Trojan.Encoder.4200

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '_srjx' = '<SYSTEM32>\CMD.EXE /C START %HOMEPATH%\My Documents\sjtoci.exe'

Создает или изменяет следующие файлы:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\RECOVERirhqm.html
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\RECOVERirhqm.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\RECOVERirhqm.png

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /c DEL <Полный путь к файлу> >> NUL
'%HOMEPATH%\My Documents\sjtoci.exe'

Завершает или пытается завершить

следующие системные процессы:

<SYSTEM32>\cmd.exe

следующие пользовательские процессы:

ecmd.exe

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Microsoft\Windows\RECOVERirhqm.html
%APPDATA%\Microsoft\Windows\RECOVERirhqm.txt
%APPDATA%\Microsoft\RECOVERirhqm.txt
%APPDATA%\Microsoft\RECOVERirhqm.png
%APPDATA%\Microsoft\Windows\RECOVERirhqm.png
%APPDATA%\Microsoft\Windows\Themes\RECOVERirhqm.png
%APPDATA%\Microsoft\SystemCertificates\RECOVERirhqm.html
%APPDATA%\Microsoft\Windows\Themes\RECOVERirhqm.html
%APPDATA%\Microsoft\Windows\Themes\RECOVERirhqm.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\RECOVERirhqm.html
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\RECOVERirhqm.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\RECOVERirhqm.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\RECOVERirhqm.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\RECOVERirhqm.png
%APPDATA%\Mozilla\Extensions\RECOVERirhqm.png
%APPDATA%\Microsoft\RECOVERirhqm.html
%APPDATA%\Mozilla\Extensions\RECOVERirhqm.html
%APPDATA%\Mozilla\Extensions\RECOVERirhqm.txt
%APPDATA%\Microsoft\SystemCertificates\RECOVERirhqm.txt
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.txt
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.png
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.png
%APPDATA%\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.html
%APPDATA%\Microsoft\MMC\RECOVERirhqm.html
%APPDATA%\Microsoft\Media Player\RECOVERirhqm.html
%APPDATA%\Microsoft\Media Player\RECOVERirhqm.txt
%APPDATA%\Microsoft\MMC\RECOVERirhqm.txt
%APPDATA%\Microsoft\MMC\RECOVERirhqm.png
%APPDATA%\Microsoft\SystemCertificates\My\RECOVERirhqm.txt
%APPDATA%\Microsoft\SystemCertificates\My\RECOVERirhqm.png
%APPDATA%\Microsoft\SystemCertificates\RECOVERirhqm.png
%APPDATA%\Microsoft\SystemCertificates\My\RECOVERirhqm.html
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.html
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.html
%APPDATA%\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.txt
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.txt
%APPDATA%\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\RECOVERirhqm.html
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\RECOVERirhqm.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\RECOVERirhqm.png
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\RECOVERirhqm.png
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\RECOVERirhqm.html
%HOMEPATH%\Favorites\RECOVERirhqm.html
%HOMEPATH%\Favorites\Links\RECOVERirhqm.html
%HOMEPATH%\Favorites\Links\RECOVERirhqm.txt
%HOMEPATH%\Favorites\RECOVERirhqm.txt
%HOMEPATH%\Favorites\RECOVERirhqm.png
<LS_APPDATA>\Identities\RECOVERirhqm.txt
<LS_APPDATA>\Identities\RECOVERirhqm.png
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\RECOVERirhqm.png
<LS_APPDATA>\Identities\RECOVERirhqm.html
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\RECOVERirhqm.html
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\RECOVERirhqm.html
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\RECOVERirhqm.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\RECOVERirhqm.txt
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\RECOVERirhqm.png
%HOMEPATH%\Favorites\Links\RECOVERirhqm.png
%APPDATA%\Mozilla\Firefox\RECOVERirhqm.png
%APPDATA%\Mozilla\Firefox\Profiles\RECOVERirhqm.html
%APPDATA%\Mozilla\Firefox\RECOVERirhqm.html
%APPDATA%\Mozilla\Firefox\RECOVERirhqm.txt
%APPDATA%\Mozilla\Firefox\Profiles\RECOVERirhqm.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\RECOVERirhqm.txt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\RECOVERirhqm.png
%APPDATA%\Mozilla\Firefox\Profiles\RECOVERirhqm.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\RECOVERirhqm.html
%HOMEPATH%\Cookies\RECOVERirhqm.png
%APPDATA%\RECOVERirhqm.html
%HOMEPATH%\Cookies\RECOVERirhqm.html
%HOMEPATH%\Cookies\RECOVERirhqm.txt
%APPDATA%\RECOVERirhqm.txt
%APPDATA%\Mozilla\RECOVERirhqm.txt
%APPDATA%\Mozilla\RECOVERirhqm.png
%APPDATA%\RECOVERirhqm.png
%APPDATA%\Mozilla\RECOVERirhqm.html
%APPDATA%\Microsoft\Media Player\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Local Settings\History\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Local Settings\History\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Local Settings\Temp\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Local Settings\History\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Local Settings\Temp\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Local Settings\Temp\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Local Settings\Application Data\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Cookies\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Cookies\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Application Data\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Application Data\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Cookies\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Application Data\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RECOVERirhqm.txt
