Trojan.MulDrop8.34929

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\USBSafelyRemoveService] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\USBSafelyRemoveService] 'ImagePath' = '"%ProgramFiles%\USB Safely Remove\USBSRService.exe"'

Malicious functions:

Executes the following:

'<SYSTEM32>\taskkill.exe' /F /IM USBSafelyRemove.exe

Modifies file system:

Creates the following files:

%TEMP%\1.tmp\2.bat
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-2LCGO.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-85284.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-G0HNB.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-MDL6L.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-VCT3H.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-3LT51.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-BS02R.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-FM476.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-1QC96.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-RBTGC.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-FM86K.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-71CH2.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-IHKDG.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-RECAU.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-SDV4U.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-OMM10.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-FBL07.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-70NHF.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-E4IHV.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-2E97P.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-IAGL1.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-FQBOL.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-L09H1.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-7TLA4.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-DMB3P.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-9J6HB.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-VVVNC.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-SOM0P.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-PMC2B.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-0AI6N.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-N9KIU.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-6A793.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-U72IJ.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-BT6R0.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-OTK9S.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-LH48I.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-J5R77.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-GQPQR.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-U8M07.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-PIQB7.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-6LDJG.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-1B9J8.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-R3814.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-N74IO.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-1BH88.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-MRE5S.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-43785.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-04D8D.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-46QLB.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-PO1OH.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-VH8PL.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-7IG3H.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-JKHA2.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-97EKV.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-P3TUQ.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-031G8.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-JQE8L.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-R3T8T.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-G7S9H.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-KA38R.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-P19IM.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-77264.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-9D6SL.tmp
%ProgramFiles%\USB Safely Remove\Skins\Classic\is-LDD05.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-S3E67.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-IVCQN.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-TNPOH.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-5I2JB.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-EOP2J.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-NLTV4.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-JA4V3.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-SKOL3.tmp
%ProgramFiles%\USB Safely Remove\is-I3MIC.tmp
%ProgramFiles%\USB Safely Remove\is-U6TH2.tmp
%ProgramFiles%\USB Safely Remove\is-05V7M.tmp
%ProgramFiles%\USB Safely Remove\is-LHAB4.tmp
%ProgramFiles%\USB Safely Remove\is-IKMNG.tmp
%ProgramFiles%\USB Safely Remove\is-3U4TK.tmp
%ProgramFiles%\USB Safely Remove\is-LO55G.tmp
%ProgramFiles%\USB Safely Remove\is-E1CR5.tmp
%ProgramFiles%\USB Safely Remove\is-S9REM.tmp
%ProgramFiles%\USB Safely Remove\is-0VM78.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-SOG31.tmp
%ProgramFiles%\USB Safely Remove\is-16LEU.tmp
%ProgramFiles%\USB Safely Remove\is-HD78M.tmp
%HOMEPATH%\Start Menu\Programs\USB Safely Remove\USB Safely Remove.lnk
%HOMEPATH%\Start Menu\Programs\USB Safely Remove\USB Safely Remove Help.lnk
%HOMEPATH%\Start Menu\Programs\USB Safely Remove\Readme\How to Order.lnk
%HOMEPATH%\Start Menu\Programs\USB Safely Remove\Readme\Readme.lnk
\\Device\\HarddiskVolume1\\Documents and Settings\\%USERNAME%\\Start Menu\\Programs\\USB Safely Remove\\Readme\\What\'s New.lnk
\\Device\\HarddiskVolume1\\Muldrop\\Wibu\'t Nfx.mol_0
%HOMEPATH%\Start Menu\Programs\USB Safely Remove\USB Safely Remove on the Web.lnk
%HOMEPATH%\Start Menu\Programs\USB Safely Remove\Uninstall USB Safely Remove.lnk
%HOMEPATH%\Desktop\USB Safely Remove.lnk
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\USB Safely Remove.lnk
%ProgramFiles%\USB Safely Remove\SafelyRemove.url
%ProgramFiles%\USB Safely Remove\unins000.dat
%ProgramFiles%\USB Safely Remove\Languages\is-BMGGU.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-I52TB.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-MS9S3.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-7LI99.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-CG51T.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-LTQM1.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-PJ0KR.tmp
%ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-AJ7I4.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-PEVKQ.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-ENBJI.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-8EH3F.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-Q3529.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-35B8K.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-NBU5H.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-3S88C.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-9KSHP.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-RMJ92.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-TG36N.tmp
%APPDATA%\USBSRService\USBSRService.log.txt
%ProgramFiles%\USB Safely Remove\Languages\is-16543.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-T6O5S.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-FVL5R.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-JCBFV.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-JETLN.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-96DIR.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-PPE5M.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-6LEA5.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-G08VN.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-ONO7N.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-GNTT0.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-1419K.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-Q2TK0.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-4SC07.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-TMVMF.tmp
%ProgramFiles%\USB Safely Remove\Languages\is-SAMVC.tmp
%ProgramFiles%\USB Safely Remove\is-F6LKI.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-H2N9C.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-50DD3.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-2MDQ3.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-PL4B5.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-I3EBO.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-1676S.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-NSD7R.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-OM4AS.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-4ISHC.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-NEL61.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-2HMIH.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-P74BC.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-BJJAQ.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-E3OOA.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-A60CU.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-K5KFD.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-M1DAC.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-LN15F.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-KGETP.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-2NC9L.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-TR207.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-RM4P9.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-2P9VR.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-K50EU.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-V171L.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-B5V3G.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-K0J1S.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-1H940.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-CGR1U.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-J6ENQ.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-05IP6.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-4J8N4.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-6KHIE.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-JQPAI.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-FVUN1.tmp
%TEMP%\1.tmp\usbsafelyremovesetup_6-1-2.exe
%TEMP%\1.tmp\X86\USBSafelyRemove.exe
%TEMP%\1.tmp\X64\USBSafelyRemove.exe
%TEMP%\is-1NEH3.tmp\usbsafelyremovesetup_6-1-2.tmp
%TEMP%\is-N2BMH.tmp\_isetup\_shfoldr.dll
%ProgramFiles%\USB Safely Remove\is-EOR4Q.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-CPN5I.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-4HL7H.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-NHD8H.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-GNM1R.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-QOT5K.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-TLGIS.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-DN8OC.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-1HR6I.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-FPNCR.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-K8T40.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-MHLQP.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-2DUJ1.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-O6S9L.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-C2ICT.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-A2GOG.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-4GVQN.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-2J7F2.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-JH332.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-KQ0EA.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-8NRAQ.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-0FIEF.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-LG1B0.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-VLSCV.tmp
%TEMP%\1.tmp\1.reg
%ProgramFiles%\USB Safely Remove\DeviceImages\is-658UP.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-9GJMI.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-MLP5P.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-HFJE2.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-AG855.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-555M0.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-B1P3C.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-OM14K.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-MRK21.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-5OG9C.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-U9PJB.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-KHSVC.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-0KTUO.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-KJRBT.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-QLGV0.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-BQHKK.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-F14G1.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-KSO5B.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-NNU65.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-CTCLS.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-T1QUL.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-LRV1D.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-9Q0OD.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-FAJPM.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-GNF7B.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-C8DFR.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-PSMFL.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-CT3OV.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-4OFQR.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-8R44E.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-PH9LK.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-FMDHQ.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-UDHTU.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-BS4MT.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-7N36L.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-0SB0T.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-3SESD.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-8MDJU.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-JKP4O.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-EO9OD.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-2495U.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-9NC1U.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-JAV74.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-7IUV8.tmp
%ProgramFiles%\USB Safely Remove\DeviceImages\is-3V5F6.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-OGKJ6.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-7AHCE.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-45V4S.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-EJ129.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-PJ45J.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-H5R7F.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-MNS70.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-VFR11.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-IDA7C.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-8G5UU.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-H7S7D.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-FV1CU.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-DPGGR.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-PFEDK.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-K67BQ.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-GRTA0.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-8AH55.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-KAR28.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-HTLU0.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-54IRS.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-VDSHK.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-36HVJ.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-HTUBM.tmp
%ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-85JE0.tmp
C:\Documents and Settings\LocalService\Application Data\USBSRService\USBSRService.log.txt

