:\WINDOWS\ocmsn.log
Creates FileC:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
Creates FileC:\WINDOWS\inf\acpi.inf
Creates FileC:\WINDOWS\Cursors\handapst.exe
Creates FileC:\Program Files\Windows NT\Pinball\SOUND1.WAV
Creates FileC:\WINDOWS\Cursors\no_m.cur
Creates FileC:\WINDOWS\inf\cyyport.PNF
Creates FileC:\WINDOWS\inf\mdmltsft.PNF
Creates FileC:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
Creates FileC:\WINDOWS\Fonts\cvgasys.fon
Creates FileC:\WINDOWS\Cursors\help_r.cur
Creates FileC:\WINDOWS\Help\odbcinst.chm
Creates FileC:\WINDOWS\Help\newfeat1.hlp
Creates FileC:\WINDOWS\ime\chsime\applets\PINTLCSK.DIC
Creates FileC:\WINDOWS\Cursors\size3_im.cur
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\forms.gif
Creates FileC:\Program Files\Common Files\System\wab32.dll
Creates FileC:\WINDOWS\Help\cyzcoins.chm
Creates FileC:\WINDOWS\Help\Tours\htmlTour\safe_easy_faster.exe
Creates FileC:\Program Files\Online Services\Use MSN Explorer to sign up for Internet Access (US only).lnk
Creates FileC:\WINDOWS\Cursors\pen_rm.cur
Creates FileC:\WINDOWS\Cursors\help_rl.cur
Creates FileC:\WINDOWS\Fonts\cga40869.fon
Creates FileC:\WINDOWS\Help\wmplay.chm
Creates FileC:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\Magnifier.lnk
Creates FileC:\WINDOWS\inf\mdmbcmsm.inf
Creates FileC:\WINDOWS\Fonts\UPCEL.TTF
Creates FileC:\Program Files\Common Files\System\ado\msado21.tlb
Creates FileC:\WINDOWS\inf\fsvgaadd.inf
Creates FileC:\WINDOWS\Help\agt041d.hlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe\Acrobat\7.0\Cache\AcroFnt07.lst
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\isignup.exe
Creates FileC:\WINDOWS\Fonts\mriam.ttf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\nav_unlock.exe
Creates FileC:\Documents and Settings\All Users\Documents\My Videos\Desktop.ini
Creates FileC:\WINDOWS\Help\Tours\htmlTour\unlock_optimized_ghost.exe
Creates FileC:\WINDOWS\Help\sysrestore.chm
Creates FileC:\Msvbvm60.dll
Creates FileC:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Btn\tplay.exe
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\showmenu.gif
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\office_convert.gif
Creates FileC:\WINDOWS\Sti_Trace.log
Creates FileC:\WINDOWS\Help\defrag.chm
Creates FileC:\WINDOWS\winhelp.exe
Creates FileC:\WINDOWS\inf\legcydrv.PNF
Creates FileC:\WINDOWS\inf\keyboard.inf
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\desktop.ini
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp
Creates FileC:\WINDOWS\Fonts\smallfe.fon
Creates FileC:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\desktop.ini
Creates FileC:\Documents and Settings\Administrator\NetHood\shared on Samba 3.6.9-151.el6 (192.168.1.1)\target.lnk
Creates FileC:\WINDOWS\inf\intl.PNF
Creates FileC:\WINDOWS\Help\agt040b.hlp
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Fiesta.htm
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\icwx25b.dun
Creates FileC:\WINDOWS\Fonts\davidbd.ttf
Creates FileC:\WINDOWS\Help\wuauhelp.chm
Creates FileC:\WINDOWS\inf\hpscan.inf
Creates FileC:\WINDOWS\inf\mdmcodex.PNF
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\desktop.ini
Creates FileC:\WINDOWS\inf\mdmgl008.inf
Creates FileC:\Program Files\NetMeeting\h323cc.dll
Creates FileC:\Program Files\Outlook Express\msimn.exe
Creates FileC:\WINDOWS\Cursors\size4_rm.cur
Creates FileC:\WINDOWS\Help\progman.hlp
Creates FileC:\WINDOWS\inf\adm_port.inf
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\e216ef88307a32408915eb991be5a378\System.Web.RegularExpressions.ni.dll
Creates FileC:\WINDOWS\inf\flash.PNF
Creates FileC:\WINDOWS\ime\imjp8_1\imjpdct.exe
Creates FileC:\WINDOWS\inf\axant5.PNF
Creates FileC:\Program Files\MSN\MSNCoreFiles\Install\MSN9Components\digopt.msi
Creates FileC:\WINDOWS\Help\odbcjet.chm
Creates FileC:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0019E545\Plylst15.wpl
Creates FileC:\WINDOWS\Help\dskquoui.chm
Creates FileC:\WINDOWS\Fonts\UPCKL.TTF
Creates FileC:\WINDOWS\Help\Tours\mmTour\segment1.txt
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\attach.gif
Creates FileC:\WINDOWS\Fonts\seriffr.fon
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Esl\AiodLite.dll
Creates FileC:\Program Files\Messenger\msgsc.dll
Creates FileC:\WINDOWS\Fonts\UPCEBI.TTF
Creates FileC:\WINDOWS\Help\Tours\htmlTour\start_ending.htm
Creates FileC:\WINDOWS\Help\dsclient.hlp
Creates FileC:\WINDOWS\Fonts\vgafixe.fon
Creates FileC:\WINDOWS\Help\iismmc.chm
Creates FileC:\WINDOWS\inf\hdaudbus.PNF
Creates FileC:\WINDOWS\ime\shared\res\padrs804.dll
Creates FileC:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
Creates FileC:\WINDOWS\Help\Tours\htmlTour\connected_data_big.exe
Creates FileC:\WINDOWS\inf\irtos4mo.PNF
Creates FileC:\WINDOWS\Help\license.chm
Creates FileC:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
Creates FileC:\WINDOWS\Fonts\85f1256.fon
Creates FileC:\Program Files\Common Files\Microsoft Shared\Speech\1033\spcplui.dll
Creates FileC:\WINDOWS\Help\els.hlp
Creates FileC:\WINDOWS\Help\Tours\htmlTour\unlock_fr.htm
Creates FileC:\WINDOWS\inf\1394.PNF
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Network Blitz Bkgrd.gif
Creates FileC:\WINDOWS\inf\mdmeric2.PNF
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Creates FileC:\Documents and Settings\Default User\Start Menu\Programs\Startup\desktop.ini
Creates FileC:\WINDOWS\Fonts\raavi.ttf
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm8.exe
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\Spelling.api
Creates FileC:\WINDOWS\Fonts\lsansi.ttf
Creates FileC:\WINDOWS\inf\mdmcpq.inf
Creates FileC:\WINDOWS\inf\ieaccess.inf
Creates FileC:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\desktop.ini
Creates FileC:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Tour Windows XP.lnk
Creates FileC:\WINDOWS\ime\imjp8_1\HELP\imjpsme.hlp
Creates FileC:\WINDOWS\Help\wmic.chm
Creates FileC:\Documents and Settings\Administrator\Templates\excel4.xls
