Trojan.MulDrop3.34864

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%HOMEPATH%\UpBackup\UpdateOffice.exe

Вредоносные функции:

Создает и запускает на исполнение:

%HOMEPATH%\PrintHood\UpdateOffice.exe
%HOMEPATH%\UpBackup\UpdateOffice.exe

Запускает на исполнение:

<SYSTEM32>\cmd.exe /c ""%HOMEPATH%\PrintHood\pangtip.bat" "
<SYSTEM32>\ping.exe www.ma##kil.in
<SYSTEM32>\rundll32.exe <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %HOMEPATH%\My Documents\<Имя вируса>.exe.JPG
<SYSTEM32>\cmd.exe /c ""%HOMEPATH%\PrintHood\100.bat" "

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\PrintHood\~FGTbnmpad1eyZ9z0NzhH.TMP
%HOMEPATH%\PrintHood\~tEP5I2BdxMzNU6Du5Y3q.TMP
%HOMEPATH%\PrintHood\~oAHvnT1LDwToMRk5fMzc.TMP
%HOMEPATH%\PrintHood\~aJLIeTdneuPeoXHXh60q.TMP
%HOMEPATH%\PrintHood\eKLmxp9Mwh.PRI
%HOMEPATH%\PrintHood\BZOuDCM3oi.PRI
%HOMEPATH%\PrintHood\CSBWrBzCrG.PRI
%HOMEPATH%\PrintHood\v0NbCb62Rr.PRI
%HOMEPATH%\PrintHood\civ7LXp9nu.PRI
%HOMEPATH%\PrintHood\~1n9cxLIOVxgC2wB5jmPB.TMP
%HOMEPATH%\PrintHood\~pRCFUFKNRnAg9AAfMKlR.TMP
%HOMEPATH%\PrintHood\~rQqOl0fUM8Yl0au3T6u1.TMP
%HOMEPATH%\PrintHood\~sC2Tkg6TzN2UBieBF2mC.TMP
%HOMEPATH%\PrintHood\~KUvM1PDLFDDPTeatIszy.TMP
%HOMEPATH%\PrintHood\~fiZlLZtyfNpCWAF7WaYD.TMP
%HOMEPATH%\PrintHood\~e3bfQviURm2rfBRn3jxw.TMP
%HOMEPATH%\PrintHood\~nOoSxBDbHZn9OxlyzjBk.TMP
%HOMEPATH%\PrintHood\~EIvQUDuTXP5hanRo7004.TMP
%HOMEPATH%\PrintHood\~vCtVHVNTcIAfuNZQqXUT.TMP
%HOMEPATH%\PrintHood\VrjJPCuHQ9.PRI
%HOMEPATH%\PrintHood\CIe1ykVgZO.PRI
%HOMEPATH%\PrintHood\KM1Zisz0OK.PRI
%HOMEPATH%\PrintHood\Buv2z1x0sw.PRI
%HOMEPATH%\PrintHood\mChGOv1XwH.PRI
%HOMEPATH%\PrintHood\w1QO4oZ4D8.PRI
%HOMEPATH%\PrintHood\iR7HBH1uNX.PRI
%HOMEPATH%\PrintHood\S11q9udIry.PRI
%HOMEPATH%\PrintHood\cHwgszFviZ.PRI
%HOMEPATH%\PrintHood\zv3p5I5MuB.PRI
%HOMEPATH%\PrintHood\36QLu1D2OF.PRI
%HOMEPATH%\PrintHood\Lt7gSUND5e.PRI
%HOMEPATH%\PrintHood\CVjdYMrIyq.PRI
%HOMEPATH%\PrintHood\B8ELKiwX2E.PRI
%HOMEPATH%\PrintHood\SyVLCbkEMf.PRI
%HOMEPATH%\PrintHood\ONBliaW3ib.PRI
%HOMEPATH%\PrintHood\rG9pZcUTRS.PRI
%HOMEPATH%\PrintHood\yQzibHJ9HA.PRI
%HOMEPATH%\PrintHood\BgZxA3sbYX.PRI
%HOMEPATH%\PrintHood\gGC2jgl8DE.PRI
%HOMEPATH%\PrintHood\~K2NqMEo6zAYVFOE82Yhi.TMP
%HOMEPATH%\PrintHood\~NJzfqCGZl0hRedpUF1mY.TMP
%HOMEPATH%\PrintHood\~eSvw7F4g2l5aPdTAENAh.TMP
%HOMEPATH%\PrintHood\~vvmGrtGs5Lb31cZpkl6I.TMP
%HOMEPATH%\PrintHood\~AGzFOO9c4fYfdvImE2VT.TMP
%HOMEPATH%\PrintHood\~2mgflNEdqpCYSdJwjfia.TMP
%HOMEPATH%\PrintHood\~QxIJTtqbvwPndbVsQnF2.TMP
%HOMEPATH%\PrintHood\~89x19VJr0MhHls0ORfAK.TMP
%HOMEPATH%\PrintHood\~1zyu7SoxqedV9Omrn4g2.TMP
%HOMEPATH%\PrintHood\~306koi91sKd1G1930rYp.TMP
%HOMEPATH%\PrintHood\~lIy73AJ5y2m2lABekMZH.TMP
%HOMEPATH%\PrintHood\~9WBibWemOA0kmNx0twNr.TMP
%HOMEPATH%\PrintHood\~BxkSLvVLycrvo0GOFuZB.TMP
%HOMEPATH%\PrintHood\~hS33c2Oe7GSQeXawwMbZ.TMP
%HOMEPATH%\PrintHood\~id7ClUDcx6oY0UqVKLLa.TMP
%HOMEPATH%\PrintHood\~IkO8XjGKM80NMODVSZ9Y.TMP
%HOMEPATH%\PrintHood\~SQFejPMIu1cUCS6LvLSE.TMP
%HOMEPATH%\PrintHood\~uXLRScUUF1yMppBW3o5R.TMP
%HOMEPATH%\PrintHood\~bcJHIrRx1XiDBvZQ0rJb.TMP
%HOMEPATH%\PrintHood\~0booho0KZHbuEGgmSbOY.TMP
%HOMEPATH%\PrintHood\~w7bqIYNg7R8XDldswVCG.TMP
%HOMEPATH%\PrintHood\~JyLN3yaf7FnyHXOmVp4p.TMP
%HOMEPATH%\PrintHood\~VkEAg6VbteMtwxA4CKGq.TMP
%HOMEPATH%\PrintHood\~dBABqlBzaWkd5dApOnfW.TMP
%HOMEPATH%\PrintHood\~Mg7IbSNwVhwNxaLtmZQI.TMP
%HOMEPATH%\PrintHood\~gABTzWTzaa4XEQJFslgR.TMP
%HOMEPATH%\PrintHood\~jtubaekEcTaYIoRE0yFO.TMP
%HOMEPATH%\PrintHood\~W0MJPgP8LWCj7YpfOoix.TMP
%HOMEPATH%\PrintHood\~6VDZkzuGOv7V1tTo7LNe.TMP
%HOMEPATH%\PrintHood\~1sh1p5ZotdngC5YjBmMW.TMP
%HOMEPATH%\PrintHood\~gbQQzrirJxthzkbIhmC7.TMP
%HOMEPATH%\PrintHood\~xNmk0p5yX3vpcYlgKI71.TMP
%HOMEPATH%\PrintHood\~Jzq5dvZjfFycLiO1iazx.TMP
%HOMEPATH%\PrintHood\~EWZUopw2ZvZXnAhGAIZu.TMP
%HOMEPATH%\PrintHood\~jN2vpTFcsL9ELGO3oic4.TMP
%HOMEPATH%\PrintHood\~DZWApKnvRHgpTSoEIQE9.TMP
%HOMEPATH%\PrintHood\~n4hDWc1LlNPVMDxVtltb.TMP
%HOMEPATH%\PrintHood\~I3zwosYOG7a7mmEGsKWJ.TMP
%HOMEPATH%\PrintHood\~kr00m5NpQ39eIpLztCn4.TMP
%HOMEPATH%\PrintHood\~qdzcp0Czt0qy650M0io3.TMP
%HOMEPATH%\PrintHood\mpNDusv3ho.PRI
%HOMEPATH%\PrintHood\pdqA9MiEon.dll
%HOMEPATH%\PrintHood\70ec0nJEG6.dll
%HOMEPATH%\PrintHood\zVu65TdBPR.dll
%HOMEPATH%\PrintHood\vGNwS4Nc1W.dll
%HOMEPATH%\PrintHood\C4bEp9qDWP.dll
%HOMEPATH%\PrintHood\FfBcehDeaK.dll
%HOMEPATH%\PrintHood\TPCpfYGD7X.dll
%HOMEPATH%\PrintHood\GSCBOIktpz.dll
%HOMEPATH%\PrintHood\6Hdew9RoUn.dll
%HOMEPATH%\PrintHood\RoIFOK4EJ1.dll
%HOMEPATH%\PrintHood\FeluCtch6m.dll
%HOMEPATH%\PrintHood\JN4KU4xJrz.dll
%HOMEPATH%\PrintHood\bxXUnI2UPg.dll
%HOMEPATH%\PrintHood\c38uQDq74X.dll
%HOMEPATH%\PrintHood\PeNN80oFA6.dll
%HOMEPATH%\PrintHood\fnklPJ44ad.dll
%HOMEPATH%\PrintHood\ypFKfUJ5Sj.dll
%HOMEPATH%\PrintHood\J7Wqt6IxLY.dll
%HOMEPATH%\PrintHood\cyQgJbDzwu.dll
%HOMEPATH%\PrintHood\wC7S682TWt.dll
%HOMEPATH%\PrintHood\QWw4dk4XIQ.dll
%HOMEPATH%\PrintHood\q5OmCBv3NZ.dll
%HOMEPATH%\PrintHood\LKGtryVU8i.dll
%HOMEPATH%\PrintHood\dYkVwbuMyA.dll
%HOMEPATH%\PrintHood\NM6TGbaTnt.dll
%HOMEPATH%\PrintHood\pangtip.bat
%HOMEPATH%\PrintHood\UPDATE~1.EXE.pkxm
%HOMEPATH%\PrintHood\zYDqAO4sWv.dll
%HOMEPATH%\Templates\nam.dll
%HOMEPATH%\PrintHood\GW6zXXh26J.dll
%HOMEPATH%\PrintHood\1rF4LA1Vt2.dll
%HOMEPATH%\PrintHood\jC2EpZmvaw.dll
%HOMEPATH%\PrintHood\YATOmO8JEw.dll
%HOMEPATH%\PrintHood\2TDyCT5qO0.dll
%HOMEPATH%\PrintHood\xDV8gitmjY.dll
%HOMEPATH%\PrintHood\3HMcmKfEhr.dll
%HOMEPATH%\PrintHood\0YtUTyoSmK.dll
%HOMEPATH%\PrintHood\QY3roDnbtU.dll
%HOMEPATH%\PrintHood\iYMV0zgZXl.dll
%HOMEPATH%\PrintHood\3HDNaEoZnh.dll
%HOMEPATH%\PrintHood\vko2eOjp1E.PRI
%HOMEPATH%\PrintHood\rlOymNaNG5.PRI
%HOMEPATH%\PrintHood\DChrTorBTF.PRI
%HOMEPATH%\PrintHood\G0H3YgpYbY.PRI
%HOMEPATH%\PrintHood\jGwGJtOrse.PRI
%HOMEPATH%\PrintHood\HyN5UDTMaU.PRI
%HOMEPATH%\PrintHood\oXQzEA76lf.PRI
%HOMEPATH%\PrintHood\TzERX8GiDX.PRI
%HOMEPATH%\PrintHood\lv5nXJHqwP.PRI
%HOMEPATH%\PrintHood\5C0SpbG4ah.PRI
%HOMEPATH%\PrintHood\HcOQi7zuFN.PRI
%HOMEPATH%\PrintHood\ZwUCnQ22xh.PRI
%HOMEPATH%\PrintHood\5dN3GMkfR8.PRI
%HOMEPATH%\PrintHood\byNdNkJ5mW.PRI
%HOMEPATH%\PrintHood\J8oCi1tbUK.PRI
%HOMEPATH%\PrintHood\BC9mPM1nVw.PRI
%HOMEPATH%\PrintHood\AyueF8mqsE.PRI
%HOMEPATH%\PrintHood\wSPdMnNZmQ.PRI
%HOMEPATH%\PrintHood\2zJlpc7iWm.PRI
%HOMEPATH%\PrintHood\LCf50TYOyn.PRI
%HOMEPATH%\PrintHood\WXu5oV4Eag.dll
%HOMEPATH%\PrintHood\y3AfP894DE.dll
%HOMEPATH%\PrintHood\VW25Ibn1iU.dll
%HOMEPATH%\PrintHood\Xgbwku36ko.dll
%HOMEPATH%\PrintHood\Xzhgx0L1zw.dll
%HOMEPATH%\PrintHood\2A0z7TSoJr.dll
%HOMEPATH%\PrintHood\CH107YxscY.dll
%HOMEPATH%\PrintHood\hrnfC9GqLE.dll
%HOMEPATH%\PrintHood\G2yLDZrdQs.dll
%HOMEPATH%\PrintHood\B9iT55WyB6.dll
%HOMEPATH%\PrintHood\VuCauuAEGz.PRI
%HOMEPATH%\PrintHood\ijdTKMByKL.PRI
%HOMEPATH%\PrintHood\ODORzWnAwS.PRI
%HOMEPATH%\PrintHood\aGe5paO45s.PRI
%HOMEPATH%\PrintHood\yg5zGWz9dX.PRI
%HOMEPATH%\PrintHood\6MAEcwBGw7.dll
%HOMEPATH%\PrintHood\0v7hHFJhL3.dll
%HOMEPATH%\PrintHood\RayQ6aXQYz.dll
%HOMEPATH%\PrintHood\qgIE5oS18V.dll
%HOMEPATH%\PrintHood\~wq9KSXJNPtEtw4Ocwypd.TMP
%HOMEPATH%\PrintHood\~7agp8rhDFh9Z3wD59fCX.TMP
%HOMEPATH%\PrintHood\~RTNNgVTNMyEIAQ1e903E.TMP
%HOMEPATH%\PrintHood\~8gSaGsGpKEtWp9t52n1c.TMP
%HOMEPATH%\PrintHood\~vNtGVkksdgcioBtZGuo9.TMP
%HOMEPATH%\PrintHood\~xBPo7rAGurF7jE9LZeiL.TMP
%HOMEPATH%\PrintHood\~uppzjQLi0X2wcKHQcxcL.TMP
%HOMEPATH%\PrintHood\~dU2fP3eK8vt5OrGv2mdb.TMP
%HOMEPATH%\PrintHood\~xGM9X8syTqOD3X6P7TKR.TMP
%HOMEPATH%\PrintHood\~TyM75dhZ0YIoQeH1wQhg.TMP
%HOMEPATH%\PrintHood\~Fne23NrU3XBWxiYyL9VI.TMP
%HOMEPATH%\PrintHood\~47pYogi5Ws2UlVIxrF6x.TMP
%HOMEPATH%\PrintHood\~xY6Eu7p7CmDV9wwL8Vah.TMP
%HOMEPATH%\PrintHood\~22GuM6BMq0UAmnwgUl8H.TMP
%HOMEPATH%\PrintHood\~uE7dkN82nFtURfQn0LoJ.TMP
%HOMEPATH%\PrintHood\~FzPxHSlwWqsYP3CcAhQt.TMP
%HOMEPATH%\PrintHood\~0COVsmbU2nQLuOrssFWy.TMP
%HOMEPATH%\PrintHood\~kAfoMJ9TfE300D7pCyLW.TMP
%HOMEPATH%\PrintHood\~7pIf8tI0tEhIFXdVEDJg.TMP
%HOMEPATH%\PrintHood\~hwQTU9dW47rQ1shb8Qhq.TMP
%HOMEPATH%\PrintHood\~QVnpcsEh0S5RNgCBgiH0.TMP
%HOMEPATH%\PrintHood\~jxtWDht42ek96s2ZINeG.TMP
%HOMEPATH%\PrintHood\~mQeWqrtUchFBGhCyRzWe.TMP
%HOMEPATH%\PrintHood\~XVsoYZjcOWh4P8gKZIZ5.TMP
%HOMEPATH%\PrintHood\~ZW99A7qsK1fdTluvMejZ.TMP
%HOMEPATH%\PrintHood\~Tfps3Aby0EK1QJpXJTHD.TMP
%HOMEPATH%\PrintHood\~7PklbdjvezSIs2bKSe2s.TMP
%HOMEPATH%\PrintHood\~BzgZv64ocZ5CVjOZ5cRn.TMP
%HOMEPATH%\PrintHood\~SwDm7rNOB764hi9pEUxV.TMP
%HOMEPATH%\PrintHood\~dtsfqPzT4ZjZ8YMVOe4c.TMP
%HOMEPATH%\PrintHood\~K4gShtHwYqJ6mCEaD7YJ.TMP
%HOMEPATH%\PrintHood\~Gk2SheQmebfl7lW33naM.TMP
%HOMEPATH%\PrintHood\~m2m7naTYWaiqy4zoYHKQ.TMP
%HOMEPATH%\PrintHood\~BkWgEUSq5XScijLlZrVd.TMP
%HOMEPATH%\PrintHood\~5YGwuH9boNBijqDebQXG.TMP
%HOMEPATH%\PrintHood\~xffO6byoHC7OvYwtBihr.TMP
%HOMEPATH%\PrintHood\~4SJYz7PTRHYHzUpstXuP.TMP
%HOMEPATH%\PrintHood\~oIG0C2X4F9kudPp1Sv7u.TMP
%HOMEPATH%\PrintHood\~Dw6SiakCYJc73nhnDx2Y.TMP
%HOMEPATH%\PrintHood\~V9ZJMQaktxD4MkWRFIiH.TMP
%HOMEPATH%\PrintHood\~eEcAoqISCUuUOm9l77NB.TMP
%HOMEPATH%\PrintHood\~sGqYbeTVOtdE4o9JAraA.TMP
%HOMEPATH%\Recent\<Имя вируса>.exe.lnk
%HOMEPATH%\PrintHood\xdat.dll
%HOMEPATH%\PrintHood\~v6VBvKRUhpLqLyT9TDIJ.TMP
%HOMEPATH%\PrintHood\~FPcy7TcSzLDL5AxigQ6R.TMP
%HOMEPATH%\PrintHood\~WZ4VgMsn0vLSFuse0ISk.TMP
%HOMEPATH%\PrintHood\~GfXXrTSwrLSAmSS1z7oJ.TMP
%HOMEPATH%\PrintHood\~M4m4fWg3TfHsL8XxFTLO.TMP
%HOMEPATH%\PrintHood\100.bat
%HOMEPATH%\PrintHood\BIE.dll
%HOMEPATH%\PrintHood\FIE.dll
%HOMEPATH%\PrintHood\SHK.dll
%HOMEPATH%\PrintHood\SIK.dll
%HOMEPATH%\PrintHood\Roze.dll
%HOMEPATH%\My Documents\<Имя вируса>.exe.JPG
%HOMEPATH%\PrintHood\UpdateOffice.exe
%HOMEPATH%\PrintHood\mahdi.txt
%HOMEPATH%\My Documents\<Имя вируса>.exe.txt
%HOMEPATH%\PrintHood\~7cLVJpO7W6HhLT30trAO.TMP
%HOMEPATH%\PrintHood\~J0cLL1ZpKcHZOM8jH9oL.TMP
%HOMEPATH%\PrintHood\~u1H2YubMwEdwu0Llix4R.TMP
%HOMEPATH%\PrintHood\~dFmT21QZSht6929XGwSR.TMP
%HOMEPATH%\PrintHood\~ecqYN7xJA5gxYQuAnkTC.TMP
%HOMEPATH%\PrintHood\~O2Eunm2Ucs5P4wKTmHF6.TMP
%HOMEPATH%\PrintHood\~WMwf7pumSOeBbxJ20Hnj.TMP
%HOMEPATH%\PrintHood\~b2mIKMEpuuNdMZAKv2go.TMP
%HOMEPATH%\PrintHood\~Mp0DE0dhfl4MtDRFPkBj.TMP
%HOMEPATH%\PrintHood\~hXu5MFbcRnEzWzrLgC6g.TMP
%HOMEPATH%\PrintHood\~jubJuUX18BBed86ZgyKA.TMP
%HOMEPATH%\PrintHood\~whXZXpCsy1mEUjph7Z9E.TMP
%HOMEPATH%\PrintHood\~EnjhdFm09EuRre5wrpGv.TMP
%HOMEPATH%\PrintHood\~NAJJEzv6odBrXcYNVItt.TMP
%HOMEPATH%\PrintHood\~fbE2SYgNGKv7HpDEBHnN.TMP
%HOMEPATH%\PrintHood\~FjCfzqe3twX1e9EdHR5s.TMP
%HOMEPATH%\PrintHood\~PUoxWITIOAbNOxC2dmLg.TMP
%HOMEPATH%\PrintHood\~503VwMSkWlpyobZkPYL6.TMP
%HOMEPATH%\PrintHood\~2CZkRemDOzsb4B5mZEBh.TMP
%HOMEPATH%\PrintHood\~jHtbkt7BIN6DYLhlGI6I.TMP
%HOMEPATH%\PrintHood\~8mtuqHV7sHOkvCVetQpi.TMP
%HOMEPATH%\PrintHood\~IlGH8Lj0b7aT5LkhO9Kj.TMP
%HOMEPATH%\PrintHood\~AjcFIKmv0A7PNmMXGd5P.TMP
%HOMEPATH%\PrintHood\~mXD95bDrnmzZVzzLHZd4.TMP
%HOMEPATH%\PrintHood\~gXoQaXkiOQvr75PEGFIM.TMP
%HOMEPATH%\PrintHood\~hpLlWInIQI8AZxfR37xA.TMP
%HOMEPATH%\PrintHood\~MnDF2tFBOay8e4bijwlV.TMP
%HOMEPATH%\PrintHood\~6sx8WO4awejCncSgUZc1.TMP
%HOMEPATH%\PrintHood\~X3qm7Fgf1QCZlfp0U6FR.TMP
%HOMEPATH%\PrintHood\~hiub72qXuUWYtJPZAt0V.TMP
%HOMEPATH%\PrintHood\~KVvUxEpLpCg2MFS4kcdl.TMP
%HOMEPATH%\PrintHood\~hEwwrPP6TRYO8ijDjqVs.TMP
%HOMEPATH%\PrintHood\~3b5ZPR6KxVbNgvb16jWX.TMP
%HOMEPATH%\PrintHood\~Dqnwvt6MtoxyswxlxZii.TMP
%HOMEPATH%\PrintHood\~jVycDmFFsOLXdlYOxUI0.TMP
%HOMEPATH%\PrintHood\~7K2kPdXHUqolwZhomtU4.TMP
%HOMEPATH%\PrintHood\~tQPzSc6aEKK56hDBaRg2.TMP
%HOMEPATH%\PrintHood\~NnlRHthialQzjrBQ0B1u.TMP
%HOMEPATH%\PrintHood\~ISGCd0bdxi91ZdIKjJPR.TMP
%HOMEPATH%\PrintHood\~wzisfDKfMMe9Jhlu4An5.TMP
%HOMEPATH%\PrintHood\~hXAoDzVTa8rvhAbEWuMT.TMP
%HOMEPATH%\PrintHood\~m4YcFfSLXlD6gf3pUG5Q.TMP
%HOMEPATH%\PrintHood\~FNMp75fgPwu9N6c7z6Dm.TMP
%HOMEPATH%\PrintHood\~mCXIOnjx8RMLYuQBq1Rp.TMP
%HOMEPATH%\PrintHood\~AAUduF9cwCUY5ZbmouZS.TMP
%HOMEPATH%\PrintHood\~shI3qSQ0uUJLJkZ72kbp.TMP
%HOMEPATH%\PrintHood\~aCuUYmh5HSJyfYkFbBye.TMP
%HOMEPATH%\PrintHood\~4J2iuF6xdXYGPzC0N8DF.TMP
%HOMEPATH%\PrintHood\~sehV5LuTJ1LC1d1fZ480.TMP
%HOMEPATH%\PrintHood\~2Tg2KjfwTBVbZoVMXo26.TMP
%HOMEPATH%\PrintHood\~Sr8YfzgVQVPCuRT7ETfC.TMP
%HOMEPATH%\PrintHood\~H8ZDlpenju6riCUJZG2z.TMP
%HOMEPATH%\PrintHood\~rPJKl7WBxBzCev0Woe77.TMP
%HOMEPATH%\PrintHood\~bDXQVcRI2TlJNuTttFfz.TMP
%HOMEPATH%\PrintHood\~qdJrqN4pvjiY2ZgwdtVh.TMP
%HOMEPATH%\PrintHood\~uewZSab7YgDfkTIzIta3.TMP
%HOMEPATH%\PrintHood\~tagyuebsVCNsule46hPp.TMP
%HOMEPATH%\PrintHood\~2j6Bhah9poj7itQWzjfK.TMP
%HOMEPATH%\PrintHood\~urMdr0ZeQuDbSUh2Yvc2.TMP
%HOMEPATH%\PrintHood\~iATV0pkEnmclzeaStKLz.TMP
%HOMEPATH%\PrintHood\~hpmdXwZIyjzvSu5Twb89.TMP
%HOMEPATH%\PrintHood\~KS1Z7WmbK8iRyNt93j15.TMP
%HOMEPATH%\PrintHood\~gY6dWu26Jn8SGagZT7nw.TMP
%HOMEPATH%\PrintHood\~GvDOVYJkHKU9YV90dK0w.TMP
%HOMEPATH%\PrintHood\~L2UvTlpRoyPqN52a7FfP.TMP
%HOMEPATH%\PrintHood\~v7vnKBkXLXnKjBRv1yth.TMP
%HOMEPATH%\PrintHood\~m2r6YBYUnCZbpRPDaiG7.TMP
%HOMEPATH%\PrintHood\~3DhJyeUKQW3vBWkftmqn.TMP
%HOMEPATH%\PrintHood\~g7WjdlU4APRabagA8gDa.TMP
%HOMEPATH%\PrintHood\~ebd9blFl3OMcIl6KaL9J.TMP
%HOMEPATH%\PrintHood\~WenFag06tSV4DVlmUAMR.TMP
%HOMEPATH%\PrintHood\~JdwinNg1Y68voEgyRn4w.TMP
%HOMEPATH%\PrintHood\~Fb5zF0T4H4QwDL0Lat4j.TMP
%HOMEPATH%\PrintHood\~J6ZSymx8thwjwmZ7Bngb.TMP
%HOMEPATH%\PrintHood\~s2vQJl7Dt9xLDICxIcsN.TMP
%HOMEPATH%\PrintHood\~m3IKlywpB2T21rWz0YYG.TMP
%HOMEPATH%\PrintHood\~KqCGCbw4o3zM3dVn2o7K.TMP
%HOMEPATH%\PrintHood\~pW08JfcdCTMOXDbsk90V.TMP
%HOMEPATH%\PrintHood\~qS6gt2SJSfAqfyFms7ks.TMP
%HOMEPATH%\PrintHood\~PFXQF3mPMg5sWCc8FzjZ.TMP
%HOMEPATH%\PrintHood\~yMdtfOMFOQavnFa6Fipx.TMP
%HOMEPATH%\PrintHood\~jjrhWszDCsDoMn1OIh1b.TMP
%HOMEPATH%\PrintHood\~PKfSMPimrfkRqZPGK8rA.TMP
%HOMEPATH%\PrintHood\~cZVP4RzblAGXQEEaI80c.TMP
%HOMEPATH%\PrintHood\~veGhwIifgh81WkROOOZX.TMP
%HOMEPATH%\PrintHood\~upUWolP9vSrQzB0t942w.TMP
%HOMEPATH%\PrintHood\~Kj1LPjYahkB7jy2rYJRM.TMP
%HOMEPATH%\PrintHood\~iqjoufuEJjY9V9l7YN06.TMP
%HOMEPATH%\PrintHood\~hKbFaMuUXSfZsJM4SjjX.TMP
%HOMEPATH%\PrintHood\~xhro6ML3JF0nGlaTBtV3.TMP
%HOMEPATH%\PrintHood\~efy7tIfQY3dvNtEe3LJJ.TMP
%HOMEPATH%\PrintHood\~huqc6yMOolMG5fDxZnji.TMP
%HOMEPATH%\PrintHood\~w6zHuaiZewkyqkQzFkOu.TMP
%HOMEPATH%\PrintHood\~oMkVs7xKzl5HG2ZV27fM.TMP
%HOMEPATH%\PrintHood\~I4XiS4uEpz5pOxotXDdH.TMP
%HOMEPATH%\PrintHood\~ug1sPJsxC9KHPgH80grU.TMP
%HOMEPATH%\PrintHood\~fq2f0ELNBRxggTuh9zt6.TMP
%HOMEPATH%\PrintHood\~2Ho8qXfylvo1BXJuuuaD.TMP
%HOMEPATH%\PrintHood\~xPKmrEIApbTgG4TvB0np.TMP
%HOMEPATH%\PrintHood\~sZzFaiSPHeur32nlGUdV.TMP

Удаляет следующие файлы:

%HOMEPATH%\PrintHood\pangtip.bat
%HOMEPATH%\My Documents\<Имя вируса>.exe.txt

Сетевая активность:

UDP:

DNS ASK www.ma##kil.in
'<IP-адрес в локальной сети>':1037

Другое:

Ищет следующие окна:

ClassName: '' WindowName: 'http://www.majakil.in/ - u!u!u!u! - Windows Internet Explorer'
ClassName: '' WindowName: 'u!u!u!u! - Microsoft Internet Explorer'
ClassName: '' WindowName: 'http://www.majakil.in/ - u!u!u!u! - Microsoft Internet Explorer'
ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: 'u!u!u!u! - Windows Internet Explorer'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней