Trojan.KillFiles.8003

Техническая информация

Изменения в файловой системе:

Удаляет следующие файлы:

%WINDIR%\Santa Fe Stucco.bmp
<SYSTEM32>\oobe\html\mouse\images\bulzano.jpg
<SYSTEM32>\oobe\html\mouse\images\heidelb.jpg
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\down.bmp
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\greendot.jpg
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\up.bmp
<SYSTEM32>\oobe\html\mouse\images\paris.jpg
<SYSTEM32>\oobe\html\mouse\images\venicem.jpg
<SYSTEM32>\oobe\html\mouse\images\veronam.jpg
<SYSTEM32>\oobe\images\backdown.jpg
<SYSTEM32>\oobe\html\mouse\images\pisam.jpg
<SYSTEM32>\oobe\html\mouse\images\praguem.jpg
<SYSTEM32>\oobe\html\mouse\images\tyrol.jpg
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendVoice.bmp
%WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_normal.bmp
%WINDIR%\pchealth\helpctr\System\images\32x32\logo.bmp
%WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_generic.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\tools.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\update.bmp
%WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mousedown.bmp
%WINDIR%\pchealth\helpctr\System\images\icon_blank_12x.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\HelpCenter.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Quit.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendFile.bmp
%WINDIR%\pchealth\helpctr\System\images\icon_newwindow_12x.bmp
%WINDIR%\pchealth\helpctr\System\images\icon_tours_12x.bmp
%WINDIR%\pchealth\helpctr\System\images\icon_tutorials_12x.bmp
%WINDIR%\Web\Wallpaper\Bliss.bmp
%WINDIR%\Web\Wallpaper\Crystal.jpg
%WINDIR%\Web\Wallpaper\Home.jpg
<SYSTEM32>\oobe\images\wpatop.jpg
<SYSTEM32>\setup.bmp
%WINDIR%\Web\Wallpaper\Azul.jpg
%WINDIR%\Web\Wallpaper\Moon flower.jpg
%WINDIR%\Web\Wallpaper\Red moon desert.jpg
%WINDIR%\Web\Wallpaper\Wind.jpg
%WINDIR%\Zapotec.bmp
%WINDIR%\Web\Wallpaper\Peace.jpg
%WINDIR%\Web\Wallpaper\Power.jpg
%WINDIR%\Web\Wallpaper\Purple flower.jpg
<SYSTEM32>\oobe\images\wpakey.jpg
<SYSTEM32>\oobe\images\newmark1.jpg
<SYSTEM32>\oobe\images\newmark8.jpg
<SYSTEM32>\oobe\images\nextdown.jpg
<SYSTEM32>\oobe\images\backover.jpg
<SYSTEM32>\oobe\images\backup.jpg
<SYSTEM32>\oobe\images\mslogo.jpg
<SYSTEM32>\oobe\images\nextover.jpg
<SYSTEM32>\oobe\images\skipover.jpg
<SYSTEM32>\oobe\images\skipup.jpg
<SYSTEM32>\oobe\images\wpabtm.jpg
<SYSTEM32>\oobe\images\nextup.jpg
<SYSTEM32>\oobe\images\oemcoa.jpg
<SYSTEM32>\oobe\images\skipdown.jpg
%WINDIR%\Help\Tours\htmlTour\control_up.jpg
%WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg
%WINDIR%\Help\Tours\htmlTour\folder_up.jpg
%WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\icon_up.jpg
%WINDIR%\Help\Tours\htmlTour\intro_logo.jpg
%WINDIR%\Help\Tours\htmlTour\question_icon.jpg
%WINDIR%\Help\Tours\htmlTour\read_icon.jpg
%WINDIR%\Help\Tours\htmlTour\img004b.jpg
%WINDIR%\Help\Tours\htmlTour\img033a.jpg
%WINDIR%\Help\Tours\htmlTour\img074a.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\best_road.jpg
%WINDIR%\Help\Tours\htmlTour\best_road_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg
%WINDIR%\Coffee Bean.bmp
%WINDIR%\FeatherTexture.bmp
%WINDIR%\Greenstone.bmp
%WINDIR%\Help\Tours\htmlTour\best_robust.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\header.bmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SplashScreen.bmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\watermark.bmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\header.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\arrow_blue_normal_shadow.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\compat.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\errmsg.bmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SplashScreen.bmp
%WINDIR%\pchealth\helpctr\System\blurbs\watermark_300x.bmp
%WINDIR%\pchealth\helpctr\System\DVDUpgrd\stripe.jpg
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\logo.bmp
%WINDIR%\Help\Tours\htmlTour\ul_logo.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\window_up.jpg