Deletes the following files:

%TEMP%\is-N2BMH.tmp\_isetup\_shfoldr.dll
%TEMP%\is-1NEH3.tmp\usbsafelyremovesetup_6-1-2.tmp

Moves the following files:

from %ProgramFiles%\USB Safely Remove\is-EOR4Q.tmp to %ProgramFiles%\USB Safely Remove\unins000.exe
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-77264.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\return_drive_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-U72IJ.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\return_drive_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-6A793.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\stop_all_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-N9KIU.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\stop_all_interrupt_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-PMC2B.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\stop_all_interrupt_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-0AI6N.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\stop_all_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-2LCGO.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\update_hardware_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-85284.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\update_hardware_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-G0HNB.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\warning_letter_sign.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-MDL6L.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\browse_drive_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-VCT3H.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\browse_drive_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-3LT51.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\close_balloon_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-BS02R.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\close_balloon_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-FM476.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\close_hidden_device_list_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-1QC96.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\close_hidden_device_list_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-RBTGC.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\close_info_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-FM86K.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\close_info_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-71CH2.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\close_menu_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-IHKDG.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\close_menu_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-SDV4U.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\colorscheme.ini
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-04D8D.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\drive.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-OMM10.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\eject_drive_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-FBL07.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\eject_drive_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-70NHF.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\fixed_letter_sign.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-E4IHV.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\hot_key.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-2E97P.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\open_hidden_device_list_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-IAGL1.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\open_hidden_device_list_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-P19IM.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\reg_key_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-VFR11.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\return_drive_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-KA38R.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\reg_key_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-R3T8T.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\quick_launch_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-H2N9C.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\stop_all_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-SOG31.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\stop_all_interrupt_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-9D6SL.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\stop_all_interrupt_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-BT6R0.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\stop_all_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-OTK9S.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\update_hardware_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-LH48I.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\update_hardware_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-J5R77.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\warning_letter_sign.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-GQPQR.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\browse_drive_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-U8M07.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\browse_drive_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-PIQB7.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\close_balloon_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-6LDJG.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\close_balloon_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-1B9J8.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\close_hidden_device_list_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-R3814.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\close_hidden_device_list_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-N74IO.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\close_info_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-1BH88.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\close_info_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-MRE5S.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\close_menu_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-46QLB.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\close_menu_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-RECAU.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\colorscheme.ini
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-LDD05.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\drive.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-PO1OH.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\eject_drive_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-VH8PL.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\eject_drive_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-7IG3H.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\fixed_letter_sign.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-JKHA2.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\hot_key.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-97EKV.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\open_hidden_device_list_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-P3TUQ.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\open_hidden_device_list_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-031G8.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\options_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-JQE8L.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\options_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Classic\is-G7S9H.tmp to %ProgramFiles%\USB Safely Remove\Skins\Classic\quick_launch_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-CTCLS.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\return_drive_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-FQBOL.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\options_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-9J6HB.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\reg_key_active.png
from %ProgramFiles%\USB Safely Remove\Languages\is-ONO7N.tmp to %ProgramFiles%\USB Safely Remove\Languages\Korean.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-GNTT0.tmp to %ProgramFiles%\USB Safely Remove\Languages\Latvian.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-1419K.tmp to %ProgramFiles%\USB Safely Remove\Languages\Lithuanian.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-Q2TK0.tmp to %ProgramFiles%\USB Safely Remove\Languages\Macedonian.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-4SC07.tmp to %ProgramFiles%\USB Safely Remove\Languages\Polish.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-TMVMF.tmp to %ProgramFiles%\USB Safely Remove\Languages\Portuguese-Brazilian.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-16543.tmp to %ProgramFiles%\USB Safely Remove\Languages\Romanian.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-SAMVC.tmp to %ProgramFiles%\USB Safely Remove\Languages\Russian.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-MS9S3.tmp to %ProgramFiles%\USB Safely Remove\Languages\Serbian-Cyrillic.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-BMGGU.tmp to %ProgramFiles%\USB Safely Remove\Languages\Serbian-Latin.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-5I2JB.tmp to %ProgramFiles%\USB Safely Remove\Languages\Slovenian.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-EOP2J.tmp to %ProgramFiles%\USB Safely Remove\Languages\Spanish.lng
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-8G5UU.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\close_menu_passive.png
from %ProgramFiles%\USB Safely Remove\Languages\is-NLTV4.tmp to %ProgramFiles%\USB Safely Remove\Languages\Swedish.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-SKOL3.tmp to %ProgramFiles%\USB Safely Remove\Languages\Ukrainian.lng
from %ProgramFiles%\USB Safely Remove\is-I3MIC.tmp to %ProgramFiles%\USB Safely Remove\USRFindHandle.sys
from %ProgramFiles%\USB Safely Remove\is-U6TH2.tmp to %ProgramFiles%\USB Safely Remove\USBSRService.exe
from %ProgramFiles%\USB Safely Remove\is-05V7M.tmp to %ProgramFiles%\USB Safely Remove\USBSafelyRemove.exe
from %ProgramFiles%\USB Safely Remove\is-LHAB4.tmp to %ProgramFiles%\USB Safely Remove\usr.exe
from %ProgramFiles%\USB Safely Remove\is-IKMNG.tmp to %ProgramFiles%\USB Safely Remove\installnotes.rtf
from %ProgramFiles%\USB Safely Remove\is-3U4TK.tmp to %ProgramFiles%\USB Safely Remove\History.txt
from %ProgramFiles%\USB Safely Remove\is-LO55G.tmp to %ProgramFiles%\USB Safely Remove\License.txt
from %ProgramFiles%\USB Safely Remove\is-E1CR5.tmp to %ProgramFiles%\USB Safely Remove\Order.txt
from %ProgramFiles%\USB Safely Remove\is-S9REM.tmp to %ProgramFiles%\USB Safely Remove\Readme.txt
from %ProgramFiles%\USB Safely Remove\is-F6LKI.tmp to %ProgramFiles%\USB Safely Remove\RestoreSettings.bat
from %ProgramFiles%\USB Safely Remove\is-0VM78.tmp to %ProgramFiles%\USB Safely Remove\SaveSettings.bat
from %ProgramFiles%\USB Safely Remove\Languages\is-6LEA5.tmp to %ProgramFiles%\USB Safely Remove\Languages\Indonesian.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-G08VN.tmp to %ProgramFiles%\USB Safely Remove\Languages\Italian.lng
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-7TLA4.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\quick_launch_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-L09H1.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\options_passive.png
from %ProgramFiles%\USB Safely Remove\Languages\is-JETLN.tmp to %ProgramFiles%\USB Safely Remove\Languages\Greek.lng
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-VVVNC.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\reg_key_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-SOM0P.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\return_drive_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-43785.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\return_drive_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-S3E67.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\stop_all_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-IVCQN.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\stop_all_interrupt_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-TNPOH.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\stop_all_interrupt_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-CG51T.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\stop_all_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-LTQM1.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\update_hardware_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-PJ0KR.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\update_hardware_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-AJ7I4.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\warning_letter_sign.png
from %ProgramFiles%\USB Safely Remove\Languages\is-PEVKQ.tmp to %ProgramFiles%\USB Safely Remove\Languages\Arabic.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-ENBJI.tmp to %ProgramFiles%\USB Safely Remove\Languages\Bulgarian.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-8EH3F.tmp to %ProgramFiles%\USB Safely Remove\Languages\Catalan.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-Q3529.tmp to %ProgramFiles%\USB Safely Remove\Languages\Chinese-Simplified.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-35B8K.tmp to %ProgramFiles%\USB Safely Remove\Languages\Chinese-Traditional.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-NBU5H.tmp to %ProgramFiles%\USB Safely Remove\Languages\Croatian.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-3S88C.tmp to %ProgramFiles%\USB Safely Remove\Languages\Czech.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-9KSHP.tmp to %ProgramFiles%\USB Safely Remove\Languages\Danish.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-RMJ92.tmp to %ProgramFiles%\USB Safely Remove\Languages\Dutch-Belgium.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-TG36N.tmp to %ProgramFiles%\USB Safely Remove\Languages\Dutch-Netherlands.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-7LI99.tmp to %ProgramFiles%\USB Safely Remove\Languages\English-proof.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-I52TB.tmp to %ProgramFiles%\USB Safely Remove\Languages\Estonian.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-T6O5S.tmp to %ProgramFiles%\USB Safely Remove\Languages\French.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-FVL5R.tmp to %ProgramFiles%\USB Safely Remove\Languages\Galician.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-JCBFV.tmp to %ProgramFiles%\USB Safely Remove\Languages\German.lng
from %ProgramFiles%\USB Safely Remove\Languages\is-96DIR.tmp to %ProgramFiles%\USB Safely Remove\Languages\Hebrew.lng
from %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\is-DMB3P.tmp to %ProgramFiles%\USB Safely Remove\Skins\Win8ModernUI\quick_launch_passive.png
from %ProgramFiles%\USB Safely Remove\Languages\is-PPE5M.tmp to %ProgramFiles%\USB Safely Remove\Languages\Hungarian.lng
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-BS4MT.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\reg_key_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-UDHTU.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\reg_key_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-FMDHQ.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\quick_launch_passive.png
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-NSD7R.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\HDD SATA.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-OM4AS.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\HDD SCSI.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-4ISHC.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\HDD USB (white).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-NEL61.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\HDD USB.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-2HMIH.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\HDD.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-P74BC.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Headphones.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-BJJAQ.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\iPod.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-E3OOA.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Joypad.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-A60CU.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Joystick.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-M1DAC.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Keyboard.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-FPNCR.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Loudspeaker.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-LN15F.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Memory card CF.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-KGETP.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Memory card MS.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-2NC9L.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Memory card SD.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-TR207.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Memory card XD.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-RM4P9.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Microphone.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-2P9VR.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Mobile phone.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-K50EU.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Modem.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-V171L.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Mouse.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-B5V3G.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\MP3 player.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-K0J1S.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\PCI-card.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-1H940.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\PDA.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-CGR1U.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Printer.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-J6ENQ.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Radio.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-1HR6I.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\RemoteControl.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-9GJMI.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Scanner.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-I3EBO.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\HDD 2.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-MLP5P.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\SCSI logo.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-PL4B5.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\HDD (yellow).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-4J8N4.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\HDD (blue).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-CPN5I.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Battery.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-4HL7H.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Bluetooth.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-NHD8H.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Camera.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-GNM1R.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Card reader (black).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-QOT5K.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Card reader (green).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-TLGIS.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Card reader (red).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-DN8OC.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Card reader.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-K8T40.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\CD-DVD player.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-K5KFD.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Fingerprint.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-658UP.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Flash drive (black).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-MHLQP.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Flash drive (gray).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-2DUJ1.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Flash drive (green).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-O6S9L.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Flash drive (light).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-C2ICT.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Flash drive (orange).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-A2GOG.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Flash drive (pink).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-4GVQN.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Flash drive (white).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-2J7F2.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Flash drive (wine).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-JH332.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Flash drive 2 (black).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-KQ0EA.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Flash drive 2 (gray).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-8NRAQ.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Flash drive 2 (green).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-0FIEF.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Flash drive 2 (light).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-LG1B0.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Flash drive 2 (pink).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-VLSCV.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Flash drive 2 (wine).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-FVUN1.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Flash drive 2.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-JQPAI.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Flash drive.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-6KHIE.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Graphics-tablet.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-05IP6.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\HDD (black).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-2MDQ3.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\HDD (red).ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-HFJE2.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Smartcard.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-1676S.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\HDD Firewire.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-JKP4O.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\TV-tuner.ico
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-AG855.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\stop_all_interrupt_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-B1P3C.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\stop_all_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-OM14K.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\update_hardware_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-MRK21.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\update_hardware_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-5OG9C.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\warning_letter_sign.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-U9PJB.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\browse_drive_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-KHSVC.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\browse_drive_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-0KTUO.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\close_balloon_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-KJRBT.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\close_balloon_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-QLGV0.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\close_hidden_device_list_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-BQHKK.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\close_hidden_device_list_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-F14G1.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\close_info_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-KSO5B.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\close_info_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-50DD3.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\close_menu_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-NNU65.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\close_menu_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-T1QUL.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\colorscheme.ini
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-LRV1D.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\drive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-9Q0OD.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\eject_drive_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-FAJPM.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\eject_drive_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-GNF7B.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\fixed_letter_sign.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-C8DFR.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\hot_key.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-PSMFL.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\open_hidden_device_list_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-CT3OV.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\open_hidden_device_list_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-4OFQR.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\options_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-8R44E.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\options_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\is-PH9LK.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Velvet\quick_launch_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-7N36L.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\stop_all_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-85JE0.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\return_drive_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-555M0.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\stop_all_interrupt_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-3SESD.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\return_drive_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-IDA7C.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\reg_key_passive.png
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-EO9OD.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\UPS.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-9NC1U.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\USB logo.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-JAV74.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\USB wireless.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-7IUV8.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Webcam.ico
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-3V5F6.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\Wi-Fi logo.ico
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-OGKJ6.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\browse_drive_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-7AHCE.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\browse_drive_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-45V4S.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\close_balloon_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-EJ129.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\close_balloon_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-PJ45J.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\close_hidden_device_list_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-H5R7F.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\close_hidden_device_list_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-MNS70.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\close_info_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-8MDJU.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\close_info_passive.png
from %ProgramFiles%\USB Safely Remove\is-16LEU.tmp to %ProgramFiles%\USB Safely Remove\USBSafelyRemove.chm
from %ProgramFiles%\USB Safely Remove\Languages\is-JA4V3.tmp to %ProgramFiles%\USB Safely Remove\Languages\Turkish.lng
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-0SB0T.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\close_menu_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-FV1CU.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\drive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-DPGGR.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\eject_drive_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-PFEDK.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\eject_drive_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-K67BQ.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\fixed_letter_sign.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-GRTA0.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\hot_key.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-8AH55.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\open_hidden_device_list_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-KAR28.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\open_hidden_device_list_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-HTLU0.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\options_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-54IRS.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\options_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-VDSHK.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\quick_launch_active.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-36HVJ.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\quick_launch_passive.png
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-HTUBM.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\reg_key_active.png
from %ProgramFiles%\USB Safely Remove\DeviceImages\is-2495U.tmp to %ProgramFiles%\USB Safely Remove\DeviceImages\USB device.ico
from %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\is-H7S7D.tmp to %ProgramFiles%\USB Safely Remove\Skins\Black Contrast\colorscheme.ini
from %ProgramFiles%\USB Safely Remove\is-HD78M.tmp to %ProgramFiles%\USB Safely Remove\USBSafelyRemoveRu.chm

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: ''

Creates and executes the following:

'%TEMP%\1.tmp\usbsafelyremovesetup_6-1-2.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-1NEH3.tmp\usbsafelyremovesetup_6-1-2.tmp' /SL5="$200E0,5274606,78848,%TEMP%\1.tmp\usbsafelyremovesetup_6-1-2.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%ProgramFiles%\USB Safely Remove\USBSRService.exe' /install /silent
'%ProgramFiles%\USB Safely Remove\USBSRService.exe'

Executes the following:

'<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\2.bat" <Full path to file>"

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней