AntiVermins Removal - How to Remove AntiVermins
December 18, 2006 file found under AntiVermins
AntiVermins is an anti-spyware program that secretly installs a trojan onto your computer and displays false security notifications in attempt to get you to buy their software.
You may be infected with AntiVermins, if you detect C:\Program Files\AntiVermins\AntiVermins.exe on your computer.
Remove AntiVermins
Choose AntiVermins removal procedure:
- AntiVermins Automatic Removal, click here. (Fast & Easy.)
- AntiVermins Manual Removal, click here. (Some technical skills required.)
AntiVermins Image
AntiVermins Manual Removal Instructions
Note: This manual removal process can be difficult. To avoid unnecessary risk of destroying your computer, use this automatic check to detect and remove AntiVermins.
Detect and remove these AntiVermins processes:
AntiVerminsPro.exe
av_setup_v2_1[1].exe
antivermins.exe
Delete these AntiVermins DLL files:
msvcp71.dll
msvcr71.dll
hjpprpu.dll
cvnzie.dll
kuhmk.dll
Remove these AntiVermins registry values:
HKEY_CLASSES_ROOT\clsid\{663de629-4ffd-a944-6f0a-64f98e925b62}
HKEY_CLASSES_ROOT\interface\{0be87caf-1c8e-43c7-a476-5af1a2f5a43f}
HKEY_CLASSES_ROOT\interface\{0cd726ec-f1f5-4210-9011-ee6b5332a279}
HKEY_CLASSES_ROOT\interface\{1efd4366-6676-4af7-a88a-872a49e2601d}
HKEY_CLASSES_ROOT\interface\{3b3fa480-138e-47e6-b79a-9a0f7b2846d5}
HKEY_CLASSES_ROOT\interface\{3e186ce2-1abb-45d6-a4b9-4fcd11fbb014}
HKEY_CLASSES_ROOT\interface\{4af8e04f-0d5e-4c3f-ba67-81b685584c12}
HKEY_CLASSES_ROOT\interface\{6c80c5b2-4748-411c-8120-09426f8ed212}
HKEY_CLASSES_ROOT\interface\{748c9204-6c92-485b-8bf8-3af7ecf03cde}
HKEY_CLASSES_ROOT\interface\{b6a0aa8a-7cb1-44f0-ace7-7a69739c8674}
HKEY_CLASSES_ROOT\interface\{c27d97e9-004b-4f4f-a5b0-b7188ddae024}
HKEY_CLASSES_ROOT\interface\{c3176a2c-3119-4f7f-b847-62b5ee6763e5}
HKEY_CLASSES_ROOT\interface\{cac16e1a-d86b-428a-bb7b-65f2d2bfc160}
HKEY_CLASSES_ROOT\interface\{dd369501-ede4-4e99-8728-7c9e4bbe6be8}
HKEY_CLASSES_ROOT\interface\{eac1accd-7790-4991-a9d2-550806d6d9c3}
HKEY_CLASSES_ROOT\interface\{ef2aa606-b72e-4a1b-b076-8b148661f3b7}
HKEY_CLASSES_ROOT\interface\{f9476885-40eb-4405-878a-193baf18ce9b}
HKEY_CLASSES_ROOT\typelib\{13693777-5b9d-4afc-99f1-650f569a0eb0}
HKEY_LOCAL_MACHINE\software\antivermins
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\antivermins.exe
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run antivermins
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\antivermins
Detect and remove these AntiVermins files:
AntiVerminsPro 2.1.lnk
AntiVerminsPro.lnk
AntiVerminsPro 2.1 Website.lnk
Uninstall AntiVerminsPro 2.1.lnk
External Links:
http://en.wikipedia.org/wiki/Spyware
http://www.antispywarecoalition.org
Mirar Removal - How to Remove Mirar
August 07, 2006 file found under Mirar
Mirar is a Browser Helper Object (BHO) that adds to the web browser as an Internet Explorer toolbar. Mirar creates targeted pop-up ads based on visited URLs and search terms used. While you surf the web, Mirar Toolbar collects data in an attempt to display affiliate Web pages that are related to the Web page currently being viewed. Mirar is also known as GetMirar, www.getmirar.com. This program is currently offering an uninstaller.
You may be infected with Mirar, if you detect C:\Windows\mirar\mirarsetup.exe. on your computer.
Remove Mirar
Choose Mirar removal procedure:
- Mirar Automatic Removal (Fast & Easy.)
- Mirar Manual Removal (Some technical skills required.)
Mirar Image
Mirar Manual Removal Instructions
Note: This manual removal process can be difficult. To avoid unnecessary risk of destroying your computer, use this automatic check to detect and remove Mirar.
Detect and delete these Mirar processes:
mirarsetup.exe
875455-NOSB.exe
Remove these Mirar DLL files:
winnb[X].dll
winnb40.dll
winnb41.dll
windmy.dll
nn_bar.dll
nn_bar21.dll
nn_bar22.dll
nn_bar31.dll
Remove these Mirar registry values:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunToolbarInstall=mirarsetup.exe
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDLLsC:WindowsDownloadedProgramFilesmirarsetup.exe
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDLLsC:WindowsSystem32windmy.dll
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionModuleUsageC:/Windows/DownloadedProgramFiles/mirarsetup.exe
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionModuleUsageC:/Windows/System32/windmy.dll
9A9C9B68-F908-4AAB-8D0C-10EA8997F37E
HKEY_LOCAL_MACHINESOFTWAREClassesNN_Bar.NN_Bar_Helper
HKEY_LOCAL_MACHINESOFTWAREClassesNN_Bar.NN_Bar_Helper.1
HKEY_LOCAL_MACHINESOFTWAREClassesNN_Bar.NN_WebBand
HKEY_LOCAL_MACHINESOFTWAREClassesNN_Bar.NN_WebBand.1
HKEY_LOCAL_MACHINESOFTWAREClassesNN_Bar_Dummy.NN_BarDummy
HKEY_LOCAL_MACHINESOFTWAREClassesNN_Bar_Dummy.NN_BarDummy.1
179E4B4A-76C3-4F65-BCED-C9FA1A28D2EF
8A0DCBDA-6E20-489C-9041-C1E8A0352E75
1037B06C-84B7-4240-8D80-485810A0497D
224302B0-94E9-45C2-9E5B-BA989EE556E1
54B287F9-FD90-4457-B65E-CB91560C021D
6E4C7AFC-9915-4036-B7F9-8B3F1710788F
566DEDE9-9ED8-45DA-9BE6-9B2EEAB17F49
F8310E7D-4C4D-46A4-A068-B5BB99411CC7
4035DE1B-D54A-411E-9EE7-923295D2E86E
753B9349-7E46-4E5C-A27F-A60A6BF1EAB5
9A9C9B69-F908-4AAB-8D0C-10EA8997F37E
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInternetSettingsoneMapDomains
et-nucleus.com
Detect and remove these Mirar files:
mit3.tmp
mit3.tmp.cab
Mirar Variants:
Mirar Virus, Mirar Spyware,
Mirar Adware, Mirar Toolbar,
Mirar Tolbar, Mirar Tool Bar,
Adware.Mirar, GetMirar.
SpyHeal Removal - How to Remove SpyHeal
July 26, 2006 file found under SpyHeal
SpyHeal, the latest version of SpywareQuake, is a rogue anti-spyware program that secretly installs a trojan onto your computer and pops up false security notifications in attempt to get you to buy the SpyHeal software.
You may be infected with Spy Heal, if you detect C:\Windows\spyheal\spyheal.exe. on your computer.
Remove Spy Heal
Choose Spy Heal removal procedure:
- SpyHeal Automatic Removal (Fast & Easy.)
- SpyHeal Manual Removal (Some technical skills required.)
SpyHeal Image
SpyHeal Manual Removal Instructions
Note: This manual removal process can be difficult. To avoid unnecessary risk of destroying your computer, use this automatic check to detect and remove SpyHeal.
Detect and delete these Spy Heal processes:
spyheal_setup.exe
spyheal.exe
uninst.exe
Remove these SpyHeal DLL files:
msvcp71.dll
msvcr71.dll
Remove these Spy Heal registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpywareQuake
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Uninstall\SpywareQuake\UninstallString: "%programfiles%\SpywareQuake\uninst.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Uninstall\SpywareQuake\URLInfoAbout: "http://www.spywarequake.com"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Uninstall\SpywareQuake\Publisher: "SpywareQuake.com"
Detect and remove these SpyHeal files:
uninstall spyheal 2.1.lnk
spyheal.lnk
spyheal 2.1 website.lnk
spyheal 2.1.lnk
blacklist.txt
english.ini
spyheal.url
ref.dat
ref.dat.old
SpyHeal Variants:
spyheal 2.0 , spy heal 2.0
spyheal 2.1 , spy heal 2.1
spyheal v.2.1 , spy heal v.2.1
spyheal v2.1 , spy heal v2.1
spyheal spywarequake
spyheal trojan
External Links:
http://en.wikipedia.org/wiki/Spyware
http://www.antispywarecoalition.org
WinFixer Removal - How to Remove WinFixer
July 25, 2006 file found under
WinFixer, also known as Virtumonde, is a registry cleaner which pretends to scan and fix registry problems, repair files and hard drive errors. WinFixer may install adware and other programs without your consent. WinFixer can be installed upon visiting www.600pics.com. WinFixer may display pop-ups and uncloseable message boxes. Similar WinFixer programs are ErrorSafe, WinSoftware, and GasBuddies.
You may be infected with WinFixer, if you detect C:\Windows\winfixer\winfixer20.exe. on your computer.
Remove WinFixer
Choose WinFixer removal procedure:
- WinFixer Automatic Removal (Fast & Easy.)
- WinFixer Manual Removal (Some technical skills required.)
WinFixer Image
WinFixer Manual Removal Instructions
Note: This manual removal process can be difficult. To avoid unnecessary risk of destroying your computer, use this automatic check to detect and remove WinFixer.
Detect and delete these WinFixer processes:
winfixer2005setup.exe
winfixer20.exe
winfixerscannerinstall.exe
uwfx5lp_0001_0803netinstaller.exe
uwfx51.exe
setup.exe
df_kme.exe
install.exe
sr.exe
updater.exe
unins000.exe
wfx5.exe
Remove these WinFixer DLL files:
ffwraper.dll
fixcore.dll
ftrec.dll
idletrac.dll
mmfix.dll
oedrop.dll
strres.dll
crxml.dll
pcheck.dll
compcln.dll
df_fixer.dll
df_proxy.dll
ffcom.dll
Remove these WinFixer registry values:
HKEY_CURRENT_USER\software\winsoftware\winfixer2005
HKEY_CURRENT_USER\software\winsoftware\winfixer2005\settings
HKEY_CURRENT_USER\software\winsoftware\winfixer2005\settingsfirstrun
HKEY_CURRENT_USER\software\winsoftware\winfixer2005\settingsinstalldate
HKEY_CURRENT_USER\software\winsoftware\winfixer2005\settingslast_scan_high
HKEY_CURRENT_USER\software\winsoftware\winfixer2005\settingslast_scan_low
HKEY_CURRENT_USER\software\winsoftware\winfixer2005\settingslast_timeout_high
HKEY_CURRENT_USER\software\winsoftware\winfixer2005\settingslast_timeout_low
HKEY_CURRENT_USER\software\winsoftware\winfixer2005\settingslastscanerrorcount
HKEY_CURRENT_USER\software\winsoftware\winfixer2005\settingsoverwriteandbackupfilestopath
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunWinFixer2005
HKEY_LOCAL_MACHINE\software\winsoftware\winfixer2005abbr
HKEY_LOCAL_MACHINE\software\winsoftware\winfixer2005activationcode
HKEY_LOCAL_MACHINE\software\winsoftware\winfixer2005euluwfx5lp_0001_0803
HKEY_LOCAL_MACHINE\software\winsoftware\winfixer2005installpath
HKEY_LOCAL_MACHINE\software\winsoftware\winfixer2005productcode
Detect and remove these WinFixer files:
unins000.dat
up.datdatabase.sav
program.sav
license.rtf
sr.log
trace.log
update.log
support.url
wfx5.url
template.dbx
df_kmd.sys
flash.ini
updater.dat
activate.dat
bnlink.dat
lapv.dat
lock.dat
pv.dat
WinFixer Variants:
Win Fixer, WinFixer 2005,
Win Fixer 2005, WinFixer 2006,
Win Fixer 2006, WinFixer Virus,
Win Fixer Virus, WinFixer Spyware,
Win Fixer Spyware, Downloader.WinFixer2006,
WinFixer Adware.
Top Rogue Anti-Spyware Programs
June 01, 2006 file found under Rogue Anti-Spyware
For those who are not aware of rogue antispyware or can't tell the difference between a trustworthy anti-spyware and a rogue anti-spyware, here's a little quick explanation on the matter.
Rogue anti-spyware programs are security tools that use fake warnings only to trick the user into believing that their computer may be infected with spyware so they are convinced to purchase the full version of rogue program. Instead of providing a spyware solution it causes more harm than good. It may take control of your computer and start issuing more popups and changing your browser default settings.
Here is a list of popular rogue anti-spyware and security applications. (Note: This spyware list will change as new spyware is detected so you will be up-to-date on what to avoid.)
SpywareQuake (removal instructions)
Spyware Quake is a trojan that displays an icon in the system tray. SpywareQuake looks like a legitimate application for removal of spyware, but it's installed by a trojan in an attempt to trick you into buying it. The trojan is able to change the Internet Explorer default home page and redirect the web browser to malicious web sites. SpywareQuake will also pop-up fake alerts that resemble system alerts in another attempt to get you to buy it.
SpyFalcon (removal instructions)
SpyFalcon may appear as an icon in your Windows tray and show a message that says your PC is infected with malware. SpyFalcon may then suggest you download and install software to remove this malware. If you follow its directions, you will download SpyFalcon, and once downloaded SpyFalcon may redirect your Internet Explorer home page and search results to a malicious website. SpyFalcon may also download and install other software without your permission. SpyFalcon may be distributed through bundles of trojans and other malware.
SpySheriff (removal instructions)
SpySheriff is a system hijacker that secretly installs to victim PCs. SpySheriff causes the desktop to change and display a fake warning message that tricks users into installing the antispyware software (SpySheriff).
SpyAxe (removal instructions)
SpyAxe is a trojan, that shows one or two icons in the system tray and displays a message saying that the system is infected with spyware and asking the user to download and install an anti-spyware program, which is actually a malicious software program. Once the user clicks on such message, the trojan opens the anti-spyware's official web site. It may also try to download the application automatically. SpyAxe may also change the desktop background.
PestTrap (removal instructions)
Pest Trap may note harmless software as threats in an attempt to have you purchase Pest Trap's full version to remove these harmless programs. PestTrap may also automatically launch at your computer's startup and scan your computer. Pest Trap may be knowingly downloaded and installed by users, and it may be installed without permission through browser exploits.
WinFixer (removal instructions)
WinFixer is a commercial product that pretends to be a legitimate system tool. WinFixer is actually spyware, which continuously displays annoying false reports of purportedly detected system problems, errors and parasite threats. This may trick the user into thinking that the program is not a security threat and make the user purchase a version of WinFixer.
BraveSentry (removal instructions)
BraveSentry hijacks the web browser and it is known to issue fake warnings on your computer in order to manipulate you into buying its full commercial version. It can also be installed from the BraveSentry website and has been forced onto the computer without EULA and users knownledge of installation. It does not actually detect parasites, but targets harmless system and software objects as threats in attempt to trick the user into purchasing the full version of Brave Sentry. BraveSentry is related to SpySheriff and Spware-no.
WinHound (removal instructions)
WinHound is a trojan, which silently installs itself to vulnerable computers by exploiting certain system or web browser security flaws. Once executed, WinHound installs several other dangerous threats, changes the Internet Explorer default home page and the desktop wallpaper. The new wallpaper issues fake warnings on your computer in order to make the user to buy it's version. WinHound can use a rootkit to cloak its files, running processes and other related objects.
SpywareStrike (removal instructions)
SpywareStrike is a variant of SpyAxe. SpywareStrike shows a message, which says that the compromised PC is infected with dangerous malware spywares and asks the user to download and install an anti-malware application, which actually is SpywareStrike, corrupt illegaly distributed malware remover. Once the user clicks on such message, the trojan opens the official web site of SpywareStrike. It may also try to download the software. The trojan is able to change the Internet Explorer default home page and send the web browser to malicious web sites. SpywareStrike automatically runs on every Windows startup.
RazeSpyware (removal instructions)
RazeSpyware claims to clean spyware after the product is registered when in reality it only searches for known threats (which signatures are included into the program's spyware definitions database) and does not check all the files, registry entries and running processes. Upon execution the Trojan adds a HTML page in %windir% as index.html (also detected as Raze Trojan). The HTML page is then installed as desktop wallpaper that displays a fake warning that system is infected with spyware, keyloggers and adult content. It prompts user to download Raze AntiSpyware to protect themselves against these threats.
Recent SpyFalcon file detected, oqipt.dll.
May 22, 2006 file found under SpyFalcon
SpyFalcon, a rogue anti-spyware program, displays fake security warnings claiming that your PC is infected with malicious spyware tricking users into purchasing their software. Now there's a new SpyFalcon variant released, C:\Windows\System32\oqipt.dll. If you have oqipt.dll on your computer, you may be infected with SpywareQuake.
Remove SpyFalcon and it's variant oqipt.dll automatically -- click here (Fast & Easy).
Manually remove oqipt.dll from the following registry keys:
Note: Manual removal can be dangerous. Avoid damaging your machine, scan your computer for SpywareQuake.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
SharedTaskScheduler]
“{5bc82bdb-bc03-4671-9a78-3ef2b68449de}”=”advisability”
[HKEY_CURRENT_USER\Software\Classes\CLSID\
{5bc82bdb-bc03-4671-9a78-3ef2b68449de}\InProcServer32]
@=”C:\WINDOWS\system32\oqipt.dll"
SpyFalcon manual removal instructions available, click here.
SpyFalcon variant detected - appmagr.dll
May 21, 2006 file found under SpyFalcon
SpyFalcon, a rogue anti-spyware program, displays fake security warnings claiming that your PC is infected with malicious spyware tricking users into purchasing their software. Now there's a new SpyFalcon variant released, C:\Windows\System32\appmagr.dll. If you have appmagr.dll on your computer, you may be infected with SpywareQuake.
Remove SpyFalcon and it's variant appmagr.dll automatically -- click here (Fast & Easy).
Manually remove appmagr.dll from the following registry keys:
Note: Manual removal can be dangerous. Avoid damaging your machine, scan your computer for SpywareQuake.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
SharedTaskScheduler]
“{64ba30a2-811a-4597-b0af-d551128be340}”=”AppManager”
[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\
{64ba30a2-811a-4597-b0af-d551128be340}\InProcServer32]
@=”C:\WINDOWS\system32\appmagr.dll"
SpyFalcon manual removal instructions available, click here.
New SpyFalcon File - sbnudh.dll
May 20, 2006 file found under SpyFalcon
SpyFalcon, a rogue anti-spyware program, displays fake security warnings claiming that your PC is infected with malicious spyware tricking users into purchasing their software. Now there's a new SpyFalcon variant released, C:\Windows\System32\sbnudh.dll. If you have sbnudh.dll on your computer, you may be infected with SpywareQuake.
Remove SpyFalcon and it's variant sbnudh.dll automatically -- click here (Fast & Easy).
Manually remove sbnudh.dll from the following registry keys:
Note: Manual removal can be dangerous. Avoid damaging your machine, scan your computer for SpywareQuake.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
SharedTaskScheduler]
“{89aef01d-d237-49c7-84dc-4e1904c1fd31}”=”AutoDisc Ware”
[HKEY_CURRENT_USER\Software\Classes\CLSID\
{89aef01d-d237-49c7-84dc-4e1904c1fd31}\InProcServer32]
@=”C:\WINDOWS\system32\sbnudh.dll"
SpyFalcon manual removal instructions available, click here.
RazeSpyware Removal - How to Remove RazeSpyware
May 15, 2006 file found under RazeSpyware
RazeSpyware is an anti-spyware program that secretly installs a trojan onto your computer and displays false security notifications in attempt to get you to buy their software.
You may be infected with Raze Spyware, if you detect C:\Program Files\RazeSpyware\RazeSpyware.exe on your computer.
Remove RazeSpyware
Choose RazeSpyware removal procedure:
- RazeSpyware Automatic Removal, click here. (Fast & Easy.)
- RazeSpyware Manual Removal, click here. (Some technical skills required.)
Raze Spyware Image
Raze Spyware Manual Removal Instructions
Note: This manual removal process can be difficult. To avoid unnecessary risk of destroying your computer, use this automatic check to detect and remove RazeSpyware.
Detect and remove these RazeSpyware processes:
razespyware.exe
razespyware_monitor.exe
uninstall.exe
Delete these RazeSpyware DLL files:
razespyware.dll
razespyware_monitor.dll
unzdll.dll
mswinb32.dll
mswinf32.dll
Remove these Raze Spyware registry values:
HKEY_CLASSES_ROOT\winapi32.MyBHO
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects\{7A533235-A128-434B-9F8A-9300A544D191}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ RazeSpyware
HKEY_USERS\*\Software\ RazeSpyware
Detect and remove these RazeSpyware files:
razespyware.lnk
autoexec.sss
External Links:
http://en.wikipedia.org/wiki/Spyware
http://www.antispywarecoalition.org
SpywareStrike Removal - How to Remove SpywareStrike
May 15, 2006 file found under SpywareStrike
SpywareStrike is an anti-spyware program that secretly installs a trojan onto your computer and displays false security notifications in attempt to get you to buy their software.
You may be infected with SpywareStrike, if you detect C:\Program Files\SpywareStrike\SpywareStrike.exe on your computer.
Remove SpywareStrike
Choose SpySheriff removal procedure:
- SpywareStrike Automatic Removal, click here. (Fast & Easy.)
- SpywareStrike Manual Removal, click here. (Some technical skills required.)
SpywareStrike Image
SpyAxe Manual Removal Instructions
Note: This manual removal process can be difficult. To avoid unnecessary risk of destroying your computer, use this automatic check to detect and remove SpywareStrike.
Detect and remove these SpywareStrike processes:
spywarestrike.exe
ss_setup.exe
Delete these SpywareStrike DLL files:
netwrap.dll
replmap.dll
wiatwain.dll
Remove these SpywareStrike registry values:
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindows CurrentVersionRunSpywareStrike
HKEY_LOCAL_MACHINE SOFTWAREClassesAppID{70F17C8C-1744-41B6-9D07-575DB448DCC5}
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindows CurrentVersionApp Pathsspywarestrike.exe
HKEY_LOCAL_MACHINE SOFTWARESpywareStrike
Detect and remove these SpywareStrike files:
nvctrl.exe
hp[X].tmp
