Trojan.StartPage.37696

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Walpaper' = '%WINDIR%\Walpaper'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Print Epson' = 'C:\Documents and Setting\Temporary\Epson'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\Semut.vbs
%HOMEPATH%\Start Menu\Programs\Startup\Fuckme.com

Создает следующие файлы на съемном носителе:

<Имя диска съемного носителя>:\Walpaper.exe

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует отображение:

скрытых файлов
расширений файлов

блокирует запуск следующих системных утилит:

Диспетчера задач (Taskmgr)
Редактора реестра (RegEdit)

Изменяет следующие настройки проводника Windows (Windows Explorer):

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'

Принудительно разрешает автозапуск со съемных носителей.

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg.exe
%WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg.exe
%WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg.exe
%WINDIR%\Help\Tours\htmlTour\window_up.jpg.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.exe
%WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg.exe
%WINDIR%\Help\Tours\htmlTour\unlock_built.jpg.exe
%WINDIR%\Help\Tours\htmlTour\ul_logo.jpg.exe
%WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg.exe
%WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg.exe
%WINDIR%\Help\Tours\htmlTour\unlock_optimized_big.jpg.exe
%WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg.exe
<SYSTEM32>\oobe\html\mouse\images\bulzanom.jpg.exe
<SYSTEM32>\oobe\html\mouse\images\bulzano.jpg.exe
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\greendot.jpg.exe
<SYSTEM32>\oobe\html\mouse\images\heidelb.jpg.exe
<SYSTEM32>\oobe\html\mouse\images\parism.jpg.exe
<SYSTEM32>\oobe\html\mouse\images\paris.jpg.exe
<SYSTEM32>\oobe\html\mouse\images\heidelbm.jpg.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg.exe
%WINDIR%\pchealth\helpctr\System\DVDUpgrd\stripe.jpg.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg.exe
%WINDIR%\Help\Tours\htmlTour\taskbar_up.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img121.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img116.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img110.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img123.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img149.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img136.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img126.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img074a.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img072.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img068.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img089.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img109.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img103.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img100.jpg.exe
%WINDIR%\Help\Tours\htmlTour\intro_logo.jpg.exe
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg.exe
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big.jpg.exe
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg.exe
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster.jpg.exe
%WINDIR%\Help\Tours\htmlTour\start_up.jpg.exe
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg.exe
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg.exe
%WINDIR%\Help\Tours\htmlTour\question_icon.jpg.exe
%WINDIR%\Help\Tours\htmlTour\pen_icon.jpg.exe
%WINDIR%\Help\Tours\htmlTour\logo.jpg.exe
%WINDIR%\Help\Tours\htmlTour\read_icon.jpg.exe
%WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg.exe
%WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg.exe
%WINDIR%\Help\Tours\htmlTour\safe_easy_better.jpg.exe
<SYSTEM32>\oobe\html\mouse\images\pisa.jpg.exe
%WINDIR%\Web\Wallpaper\Friend.jpg.exe
%WINDIR%\Web\Wallpaper\Follow.jpg.exe
%WINDIR%\Web\Wallpaper\Crystal.jpg.exe
%WINDIR%\Web\Wallpaper\Home.jpg.exe
%WINDIR%\Web\Wallpaper\Power.jpg.exe
%WINDIR%\Web\Wallpaper\Peace.jpg.exe
%WINDIR%\Web\Wallpaper\Moon flower.jpg.exe
<SYSTEM32>\oobe\images\wpakey.jpg.exe
<SYSTEM32>\oobe\images\wpaflag.jpg.exe
<SYSTEM32>\oobe\images\wpabtm.jpg.exe
<SYSTEM32>\oobe\images\wpatop.jpg.exe
%WINDIR%\Web\Wallpaper\Azul.jpg.exe
%WINDIR%\Web\Wallpaper\Autumn.jpg.exe
%WINDIR%\Web\Wallpaper\Ascent.jpg.exe
%WINDIR%\Web\Wallpaper\Purple flower.jpg.exe
%HOMEPATH%\Templates\winword2.doc.exe
%HOMEPATH%\Templates\winword.doc.exe
%WINDIR%\Web\Wallpaper\Windows XP.jpg.exe
C:\Documents and Settings\Default User\Templates\winword.doc.exe
<SYSTEM32>\config\systemprofile\Templates\winword2.doc.exe
<SYSTEM32>\config\systemprofile\Templates\winword.doc.exe
C:\Documents and Settings\Default User\Templates\winword2.doc.exe
%WINDIR%\Web\Wallpaper\Ripple.jpg.exe
%WINDIR%\Web\Wallpaper\Red moon desert.jpg.exe
%WINDIR%\Web\Wallpaper\Radiance.jpg.exe
%WINDIR%\Web\Wallpaper\Stonehenge.jpg.exe
%WINDIR%\Web\Wallpaper\Wind.jpg.exe
%WINDIR%\Web\Wallpaper\Vortec space.jpg.exe
%WINDIR%\Web\Wallpaper\Tulips.jpg.exe
<SYSTEM32>\oobe\images\wpaback.jpg.exe
<SYSTEM32>\oobe\images\backdown.jpg.exe
<SYSTEM32>\oobe\html\mouse\images\veronam.jpg.exe
<SYSTEM32>\oobe\html\mouse\images\verona.jpg.exe
<SYSTEM32>\oobe\images\backoff.jpg.exe
<SYSTEM32>\oobe\images\mslogo.jpg.exe
<SYSTEM32>\oobe\images\backup.jpg.exe
<SYSTEM32>\oobe\images\backover.jpg.exe
<SYSTEM32>\oobe\html\mouse\images\praguem.jpg.exe
<SYSTEM32>\oobe\html\mouse\images\prague.jpg.exe
<SYSTEM32>\oobe\html\mouse\images\pisam.jpg.exe
<SYSTEM32>\oobe\html\mouse\images\tyrol.jpg.exe
<SYSTEM32>\oobe\html\mouse\images\venicem.jpg.exe
<SYSTEM32>\oobe\html\mouse\images\venice.jpg.exe
<SYSTEM32>\oobe\html\mouse\images\tyrolm.jpg.exe
<SYSTEM32>\oobe\images\newbtm1.jpg.exe
<SYSTEM32>\oobe\images\oemcoa.jpg.exe
<SYSTEM32>\oobe\images\nextup.jpg.exe
<SYSTEM32>\oobe\images\nextover.jpg.exe
<SYSTEM32>\oobe\images\skipdown.jpg.exe
<SYSTEM32>\oobe\images\skipup.jpg.exe
<SYSTEM32>\oobe\images\skipover.jpg.exe
<SYSTEM32>\oobe\images\skipoff.jpg.exe
<SYSTEM32>\oobe\images\newmark8.jpg.exe
<SYSTEM32>\oobe\images\newmark1.jpg.exe
<SYSTEM32>\oobe\images\newbtm8.jpg.exe
<SYSTEM32>\oobe\images\newtop1.jpg.exe
<SYSTEM32>\oobe\images\nextoff.jpg.exe
<SYSTEM32>\oobe\images\nextdown.jpg.exe
<SYSTEM32>\oobe\images\newtop8.jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\E514A0B43ECC3F196EF5A53CBCC447[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\E4FEBBC3AD7741B1DD320B09ABB5E[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\CEE573942B46AC97112655050BC[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\31D6CF613DCE652EE5373C172D9[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\62699326E6A9F8FD8E34FBFF3A35CA[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\5D6F6A7B6435E4857AE20303A2E6[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\3E36B6651EEF72A62EF52B8295698[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\731042614F8E9B3698BBEE93354228[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\6C4F727B5EEEB1AC2D163A8E519D1[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\688850C560414B517D34A2E86FD8D[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\9EA7DAF3C7F7C4611DB20558F4211[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\C44C109BA3922778FCC4638545EE5F[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\B8FB12415C455388F8D825EB5A6CB6[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\B8A1A994F4336CFC004F2B594CE0[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\67E69B80B12B19E4515C4D8C8DD73[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\22AB9C71E94F6966F04B662049D3B2[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\1D4FFF6DE1AEBD4CEF1C7F1452D[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\1A6C9F0F38572BD8028852BEDEC13[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\29B9FD62C7F84E8A554807673CCF5[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\898788D35CB3E86AD144D1211B388D[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\46945095A1192C5E79A061508F5A[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\3097345C2562507A54A320738111[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\B8F195D5C625A66D1A9CB4556A25[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\84D8EBD81C7ADB3120A859A8A6C6DE[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\6839FCA4D445BFA21B2BC7CAEAE1D[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\C7E9B81CC78AF7F334BF1E57E97EE[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\F858474EB11E71A027BD572A933E1[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\E6A53F539D5B43E6DB45B115ED5DE[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\DCE06D5B11AC29F14CFA163699C3B[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\60CB88EBF6F0438748A881A49DEE63[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\04F394908627E5E948CD862CA29D[1].jpg.exe
%WINDIR%\help.htm
<Текущая директория>pesene_seng_gawe.htm
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\07D1F36E33949B7C68D62519152[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\3564127DCB1D39D50C79BCDCC96C[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\34CDA9506D39A01DC809CFB8711[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\1E5ADBCC3A86BBD55C3E87DF4D9ED8[1].jpg.exe
%APPDATA%\TuGas.exe
<LS_APPDATA>\MakeLove.exe
%HOMEPATH%\My Documents\My Pictures\XxXLove.exe
%APPDATA%\sys.dll
<Текущая директория>Autorun.inf
%WINDIR%\Walpaper.exe
C:\Walpaper.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\3E97E63B509EB7FBF6488B17BFAF8D[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\30DDF549F8A04A366E72EE82A91E20[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\243EB41653B13AAC7478E5B7BF22B[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\F3A559EF22035881817C2E90C98D[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\3637D65C41D29B88A6368882166F[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\5D43FEC3F9BD416D151EAA6BD6176A[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\5742ECCEEF5583F46AFACEB54EAFFC[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\51EE408B63CDEB903E2243C6938D40[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\882EFB257E7465D7B6635A7E37B0[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\63212C31DFE99880DDEE44BEE75[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\5CF16DE630438C502BA8448921A34B[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\9B5E4A6AC49632859858DC23FFED32[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\EFC8FB28495C28E8ECF3F16E2B2964[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\C01537BDF704C6BDD45A34DC94F9[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\ADA5DEA01BBF7ADEE426CAEDC7D758[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\8CEEC8149CA55225EBCC0B668BD28[1].jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_networks.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_data.jpg.exe
%WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg.exe
%WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg.exe
%WINDIR%\Help\Tours\htmlTour\control_up.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img033a.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img033.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img014.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img034.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img060.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img046.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img040.jpg.exe
%WINDIR%\Help\Tours\htmlTour\end_up.jpg.exe
%WINDIR%\Help\Tours\htmlTour\desktop_up.jpg.exe
%WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg.exe
%WINDIR%\Help\Tours\htmlTour\folder_up.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img004b.jpg.exe
%WINDIR%\Help\Tours\htmlTour\icon_up.jpg.exe
%WINDIR%\Help\Tours\htmlTour\gradient.jpg.exe
%WINDIR%\Help\Tours\htmlTour\best_secure.jpg.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\FA4DD27C32E9874A17757E97489C7A[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\F95091CDFB594606AF86F0C6C9A[1].jpg.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Clear Day Bkgrd.jpg.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\C33EA37E42F0A2D61D281D1D5912B4[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\BBFF8ED9BF1490FB74EF88764CA2B[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\A441DEEA5B6E3413876B38D4A155E1[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\C736A355F5C3A230968347D8F4C14[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\F67471F499193AEFE6577D35B3F453[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\EF6FAE8FDF4F641813A37248D7551[1].jpg.exe
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\D21BB52564361BB53C5DF0F5EF3C[1].jpg.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Fiesta Bkgrd.jpg.exe
%WINDIR%\Help\Tours\htmlTour\best_road_big.jpg.exe
%WINDIR%\Help\Tours\htmlTour\best_road.jpg.exe
%PROGRAM_FILES%\Movie Maker\Shared\Sample2.jpg.exe
%WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg.exe
%WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg.exe
%WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg.exe
%WINDIR%\Help\Tours\htmlTour\best_robust.jpg.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Maize Bkgrd.jpg.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Leaves Bkgrd.jpg.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Glacier Bkgrd.jpg.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Nature Bkgrd.jpg.exe
%PROGRAM_FILES%\Movie Maker\Shared\Sample1.jpg.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Sunflower Bkgrd.jpg.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\Pie Charts Bkgrd.jpg.exe

Присваивает атрибут 'скрытый' для следующих файлов:

%HOMEPATH%\Start Menu\Programs\Startup\Fuckme.com
<LS_APPDATA>\MakeLove.exe
%HOMEPATH%\My Documents\My Pictures\XxXLove.exe

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней