Поддержка
Круглосуточная поддержка

Позвоните

Бесплатно по России:
8-800-333-79-32

ЧаВо | Форум

Ваши запросы

  • Все: -
  • Незакрытые: -
  • Последний: -

Позвоните

Бесплатно по России:
8-800-333-79-32

Свяжитесь с нами Незакрытые запросы: 

Профиль

Профиль

Win32.HLLW.Autoruner2.17582

Добавлен в вирусную базу Dr.Web: 2014-10-06

Описание добавлено:

Техническая информация

Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
  • [<HKLM>\SOFTWARE\Classes\docfile\shell\open\command] '' = '<SYSTEM32>\service.exe'
  • [<HKLM>\SOFTWARE\Classes\jpgfile\shell\open\command] '' = '<SYSTEM32>\service.exe'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ServiceOptionMP3' = '"%WINDIR%\winamp.dll.exe"'
  • [<HKLM>\SOFTWARE\Classes\txtfile\shell\open\command] '' = '<SYSTEM32>\service.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Print Epson' = 'C:\Documents and Setting\Temporary\Epson'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'service' = '%WINDIR%\service.exe'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'userinit' = '<SYSTEM32>\userinit.exe,%WINDIR%\service.exe'
Создает или изменяет следующие файлы:
  • %HOMEPATH%\Start Menu\Programs\Startup\Explorer.vbs
  • %HOMEPATH%\Start Menu\Programs\Startup\kernel32.com
Создает следующие файлы на съемном носителе:
  • <Имя диска съемного носителя>:\WIN_SyncMas\Folder.htt
  • <Имя диска съемного носителя>:\Desktop.ini
  • <Имя диска съемного носителя>:\WIN_SyncMas\service.exe
  • <Имя диска съемного носителя>:\service.exe
  • <Имя диска съемного носителя>:\Puisi 5H4-5H4_SyncMas.txt
  • <Имя диска съемного носителя>:\autorun.inf
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует отображение:
  • скрытых файлов
  • расширений файлов
блокирует запуск следующих системных утилит:
  • Редактора реестра (RegEdit)
блокирует:
  • Компонент восстановления системы (SR)
Запускает на исполнение:
  • '<SYSTEM32>\taskkill.exe' /f /im winamp.exe
Изменяет следующие настройки проводника Windows (Windows Explorer):
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoFind' = '00000001'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
  • C:\autorun.inf
  • C:\WIN_SyncMas\Folder.htt
  • C:\service.exe
  • C:\Puisi 5H4-5H4_SyncMas.txt
  • C:\Desktop.ini
  • %WINDIR%\service.exe
  • <SYSTEM32>\oeminfo.ini
  • C:\WIN_SyncMas\service.exe
  • <SYSTEM32>\service.exe
  • %WINDIR%\regedit.An_WINByte
  • <LS_APPDATA>\dlhost.exe
  • %APPDATA%\TuGas.exe
  • %HOMEPATH%\My Documents\My Pictures\svcosht.exe
  • %APPDATA%\sys.dll
  • C:\Documents and Settings.exe
  • <SYSTEM32>\taskmgr.An_WINByte
  • %WINDIR%.exe
  • %PROGRAM_FILES%.exe
Присваивает атрибут 'скрытый' для следующих файлов:
  • <SYSTEM32>\oobe\html\mouse\images\paris.jpg.TempByte
  • <SYSTEM32>\oobe\html\mouse\images\heidelbm.jpg.TempByte
  • <SYSTEM32>\oobe\html\mouse\images\parism.jpg.TempByte
  • <SYSTEM32>\oobe\html\mouse\images\pisam.jpg.TempByte
  • <SYSTEM32>\oobe\html\mouse\images\pisa.jpg.TempByte
  • <SYSTEM32>\oobe\html\mouse\images\heidelb.jpg.TempByte
  • %WINDIR%\pchealth\helpctr\System\DVDUpgrd\stripe.jpg.TempByte
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.TempByte
  • %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\greendot.jpg.TempByte
  • <SYSTEM32>\oobe\html\mouse\images\bulzanom.jpg.TempByte
  • <SYSTEM32>\oobe\html\mouse\images\bulzano.jpg.TempByte
  • <SYSTEM32>\oobe\html\mouse\images\prague.jpg.TempByte
  • <SYSTEM32>\oobe\images\backdown.jpg.TempByte
  • <SYSTEM32>\oobe\html\mouse\images\veronam.jpg.TempByte
  • <SYSTEM32>\oobe\images\backoff.jpg.TempByte
  • <SYSTEM32>\oobe\images\backup.jpg.TempByte
  • <SYSTEM32>\oobe\images\backover.jpg.TempByte
  • <SYSTEM32>\oobe\html\mouse\images\verona.jpg.TempByte
  • <SYSTEM32>\oobe\html\mouse\images\tyrol.jpg.TempByte
  • <SYSTEM32>\oobe\html\mouse\images\praguem.jpg.TempByte
  • <SYSTEM32>\oobe\html\mouse\images\tyrolm.jpg.TempByte
  • <SYSTEM32>\oobe\html\mouse\images\venicem.jpg.TempByte
  • <SYSTEM32>\oobe\html\mouse\images\venice.jpg.TempByte
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\unlock_optimized_big.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\unlock_built.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\start_up.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\ul_logo.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\taskbar_up.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg.TempByte
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.TempByte
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg.TempByte
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.TempByte
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg.TempByte
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.TempByte
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\window_up.jpg.TempByte
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.TempByte
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.TempByte
  • %WINDIR%\Web\Wallpaper\Purple flower.jpg.TempByte
  • %WINDIR%\Web\Wallpaper\Power.jpg.TempByte
  • %WINDIR%\Web\Wallpaper\Radiance.jpg.TempByte
  • %WINDIR%\Web\Wallpaper\Ripple.jpg.TempByte
  • %WINDIR%\Web\Wallpaper\Red moon desert.jpg.TempByte
  • %WINDIR%\Web\Wallpaper\Peace.jpg.TempByte
  • %WINDIR%\Web\Wallpaper\Follow.jpg.TempByte
  • %WINDIR%\Web\Wallpaper\Crystal.jpg.TempByte
  • %WINDIR%\Web\Wallpaper\Friend.jpg.TempByte
  • %WINDIR%\Web\Wallpaper\Moon flower.jpg.TempByte
  • %WINDIR%\Web\Wallpaper\Home.jpg.TempByte
  • %WINDIR%\Web\Wallpaper\Stonehenge.jpg.TempByte
  • %HOMEPATH%\Templates\excel4.xls.FILETemp
  • %HOMEPATH%\Templates\excel.xls.FILETemp
  • <SYSTEM32>\config\systemprofile\Templates\excel.xls.FILETemp
  • <SYSTEM32>\oeminfo.ini
  • <SYSTEM32>\config\systemprofile\Templates\excel4.xls.FILETemp
  • C:\Documents and Settings\Default User\Templates\excel4.xls.FILETemp
  • %WINDIR%\Web\Wallpaper\Vortec space.jpg.TempByte
  • %WINDIR%\Web\Wallpaper\Tulips.jpg.TempByte
  • %WINDIR%\Web\Wallpaper\Wind.jpg.TempByte
  • C:\Documents and Settings\Default User\Templates\excel.xls.FILETemp
  • %WINDIR%\Web\Wallpaper\Windows XP.jpg.TempByte
  • %WINDIR%\Web\Wallpaper\Azul.jpg.TempByte
  • <SYSTEM32>\oobe\images\nextdown.jpg.TempByte
  • <SYSTEM32>\oobe\images\newtop8.jpg.TempByte
  • <SYSTEM32>\oobe\images\nextoff.jpg.TempByte
  • <SYSTEM32>\oobe\images\nextup.jpg.TempByte
  • <SYSTEM32>\oobe\images\nextover.jpg.TempByte
  • <SYSTEM32>\oobe\images\newtop1.jpg.TempByte
  • <SYSTEM32>\oobe\images\newbtm1.jpg.TempByte
  • <SYSTEM32>\oobe\images\mslogo.jpg.TempByte
  • <SYSTEM32>\oobe\images\newbtm8.jpg.TempByte
  • <SYSTEM32>\oobe\images\newmark8.jpg.TempByte
  • <SYSTEM32>\oobe\images\newmark1.jpg.TempByte
  • <SYSTEM32>\oobe\images\oemcoa.jpg.TempByte
  • <SYSTEM32>\oobe\images\wpakey.jpg.TempByte
  • <SYSTEM32>\oobe\images\wpaflag.jpg.TempByte
  • <SYSTEM32>\oobe\images\wpatop.jpg.TempByte
  • %WINDIR%\Web\Wallpaper\Autumn.jpg.TempByte
  • %WINDIR%\Web\Wallpaper\Ascent.jpg.TempByte
  • <SYSTEM32>\oobe\images\wpabtm.jpg.TempByte
  • <SYSTEM32>\oobe\images\skipoff.jpg.TempByte
  • <SYSTEM32>\oobe\images\skipdown.jpg.TempByte
  • <SYSTEM32>\oobe\images\skipover.jpg.TempByte
  • <SYSTEM32>\oobe\images\wpaback.jpg.TempByte
  • <SYSTEM32>\oobe\images\skipup.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\safe_easy_faster.jpg.TempByte
  • %PROGRAM_FILES%\Movie Maker\Shared\Sample1.jpg.TempByte
  • %CommonProgramFiles%\Microsoft Shared\Stationery\Sunflower Bkgrd.jpg.TempByte
  • %PROGRAM_FILES%\Movie Maker\Shared\Sample2.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\best_road_big.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\best_road.jpg.TempByte
  • %CommonProgramFiles%\Microsoft Shared\Stationery\Pie Charts Bkgrd.jpg.TempByte
  • %CommonProgramFiles%\Microsoft Shared\Stationery\Glacier Bkgrd.jpg.TempByte
  • %CommonProgramFiles%\Microsoft Shared\Stationery\Fiesta Bkgrd.jpg.TempByte
  • %CommonProgramFiles%\Microsoft Shared\Stationery\Leaves Bkgrd.jpg.TempByte
  • %CommonProgramFiles%\Microsoft Shared\Stationery\Nature Bkgrd.jpg.TempByte
  • %CommonProgramFiles%\Microsoft Shared\Stationery\Maize Bkgrd.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\connected_data.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\best_robust.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\best_secure.jpg.TempByte
  • %CommonProgramFiles%\Microsoft Shared\Stationery\Clear Day Bkgrd.jpg.TempByte
  • C:\WIN_SyncMas\service.exe
  • C:\Desktop.ini
  • <Имя диска съемного носителя>:\service.exe
  • <Имя диска съемного носителя>:\WIN_SyncMas\Folder.htt
  • <Имя диска съемного носителя>:\autorun.inf
  • C:\WIN_SyncMas\Folder.htt
  • <LS_APPDATA>\dlhost.exe
  • %HOMEPATH%\My Documents\My Pictures\svcosht.exe
  • %HOMEPATH%\Start Menu\Programs\Startup\kernel32.com
  • C:\autorun.inf
  • C:\service.exe
  • <Имя диска съемного носителя>:\Desktop.ini
  • %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.TempByte
  • <SYSTEM32>\config\systemprofile\Templates\winword2.doc.FILETemp
  • %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.TempByte
  • %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.TempByte
  • %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.TempByte
  • <SYSTEM32>\config\systemprofile\Templates\winword.doc.FILETemp
  • C:\Documents and Settings\Default User\Templates\winword.doc.FILETemp
  • <Имя диска съемного носителя>:\WIN_SyncMas\service.exe
  • C:\Documents and Settings\Default User\Templates\winword2.doc.FILETemp
  • %HOMEPATH%\Templates\winword2.doc.FILETemp
  • %HOMEPATH%\Templates\winword.doc.FILETemp
  • %WINDIR%\Help\Tours\htmlTour\img121.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\img116.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\img123.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\img136.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\img126.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\img110.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\img089.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\img074a.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\img100.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\img109.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\img103.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\img149.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\safe_easy_better.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\logo.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\intro_logo.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\pen_icon.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\read_icon.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\question_icon.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\img072.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\control_up.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\end_up.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\desktop_up.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\connected_networks.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\folder_up.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\img040.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\img034.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\img046.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\img068.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\img060.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\img033a.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\icon_up.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\gradient.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\img004b.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\img033.jpg.TempByte
  • %WINDIR%\Help\Tours\htmlTour\img014.jpg.TempByte
Удаляет следующие файлы:
  • <SYSTEM32>\oobe\html\mouse\images\tyrol.jpg
  • <SYSTEM32>\oobe\html\mouse\images\praguem.jpg
  • <SYSTEM32>\oobe\html\mouse\images\venice.jpg
  • <SYSTEM32>\oobe\html\mouse\images\tyrolm.jpg
  • <SYSTEM32>\oobe\html\mouse\images\prague.jpg
  • <SYSTEM32>\oobe\html\mouse\images\parism.jpg
  • <SYSTEM32>\oobe\html\mouse\images\paris.jpg
  • <SYSTEM32>\oobe\html\mouse\images\pisam.jpg
  • <SYSTEM32>\oobe\html\mouse\images\pisa.jpg
  • <SYSTEM32>\oobe\html\mouse\images\venicem.jpg
  • <SYSTEM32>\oobe\images\mslogo.jpg
  • <SYSTEM32>\oobe\images\backup.jpg
  • <SYSTEM32>\oobe\images\newbtm8.jpg
  • <SYSTEM32>\oobe\images\newbtm1.jpg
  • <SYSTEM32>\oobe\images\backover.jpg
  • <SYSTEM32>\oobe\html\mouse\images\veronam.jpg
  • <SYSTEM32>\oobe\html\mouse\images\verona.jpg
  • <SYSTEM32>\oobe\images\backoff.jpg
  • <SYSTEM32>\oobe\images\backdown.jpg
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
  • %WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg
  • %WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg
  • %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
  • %WINDIR%\Help\Tours\htmlTour\window_up.jpg
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
  • <SYSTEM32>\oobe\html\mouse\images\bulzanom.jpg
  • <SYSTEM32>\oobe\html\mouse\images\bulzano.jpg
  • <SYSTEM32>\oobe\html\mouse\images\heidelbm.jpg
  • <SYSTEM32>\oobe\html\mouse\images\heidelb.jpg
  • %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\greendot.jpg
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg
  • %WINDIR%\pchealth\helpctr\System\DVDUpgrd\stripe.jpg
  • %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
  • <SYSTEM32>\oobe\images\newmark1.jpg
  • %WINDIR%\Web\Wallpaper\Peace.jpg
  • %WINDIR%\Web\Wallpaper\Moon flower.jpg
  • %WINDIR%\Web\Wallpaper\Purple flower.jpg
  • %WINDIR%\Web\Wallpaper\Power.jpg
  • %WINDIR%\Web\Wallpaper\Home.jpg
  • %WINDIR%\Web\Wallpaper\Crystal.jpg
  • %WINDIR%\Web\Wallpaper\Azul.jpg
  • %WINDIR%\Web\Wallpaper\Friend.jpg
  • %WINDIR%\Web\Wallpaper\Follow.jpg
  • %WINDIR%\Web\Wallpaper\Radiance.jpg
  • %WINDIR%\Web\Wallpaper\Windows XP.jpg
  • %WINDIR%\Web\Wallpaper\Wind.jpg
  • <SYSTEM32>\config\systemprofile\Templates\excel4.xls
  • <SYSTEM32>\config\systemprofile\Templates\excel.xls
  • %WINDIR%\Web\Wallpaper\Vortec space.jpg
  • %WINDIR%\Web\Wallpaper\Ripple.jpg
  • %WINDIR%\Web\Wallpaper\Red moon desert.jpg
  • %WINDIR%\Web\Wallpaper\Tulips.jpg
  • %WINDIR%\Web\Wallpaper\Stonehenge.jpg
  • <SYSTEM32>\oobe\images\nextup.jpg
  • <SYSTEM32>\oobe\images\nextover.jpg
  • <SYSTEM32>\oobe\images\skipdown.jpg
  • <SYSTEM32>\oobe\images\oemcoa.jpg
  • <SYSTEM32>\oobe\images\nextoff.jpg
  • <SYSTEM32>\oobe\images\newtop1.jpg
  • <SYSTEM32>\oobe\images\newmark8.jpg
  • <SYSTEM32>\oobe\images\nextdown.jpg
  • <SYSTEM32>\oobe\images\newtop8.jpg
  • <SYSTEM32>\oobe\images\skipoff.jpg
  • <SYSTEM32>\oobe\images\wpatop.jpg
  • <SYSTEM32>\oobe\images\wpakey.jpg
  • %WINDIR%\Web\Wallpaper\Autumn.jpg
  • %WINDIR%\Web\Wallpaper\Ascent.jpg
  • <SYSTEM32>\oobe\images\wpaflag.jpg
  • <SYSTEM32>\oobe\images\skipup.jpg
  • <SYSTEM32>\oobe\images\skipover.jpg
  • <SYSTEM32>\oobe\images\wpabtm.jpg
  • <SYSTEM32>\oobe\images\wpaback.jpg
  • %WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg
  • %WINDIR%\Help\Tours\htmlTour\control_up.jpg
  • %WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg
  • %WINDIR%\Help\Tours\htmlTour\desktop_up.jpg
  • %WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg
  • %WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg
  • %WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg
  • %WINDIR%\Help\Tours\htmlTour\connected_networks.jpg
  • %WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg
  • %WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg
  • %WINDIR%\Help\Tours\htmlTour\end_up.jpg
  • %WINDIR%\Help\Tours\htmlTour\img033a.jpg
  • %WINDIR%\Help\Tours\htmlTour\img033.jpg
  • %WINDIR%\Help\Tours\htmlTour\img040.jpg
  • %WINDIR%\Help\Tours\htmlTour\img034.jpg
  • %WINDIR%\Help\Tours\htmlTour\img014.jpg
  • %WINDIR%\Help\Tours\htmlTour\gradient.jpg
  • %WINDIR%\Help\Tours\htmlTour\folder_up.jpg
  • %WINDIR%\Help\Tours\htmlTour\img004b.jpg
  • %WINDIR%\Help\Tours\htmlTour\icon_up.jpg
  • %WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg
  • %WINDIR%\Help\Tours\htmlTour\best_road_big.jpg
  • %WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg
  • %WINDIR%\Help\Tours\htmlTour\best_robust.jpg
  • %WINDIR%\Help\Tours\htmlTour\best_road.jpg
  • %WINDIR%\regedit.exe
  • <SYSTEM32>\taskmgr.exe
  • <SYSTEM32>\config\systemprofile\Templates\winword2.doc
  • <SYSTEM32>\config\systemprofile\Templates\winword.doc
  • %WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg
  • %WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg
  • %WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg
  • %WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg
  • %WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg
  • %WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg
  • %WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg
  • %WINDIR%\Help\Tours\htmlTour\best_secure.jpg
  • %WINDIR%\Help\Tours\htmlTour\connected_data.jpg
  • %WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg
  • %WINDIR%\Help\Tours\htmlTour\img046.jpg
  • %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg
  • %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big.jpg
  • %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg
  • %WINDIR%\Help\Tours\htmlTour\safe_easy_faster.jpg
  • %WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg
  • %WINDIR%\Help\Tours\htmlTour\safe_easy_better.jpg
  • %WINDIR%\Help\Tours\htmlTour\read_icon.jpg
  • %WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg
  • %WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg
  • %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg
  • %WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg
  • %WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg
  • %WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg
  • %WINDIR%\Help\Tours\htmlTour\unlock_optimized_big.jpg
  • %WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg
  • %WINDIR%\Help\Tours\htmlTour\taskbar_up.jpg
  • %WINDIR%\Help\Tours\htmlTour\start_up.jpg
  • %WINDIR%\Help\Tours\htmlTour\unlock_built.jpg
  • %WINDIR%\Help\Tours\htmlTour\ul_logo.jpg
  • %WINDIR%\Help\Tours\htmlTour\img103.jpg
  • %WINDIR%\Help\Tours\htmlTour\img100.jpg
  • %WINDIR%\Help\Tours\htmlTour\img110.jpg
  • %WINDIR%\Help\Tours\htmlTour\img109.jpg
  • %WINDIR%\Help\Tours\htmlTour\img089.jpg
  • %WINDIR%\Help\Tours\htmlTour\img068.jpg
  • %WINDIR%\Help\Tours\htmlTour\img060.jpg
  • %WINDIR%\Help\Tours\htmlTour\img074a.jpg
  • %WINDIR%\Help\Tours\htmlTour\img072.jpg
  • %WINDIR%\Help\Tours\htmlTour\img116.jpg
  • %WINDIR%\Help\Tours\htmlTour\logo.jpg
  • %WINDIR%\Help\Tours\htmlTour\intro_logo.jpg
  • %WINDIR%\Help\Tours\htmlTour\question_icon.jpg
  • %WINDIR%\Help\Tours\htmlTour\pen_icon.jpg
  • %WINDIR%\Help\Tours\htmlTour\img149.jpg
  • %WINDIR%\Help\Tours\htmlTour\img123.jpg
  • %WINDIR%\Help\Tours\htmlTour\img121.jpg
  • %WINDIR%\Help\Tours\htmlTour\img136.jpg
  • %WINDIR%\Help\Tours\htmlTour\img126.jpg
Другое:
Ищет следующие окна:
  • ClassName: 'Edit' WindowName: ''
  • ClassName: '' WindowName: ''
  • ClassName: 'Notepad' WindowName: ''
  • ClassName: 'Indicator' WindowName: ''
  • ClassName: 'Shell_TrayWnd' WindowName: ''