[djrogers]

> But the post says that the malware checks if any of those folders exists

Presumably so it doesn't re-infect an already compromised host