Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Paint.exe' = '%APPDATA%\Paint.exe'
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn1.exe
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\vicwconn1.ico
- %PROGRAM_FILES%\Internet Explorer\vIEXPLORE.ico
- %PROGRAM_FILES%\Internet Explorer\RCX9.tmp
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\vicwconn2.ico
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\RCXB.tmp
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\RCXA.tmp
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn2.exe
- %PROGRAM_FILES%\FireFox\xpt_link.exe
- %PROGRAM_FILES%\FireFox\uninstall\helper.exe
- %PROGRAM_FILES%\FireFox\xpidl.exe
- %PROGRAM_FILES%\FireFox\xpt_dump.exe
- %PROGRAM_FILES%\Internet Explorer\iedw.exe
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE
- %PROGRAM_FILES%\FireFox\uninstall\vhelper.ico
- %PROGRAM_FILES%\FireFox\uninstall\RCX8.tmp
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwrmind.exe
- %PROGRAM_FILES%\Movie Maker\moviemk.exe
- %PROGRAM_FILES%\Movie Maker\vmoviemk.ico
- %PROGRAM_FILES%\Messenger\vmsmsgs.ico
- %PROGRAM_FILES%\Messenger\RCXE.tmp
- %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\vmsnsusii.ico
- %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\RCX10.tmp
- %PROGRAM_FILES%\Movie Maker\RCXF.tmp
- %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\msnsusii.exe
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\vinetwiz.ico
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\RCXC.tmp
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwtutor.exe
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\inetwiz.exe
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\RCXD.tmp
- %PROGRAM_FILES%\Messenger\msmsgs.exe
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\isignup.exe
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\visignup.ico
- %CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE
- %CommonProgramFiles%\Microsoft Shared\DW\vDW20.ico
- C:\Far\RCX2.tmp
- C:\Far\Plugins\ffpd.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\vmsinfo32.ico
- %CommonProgramFiles%\Microsoft Shared\DW\RCX3.tmp
- %CommonProgramFiles%\Microsoft Shared\DW\DWTRIG20.EXE
- C:\Paint
- C:\Far\Far.exe
- %APPDATA%\Paint.exe
- C:\hold.inf
- C:\Far\UnInstall.exe
- C:\Far\vUnInstall.ico
- C:\Far\vFar.ico
- C:\Far\RCX1.tmp
- %CommonProgramFiles%\Microsoft Shared\MSInfo\RCX4.tmp
- %PROGRAM_FILES%\FireFox\plugin-container.exe
- %PROGRAM_FILES%\FireFox\shlibsign.exe
- %PROGRAM_FILES%\FireFox\mangle.exe
- %PROGRAM_FILES%\FireFox\nsinstall.exe
- %PROGRAM_FILES%\FireFox\RCX7.tmp
- %PROGRAM_FILES%\FireFox\xpcshell.exe
- %PROGRAM_FILES%\FireFox\updater.exe
- %PROGRAM_FILES%\FireFox\vupdater.ico
- %PROGRAM_FILES%\FireFox\vcrashreporter.ico
- %PROGRAM_FILES%\FireFox\RCX5.tmp
- %CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe
- %PROGRAM_FILES%\FireFox\crashreporter.exe
- %PROGRAM_FILES%\FireFox\RCX6.tmp
- %PROGRAM_FILES%\FireFox\js.exe
- %PROGRAM_FILES%\FireFox\firefox.exe
- %PROGRAM_FILES%\FireFox\vfirefox.ico
Присваивает атрибут 'скрытый' для следующих файлов:
- C:\Paint
- C:\autorun.inf
Удаляет следующие файлы:
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\vicwconn1.ico
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn2.exe
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\vicwconn2.ico
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn1.exe
- %PROGRAM_FILES%\FireFox\uninstall\vhelper.ico
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE
- %PROGRAM_FILES%\Internet Explorer\vIEXPLORE.ico
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\inetwiz.exe
- %PROGRAM_FILES%\Messenger\vmsmsgs.ico
- %PROGRAM_FILES%\Movie Maker\moviemk.exe
- %PROGRAM_FILES%\Movie Maker\vmoviemk.ico
- %PROGRAM_FILES%\Messenger\msmsgs.exe
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\vinetwiz.ico
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\isignup.exe
- %PROGRAM_FILES%\Internet Explorer\Connection Wizard\visignup.ico
- %CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE
- %CommonProgramFiles%\Microsoft Shared\DW\vDW20.ico
- %CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe
- C:\Far\vUnInstall.ico
- C:\Far\Far.exe
- C:\Far\vFar.ico
- C:\Far\UnInstall.exe
- %CommonProgramFiles%\Microsoft Shared\MSInfo\vmsinfo32.ico
- %PROGRAM_FILES%\FireFox\updater.exe
- %PROGRAM_FILES%\FireFox\vupdater.ico
- %PROGRAM_FILES%\FireFox\uninstall\helper.exe
- %PROGRAM_FILES%\FireFox\vfirefox.ico
- %PROGRAM_FILES%\FireFox\crashreporter.exe
- %PROGRAM_FILES%\FireFox\vcrashreporter.ico
- %PROGRAM_FILES%\FireFox\firefox.exe
