PUA_WFPDISABLE.GA

This potentially unwanted application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This potentially unwanted application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This potentially unwanted application drops the following files:

• %Desktop%\Welcome to FlyakiteOSX.lnk
• %Desktop%\Tiger System Preferences v2.lnk
• %All Users Profile%\Start Menu\Programs\FlyakiteOSX\Software\Tiger System Preferences.lnk
• %All Users Profile%\Start Menu\Programs\FlyakiteOSX\Software\UberIcon.lnk
• %All Users Profile%\Start Menu\Programs\FlyakiteOSX\Software\WinRoll.lnk
• %All Users Profile%\Start Menu\Programs\FlyakiteOSX\Software\Y'z Shadow.lnk
• %All Users Profile%\Start Menu\Programs\FlyakiteOSX\Software\iColorFolder.lnk
• %All Users Profile%\Start Menu\Programs\FlyakiteOSX\Tools\Advanced\Force System File Update.lnk
• %All Users Profile%\Start Menu\Programs\FlyakiteOSX\Tools\Current User Settings.lnk
• %All Users Profile%\Start Menu\Programs\FlyakiteOSX\Tools\Rebuild Icon Cache.lnk
• %All Users Profile%\Start Menu\Programs\FlyakiteOSX\Tools\System Files Updater.lnk
• %All Users Profile%\Start Menu\Programs\FlyakiteOSX\Uninstall.lnk
• %All Users Profile%\Start Menu\Programs\FlyakiteOSX\Website.lnk
• %All Users Profile%\Start Menu\Programs\FlyakiteOSX\Welcome to FlyakiteOSX.lnk
• %Start Menu%\Programs\Tiger System Preferences v2\CPUZ.lnk
• %Start Menu%\Programs\Tiger System Preferences v2\Customize Tutorial.lnk
• %Start Menu%\Programs\Tiger System Preferences v2\Tiger System Preferences v2.lnk
• %Start Menu%\Programs\Tiger System Preferences v2\TweakGDS.lnk
• %Start Menu%\Programs\Tiger System Preferences v2\Uninstall Tiger System Preferences v2.lnk
• %Start Menu%\Programs\iColorFolder\Download additional skins.lnk
• %Start Menu%\Programs\iColorFolder\Skin Selector.lnk
• %Start Menu%\Programs\iColorFolder\Uninstall iColorFolder.lnk
• %User Temp%\{random characters}.tmp\TSPv2.exe
• %User Temp%\{random characters}.tmp\Batch Restore Script.exe
• %User Temp%\{random characters}.tmp\ExecCmd.dll
• %User Temp%\{random characters}.tmp\Extra Options.ini
• %User Temp%\{random characters}.tmp\InstallOptions.dll
• %User Temp%\{random characters}.tmp\Logo.bmp
• %User Temp%\{random characters}.tmp\MainPage.ini
• %User Temp%\{random characters}.tmp\Splash.gif
• %User Temp%\{random characters}.tmp\System.dll
• %User Temp%\{random characters}.tmp\iColorFolder.exe
• %User Temp%\{random characters}.tmp\ioSpecial.ini
• %User Temp%\{random characters}.tmp\modern-header.bmp
• %User Temp%\{random characters}.tmp\modern-wizard.bmp
• %User Temp%\{random characters}.tmp\newadvsplash.dll
• %User Temp%\{random characters}.tmp\nsProcess.dll
• %Program Files%\UberIcon\Changelog.html
• %Program Files%\UberIcon\Data\About\._About.png
• %Program Files%\UberIcon\Data\About\About.ini
• %Program Files%\UberIcon\Data\About\About.png
• %Program Files%\UberIcon\Languages\Instructions.html
• %Program Files%\UberIcon\Languages\Language IDs.URL
• %Program Files%\UberIcon\Languages\LanguageID Finder.exe
• %Program Files%\UberIcon\Languages\{numbers}.ini
• %Program Files%\UberIcon\License-Full.html
• %Program Files%\UberIcon\License.html
• %Program Files%\UberIcon\License_files\deed.gif
• %Program Files%\UberIcon\License_files\deed_{numbers}.gif
• %Program Files%\UberIcon\License_files\deeds.css
• %Program Files%\UberIcon\License_files\logo_code.gif
• %Program Files%\UberIcon\License_files\logo_deed.gif
• %Program Files%\UberIcon\License_files\popup.gif
• %Program Files%\UberIcon\Plugins\iBounce\Source\iBounce.cpp
• %Program Files%\UberIcon\Plugins\iBounce\Source\iBounce.ncb
• %Program Files%\UberIcon\Plugins\iBounce\Source\iBounce.sln
• %Program Files%\UberIcon\Plugins\iBounce\Source\iBounce.suo
• %Program Files%\UberIcon\Plugins\iBounce\Source\iBounce.vcproj
• %Program Files%\UberIcon\Plugins\iBounce\Source\stdafx.cpp
• %Program Files%\UberIcon\Plugins\iBounce\Source\stdafx.h
• %Program Files%\UberIcon\Plugins\iBounce\fx.dll
• %Program Files%\UberIcon\Plugins\iZoom\Source\iZoom.cpp
• %Program Files%\UberIcon\Plugins\iZoom\Source\iZoom.ncb
• %Program Files%\UberIcon\Plugins\iZoom\Source\iZoom.sln
• %Program Files%\UberIcon\Plugins\iZoom\Source\iZoom.suo
• %Program Files%\UberIcon\Plugins\iZoom\Source\iZoom.vcproj
• %Program Files%\UberIcon\Plugins\iZoom\Source\stdafx.cpp
• %Program Files%\UberIcon\Plugins\iZoom\Source\stdafx.h
• %Program Files%\UberIcon\Plugins\iZoom\fx.dll
• %Program Files%\UberIcon\UberAPI\UberAPI.h
• %Program Files%\UberIcon\UberAPI\exports.def
• %Program Files%\UberIcon\UberIcon Manager.exe
• %Program Files%\UberIcon\UberIcon.dll
• %Program Files%\WinRoll\readme.html
• %Program Files%\WinRoll\winroll.dll
• %Program Files%\WinRoll\winroll.exe
• %Program Files%\WinRoll\winroll.png
• %Program Files%\YzShadow\Languages\English.lang
• %Program Files%\YzShadow\Languages\Japanese.lang
• %Program Files%\YzShadow\Readme_en.txt
• %Program Files%\YzShadow\Readme_jp.txt
• %Program Files%\YzShadow\YzShadow.dll
• %Program Files%\YzShadow\YzShadow.exe
• %Program Files%\YzShadow\YzShadow.ini
• %Program Files%\iColorFolder\CMExt.dll
• %Program Files%\iColorFolder\doc\Changelog.txt
• %Program Files%\iColorFolder\doc\How to build the sources.txt
• %Program Files%\iColorFolder\doc\How to create a Skin.txt
• %Program Files%\iColorFolder\doc\License.txt
• %Program Files%\iColorFolder\doc\ReadMe_en.txt
• %Program Files%\iColorFolder\doc\ReadMe_fr.txt
• %Program Files%\iColorFolder\iColorFolder.dll
• %Program Files%\iColorFolder\iColorFolder.exe
• %Program Files%\iColorFolder\skins\Mac OS X\iColorFolder.dll
• %Program Files%\iColorFolder\skins\Mac OS X\preview.png
• %Program Files%\iColorFolder\skins\WindowsXP\iColorFolder.dll
• %Program Files%\iColorFolder\skins\WindowsXP\preview.png
• %Program Files%\iColorFolder\uninstall.exe
• %Windows%\Alt+Q Hotkey.exe
• %Windows%\Cursors\OSX\OS X Alternate.cur
• %Windows%\Cursors\OSX\OS X Beam.cur
• %Windows%\Cursors\OSX\OS X Busy.ani
• %Windows%\Cursors\OSX\OS X Cross.cur
• %Windows%\Cursors\OSX\OS X Cursor.cur
• %Windows%\Cursors\OSX\OS X Hand.cur
• %Windows%\Cursors\OSX\OS X Help.cur
• %Windows%\Cursors\OSX\OS X Pen.cur
• %Windows%\Cursors\OSX\OS X Resize All.cur
• %Windows%\Cursors\OSX\OS X Resize Left.cur
• %Windows%\Cursors\OSX\OS X Resize Right.cur
• %Windows%\Cursors\OSX\OS X Size Horz.cur
• %Windows%\Cursors\OSX\OS X Size Vert.cur
• %Windows%\Cursors\OSX\OS X Unavailable.cur
• %Windows%\Cursors\OSX\OS X Working.ani
• %Windows%\FlyakiteOSX\FileTypeIcons\BMP.ico
• %Windows%\FlyakiteOSX\FileTypeIcons\GIF.ico
• %Windows%\FlyakiteOSX\FileTypeIcons\JPEG.ico
• %Windows%\FlyakiteOSX\FileTypeIcons\PNG.ico
• %Windows%\FlyakiteOSX\FileTypeIcons\PSD.ico
• %Windows%\FlyakiteOSX\FileTypeIcons\TIFF.ico
• %Windows%\FlyakiteOSX\Install.ico
• %Windows%\FlyakiteOSX\Lucida Grande Bold.ttf
• %Windows%\FlyakiteOSX\Lucida Grande.ttf
• %Windows%\FlyakiteOSX\NewFiles\acctres.dll
• %Windows%\FlyakiteOSX\NewFiles\accwiz.exe
• %Windows%\FlyakiteOSX\NewFiles\ahui.exe
• %Windows%\FlyakiteOSX\NewFiles\asctrls.ocx
• %Windows%\FlyakiteOSX\NewFiles\batmeter.dll
• %Windows%\FlyakiteOSX\NewFiles\batt.dll
• %Windows%\FlyakiteOSX\NewFiles\browseui.dll
• %Windows%\FlyakiteOSX\NewFiles\cagicon.exe
• %Windows%\FlyakiteOSX\NewFiles\calc.exe
• %Windows%\FlyakiteOSX\NewFiles\cards.dll
• %Windows%\FlyakiteOSX\NewFiles\certmgr.dll
• %Windows%\FlyakiteOSX\NewFiles\charmap.exe
• %Windows%\FlyakiteOSX\NewFiles\ciadmin.dll
• %Windows%\FlyakiteOSX\NewFiles\cleanmgr.exe
• %Windows%\FlyakiteOSX\NewFiles\cmd.exe
• %Windows%\FlyakiteOSX\NewFiles\cmdial32.dll
• %Windows%\FlyakiteOSX\NewFiles\cmmon32.exe
• %Windows%\FlyakiteOSX\NewFiles\comctl32.dll
• %Windows%\FlyakiteOSX\NewFiles\comres.dll
• %Windows%\FlyakiteOSX\NewFiles\console.dll
• %Windows%\FlyakiteOSX\NewFiles\credui.dll
• %Windows%\FlyakiteOSX\NewFiles\cscui.dll
• %Windows%\FlyakiteOSX\NewFiles\deskadp.dll
• %Windows%\FlyakiteOSX\NewFiles\deskmon.dll
• %Windows%\FlyakiteOSX\NewFiles\devmgr.dll
• %Windows%\FlyakiteOSX\NewFiles\dfrgres.dll
• %Windows%\FlyakiteOSX\NewFiles\dmdlgs.dll
• %Windows%\FlyakiteOSX\NewFiles\dpvoice.dll
• %Windows%\FlyakiteOSX\NewFiles\dpvsetup.exe
• %Windows%\FlyakiteOSX\NewFiles\drwtsn32.exe
• %Windows%\FlyakiteOSX\NewFiles\dsquery.dll
• %Windows%\FlyakiteOSX\NewFiles\dvdplay.exe
• %Windows%\FlyakiteOSX\NewFiles\dxdiag.exe
• %Windows%\FlyakiteOSX\NewFiles\els.dll
• %Windows%\FlyakiteOSX\NewFiles\eventvwr.exe
• %Windows%\FlyakiteOSX\NewFiles\excel.exe
• %Windows%\FlyakiteOSX\NewFiles\explorer.exe
• %Windows%\FlyakiteOSX\NewFiles\filemgmt.dll
• %Windows%\FlyakiteOSX\NewFiles\fldrclnr.dll
• %Windows%\FlyakiteOSX\NewFiles\fontext.dll
• %Windows%\FlyakiteOSX\NewFiles\gcdef.dll
• %Windows%\FlyakiteOSX\NewFiles\gpedit.dll
• %Windows%\FlyakiteOSX\NewFiles\helpctr.exe
• %Windows%\FlyakiteOSX\NewFiles\hhctrl.ocx
• %Windows%\FlyakiteOSX\NewFiles\hnetwiz.dll
• %Windows%\FlyakiteOSX\NewFiles\hotplug.dll
• %Windows%\FlyakiteOSX\NewFiles\hticons.dll
• %Windows%\FlyakiteOSX\NewFiles\hypertrm.exe
• %Windows%\FlyakiteOSX\NewFiles\icmui.dll
• %Windows%\FlyakiteOSX\NewFiles\icwdial.dll
• %Windows%\FlyakiteOSX\NewFiles\ieaksie.dll
• %Windows%\FlyakiteOSX\NewFiles\iexplore.exe
• %Windows%\FlyakiteOSX\NewFiles\inetcplc.dll
• %Windows%\FlyakiteOSX\NewFiles\infopath.exe
• %Windows%\FlyakiteOSX\NewFiles\joticon.exe
• %Windows%\FlyakiteOSX\NewFiles\keymgr.dll
• %Windows%\FlyakiteOSX\NewFiles\logon.scr
• %Windows%\FlyakiteOSX\NewFiles\logonui.exe
• %Windows%\FlyakiteOSX\NewFiles\magnify.exe
• %Windows%\FlyakiteOSX\NewFiles\main.cpl
• %Windows%\FlyakiteOSX\NewFiles\mdminst.dll
• %Windows%\FlyakiteOSX\NewFiles\migpwd.exe
• %Windows%\FlyakiteOSX\NewFiles\migwiz.exe
• %Windows%\FlyakiteOSX\NewFiles\misc.exe
• %Windows%\FlyakiteOSX\NewFiles\mmc.exe
• %Windows%\FlyakiteOSX\NewFiles\mmsys.cpl
• %Windows%\FlyakiteOSX\NewFiles\mobsync.dll
• %Windows%\FlyakiteOSX\NewFiles\mobsync.exe
• %Windows%\FlyakiteOSX\NewFiles\modemui.dll
• %Windows%\FlyakiteOSX\NewFiles\moricons.dll
• %Windows%\FlyakiteOSX\NewFiles\moviemk.exe
• %Windows%\FlyakiteOSX\NewFiles\mqutil.dll
• %Windows%\FlyakiteOSX\NewFiles\msaccess.exe
• %Windows%\FlyakiteOSX\NewFiles\msconfig.exe
• %Windows%\FlyakiteOSX\NewFiles\mscorier.dll
• %Windows%\FlyakiteOSX\NewFiles\msdxm.ocx
• %Windows%\FlyakiteOSX\NewFiles\msgina.dll
• %Windows%\FlyakiteOSX\NewFiles\mshearts.exe
• %Windows%\FlyakiteOSX\NewFiles\mshtml.dll
• %Windows%\FlyakiteOSX\NewFiles\msident.dll
• %Windows%\FlyakiteOSX\NewFiles\msieftp.dll
• %Windows%\FlyakiteOSX\NewFiles\msiexec.exe
• %Windows%\FlyakiteOSX\NewFiles\msimn.exe
• %Windows%\FlyakiteOSX\NewFiles\msinfo32.exe
• %Windows%\FlyakiteOSX\NewFiles\msmsgs.exe
• %Windows%\FlyakiteOSX\NewFiles\msoeres.dll
• %Windows%\FlyakiteOSX\NewFiles\mspaint.exe
• %Windows%\FlyakiteOSX\NewFiles\mspicons.exe
• %Windows%\FlyakiteOSX\NewFiles\mspub.exe
• %Windows%\FlyakiteOSX\NewFiles\mstask.dll
• %Windows%\FlyakiteOSX\NewFiles\mstsc.exe
• %Windows%\FlyakiteOSX\NewFiles\mycomput.dll
• %Windows%\FlyakiteOSX\NewFiles\mydocs.dll
• %Windows%\FlyakiteOSX\NewFiles\narrator.exe
• %Windows%\FlyakiteOSX\NewFiles\ncpa.cpl
• %Windows%\FlyakiteOSX\NewFiles\netid.dll
• %Windows%\FlyakiteOSX\NewFiles\netplwiz.dll
• %Windows%\FlyakiteOSX\NewFiles\netsetup.exe
• %Windows%\FlyakiteOSX\NewFiles\netshell.dll
• %Windows%\FlyakiteOSX\NewFiles\newdev.dll
• %Windows%\FlyakiteOSX\NewFiles\notepad.exe
• %Windows%\FlyakiteOSX\NewFiles\ntbackup.exe
• %Windows%\FlyakiteOSX\NewFiles\ntkrnlpa.exe
• %Windows%\FlyakiteOSX\NewFiles\ntmsmgr.dll
• %Windows%\FlyakiteOSX\NewFiles\ntoskrnl.exe
• %Windows%\FlyakiteOSX\NewFiles\ntshrui.dll
• %Windows%\FlyakiteOSX\NewFiles\nusrmgr.cpl
• %Windows%\FlyakiteOSX\NewFiles\occache.dll
• %Windows%\FlyakiteOSX\NewFiles\odbcad32.exe
• %Windows%\FlyakiteOSX\NewFiles\odbccp32.cpl
• %Windows%\FlyakiteOSX\NewFiles\odbcint.dll
• %Windows%\FlyakiteOSX\NewFiles\ois.exe
• %Windows%\FlyakiteOSX\NewFiles\oisicon.exe
• %Windows%\FlyakiteOSX\NewFiles\ole32.dll
• %Windows%\FlyakiteOSX\NewFiles\onenote.exe
• %Windows%\FlyakiteOSX\NewFiles\onenotem.exe
• %Windows%\FlyakiteOSX\NewFiles\osk.exe
• %Windows%\FlyakiteOSX\NewFiles\osuninst.exe
• %Windows%\FlyakiteOSX\NewFiles\outicon.exe
• %Windows%\FlyakiteOSX\NewFiles\outlook.exe
• %Windows%\FlyakiteOSX\NewFiles\packager.exe
• %Windows%\FlyakiteOSX\NewFiles\perfmon.exe
• %Windows%\FlyakiteOSX\NewFiles\photowiz.dll
• %Windows%\FlyakiteOSX\NewFiles\powercfg.cpl
• %Windows%\FlyakiteOSX\NewFiles\powerpnt.exe
• %Windows%\FlyakiteOSX\NewFiles\pptico.exe
• %Windows%\FlyakiteOSX\NewFiles\printui.dll
• %Windows%\FlyakiteOSX\NewFiles\rarext.dll
• %Windows%\FlyakiteOSX\NewFiles\rasdlg.dll
• %Windows%\FlyakiteOSX\NewFiles\rcimlby.exe
• %Windows%\FlyakiteOSX\NewFiles\regedit.exe
• %Windows%\FlyakiteOSX\NewFiles\regwizc.dll
• %Windows%\FlyakiteOSX\NewFiles\remotepg.dll
• %Windows%\FlyakiteOSX\NewFiles\rstrui.exe
• %Windows%\FlyakiteOSX\NewFiles\rtcshare.exe
• %Windows%\FlyakiteOSX\NewFiles\sapi.cpl
• %Windows%\FlyakiteOSX\NewFiles\sdhcinst.dll
• %Windows%\FlyakiteOSX\NewFiles\sendmail.dll
• %Windows%\FlyakiteOSX\NewFiles\setupapi.dll
• %Windows%\FlyakiteOSX\NewFiles\shdoclc.dll
• %Windows%\FlyakiteOSX\NewFiles\shdocvw.dll
• %Windows%\FlyakiteOSX\NewFiles\shell32.dll
• %Windows%\FlyakiteOSX\NewFiles\shimgvw.dll
• %Windows%\FlyakiteOSX\NewFiles\shrpubw.exe
• %Windows%\FlyakiteOSX\NewFiles\sigverif.exe
• %Windows%\FlyakiteOSX\NewFiles\sndrec32.exe
• %Windows%\FlyakiteOSX\NewFiles\sndvol32.exe
• %Windows%\FlyakiteOSX\NewFiles\sol.exe
• %Windows%\FlyakiteOSX\NewFiles\spider.exe
• %Windows%\FlyakiteOSX\NewFiles\srchui.dll
• %Windows%\FlyakiteOSX\NewFiles\srrstr.dll
• %Windows%\FlyakiteOSX\NewFiles\sti_ci.dll
• %Windows%\FlyakiteOSX\NewFiles\stimon.exe
• %Windows%\FlyakiteOSX\NewFiles\stobject.dll
• %Windows%\FlyakiteOSX\NewFiles\storprop.dll
• %Windows%\FlyakiteOSX\NewFiles\syncapp.exe
• %Windows%\FlyakiteOSX\NewFiles\syncui.dll
• %Windows%\FlyakiteOSX\NewFiles\sysdm.cpl
• %Windows%\FlyakiteOSX\NewFiles\syskey.exe
• %Windows%\FlyakiteOSX\NewFiles\sysmon.ocx
• %Windows%\FlyakiteOSX\NewFiles\sysocmgr.exe
• %Windows%\FlyakiteOSX\NewFiles\syssetup.dll
• %Windows%\FlyakiteOSX\NewFiles\tapiui.dll
• %Windows%\FlyakiteOSX\NewFiles\taskmgr.exe
• %Windows%\FlyakiteOSX\NewFiles\telephon.cpl
• %Windows%\FlyakiteOSX\NewFiles\telnet.exe
• %Windows%\FlyakiteOSX\NewFiles\themeui.dll
• %Windows%\FlyakiteOSX\NewFiles\timedate.cpl
• %Windows%\FlyakiteOSX\NewFiles\tourstart.exe
• %Windows%\FlyakiteOSX\NewFiles\upnpui.dll
• %Windows%\FlyakiteOSX\NewFiles\url.dll
• %Windows%\FlyakiteOSX\NewFiles\urlmon.dll
• %Windows%\FlyakiteOSX\NewFiles\user32.dll
• %Windows%\FlyakiteOSX\NewFiles\utilman.exe
• %Windows%\FlyakiteOSX\NewFiles\verifier.exe
• %Windows%\FlyakiteOSX\NewFiles\wab.exe
• %Windows%\FlyakiteOSX\NewFiles\wab32.dll
• %Windows%\FlyakiteOSX\NewFiles\wab32res.dll
• %Windows%\FlyakiteOSX\NewFiles\wabfind.dll
• %Windows%\FlyakiteOSX\NewFiles\wabimp.dll
• %Windows%\FlyakiteOSX\NewFiles\wabmig.exe
• %Windows%\FlyakiteOSX\NewFiles\webcheck.dll
• %Windows%\FlyakiteOSX\NewFiles\wiaacmgr.exe
• %Windows%\FlyakiteOSX\NewFiles\wiadefui.dll
• %Windows%\FlyakiteOSX\NewFiles\wiashext.dll
• %Windows%\FlyakiteOSX\NewFiles\winbrand.dll
• %Windows%\FlyakiteOSX\NewFiles\winchat.exe
• %Windows%\FlyakiteOSX\NewFiles\winhlp32.exe
• %Windows%\FlyakiteOSX\NewFiles\wininet.dll
• %Windows%\FlyakiteOSX\NewFiles\winmine.exe
• %Windows%\FlyakiteOSX\NewFiles\winrar.exe
• %Windows%\FlyakiteOSX\NewFiles\winsrv.dll
• %Windows%\FlyakiteOSX\NewFiles\winword.exe
• %Windows%\FlyakiteOSX\NewFiles\wmplayer.exe
• %Windows%\FlyakiteOSX\NewFiles\wordicon.exe
• %Windows%\FlyakiteOSX\NewFiles\wordpad.exe
• %Windows%\FlyakiteOSX\NewFiles\wpabaln.exe
• %Windows%\FlyakiteOSX\NewFiles\write.exe
• %Windows%\FlyakiteOSX\NewFiles\wscript.exe
• %Windows%\FlyakiteOSX\NewFiles\wscui.cpl
• %Windows%\FlyakiteOSX\NewFiles\wsecedit.dll
• %Windows%\FlyakiteOSX\NewFiles\wuauclt.exe
• %Windows%\FlyakiteOSX\NewFiles\wuaucpl.cpl
• %Windows%\FlyakiteOSX\NewFiles\wupdmgr.exe
• %Windows%\FlyakiteOSX\NewFiles\xlicons.exe
• %Windows%\FlyakiteOSX\NewFiles\xpsp2res.dll
• %Windows%\FlyakiteOSX\NewFiles\zipfldr.dll
• %Windows%\FlyakiteOSX\Tools\Current User Settings.exe
• %Windows%\FlyakiteOSX\Tools\Force System File Update.exe
• %Windows%\FlyakiteOSX\Tools\Move Taskbar to Bottom.exe
• %Windows%\FlyakiteOSX\Tools\Move Taskbar to Top.exe
• %Windows%\FlyakiteOSX\Tools\MoveEx.exe
• %Windows%\FlyakiteOSX\Tools\RebIC.exe
• %Windows%\FlyakiteOSX\Tools\ReplacePalette.xsc
• %Windows%\FlyakiteOSX\Tools\ResHacker.ini
• %Windows%\FlyakiteOSX\Tools\System Files Updater.exe
• %Windows%\FlyakiteOSX\Tools\Universal UXTheme Patcher v1.4.exe
• %Windows%\FlyakiteOSX\Tools\XVI32.exe
• %Windows%\FlyakiteOSX\Tools\XVI32.ini
• %Windows%\FlyakiteOSX\Tools\bootcfg.exe
• %Windows%\FlyakiteOSX\Tools\gsar.exe
• %Windows%\FlyakiteOSX\Tools\reshacker.exe
• %Windows%\FlyakiteOSX\Tools\wfpdisable.exe
• %Windows%\FlyakiteOSX\Tray.ico
• %Windows%\FlyakiteOSX\Uninstall.exe
• %Windows%\FlyakiteOSX\Website.lnk
• %Windows%\Resources\Sounds\Iceman\Alarm.wav
• %Windows%\Resources\Sounds\Iceman\Close.wav
• %Windows%\Resources\Sounds\Iceman\Error.wav
• %Windows%\Resources\Sounds\Iceman\Funk.wav
• %Windows%\Resources\Sounds\Iceman\Grab.wav
• %Windows%\Resources\Sounds\Iceman\Hardware Connected.wav
• %Windows%\Resources\Sounds\Iceman\Hardware Disconnected.wav
• %Windows%\Resources\Sounds\Iceman\Maximize.wav
• %Windows%\Resources\Sounds\Iceman\Menu Command.wav
• %Windows%\Resources\Sounds\Iceman\Menu Popup.wav
• %Windows%\Resources\Sounds\Iceman\Minimize.wav
• %Windows%\Resources\Sounds\Iceman\New Messages.wav
• %Windows%\Resources\Sounds\Iceman\No New Messages.wav
• %Windows%\Resources\Sounds\Iceman\Open.wav
• %Windows%\Resources\Sounds\Iceman\Ping.wav
• %Windows%\Resources\Sounds\Iceman\Print Complete.wav
• %Windows%\Resources\Sounds\Iceman\Purr.wav
• %Windows%\Resources\Sounds\Iceman\System Log In.wav
• %Windows%\Resources\Sounds\Iceman\System Log Off.wav
• %Windows%\Resources\Sounds\Iceman\Trash Drop Item.wav
• %Windows%\Resources\Sounds\Iceman\Trash Empty.wav
• %Windows%\Resources\Sounds\Iceman\Undo(Max).wav
• %Windows%\Resources\Sounds\Iceman\Undo(Min).wav
• %Windows%\Resources\Themes\Tiger\Readme.txt
• %Windows%\Resources\Themes\Tiger\Shell\AppleG\shellstyle.dll
• %Windows%\Resources\Themes\Tiger\Shell\NormalColor\shellstyle.dll
• %Windows%\Resources\Themes\Tiger\Shell\WindowB\shellstyle.dll
• %Windows%\Resources\Themes\Tiger\Shell\WindowG\shellstyle.dll
• %Windows%\Resources\Themes\Tiger\StudioTwentyEight.url
• %Windows%\Resources\Themes\Tiger\Tiger Compact.msstyles
• %Windows%\Resources\Themes\Tiger\Tiger.msstyles
• %Windows%\RestoreFlyakiteOSX.txt
• %Windows%\Web\Wallpaper\Aqua Blue.bmp
• %Windows%\pchealth\helpctr\System\images\16x16\arrow_blue_normal_shadow.bmp
• %Windows%\pchealth\helpctr\System\images\16x16\arrow_green_normal_shadow.bmp
• %Windows%\pchealth\helpctr\System\images\16x16\compat.bmp
• %Windows%\pchealth\helpctr\System\images\16x16\errmsg.bmp
• %Windows%\pchealth\helpctr\System\images\16x16\support.bmp
• %Windows%\pchealth\helpctr\System\images\16x16\tools.bmp
• %Windows%\pchealth\helpctr\System\images\16x16\update.bmp
• %Windows%\pchealth\helpctr\System\images\16x16\warning.gif
• %Windows%\pchealth\helpctr\System\images\24x24\arrow_green_mousedown.bmp
• %Windows%\pchealth\helpctr\System\images\24x24\arrow_green_mouseover.bmp
• %Windows%\pchealth\helpctr\System\images\24x24\arrow_green_normal.bmp
• %Windows%\pchealth\helpctr\System\images\32x32\logo.bmp
• %Windows%\pchealth\helpctr\System\images\48x48\desktop_icon_generic.bmp
• %Windows%\pchealth\helpctr\System\images\48x48\desktop_icon_{numbers}.bmp
• %Windows%\pchealth\helpctr\System\images\Centers\blue_arrow.gif
• %Windows%\pchealth\helpctr\System\images\error.gif
• %Windows%\pchealth\helpctr\System\images\feedback.gif
• %Windows%\pchealth\helpctr\System\images\info.gif
• %Windows%\pchealth\helpctr\System\images\warning.gif
• %System%\Flurry.scr
• %System%\dllcache\acctres.dll
• %System%\dllcache\accwiz.exe
• %System%\dllcache\ahui.exe
• %System%\dllcache\asctrls.ocx
• %System%\dllcache\batmeter.dll
• %System%\dllcache\batt.dll
• %System%\dllcache\browseui.dll
• %System%\dllcache\calc.exe
• %System%\dllcache\cards.dll
• %System%\dllcache\certmgr.dll
• %System%\dllcache\charmap.exe
• %System%\dllcache\ciadmin.dll
• %System%\dllcache\cleanmgr.exe
• %System%\dllcache\cmd.exe
• %System%\dllcache\cmdial32.dll
• %System%\dllcache\cmmon32.exe
• %System%\dllcache\comctl32.dll
• %System%\dllcache\comres.dll
• %System%\dllcache\console.dll
• %System%\dllcache\credui.dll
• %System%\dllcache\cscui.dll
• %System%\dllcache\deskadp.dll
• %System%\dllcache\deskmon.dll
• %System%\dllcache\devmgr.dll
• %System%\dllcache\dfrgres.dll
• %System%\dllcache\dmdlgs.dll
• %System%\dllcache\dpvoice.dll
• %System%\dllcache\dpvsetup.exe
• %System%\dllcache\drwtsn32.exe
• %System%\dllcache\dsquery.dll
• %System%\dllcache\dxdiag.exe
• %System%\dllcache\els.dll
• %System%\dllcache\eventvwr.exe
• %System%\dllcache\explorer.exe
• %System%\dllcache\filemgmt.dll
• %System%\dllcache\fldrclnr.dll
• %System%\dllcache\fontext.dll
• %System%\dllcache\gcdef.dll
• %System%\dllcache\gpedit.dll
• %System%\dllcache\helpctr.exe
• %System%\dllcache\hhctrl.ocx
• %System%\dllcache\hnetwiz.dll
• %System%\dllcache\hotplug.dll
• %System%\dllcache\icmui.dll
• %System%\dllcache\icwdial.dll
• %System%\dllcache\ieaksie.dll
• %System%\dllcache\iexplore.exe
• %System%\dllcache\inetcplc.dll
• %System%\dllcache\keymgr.dll
• %System%\dllcache\logon.scr
• %System%\dllcache\logonui.exe
• %System%\dllcache\magnify.exe
• %System%\dllcache\main.cpl
• %System%\dllcache\mdminst.dll
• %System%\dllcache\migwiz.exe
• %System%\dllcache\mmc.exe
• %System%\dllcache\mmsys.cpl
• %System%\dllcache\mobsync.dll
• %System%\dllcache\mobsync.exe
• %System%\dllcache\modemui.dll
• %System%\dllcache\moricons.dll
• %System%\dllcache\moviemk.exe
• %System%\dllcache\mqutil.dll
• %System%\dllcache\msconfig.exe
• %System%\dllcache\msdxm.ocx
• %System%\dllcache\msgina.dll
• %System%\dllcache\mshearts.exe
• %System%\dllcache\mshtml.dll
• %System%\dllcache\msident.dll
• %System%\dllcache\msieftp.dll
• %System%\dllcache\msiexec.exe
• %System%\dllcache\msimn.exe
• %System%\dllcache\msinfo32.exe
• %System%\dllcache\msoeres.dll
• %System%\dllcache\mspaint.exe
• %System%\dllcache\mstask.dll
• %System%\dllcache\mycomput.dll
• %System%\dllcache\mydocs.dll
• %System%\dllcache\narrator.exe
• %System%\dllcache\ncpa.cpl
• %System%\dllcache\netid.dll
• %System%\dllcache\netplwiz.dll
• %System%\dllcache\netsetup.exe
• %System%\dllcache\netshell.dll
• %System%\dllcache\newdev.dll
• %System%\dllcache\notepad.exe
• %System%\dllcache\ntbackup.exe
• %System%\dllcache\ntmsmgr.dll
• %System%\dllcache\ntshrui.dll
• %System%\dllcache\nusrmgr.cpl
• %System%\dllcache\occache.dll
• %System%\dllcache\odbcad32.exe
• %System%\dllcache\odbccp32.cpl
• %System%\dllcache\odbcint.dll
• %System%\dllcache\ole32.dll
• %System%\dllcache\osk.exe
• %System%\dllcache\osuninst.exe
• %System%\dllcache\packager.exe
• %System%\dllcache\perfmon.exe
• %System%\dllcache\photowiz.dll
• %System%\dllcache\powercfg.cpl
• %System%\dllcache\printui.dll
• %System%\dllcache\rasdlg.dll
• %System%\dllcache\rcimlby.exe
• %System%\dllcache\regedit.exe
• %System%\dllcache\regwizc.dll
• %System%\dllcache\remotepg.dll
• %System%\dllcache\rstrui.exe
• %System%\dllcache\rtcshare.exe
• %System%\dllcache\sapi.cpl
• %System%\dllcache\sendmail.dll
• %System%\dllcache\setupapi.dll
• %System%\dllcache\shdoclc.dll
• %System%\dllcache\shdocvw.dll
• %System%\dllcache\shimgvw.dll
• %System%\dllcache\shrpubw.exe
• %System%\dllcache\sigverif.exe
• %System%\dllcache\sndrec32.exe
• %System%\dllcache\sndvol32.exe
• %System%\dllcache\sol.exe
• %System%\dllcache\spider.exe
• %System%\dllcache\srchui.dll
• %System%\dllcache\srrstr.dll
• %System%\dllcache\sti_ci.dll
• %System%\dllcache\stimon.exe
• %System%\dllcache\stobject.dll
• %System%\dllcache\syncapp.exe
• %System%\dllcache\syncui.dll
• %System%\dllcache\sysdm.cpl
• %System%\dllcache\syskey.exe
• %System%\dllcache\sysmon.ocx
• %System%\dllcache\sysocmgr.exe
• %System%\dllcache\syssetup.dll
• %System%\dllcache\tapiui.dll
• %System%\dllcache\taskmgr.exe
• %System%\dllcache\telephon.cpl
• %System%\dllcache\telnet.exe
• %System%\dllcache\themeui.dll
• %System%\dllcache\timedate.cpl
• %System%\dllcache\upnpui.dll
• %System%\dllcache\url.dll
• %System%\dllcache\urlmon.dll
• %System%\dllcache\user32.dll
• %System%\dllcache\utilman.exe
• %System%\dllcache\verifier.exe
• %System%\dllcache\wab.exe
• %System%\dllcache\wab32.dll
• %System%\dllcache\wab32res.dll
• %System%\dllcache\wabfind.dll
• %System%\dllcache\wabimp.dll
• %System%\dllcache\wabmig.exe
• %System%\dllcache\webcheck.dll
• %System%\dllcache\wiaacmgr.exe
• %System%\dllcache\wiadefui.dll
• %System%\dllcache\wiashext.dll
• %System%\dllcache\winbrand.dll
• %System%\dllcache\winchat.exe
• %System%\dllcache\winhlp32.exe
• %System%\dllcache\wininet.dll
• %System%\dllcache\winmine.exe
• %System%\dllcache\winsrv.dll
• %System%\dllcache\wmplayer.exe
• %System%\dllcache\wordpad.exe
• %System%\dllcache\wpabaln.exe
• %System%\dllcache\write.exe
• %System%\dllcache\wscript.exe
• %System%\dllcache\wscui.cpl
• %System%\dllcache\wsecedit.dll
• %System%\dllcache\wuauclt.exe
• %System%\dllcache\wuaucpl.cpl
• %System%\dllcache\wupdmgr.exe
• %System%\dllcache\xpsp2res.dll
• %System%\dllcache\zipfldr.dll
• %System%\ntkrnlpa.exe.FlyakiteOSX
• %System%\ntoskrnl.exe.FlyakiteOSX
• %System%\uxtheme.backup
• %System%\uxtheme.new

(Note: %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Start Menu% is the Start Menu folder, where it usually is C:\Documents and Settings\{user name}\Start Menu on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It creates the following folders:

• %All Users Profile%\Start Menu\Programs\FlyakiteOSX
• %Program Files%\Tiger System Preferences v2
• %Program Files%\UberIcon
• %Program Files%\WinRoll
• %Program Files%\YzShadow
• %Program Files%\iColorFolder
• %Start Menu%\Programs\Tiger System Preferences v2
• %Start Menu%\Programs\iColorFolder
• %System%\dllcache
• %User Temp%\{random characters}.tmp
• %Windows%\Cursors\OSX
• %Windows%\FlyakiteOSX
• %Windows%\FlyakiteOSX\Backup
• %Windows%\FlyakiteOSX\FileTypeIcons
• %Windows%\FlyakiteOSX\Logs
• %Windows%\FlyakiteOSX\NewFiles
• %Windows%\FlyakiteOSX\Resources
• %Windows%\FlyakiteOSX\TempFiles
• %Windows%\FlyakiteOSX\Tools

(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %Start Menu% is the Start Menu folder, where it usually is C:\Documents and Settings\{user name}\Start Menu on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

Autostart Technique

This potentially unwanted application creates the following registry entries to enable automatic execution of dropped component at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Alt+Q Hotkey Tool = "%Windows%\Alt+Q Hotkey.exe" = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

ObjectDock = ""
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run = RK Launcher = "%Program Files%\RK Launcher\RKLauncher.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
UberIcon = ""%Program Files%\UberIcon\UberIcon Manager.exe"" = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

WinRoll = "%Program Files%\WinRoll\winroll.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run = Yz Shadow = "%Program Files%\YzShadow\YzShadow.exe"

Other System Modifications

This potentially unwanted application adds the following registry keys:

HKEY_CURRENT_USER\Control Panel\Cursors

HKEY_CURRENT_USER\Control Panel\Cursors\
Schemes

HKEY_CURRENT_USER\Software\UberIcon-v1.0.0

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Tweaks

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Extras

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
FILES

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Skins

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Software

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
FlyakiteOSX

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tiger System Preferences v2

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
iColorFolder"

HKEY_LOCAL_MACHINE\SOFTWARE\Revenger inc.

HKEY_LOCAL_MACHINE\SOFTWARE\iColorFolder

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Session Manager
AllowProtectedRenames = "1"

HKEY_CURRENT_USER\Control Panel\Cursors
= "OS X"

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = "%Windows%\Web\Wallpaper\Aqua Blue.bmp"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX
GUID = "{GUID}"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX
MaxIconSize = "{numbers}"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Extras
Cursors = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Extras
DefaultScreenSaver = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Extras
FlurryScreenSaver = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Extras
HelpandSupport = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Extras
LogonScreen = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Extras
Sounds = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Extras
UserAccountPictures = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Extras
Wallpaper = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
FILES
{files listed in %Windows%\FlyakiteOSX\NewFiles folder} = "{numbers}"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Skins
MSStyle = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Software
Alt+Q = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Software
ObjectDock = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Software
RKLauncher = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Software
TigerSystemPreferences = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Software
UberIcon = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Software
WinRoll = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Software
YzShadow = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Software
iColorFolder = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Tweaks
CommandConsole = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Tweaks
MoveTaskbar = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Tweaks
ThrobberIE = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Tweaks
ThrobberShell = "yes"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
FlyakiteOSX
DisplayIcon = "%Windows%\FlyakiteOSX\Install.ico"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
FlyakiteOSX
DisplayName = "FlyakiteOSX"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
FlyakiteOSX
DisplayVersion = "v3.5"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
FlyakiteOSX
Publisher = "Portrait of a Kite, Inc."

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
FlyakiteOSX
URLInfoAbout = "http://osx.portraitofakite.com"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
FlyakiteOSX
UninstallString = "%Windows%\FlyakiteOSX\Uninstall.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tiger System Preferences v2
DisplayName = "Tiger System Preferences v2"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
Tiger System Preferences v2
UninstallString = "%Program Files%\Tiger System Preferences v2\Uninstal.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
iColorFolder
DisplayName = "iColorFolder"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
iColorFolder
UninstallString = "%Program Files%\iColorFolder\uninstall.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\FlyakiteOSX\
Extras
BootScreen = "yes"

HKEY_CURRENT_USER\Control Panel\Cursors\
Schemes
OS X = "%Windows%\Cursors\OSX\OS X Cursor.cur,%Windows%\Cursors\OSX\OS X Help.cur,%Windows%\Cursors\OSX\OS X Working.ani,%Windows%\Cursors\OSX\OS X Busy.ani,%Windows%\Cursors\OSX\OS X Cross.cur,%Windows%\Cursors\OSX\OS X Beam.cur,%Windows%\Cursors\OSX\OS X Pen.cur,%Windows%\Cursors\OSX\OS X Unavailable.cur,%Windows%\Cursors\OSX\OS X Size Horz.cur,%Windows%\Cursors\OSX\OS X Size Vert.cur,%Windows%\Cursors\OSX\OS X Resize Right.cur,%Windows%\Cursors\OSX\OS X Resize Left.cur,%Windows%\Cursors\OSX\OS X Resize All.cur,%Windows%\Cursors\OSX\OS X Alternate.cur,%Windows%\Cursors\OSX\OS X Hand.cur"c

HKEY_LOCAL_MACHINE\SOFTWARE\iColorFolder
= "%Program Files%\iColorFolder"