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\PictureTasks\Howto\images\print.gif
Creates FileC:\WINDOWS\inf\g200.inf
Creates FileC:\Program Files\NetMeeting\MST120.DLL
Creates FileC:\WINDOWS\Help\dijoy.hlp
Creates FileC:\WINDOWS\Fonts\coureg.fon
Creates FileC:\WINDOWS\FaxSetup.log
Creates FileC:\WINDOWS\Fonts\vgafixr.fon
Creates FileC:\WINDOWS\inf\icam4usb.inf
Creates FileC:\WINDOWS\wiadebug.log
Creates FileC:\Documents and Settings\Administrator\Application Data\Adobe\Acrobat\9.0\SharedDataEvents
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\6.gif
Creates FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg
Creates FileC:\Program Files\NetMeeting\nmas.dll
Creates FileC:\WINDOWS\Greenstone.exe
Creates FileC:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe\Color\ACECache4.lst
Creates FileC:\WINDOWS\Fonts\8514fixr.fon
Creates FileC:\WINDOWS\Fonts\app852.fon
Creates FileC:\WINDOWS\ime\imjp8_1\DICTS\imjpsb.dic
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0019E545\Plylst6.wpl
Creates FileC:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.bak
Creates FileC:\WINDOWS\inf\devxprop.PNF
Creates FileC:\Program Files\MSN Gaming Zone\Windows\zeeverm.dll
Creates FileC:\WINDOWS\Fonts\c8514sys.fon
Creates FileC:\WINDOWS\Help\offlinefolders.chm
Creates FileC:\WINDOWS\inf\atim128.inf
Creates FileC:\Program Files\Movie Maker\Shared\Msvbvm60.dll
Creates FileC:\WINDOWS\Cursors\busy_i.cur
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp
Creates FileC:\WINDOWS\Help\iesupp.chm
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Games\Minesweeper.lnk
Creates FileC:\Program Files\Outlook Express\wabmig.exe
Creates FileC:\WINDOWS\Help\secauth.hlp
Creates FileC:\WINDOWS\ime\CHTIME\Applets\CHTAPT.CHM
Creates FileC:\WINDOWS\Fonts\courfg.fon
Creates FileC:\Program Files\Internet Explorer\MUI\0409\mscorier.dll
Creates FileC:\Program Files\Common Files\Microsoft Shared\web server extensions\40\bin\FP4AWEC.DLL
Creates FileC:\Program Files\Windows NT\Pinball\SOUND43.WAV
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\07a1d8d20618de48b3cb798a24f977fc\AspNetMMCExt.ni.dll
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\cd756036bd3d00479a648c21aeaf72da\System.Web.Mobile.ni.dll
Creates FileC:\WINDOWS\inf\bthpan.inf
Creates FileC:\Program Files\Common Files\System\ado\msador15.dll
Creates FileC:\WINDOWS\AppPatch\msimain.sdb
Creates FileC:\WINDOWS\inf\mdmcpq2.inf
Creates FileC:\WINDOWS\Help\mstask.hlp
Creates FileC:\WINDOWS\Fonts\courf.fon
Creates FileC:\WINDOWS\Help\osk.chm
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Leaves.htm
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Pie Charts.htm
Creates FileC:\WINDOWS\inf\mdmgl008.PNF
Creates FileC:\WINDOWS\Help\ciadmin.htm
Creates FileC:\WINDOWS\inf\mdmairte.PNF
Creates FileC:\WINDOWS\inf\asroc.inf
Creates FileC:\Program Files\MSN Gaming Zone\Windows\UniAnsi.dll
Creates FileC:\WINDOWS\Fonts\vga949.fon
Creates FileC:\Program Files\Common Files\MSSoap\Binaries\Resources\1033\mssoapr.dll
Creates FileC:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0019E545\Plylst12.wpl
Creates FileC:\WINDOWS\Help\conf1.chm
Creates FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Msvbvm60.dll
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud6.exe
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Technical.htm
Creates FileC:\WINDOWS\inf\cdrom.PNF
Creates FileC:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\D4Z32ED8\desktop.ini
Creates FileC:\Program Files\Windows NT\Pinball\SOUND14.WAV
Creates FileC:\WINDOWS\Help\article.chm
Creates FileC:\WINDOWS\Help\tshoot.chm
Creates FileC:\WINDOWS\DtcInstall.log
Creates FileC:\WINDOWS\Fonts\s8514fix.fon
Creates FileC:\WINDOWS\inf\mdmlt3.PNF
Creates FileC:\WINDOWS\ime\imkr6_1\applets\imekrmbx.dll
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\areatool.gif
Creates FileC:\WINDOWS\Fonts\sseriffr.fon
Creates FileC:\WINDOWS\Fonts\ssee1256.fon
Creates FileC:\WINDOWS\inf\irdaalif.PNF
Creates FileC:\WINDOWS\Help\Tours\htmlTour\best_road_ghost.exe
Creates FileC:\WINDOWS\inf\digiisdn.PNF
Creates FileC:\Program Files\Common Files\System\Ole DB\oledb32.dll
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Data Sources (ODBC).lnk
Creates FileC:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\desktop.ini
Creates FileC:\WINDOWS\Help\ratings.chm
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\System Information.lnk
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32Info.exe
Creates FileC:\WINDOWS\Fonts\trebucbi.ttf
Creates FileC:\WINDOWS\Fonts\app949.fon
Creates FileC:\WINDOWS\Fonts\serifer.fon
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Activate Windows.lnk
Creates FileC:\WINDOWS\AppPatch\AcLua.dll
Creates FileC:\WINDOWS\cmsetacl.log
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\SPPlugins\ADMPlugin.apl
Creates FileC:\WINDOWS\inf\AER_1031.ADM
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\mplogo.exe
Creates FileC:\WINDOWS\Help\ieakmmc.chm
Creates FileC:\WINDOWS\PSEXESVC.EXE
Creates FileC:\WINDOWS\Fonts\lsans.ttf
Creates FileC:\WINDOWS\Help\msmqconcepts.chm
Creates FileC:\WINDOWS\Help\comexp.chm
Creates FileC:\WINDOWS\Help\infrared.hlp
Creates FileC:\WINDOWS\inf\koc.PNF
Creates FileC:\WINDOWS\Fonts\mangal.ttf
Creates FileC:\WINDOWS\Fonts\verdanab.ttf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\img110.exe
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins3d\drvDX8.x3d
Creates FileC:\Documents and Settings\Administrator\Application Data\Adobe\Acrobat\9.0\JavaScripts\glob.js
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\907855fd87ed5a4c815ed5e7d60fff88\System.EnterpriseServices.ni.dll
Creates FileC:\WINDOWS\inf\mdmcpv.PNF
Creates FileC:\WINDOWS\inf\certclas.PNF
Creates FileC:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfkd.nlp
Creates FileC:\WINDOWS\Help\wscript.hlp
Creates FileC:\WINDOWS\Help\devmgr.chm
Creates FileC:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Scheduled Tasks.lnk
Creates FileC:\WINDOWS\Help\fxsclnt.hlp
Creates FileC:\WINDOWS\Cursors\hnwse.cur
Creates FileC:\CONFIG.SYS
Creates FileC:\Program Files\Common Files\System\Ole DB\msdaenum.dll
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Entertainment\desktop.ini
Creates FileC:\Program Files\NetMeeting\confmrsl.dll
Creates FileC:\WINDOWS\inf\battery.PNF
Creates FileC:\WINDOWS\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
Creates FileC:\WINDOWS\Help\mshearts.chm
Creates FileC:\WINDOWS\inf\mdmlt3.inf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\read_icon.exe
Creates FileC:\Program Files\Movie Maker\WMM2ERES.dll
Creates FileC:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk
Creates FileC:\WINDOWS\inf\irnsc.PNF
Creates FileC:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe\Updater6\aumLib.log
Creates FileC:\Program Files\Common Files\Microsoft Shared\Triedit\DHTMLED.OCX
Creates FileC:\Program Files\Windows NT\Pinball\SOUND111.WAV
Creates FileC:\WINDOWS\Fonts\j8514fix.fon
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Clear Day.htm
Creates FileC:\WINDOWS\inf\mdm3cpcm.inf
Creates FileC:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\Multimedia\MPP\Flash.mpp
Creates FileC:\WINDOWS\Help\msnauth.hlp
Creates FileC:\WINDOWS\Help\network.chm
Creates FileC:\WINDOWS\Help\common.chm
Creates FileC:\WINDOWS\inf\mdmintel.inf
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm5.exe
Creates FileC:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini
Creates FileC:\WINDOWS\Fonts\UPCIB.TTF
Creates FileC:\WINDOWS\Msvbvm60.dll
Creates FileC:\WINDOWS\Cursors\size2_rm.cur
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Games\Internet Backgammon.lnk
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader 7.0.lnk
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk
Creates FileC:\WINDOWS\Help\howto.chm
Creates FileC:\WINDOWS\Help\reader.hlp
Creates FileC:\WINDOWS\inf\atixpwdm.PNF
Creates FileC:\Program Files\Windows NT\Pinball\SOUND45.WAV
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\ACE.dll
Creates FilePIPE\wkssvc
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Local Security Policy.lnk
Creates FileC:\WINDOWS\Cursors\size1_i.cur
Creates FileC:\Program Files\Common Files\System\Ole DB\sqloledb.dll
Creates FileC:\WINDOWS\Help\Tours\htmlTour\end_up.exe
Creates FileC:\WINDOWS\inf\mdmeric.inf
Creates FileC:\WINDOWS\Fonts\jsmallf.fon
Creates FileC:\WINDOWS\ime\CHTIME\Applets\CHTSKDIC.DIC
Creates FileC:\WINDOWS\inf\icwnt5.inf
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe\TypeSupport\AdobeFnt11.lst
Creates FileC:\WINDOWS\inf\ieaccess.PNF
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp
Creates FileC:\WINDOWS\Fonts\cga80866.fon
Creates FileC:\WINDOWS\Cursors\3dsmove.cur
Creates FileC:\WINDOWS\inf\mdmaiwa.inf
Creates FileC:\WINDOWS\Help\winmine.chm
Creates FileC:\Program Files\Common Files\Microsoft Shared\DW\1031\DWINTL20.DLL
Creates FileC:\WINDOWS\Cursors\raindrop.exe
Creates FileC:\WINDOWS\inf\cyyport.inf
Creates FileC:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\big5.nlp
Creates FileC:\Program Files\MSN Gaming Zone\Windows\hrtzzm.exe
Creates FileC:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
Creates FileC:\WINDOWS\inf\kdk2x0.inf
Creates FileC:\WINDOWS\Soap Bubbles.exe
Creates FileC:\WINDOWS\Help\Tours\htmlTour\start_taskbar.htm
Creates FileC:\Program Files\NetMeeting\Blip.wav
Creates FileC:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normidna.nlp
Creates FileC:\Documents and Settings\Administrator\SendTo\Desktop (create shortcut).DeskLink
Creates FileC:\WINDOWS\Help\osk.hlp
Creates FileC:\WINDOWS\inf\atim128.PNF
Creates FileC:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
Creates FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg
Creates FileC:\WINDOWS\inf\mdmdcm6.PNF
Creates FileC:\WINDOWS\ime\shared\res\padrs411.dll
Creates FileC:\WINDOWS\Help\mspaint.hlp
Creates FileC:\WINDOWS\Help\rsm.hlp
Creates FileC:\Program Files\Windows NT\Pinball\SOUND49D.WAV
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Setup Files\RdrBig709\ENU\Msvbvm60.dll
Creates FileC:\WINDOWS\Help\ipsecsnp.hlp
Creates FileC:\WINDOWS\inf\icwnt5.PNF
Creates FileC:\Documents and Settings\Default User\Start Menu\desktop.ini
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Sweets Bkgrd.gif
Creates FileC:\WINDOWS\inf\dfrg.PNF
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk
Creates FileC:\Program Files\Windows NT\Pinball\SOUND563.WAV
Creates FileC:\WINDOWS\Fonts\sseriffe.fon
Creates FileC:\WINDOWS\wmsetup.log
Creates FileC:\WINDOWS\inf\mdmhayes.PNF
Creates FileC:\WINDOWS\Fonts\app775.fon
Creates FileC:\WINDOWS\Fonts\simpo.ttf
Creates FileC:\WINDOWS\inf\mdmbug3.inf
Creates FileC:\WINDOWS\Fonts\vgaf1256.fon
Creates FileC:\WINDOWS\Help\mplayer2.hlp
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\907855fd87ed5a4c815ed5e7d60fff88\System.EnterpriseServices.Wrapper.dll
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Games\Spider Solitaire.lnk
Creates FileC:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
Creates FileC:\WINDOWS\Cursors\size3_l.cur
Creates FileC:\WINDOWS\control.ini
Creates FileC:\WINDOWS\Cursors\size1_r.cur
Creates FileC:\WINDOWS\inf\mdmeric2.inf
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud9.exe
Creates FileC:\WINDOWS\Help\Tours\mmTour\segment5.txt
Creates FileC:\WINDOWS\inf\mdmke.PNF
Creates FileC:\WINDOWS\River Sumida.exe
Creates FileC:\Program Files\Common Files\System\Ole DB\msdasqlr.dll
Creates FileC:\Documents and Settings\Administrator\Application Data\Adobe\Acrobat\9.0\UserCache.bin
Creates FileC:\WINDOWS\inf\mdmiodat.PNF
Creates FileC:\Documents and Settings\Administrator\Templates\winword.doc
Creates FileC:\WINDOWS\OEWABLog.txt
Creates FileC:\WINDOWS\inf\mdmbtmdm.PNF
Creates FileC:\WINDOWS\inf\kodak.PNF
Creates FileC:\Documents and Settings\Administrator\Templates\Msvbvm60.dll
Creates FileC:\WINDOWS\inf\mdmhamrw.PNF
Creates FileC:\Program Files\MSN\MSNCoreFiles\Install\cinfo.xml
Creates FileC:\WINDOWS\inf\hidbth.PNF
Creates FileC:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL
Creates FileC:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\desktop.ini
Creates FileC:\WINDOWS\Fonts\couf1257.fon
Creates FileC:\WINDOWS\Help\nmchat.chm
Creates FileC:\WINDOWS\inf\MDMJF56E.PNF
Creates FileC:\Documents and Settings\Administrator\My Documents\My Pictures\Desktop.ini
Creates FileC:\WINDOWS\Fonts\l_10646.ttf
Creates FileC:\Program Files\Windows Media Player\npds.zip
Creates FileC:\WINDOWS\Fonts\ssee874.fon
Creates FileC:\WINDOWS\Help\nmwhiteb.chm
Creates FileC:\Program Files\Internet Explorer\IEXPLORE.EXE
Creates FileC:\WINDOWS\inf\mdm656n5.PNF
Creates FileC:\WINDOWS\Help\freecell.hlp
Creates FileC:\WINDOWS\Help\mls_trb.chm
Creates FileC:\Program Files\Windows NT\Pinball\SOUND999.WAV
Creates FileC:\Program Files\Common Files\Services\bigfoot.bmp
Creates FileC:\WINDOWS\Fonts\vga869.fon
Creates FileC:\WINDOWS\Help\bckg.chm
Creates FileC:\WINDOWS\ime\imjp8_1\applets\imskf.dll
Creates FileC:\Program Files\Windows NT\Pinball\SOUND27.WAV
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\setup.ini
Creates FileC:\WINDOWS\Fonts\8514syst.fon
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Cnt\contents.htm
Creates FileC:\WINDOWS\Cursors\arrow_rm.cur
Creates FileC:\WINDOWS\Fonts\UPCFI.TTF
Creates FileC:\WINDOWS\Help\chooser.hlp
Creates FileC:\WINDOWS\Help\dfs.hlp
Creates FileC:\WINDOWS\Help\apps_sp.chm
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Transactions\7ee22366a5a88a4d9c4b35a1724969f3\System.Transactions.ni.dll
Creates FileC:\WINDOWS\Fonts\framd.ttf
Creates FileC:\WINDOWS\inf\mdmetech.inf
Creates FileC:\Program Files\Common Files\Microsoft Shared\DW\1036\DWINTL20.DLL
Creates FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
Creates FileC:\WINDOWS\inf\mdmexp.PNF
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\PDDom.api
Creates FileC:\WINDOWS\Cursors\cross_rl.cur
Creates FileC:\WINDOWS\Cursors\larrow.cur
Creates FileC:\WINDOWS\AppPatch\AcXtrnal.dll
Creates FileC:\WINDOWS\Help\msinfo32.chm
Creates FileC:\WINDOWS\Fonts\georgiab.ttf
Creates FileC:\Program Files\MSN Gaming Zone\Windows\Shvlres.dll
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\brndlog.bak
Creates FileC:\WINDOWS\Cursors\sizenwse.exe
Creates FileC:\WINDOWS\Help\sol.chm
Creates FileC:\WINDOWS\inf\lwusbhid.PNF
Creates FileC:\Documents and Settings\Administrator\Templates\sndrec.wav
Creates FileC:\WINDOWS\inf\kodak.inf
Creates FileC:\WINDOWS\Fonts\nrkis.ttf
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Scr\controls.js
Creates FileC:\WINDOWS\Help\imgprev.chm
Creates FileC:\Program Files\Windows NT\Pinball\SOUND28.WAV
Creates FileC:\WINDOWS\Help\msoeacct.hlp
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\desktop.ini
Creates FileC:\WINDOWS\Cursors\cross_il.cur
Creates FileC:\WINDOWS\Cursors\size1_m.cur
Creates FileC:\WINDOWS\Help\objsel.hlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\AdbeRdrUpd932_all_incr.msp
Creates FileC:\WINDOWS\desktop.ini
Creates FileC:\Documents and Settings\Administrator\Application Data\Adobe\Acrobat\9.0\JavaScripts\glob.settings.js
Creates FileC:\WINDOWS\Help\Tours\htmlTour\connected_wizard.htm
Creates FileC:\WINDOWS\Help\drvvfp.chm
Creates FileC:\WINDOWS\Help\migwiz.htm
Creates FileC:\WINDOWS\inf\iereset.PNF
Creates FileC:\WINDOWS\ime\chsime\applets\PINTLCSD.DIC
Creates FileC:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
Creates FileC:\WINDOWS\Help\access.hlp
Creates FileC:\Program Files\Online Services\Refer me to more Internet Service Providers.lnk
Creates FileC:\WINDOWS\Fonts\mriamfx.ttf
Creates FileC:\WINDOWS\Fonts\vgaf874.fon
Creates FileC:\WINDOWS\Help\verifier.hlp
Creates FileC:\Documents and Settings\All Users\Start Menu\Windows Catalog.lnk
Creates FileC:\WINDOWS\inf\acerscan.PNF
Creates FileC:\WINDOWS\Help\lpeconcepts.chm
Creates FileC:\Documents and Settings\LocalService\Application Data\Adobe\Acrobat\9.0\UserCache.bin
Creates FileC:\WINDOWS\ime\CHTIME\Applets\CHTSKF.DLL
Creates FileC:\WINDOWS\inf\dvd.PNF
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Games\Internet Checkers.lnk
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm4.exe
Creates FileC:\Program Files\Windows NT\Pinball\SOUND136.WAV
Creates FileC:\Program Files\Movie Maker\Shared\Profiles\Blank.txt
Creates FileC:\Program Files\Windows NT\Accessories\mswrd8.wpc
Creates FileC:\Program Files\Common Files\Microsoft Shared\TextConv\mswrd632.wpc
Creates FileC:\Documents and Settings\LocalService\Local Settings\History\desktop.ini
Creates FileC:\WINDOWS\inf\dot4.PNF
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst
Creates FileC:\WINDOWS\Help\Tours\htmlTour\best_secure_big.exe
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\PictureTasks\Howto\images\orderproj.gif
Creates FileC:\WINDOWS\Fonts\sserifet.fon
Creates FileC:\Program Files\Windows NT\Pinball\SOUND35.WAV
Creates FileC:\Program Files\Messenger\type.wav
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Accessibility\desktop.ini
Creates FileC:\WINDOWS\Help\isconcepts.chm
Creates FileC:\WINDOWS\Help\mstask.chm
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\630fc7aca28b144e871a74356406b36c\Microsoft.Build.Engine.ni.dll
Creates FileC:\Program Files\Movie Maker\WMM2AE.dll
Creates FileC:\WINDOWS\Fonts\app932.fon
Creates FileC:\WINDOWS\Help\nthelp.chm
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\phone.ver
Creates FileC:\WINDOWS\Cursors\sizenesw.exe
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\VDKHome\VDK10.SYX
Creates FileC:\WINDOWS\Cursors\3dgnesw.cur
Creates FileC:\WINDOWS\Fonts\ega80737.fon
Creates FileC:\WINDOWS\Fonts\UPCLB.TTF
Creates FileC:\Program Files\Windows NT\Pinball\Msvbvm60.dll
Creates FileC:\WINDOWS\Cursors\hourgla2.exe
Creates FileC:\WINDOWS\Fonts\micross.ttf
Creates FileC:\WINDOWS\Fonts\serifeg.fon
Creates FileC:\WINDOWS\Help\fde.hlp
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\Glacier.htm
Creates FileC:\Program Files\Movie Maker\Shared\Sample1.jpg
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\support.icw
Creates FileC:\WINDOWS\ime\imjp8_1\imjpuex.exe
Creates FileC:\Program Files\Windows NT\Pinball\SOUND560.WAV
Creates FileC:\WINDOWS\inf\igames.PNF
Creates FileC:\WINDOWS\Fonts\smallee.fon
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\4876393e4fb4c143883be71207327eb6\System.Drawing.Design.ni.dll
Creates FileC:\Program Files\MSN\MSNCoreFiles\Install\MSN9Components\Msvbvm60.dll
Creates FileC:\WINDOWS\Fonts\wingding.ttf
Creates FileC:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\a1138a1d023bdb47991eb08a7baeb041\System.DirectoryServices.Protocols.ni.dll
Creates FileC:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
Creates FileC:\WINDOWS\Cursors\harrow.cur
Creates FileC:\Documents and Settings\Administrator\Application Data\desktop.ini
Creates FileC:\WINDOWS\Cursors\3dgns.cur
Creates FileC:\WINDOWS\Fonts\vgafixt.fon
Creates FileC:\WINDOWS\inf\61883.PNF
Creates FileC:\Program Files\Common Files\System\ado\msader15.dll
Creates FileC:\Documents and Settings\Default User\Templates\lotus.wk4
Creates FileC:\Program Files\Common Files\System\ado\msado15.dll
Creates FileC:\Program Files\Common Files\System\ado\msadomd.dll
Creates FileC:\WINDOWS\Cursors\3dwarro.cur
Creates FileC:\WINDOWS\inf\cyclom-y.inf
Creates FileC:\WINDOWS\Fonts\arial.ttf
Creates FileC:\Program Files\Windows Media Player\Msvbvm60.dll
Creates FileC:\WINDOWS\Fonts\8514oemr.fon
Creates FileC:\WINDOWS\Help\agt0412.hlp
Creates FileC:\WINDOWS\Help\ntdef.chm
Creates FileC:\WINDOWS\inf\mdmcpq.PNF
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Music\desktop.ini
Creates FileC:\WINDOWS\inf\icam3.inf
Creates FileC:\WINDOWS\Fonts\tahomabd.ttf
Creates FileC:\WINDOWS\inf\MDMJF56E.INF
Creates FileC:\WINDOWS\inf\icminst.inf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\bluearrow.exe
Creates FileC:\WINDOWS\Help\Tours\htmlTour\connected_networks_big.exe
Creates FileC:\Documents and Settings\All Users\Application Data\desktop.ini
Creates FileC:\WINDOWS\Fonts\smallft.fon
Creates FileC:\WINDOWS\Fonts\vga932.fon
Creates FileC:\WINDOWS\Cursors\size2_l.cur
Creates FileC:\WINDOWS\Help\system.chm
Creates FileC:\Program Files\Windows NT\hypertrm.exe
Creates FileC:\Documents and Settings\Default User\Templates\amipro.sam
Creates FileC:\WINDOWS\Help\winsp.chm
Creates FileC:\WINDOWS\setupapi.log
Creates FileC:\Program Files\Movie Maker\moviemk.exe
Creates FileC:\WINDOWS\Help\Tours\mmTour\segment2.swf
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Btn\bktr.exe
Creates FileC:\WINDOWS\Fonts\app855.fon
Creates FileC:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\NEMJA1ZC\desktop.ini
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\drwtsn32.log
Creates FileC:\WINDOWS\Debug\NetSetup.LOG
Creates FileC:\Documents and Settings\Default User\Application Data\desktop.ini
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\CoolType.dll
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\AdobeARM.log
Creates FileC:\Program Files\Common Files\System\ado\msjro.dll
Creates FileC:\WINDOWS\inf\mdmati.PNF
Creates FileC:\WINDOWS\Cursors\hand.exe
Creates FileC:\WINDOWS\Fonts\vga936.fon
Creates FileC:\WINDOWS\Help\Tours\htmlTour\connected_data.htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe
Creates FileC:\Program Files\Common Files\System\ado\msado25.tlb
Creates FileC:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.DTD
Creates FileC:\WINDOWS\Help\spconcepts.chm
Creates FileC:\WINDOWS\Fonts\CORDIAI.TTF
Creates FileC:\WINDOWS\inf\ksfilter.inf
Creates FileC:\WINDOWS\inf\games.PNF
Creates FileC:\WINDOWS\Help\update1.chm
Creates FileC:\WINDOWS\inf\comnt5.PNF
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\Multimedia.api
Creates FileC:\Program Files\Common Files\System\wab32res.dll
Creates FileC:\WINDOWS\Cursors\3dwwe.cur
Creates FileC:\WINDOWS\inf\mdmaiwa4.PNF
Creates FileC:\WINDOWS\Help\taskmgr.chm
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
Creates FileC:\WINDOWS\Cursors\help_i.cur
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Communications\Network Connections.lnk
Creates FileC:\WINDOWS\Help\Tours\htmlTour\safe_easy_better.exe
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\3.gif
Creates FileC:\WINDOWS\Fonts\85s1256.fon
Creates FileC:\WINDOWS\inf\digiisdn.inf
Creates FileC:\Documents and Settings\NetworkService\Local Settings\desktop.ini
Creates FileC:\WINDOWS\inf\mdmaiwa3.inf
Creates FileC:\WINDOWS\Help\utilmgr.chm
Creates FileC:\WINDOWS\Help\localsec.hlp
Creates FileC:\WINDOWS\Help\compstui.hlp
Creates FileC:\Program Files\MSN Gaming Zone\Windows\chkrres.dll
Creates FileC:\WINDOWS\Help\camera.chm
Creates FileC:\WINDOWS\inf\mdmdgden.PNF
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\amaizrul.gif
Creates FileC:\Program Files\Movie Maker\WMM2FXA.dll
Creates FileC:\WINDOWS\Help\msoe.hlp
Creates FileC:\WINDOWS\inf\AER_3082.ADM
Creates FileC:\WINDOWS\Cursors\busy_im.cur
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0019E545\Plylst8.wpl
Creates FileC:\WINDOWS\Fonts\simpbdo.ttf
Creates FileC:\WINDOWS\inf\hal.PNF
Creates FileC:\WINDOWS\Fonts\ssef874.fon
Creates FileC:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Program Compatibility Wizard.lnk
Creates FileC:\WINDOWS\Cursors\wait_il.cur
Creates FileC:\WINDOWS\inf\mdmgl007.inf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\safe_easy_better_ghost.exe
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Entertainment\Volume Control.lnk
Creates FileC:\WINDOWS\Fonts\lucon.ttf
Creates FileC:\WINDOWS\Help\wordpad.chm
Creates FileC:\Program Files\Windows Media Player\mpvis.dll
Creates FileC:\WINDOWS\inf\mdmarch.PNF
Creates FileC:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileC:\WINDOWS\Cursors\size1_il.cur
Creates FileC:\WINDOWS\Help\calc.chm
Creates FileC:\WINDOWS\Help\clipbrd.chm
Creates FileC:\WINDOWS\Cursors\hibeam.cur
Creates FileC:\WINDOWS\inf\fsvga.inf
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Cnt\wmploc.js
Creates FileC:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfd.nlp
Creates FileC:\Documents and Settings\LocalService\Local Settings\desktop.ini
Creates FileC:\WINDOWS\Help\speech.chm
Creates FileC:\WINDOWS\Help\regedit.hlp
Creates FileC:\WINDOWS\Help\windows.hlp
Creates FileC:\WINDOWS\Help\PINTLPAD.CHM
Creates FileC:\WINDOWS\Help\tapi.chm
Creates FileC:\WINDOWS\Help\ddeshare.chm
Creates FileC:\Program Files\Common Files\System\msadc\handler.reg
Creates FileC:\WINDOWS\Help\saferconcepts.chm
Creates FileC:\WINDOWS\Fonts\shruti.ttf
Creates FileC:\WINDOWS\Help\mspaint.chm
Creates FileC:\WINDOWS\Cursors\beam_rm.cur
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp
Creates FileC:\WINDOWS\inf\mdm3com.PNF
Creates FileC:\WINDOWS\inf\hpdigwia.PNF
Creates FileC:\WINDOWS\inf\acpi.PNF
Creates FileC:\Program Files\Outlook Express\setup50.exe
Creates FileC:\WINDOWS\Help\sapicpl.hlp
Creates FileC:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bopomofo.nlp
Creates FileC:\WINDOWS\Help\agt0404.hlp
Creates FileC:\WINDOWS\comsetup.log
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Video\mdlib.wmv
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\VDKHome\ENU\VDK10.SYD
Creates FileC:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Notepad.lnk
Creates FileC:\WINDOWS\Fonts\cga80869.fon
Creates FileC:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IIQ3LGTM\desktop.ini
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\EScript.api
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\AGM.dll
Creates FileC:\WINDOWS\inf\avmisdn.PNF
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\bullet.gif
Creates FileC:\Program Files\Movie Maker\Shared\paint.png
Creates FileC:\WINDOWS\Cursors\appstar2.exe
Creates FileC:\Program Files\MSN Gaming Zone\Windows\Rvsezm.exe
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\trialoc.dll
Creates FileC:\WINDOWS\inf\mdmgl009.PNF
Creates FileC:\WINDOWS\Help\chkr.chm
Creates FileC:\WINDOWS\system.ini
Creates FileC:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Synchronize.lnk
Creates FileC:\WINDOWS\Help\agt0407.hlp
Creates FileC:\WINDOWS\inf\mdmati.inf
Creates FileC:\WINDOWS\inf\mdmcom1.inf
Creates FileC:\WINDOWS\Fonts\comicbd.ttf
Creates FileC:\WINDOWS\inf\bth.inf
Creates FileC:\WINDOWS\Fonts\h8514fix.fon
Creates FileC:\Program Files\Common Files\System\msadc\msdaprst.dll
Creates FileC:\WINDOWS\Help\Tours\htmlTour\nav_connected.exe
Creates FileC:\Program Files\MSN\MSNCoreFiles\OOBE\obepopc.dll
Creates FileC:\WINDOWS\tabletoc.log
Creates FileC:\WINDOWS\inf\mdminfot.PNF
Creates FileC:\WINDOWS\inf\mdmboca.inf
Creates FileC:\WINDOWS\Cursors\lwait.cur
Creates FileC:\WINDOWS\inf\mchgr.PNF
Creates FileC:\WINDOWS\inf\fdc.inf
Creates FileC:\Program Files\Windows Media Player\setup_wm.exe
Creates FileC:\WINDOWS\Fonts\serf1257.fon
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\8.gif
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\callout.gif
Creates FileC:\WINDOWS\CSC\00000002
Creates FileC:\WINDOWS\Fonts\dos737.fon
Creates FileC:\Program Files\Windows Media Player\npdrmv2.dll
Creates FileC:\WINDOWS\inf\icam3.PNF
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0019E545\Plylst14.wpl
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\notes.gif
Creates FileC:\WINDOWS\ime\imkr6_1\HELP\korpaden.chm
Creates FileC:\WINDOWS\inf\mdm3mini.inf
Creates FileC:\WINDOWS\inf\fdc.PNF
Creates FileC:\WINDOWS\inf\ctmaport.inf
Creates FileC:\WINDOWS\ime\CHTIME\Applets\CHTSKDIC.DLL
Creates FileC:\Program Files\Common Files\Services\verisign.bmp
Creates FileC:\WINDOWS\Help\adprop.hlp
Creates FileC:\Program Files\Common Files\SpeechEngines\Microsoft\Lexicon\1033\r1033tts.lxa
Creates FileC:\WINDOWS\Help\mpconcepts.chm
Creates FileC:\WINDOWS\Fonts\ANGSAB.TTF
Creates FileC:\WINDOWS\NOTEPAD.EXE
Creates FileC:\WINDOWS\Fonts\coue1256.fon
Creates FileC:\WINDOWS\Help\newfeat4.chm
Creates FileC:\WINDOWS\Help\wininstl.chm
Creates FileC:\WINDOWS\inf\mdmcdp.inf
Creates FileC:\WINDOWS\regedit.exe
Creates FileC:\WINDOWS\Help\datetime.chm
Creates FileC:\WINDOWS\inf\igames.inf
Creates FileC:\WINDOWS\Cursors\move_rm.cur
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\Search.api
Creates FileC:\WINDOWS\Help\Tours\htmlTour\connected_multiple_ghost.exe
Creates FileC:\WINDOWS\inf\irdasmc.inf
Creates FileC:\Program Files\Common Files\System\Ole DB\msdasql.dll
Creates FileC:\WINDOWS\Help\snmpsnap.hlp
Creates FileC:\WINDOWS\Debug\UserMode\userenv.log
Creates FileC:\WINDOWS\Help\Tours\htmlTour\best_secure.exe
Creates FileC:\WINDOWS\Help\Tours\htmlTour\gradient.exe
Creates FileC:\WINDOWS\inf\divasrv.inf
Creates FileC:\Program Files\Windows Media Player\custsat.dll
Creates FileC:\WINDOWS\ime\CHTIME\Applets\HWXCHT.DLL
Creates FileC:\WINDOWS\Help\soundrec.hlp
Creates FileC:\WINDOWS\Help\Tours\htmlTour\best_robust_ghost.exe
Creates FileC:\WINDOWS\Coffee Bean.exe
Creates FileC:\WINDOWS\Fonts\vgasyse.fon
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Btn\tpause.exe
Creates FileC:\Program Files\Internet Explorer\Connection Wizard\icwip.dun
Creates FileC:\WINDOWS\Fonts\coue1257.fon
Creates FileC:\WINDOWS\inf\intl.inf
Creates FileC:\WINDOWS\Help\agt0408.hlp
Creates FileC:\WINDOWS\Help\blurbs.chm
Creates FileC:\WINDOWS\inf\mdmexp.inf
Creates FileC:\WINDOWS\Help\acc_dis.chm
Creates FileC:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll
Creates FileC:\WINDOWS\Fonts\8514sysr.fon
Creates FileC:\Program Files\Common Files\System\msadc\msadco.dll
Creates FileC:\Documents and Settings\Administrator\Local Settings\desktop.ini
Creates FileC:\WINDOWS\inf\mdmbtmdm.inf
Creates FileC:\WINDOWS\inf\mdmgl004.inf
Creates FileC:\WINDOWS\inf\epsnscan.inf
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
Creates FileC:\WINDOWS\Fonts\vga855.fon
Creates FileC:\WINDOWS\Help\bnts.dll
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\install.bmp
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp
Creates FileC:\WINDOWS\Fonts\artrbdo.ttf
Creates FileC:\WINDOWS\inf\mdmar1.PNF
Creates FileC:\WINDOWS\inf\atiixpag.inf
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Backup.lnk
Creates FileC:\Documents and Settings\Administrator\Favorites\MSN.com.url
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\C_HelpGreenButton_Lg_N.gif
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0019E545\Plylst4.wpl
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\Utility Manager.lnk
Creates FileC:\Program Files\Windows NT\Pinball\SOUND18.WAV
Creates FileC:\WINDOWS\inf\cpu.PNF
Creates FileC:\WINDOWS\Help\telnet.hlp
Creates FileC:\WINDOWS\inf\cyzport.PNF
Creates FileC:\WINDOWS\Help\spider.hlp
Creates FileC:\WINDOWS\inf\mdmisdn.PNF
Creates FileC:\WINDOWS\Cursors\up_rm.cur
Creates FileC:\WINDOWS\Fonts\vgasyst.fon
Creates FileC:\WINDOWS\Help\omc.chm
Creates FileC:\WINDOWS\inf\mdmdgden.inf
Creates FileC:\Documents and Settings\LocalService\Cookies\index.dat
Creates FileC:\WINDOWS\Fonts\roman.fon
Creates FileC:\WINDOWS\ime\shared\imepaden.hlp
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\HLS.api
Creates FileC:\WINDOWS\inf\mdmaiwa5.inf
Creates FileC:\WINDOWS\ime\imjp8_1\cplexe.exe
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Creates FileC:\Program Files\Movie Maker\WMM2RES2.dll
Creates FileC:\WINDOWS\Fonts\vgasys.fon
Creates FileC:\WINDOWS\Fonts\ssee1257.fon
Creates FileC:\WINDOWS\inf\mdminfot.inf
Creates FileC:\WINDOWS\Help\tcpip.chm
Creates FileC:\WINDOWS\inf\mdmcdp.PNF
Creates FileC:\WINDOWS\inf\genprint.PNF
Creates FileC:\WINDOWS\Help\Tours\htmlTour\img109.exe
Creates FileC:\WINDOWS\inf\apps.inf
Creates FileC:\WINDOWS\Fonts\UPCJBI.TTF
Creates FileC:\WINDOWS\inf\epstw2k.PNF
Creates FileC:\WINDOWS\inf\mdmirmdm.inf
Creates FileC:\WINDOWS\Cursors\help_l.cur
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Setup Files\RdrBig709\ENU\Rdr70.itw
Creates FileC:\WINDOWS\ime\shared\imepadsv.exe
Creates FileC:\WINDOWS\Help\agt041f.hlp
Creates FileC:\Program Files\Windows NT\Pinball\SOUND105.WAV
Creates FileC:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfc.nlp
Creates FileC:\WINDOWS\Help\iexplore.hlp
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud3.exe
Creates FileC:\WINDOWS\Help\Tours\htmlTour\unlock_optimized.htm
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\WordPad.lnk
Creates FileC:\Documents and Settings\All Users\Start Menu\Windows Update.lnk
Creates FileC:\WINDOWS\Help\users.hlp
Creates FileC:\Program Files\Common Files\Microsoft Shared\MSInfo\IEFILES5.INF
Creates FileC:\Documents and Settings\Administrator\Application Data\Adobe\Acrobat\7.0\Updater\udlog.txt
Creates FileC:\Documents and Settings\Default User\Templates\excel4.xls
Creates FileC:\WINDOWS\Help\connect.cnt
Creates FileC:\WINDOWS\Cursors\metronom.exe
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.dll
Creates FileC:\WINDOWS\inf\digirp.inf
Creates FileC:\Program Files\MSN\MSNCoreFiles\OOBE\obemtllc.dll
Creates FileC:\WINDOWS\inf\brmfcwia.PNF
Creates FileC:\Program Files\Common Files\Microsoft Shared\DW\3082\DWINTL20.DLL
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\tourbg.exe
Creates FileC:\WINDOWS\Cursors\wait_m.cur
Creates FileC:\WINDOWS\inf\appmig.PNF
Creates FileC:\WINDOWS\Cursors\counter.exe
Creates FileC:\WINDOWS\inf\i81xnt5.PNF
Creates FileC:\Program Files\Common Files\System\msadc\msadce.dll
Creates FileC:\Program Files\Windows NT\Pinball\SOUND7.WAV
Creates FileC:\WINDOWS\ntdtcsetup.log
Creates FileC:\WINDOWS\inf\ccdecode.PNF
Creates FileC:\Program Files\NetMeeting\conf.exe
Creates FileC:\Program Files\Windows NT\Pinball\SOUND58.WAV
Creates FileC:\Program Files\Common Files\System\ado\msadox.dll
Creates FileC:\WINDOWS\Help\fxscover.chm
Creates FileC:\WINDOWS\Help\agt0409.hlp
Creates FileC:\WINDOWS\Fonts\UPCDB.TTF
Creates FileC:\WINDOWS\Help\misc.chm
Creates FileC:\WINDOWS\Cursors\cross_rm.cur
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\Msvbvm60.dll
Creates FileC:\WINDOWS\inf\mdmdcm5.inf
Creates FileC:\WINDOWS\Help\Tours\htmlTour\img072.exe
Creates FileC:\WINDOWS\inf\mdmgl001.inf
Creates FileC:\Program Files\Windows NT\Pinball\SOUND39.WAV
Creates FileC:\Program Files\Common Files\Microsoft Shared\TextConv\write32.wpc
Creates FileC:\WINDOWS\inf\AER_1025.ADM
Creates FileC:\WINDOWS\Cursors\size4_l.cur
Creates FileC:\WINDOWS\Help\lang.chm
Creates FileC:\WINDOWS\Help\packager.chm
Creates FileC:\WINDOWS\Help\msoe.chm
Creates FileC:\WINDOWS\Fonts\estre.ttf
Creates FileC:\WINDOWS\Cursors\arrow_l.cur
Creates FileC:\WINDOWS\inf\accessor.inf
Creates FileC:\Documents and Settings\NetworkService\ntuser.ini
Creates FileC:\WINDOWS\regopt.log
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_59R.wmdb
Creates FileC:\WINDOWS\Help\gen.chm
Creates FileC:\WINDOWS\Fonts\coue1255.fon
Creates FileC:\WINDOWS\inf\dshowext.PNF
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\VDKHome\VDK10.STD
Creates FileC:\WINDOWS\Help\comexp.hlp
Creates FileC:\WINDOWS\Cursors\busy_rl.cur
Creates FileC:\WINDOWS\Help\windows.chm
Creates FileC:\WINDOWS\inf\drm.PNF
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Playlists\0019E545\Plylst3.wpl
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_20130508_125854937-MSI_vc_red.msi.txt
Creates FileC:\WINDOWS\inf\g400.inf
Creates FileC:\WINDOWS\Help\compmgmt.chm
Creates FileC:\WINDOWS\Help\localsec.chm
Creates FileC:\WINDOWS\FeatherTexture.exe
Creates FileC:\WINDOWS\Help\printfnd.chm
Creates FileC:\WINDOWS\setuplog.txt
Creates FileC:\WINDOWS\inf\certclas.inf
Creates FileC:\WINDOWS\inf\mdmdf56F.PNF
Creates FileC:\WINDOWS\AE 0124 BE.gif
Creates FileC:\WINDOWS\Help\hrtz.chm
Creates FileC:\WINDOWS\Cursors\size4_im.cur
Creates FileC:\WINDOWS\inf\mdac.inf
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Btn\cloapp.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\1abf0d.msp
Creates FileC:\WINDOWS\Fonts\msdlg874.fon
Creates FileC:\WINDOWS\inf\mdmboca.PNF
Creates FileC:\WINDOWS\inf\mdmdgitn.inf
Creates FileC:\WINDOWS\Cursors\lmove.cur
Creates FileC:\Documents and Settings\LocalService\Application Data\Adobe\Acrobat\9.0\SharedDataEvents
Creates FileC:\WINDOWS\inf\comnt5.inf
Creates FileC:\WINDOWS\sessmgr.setup.log
Creates FileC:\WINDOWS\inf\iis.PNF
Creates FileC:\WINDOWS\ime\imjp8_1\imjpinst.exe
Creates FileC:\WINDOWS\inf\digiasyn.PNF
Creates FileC:\WINDOWS\Help\compfldr.chm
Creates FileC:\WINDOWS\explorer.scf
Creates FileC:\Program Files\Windows NT\Pinball\SOUND34.WAV
Creates FileC:\WINDOWS\ime\SOFTKBD.DLL
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\Messages\RdrMsgSplash.pdf
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\Annotations\Stamps\Words.pdf
Creates FileC:\Program Files\NetMeeting\cb32.exe
Creates FileC:\WINDOWS\inf\mdmelsa.PNF
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Services.lnk
Creates FileC:\WINDOWS\Fonts\CORDIAUB.TTF
Creates FileC:\WINDOWS\inf\mdmchipv.inf
Creates FileC:\Program Files\Windows NT\Pinball\PINBALL.EXE
Creates FileC:\WINDOWS\ime\imjp8_1\HELP\imjpcle.hlp
Creates FileC:\Program Files\Windows NT\Pinball\FONT.DAT
Creates FileC:\Documents and Settings\LocalService\Application Data\Adobe\Acrobat\9.0\AdobeCMapFnt09.lst
Creates FileC:\Program Files\Outlook Express\wab.exe
Creates FileC:\WINDOWS\inf\adm_port.PNF
Creates FileC:\Documents and Settings\LocalService\Application Data\Adobe\Acrobat\7.0\Updater\udlog.txt
Creates FileC:\WINDOWS\Cursors\no_rm.cur
Creates FileC:\WINDOWS\Fonts\wst_czec.fon
Creates FileC:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\KZY09SFE\desktop.ini
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\desktop.ini
Creates FileC:\WINDOWS\Fonts\sserifft.fon
Creates FileC:\Program Files\Windows NT\Pinball\SOUND8.WAV
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\VDKHome\ENU\VDK10.STC
Creates FileC:\Documents and Settings\Administrator\NetHood\shared on Samba 3.6.9-151.el6 (192.168.1.1)\Desktop.ini
Creates FileC:\WINDOWS\Fonts\UPCLI.TTF
Creates FileC:\Documents and Settings\All Users\Application Data\Adobe\Reader\9.3\ARM\BIT1D8.tmp
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins3d\3difr.x3d
Creates FileC:\WINDOWS\Help\Tours\htmlTour\best_fr.htm
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Remote Assistance.lnk
Creates FileC:\WINDOWS\ime\imjp8_1\imjprw.exe
Creates FileC:\WINDOWS\inf\i740nt5.inf
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp
Creates FileC:\WINDOWS\Cursors\vanisher.exe
Creates FileC:\WINDOWS\inf\ims.inf
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\bkgrnd_art.gif
Creates FileC:\WINDOWS\Fonts\courbi.ttf
Creates FileC:\Program Files\Outlook Express\msoe.dll
Creates FileC:\WINDOWS\wiaservc.log
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins3d\drvDX9.x3d
Creates FileC:\Program Files\Common Files\System\Ole DB\msdaps.dll
Creates FileC:\WINDOWS\Cursors\busy_r.cur
Creates FileC:\WINDOWS\Fonts\jvgafix.fon
Creates FileC:\Program Files\Common Files\Microsoft Shared\Stationery\tech.gif
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Communications\desktop.ini
Creates FileC:\WINDOWS\inf\dgaport.inf
Creates FileC:\WINDOWS\inf\bda.PNF
Creates FileC:\WINDOWS\Fonts\marlett.ttf
Creates FileC:\WINDOWS\Help\agt040d.hlp
Creates FileC:\WINDOWS\inf\kdk2x0.PNF
Creates FileC:\WINDOWS\Help\Tours\htmlTour\pen_icon.exe
Creates FileC:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfkc.nlp
Creates FileC:\WINDOWS\inf\acerscan.inf
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Entertainment\Sound Recorder.lnk
Creates FileC:\Program Files\Windows NT\Pinball\SOUND29.WAV
Creates FileC:\Program Files\Messenger\logowin.gif
Creates FileC:\WINDOWS\Cursors\hourglas.exe
Creates FileC:\WINDOWS\ime\imkr6_1\imkrinst.ini
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\HowTo\ENU\Images\rectangle.gif
Creates FileC:\Documents and Settings\Default User\Local Settings\desktop.ini
Creates FileC:\Documents and Settings\Default User\Templates\powerpnt.ppt
Creates FileC:\WINDOWS\Help\wab.chm
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp
Creates FileC:\WINDOWS\inf\mdmltleo.PNF
Creates FileC:\Program Files\Windows NT\Accessories\wordpad.exe
Creates FileC:\Program Files\Common Files\Microsoft Shared\TextConv\msconv97.dll
Creates FileC:\Documents and Settings\Administrator\My Documents\desktop.ini
Creates FileC:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
Creates FileC:\WINDOWS\Cursors\appstar3.exe
Creates FileC:\WINDOWS\Help\ntcmds.chm
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Btn\taoff.exe
Creates FileC:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\D4Z32ED8\desktop.ini
Creates FileC:\WINDOWS\Cursors\size2_rl.cur
Creates FileC:\WINDOWS\Help\rsop.chm
Creates FileC:\Program Files\MSN Gaming Zone\Windows\shvlzm.exe
Creates FileC:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Security Center.lnk
Creates FileC:\Documents and Settings\Default User\Start Menu\Programs\Remote Assistance.lnk
Creates FileC:\WINDOWS\Fonts\palabi.ttf
Creates FileC:\WINDOWS\Fonts\ariali.ttf
Creates FileC:\WINDOWS\Help\encrypt.chm
Creates FileC:\Program Files\Adobe\Acrobat 7.0\Reader\plug_ins\Soap.api
Creates FileC:\WINDOWS\Fonts\sere1255.fon
Creates FileC:\WINDOWS\ime\imkr6_1\HELP\imkr61.chm
Creates FileC:\WINDOWS\Help\Tours\WindowsMediaPlayer\Img\Btn\taonh.exe
Creates Process"rundll32.exe" C:\WINDOWS\system32\shimgvw.dll,ImageView_Fullscreen C:\WINDOWS\AE 0124 BE.gif

Process
↳ "rundll32.exe" C:\WINDOWS\system32\shimgvw.dll,ImageView_Fullscreen C:\WINDOWS\AE 0124 BE.gif

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellImageView\Bounds ➝
NULL

Process
↳ C:\WINDOWS\system32\drivers\winlogon.exe

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\WINDOWS\system32\drivers\Msvbvm60.dll
Creates FileC:\Autorun.inf
Creates FileC:\Autorun.inf
Creates FileC:\Msvbvm60.dll
Creates FileC:\FOUND.006.exe
Creates FileC:\WINDOWS\AE 0124 BE.exe
Creates FilePIPE\wkssvc
Creates FileC:\FOUND.006.exe
Creates Filec:\B1uv3nth3x1.diz
Creates Process"C:\WINDOWS\AE 0124 BE.exe"

Process
↳ "C:\WINDOWS\AE 0124 BE.exe"

Network Details:


Raw Pcap

Strings