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\RECOVERirhqm.png
%APPDATA%\Microsoft\Address Book\RECOVERirhqm.html
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\RECOVERirhqm.html
%APPDATA%\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\RECOVERirhqm.txt
%APPDATA%\Microsoft\Address Book\RECOVERirhqm.txt
%APPDATA%\Identities\RECOVERirhqm.txt
%APPDATA%\Identities\RECOVERirhqm.png
%APPDATA%\Microsoft\Address Book\RECOVERirhqm.png
%APPDATA%\Identities\RECOVERirhqm.html
%APPDATA%\Microsoft\Internet Explorer\RECOVERirhqm.png
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\RECOVERirhqm.html
%APPDATA%\Microsoft\Internet Explorer\RECOVERirhqm.html
%APPDATA%\Microsoft\Internet Explorer\RECOVERirhqm.txt
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\RECOVERirhqm.txt
%APPDATA%\Microsoft\Credentials\RECOVERirhqm.txt
%APPDATA%\Microsoft\Credentials\RECOVERirhqm.png
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\RECOVERirhqm.png
%APPDATA%\Microsoft\Credentials\RECOVERirhqm.html
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\RECOVERirhqm.txt
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\RECOVERirhqm.txt
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Local Settings\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Local Settings\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Local Settings\RECOVERirhqm.txt
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\RECOVERirhqm.txt
%TEMP%\RECOVERirhqm.txt
%TEMP%\RECOVERirhqm.png
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RECOVERirhqm.png
%TEMP%\RECOVERirhqm.html
%HOMEPATH%\Local Settings\History\RECOVERirhqm.html
%HOMEPATH%\Local Settings\History\History.IE5\RECOVERirhqm.html
%HOMEPATH%\Local Settings\History\History.IE5\RECOVERirhqm.txt
%HOMEPATH%\Local Settings\History\RECOVERirhqm.txt
%HOMEPATH%\Local Settings\History\RECOVERirhqm.png
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RECOVERirhqm.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RECOVERirhqm.png
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\RECOVERirhqm.png
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RECOVERirhqm.html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\RECOVERirhqm.html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RECOVERirhqm.html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RECOVERirhqm.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\RECOVERirhqm.txt
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\RECOVERirhqm.png
%HOMEPATH%\Local Settings\History\History.IE5\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\Firefox\RECOVERirhqm.html
<LS_APPDATA>\Mozilla\RECOVERirhqm.html
<LS_APPDATA>\Mozilla\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\Firefox\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\RECOVERirhqm.html
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\RECOVERirhqm.png
<LS_APPDATA>\RECOVERirhqm.html
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\RECOVERirhqm.html
%HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\RECOVERirhqm.txt
<LS_APPDATA>\RECOVERirhqm.txt
<LS_APPDATA>\VMware\RECOVERirhqm.txt
<LS_APPDATA>\VMware\RECOVERirhqm.png
<LS_APPDATA>\RECOVERirhqm.png
<LS_APPDATA>\VMware\RECOVERirhqm.html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\RECOVERirhqm.txt
%HOMEPATH%\NetHood\RECOVERirhqm.png
%HOMEPATH%\My Documents\RECOVERirhqm.html
%HOMEPATH%\NetHood\RECOVERirhqm.html
%HOMEPATH%\NetHood\RECOVERirhqm.txt
%HOMEPATH%\My Documents\RECOVERirhqm.txt
%HOMEPATH%\My Documents\My Received Files\RECOVERirhqm.txt
%HOMEPATH%\My Documents\My Received Files\RECOVERirhqm.png
%HOMEPATH%\My Documents\RECOVERirhqm.png
%HOMEPATH%\My Documents\My Received Files\RECOVERirhqm.html
%HOMEPATH%\SendTo\RECOVERirhqm.png
%HOMEPATH%\Recent\RECOVERirhqm.html
%HOMEPATH%\SendTo\RECOVERirhqm.html
%HOMEPATH%\SendTo\RECOVERirhqm.txt
%HOMEPATH%\Recent\RECOVERirhqm.txt
%HOMEPATH%\PrintHood\RECOVERirhqm.txt
%HOMEPATH%\PrintHood\RECOVERirhqm.png
%HOMEPATH%\Recent\RECOVERirhqm.png
%HOMEPATH%\PrintHood\RECOVERirhqm.html
%HOMEPATH%\My Documents\My Pictures\RECOVERirhqm.html
%HOMEPATH%\Local Settings\<INETFILES>\RECOVERirhqm.html
%HOMEPATH%\Local Settings\<INETFILES>\RECOVERirhqm.txt
%HOMEPATH%\Local Settings\RECOVERirhqm.txt
%HOMEPATH%\Local Settings\RECOVERirhqm.png
%HOMEPATH%\Local Settings\<INETFILES>\RECOVERirhqm.png
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.png
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\RECOVERirhqm.html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.html
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.txt
%HOMEPATH%\My Documents\My Music\RECOVERirhqm.html
%HOMEPATH%\My Documents\My Music\RECOVERirhqm.txt
%HOMEPATH%\My Documents\My Pictures\RECOVERirhqm.txt
%HOMEPATH%\My Documents\My Pictures\RECOVERirhqm.png
%HOMEPATH%\My Documents\My Music\RECOVERirhqm.png
%HOMEPATH%\My Documents\Downloads\RECOVERirhqm.png
%HOMEPATH%\Local Settings\RECOVERirhqm.html
%HOMEPATH%\My Documents\Downloads\RECOVERirhqm.html
%HOMEPATH%\My Documents\Downloads\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\RECOVERirhqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\RECOVERirhqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\RECOVERirhqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\RECOVERirhqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\RECOVERirhqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\RECOVERirhqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\RECOVERirhqm.html
<LS_APPDATA>\Microsoft\RECOVERirhqm.html
<LS_APPDATA>\Microsoft\Media Player\RECOVERirhqm.html
<LS_APPDATA>\Microsoft\Media Player\RECOVERirhqm.txt
<LS_APPDATA>\Microsoft\Windows\RECOVERirhqm.txt
<LS_APPDATA>\Microsoft\Windows\RECOVERirhqm.png
<LS_APPDATA>\Microsoft\Media Player\RECOVERirhqm.png
<LS_APPDATA>\Microsoft\Credentials\RECOVERirhqm.png
<LS_APPDATA>\Microsoft\Credentials\S-1-5-21-2052111302-484763869-725345543-1003\RECOVERirhqm.html
<LS_APPDATA>\Microsoft\Credentials\RECOVERirhqm.html
<LS_APPDATA>\Microsoft\Credentials\RECOVERirhqm.txt
<LS_APPDATA>\Microsoft\Windows Media\RECOVERirhqm.html
<LS_APPDATA>\Microsoft\Windows Media\RECOVERirhqm.txt
<LS_APPDATA>\Microsoft\RECOVERirhqm.txt
<LS_APPDATA>\Microsoft\RECOVERirhqm.png
<LS_APPDATA>\Microsoft\Windows Media\RECOVERirhqm.png
<LS_APPDATA>\Microsoft\Windows Media\9.0\RECOVERirhqm.png
<LS_APPDATA>\Microsoft\Windows\RECOVERirhqm.html
<LS_APPDATA>\Microsoft\Windows Media\9.0\RECOVERirhqm.html
<LS_APPDATA>\Microsoft\Windows Media\9.0\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\RECOVERirhqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\RECOVERirhqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\RECOVERirhqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\RECOVERirhqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\RECOVERirhqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\RECOVERirhqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\RECOVERirhqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\RECOVERirhqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\RECOVERirhqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\RECOVERirhqm.png
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\RECOVERirhqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\RECOVERirhqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\RECOVERirhqm.html
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\RECOVERirhqm.txt
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\RECOVERirhqm.png
C:\Documents and Settings\Default User\Cookies\RECOVERirhqm.html
C:\Documents and Settings\Default User\Cookies\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Favorites\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Favorites\RECOVERirhqm.png
C:\Documents and Settings\Default User\Cookies\RECOVERirhqm.png
C:\Documents and Settings\Default User\Application Data\RECOVERirhqm.png
C:\Documents and Settings\Default User\Application Data\Microsoft\RECOVERirhqm.html
C:\Documents and Settings\Default User\Application Data\RECOVERirhqm.html
C:\Documents and Settings\Default User\Application Data\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\RECOVERirhqm.html
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\RECOVERirhqm.png
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\RECOVERirhqm.png
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\RECOVERirhqm.png
C:\Documents and Settings\Default User\Favorites\RECOVERirhqm.html
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\RECOVERirhqm.html
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.png
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.png
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.html
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\RECOVERirhqm.html
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.png
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\RECOVERirhqm.png
C:\Documents and Settings\Default User\Application Data\Microsoft\RECOVERirhqm.png
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\RECOVERirhqm.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\RECOVERirhqm.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.html
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\RECOVERirhqm.png
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\RECOVERirhqm.html
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\RECOVERirhqm.png
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.png
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\RECOVERirhqm.html
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RECOVERirhqm.html
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\RECOVERirhqm.html
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\RECOVERirhqm.png
C:\Documents and Settings\Default User\Local Settings\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Local Settings\RECOVERirhqm.png
C:\Documents and Settings\Default User\My Documents\RECOVERirhqm.png
C:\Documents and Settings\Default User\Local Settings\RECOVERirhqm.html
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\RECOVERirhqm.html
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.html
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\RECOVERirhqm.png
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\RECOVERirhqm.png
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\RECOVERirhqm.png
C:\Documents and Settings\Default User\Local Settings\Application Data\RECOVERirhqm.html
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\RECOVERirhqm.html
C:\Documents and Settings\Default User\Local Settings\History\History.IE5\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\RECOVERirhqm.png
C:\Documents and Settings\Default User\Local Settings\Application Data\RECOVERirhqm.png
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\RECOVERirhqm.html
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RECOVERirhqm.png
C:\Documents and Settings\Default User\Local Settings\Temp\RECOVERirhqm.html
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RECOVERirhqm.html
C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Local Settings\Temp\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Local Settings\History\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Local Settings\History\RECOVERirhqm.png
C:\Documents and Settings\Default User\Local Settings\Temp\RECOVERirhqm.png
C:\Documents and Settings\Default User\Local Settings\History\RECOVERirhqm.html
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\RECOVERirhqm.png
%ALLUSERSPROFILE%\Documents\My Pictures\RECOVERirhqm.txt
%ALLUSERSPROFILE%\Documents\My Pictures\RECOVERirhqm.png
%ALLUSERSPROFILE%\Documents\My Videos\RECOVERirhqm.png
%ALLUSERSPROFILE%\Documents\My Pictures\RECOVERirhqm.html
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\RECOVERirhqm.html
%ALLUSERSPROFILE%\Documents\My Music\RECOVERirhqm.html
%ALLUSERSPROFILE%\Documents\My Music\RECOVERirhqm.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\RECOVERirhqm.txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\RECOVERirhqm.png
%ALLUSERSPROFILE%\DRM\RECOVERirhqm.txt
%ALLUSERSPROFILE%\DRM\RECOVERirhqm.png
%ALLUSERSPROFILE%\Favorites\RECOVERirhqm.png
%ALLUSERSPROFILE%\DRM\RECOVERirhqm.html
%ALLUSERSPROFILE%\Documents\RECOVERirhqm.html
%ALLUSERSPROFILE%\Documents\My Videos\RECOVERirhqm.html
%ALLUSERSPROFILE%\Documents\My Videos\RECOVERirhqm.txt
%ALLUSERSPROFILE%\Documents\RECOVERirhqm.txt
%ALLUSERSPROFILE%\Documents\RECOVERirhqm.png
%ALLUSERSPROFILE%\Documents\My Music\RECOVERirhqm.png
%HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\phsys[1].htm
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\RECOVERirhqm.png
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\RECOVERirhqm.html
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\RECOVERirhqm.txt
<Текущая директория>\RECOVERirhqm.html
%HOMEPATH%\My Documents\recover_file.txt
%HOMEPATH%\My Documents\sjtoci.exe
<Текущая директория>\RECOVERirhqm.txt
<Текущая директория>\RECOVERirhqm.png
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\RECOVERirhqm.png
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\RECOVERirhqm.html
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\RECOVERirhqm.html
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\RECOVERirhqm.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\RECOVERirhqm.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\RECOVERirhqm.txt
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\RECOVERirhqm.png
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\RECOVERirhqm.png
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\RECOVERirhqm.html
%ALLUSERSPROFILE%\Favorites\RECOVERirhqm.txt
%ALLUSERSPROFILE%\Start Menu\RECOVERirhqm.png
%ALLUSERSPROFILE%\Start Menu\Programs\RECOVERirhqm.html
%ALLUSERSPROFILE%\Start Menu\RECOVERirhqm.html
%ALLUSERSPROFILE%\Start Menu\RECOVERirhqm.txt
%ALLUSERSPROFILE%\Start Menu\Programs\RECOVERirhqm.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\RECOVERirhqm.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Games\RECOVERirhqm.png
%ALLUSERSPROFILE%\Start Menu\Programs\RECOVERirhqm.png
%ALLUSERSPROFILE%\Start Menu\Programs\Games\RECOVERirhqm.html
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\RECOVERirhqm.png
%ALLUSERSPROFILE%\RECOVERirhqm.html
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\RECOVERirhqm.html
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\RECOVERirhqm.txt
%ALLUSERSPROFILE%\RECOVERirhqm.txt
%ALLUSERSPROFILE%\Templates\RECOVERirhqm.txt
%ALLUSERSPROFILE%\Templates\RECOVERirhqm.png
%ALLUSERSPROFILE%\RECOVERirhqm.png
%ALLUSERSPROFILE%\Templates\RECOVERirhqm.html
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\RECOVERirhqm.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\RECOVERirhqm.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\RECOVERirhqm.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\RECOVERirhqm.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\RECOVERirhqm.png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\RECOVERirhqm.png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\RECOVERirhqm.png
%ALLUSERSPROFILE%\Favorites\RECOVERirhqm.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\RECOVERirhqm.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\RECOVERirhqm.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\RECOVERirhqm.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\RECOVERirhqm.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\RECOVERirhqm.txt
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\RECOVERirhqm.png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\RECOVERirhqm.png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\RECOVERirhqm.png
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\RECOVERirhqm.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\RECOVERirhqm.html
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\RECOVERirhqm.txt
C:\Documents and Settings\Default User\My Documents\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Local Settings\Temp\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Local Settings\Temp\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Local Settings\Temp\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Local Settings\History\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Local Settings\History\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Local Settings\History\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Local Settings\Application Data\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\RECOVERirhqm.html
C:\Documents and Settings\LocalService\RECOVERirhqm.html
C:\Documents and Settings\LocalService\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\RECOVERirhqm.png
C:\Documents and Settings\LocalService\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Local Settings\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Local Settings\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Local Settings\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\RECOVERirhqm.txt
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\RECOVERirhqm.png
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\RECOVERirhqm.html
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\RECOVERirhqm.html
C:\Documents and Settings\Default User\Start Menu\Programs\RECOVERirhqm.png
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\RECOVERirhqm.html
C:\Documents and Settings\Default User\Start Menu\Programs\RECOVERirhqm.html
C:\Documents and Settings\Default User\Start Menu\Programs\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\RECOVERirhqm.png
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\RECOVERirhqm.png
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\RECOVERirhqm.html
C:\Documents and Settings\Default User\RECOVERirhqm.png
C:\Documents and Settings\Default User\Templates\RECOVERirhqm.html
C:\Documents and Settings\Default User\RECOVERirhqm.html
C:\Documents and Settings\Default User\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Templates\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Start Menu\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Start Menu\RECOVERirhqm.png
C:\Documents and Settings\Default User\Templates\RECOVERirhqm.png
C:\Documents and Settings\Default User\Start Menu\RECOVERirhqm.html
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\RECOVERirhqm.html
C:\Documents and Settings\Default User\PrintHood\RECOVERirhqm.html
C:\Documents and Settings\Default User\PrintHood\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Recent\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Recent\RECOVERirhqm.png
C:\Documents and Settings\Default User\PrintHood\RECOVERirhqm.png
C:\Documents and Settings\Default User\NetHood\RECOVERirhqm.png
C:\Documents and Settings\Default User\My Documents\RECOVERirhqm.html
C:\Documents and Settings\Default User\NetHood\RECOVERirhqm.html
C:\Documents and Settings\Default User\NetHood\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\RECOVERirhqm.html
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\RECOVERirhqm.txt
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\RECOVERirhqm.png
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\RECOVERirhqm.png
C:\Documents and Settings\Default User\SendTo\RECOVERirhqm.png
C:\Documents and Settings\Default User\Recent\RECOVERirhqm.html
C:\Documents and Settings\Default User\SendTo\RECOVERirhqm.html
C:\Documents and Settings\Default User\SendTo\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Cookies\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Cookies\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Cookies\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Application Data\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Application Data\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Application Data\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\RECOVERirhqm.png
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\RECOVERirhqm.html
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.txt
C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\RECOVERirhqm.png

Присваивает атрибут 'скрытый' для следующих файлов:

%HOMEPATH%\My Documents\sjtoci.exe

Самоудаляется.

Сетевая активность:

Подключается к:

'ex###ation.info':80
'co######nseprotection.com':80
'eb#####oreforyou.com':80
'es##ok.com':80
'hm##me.net':80
'sh####oherbal.com':80

TCP:

Запросы HTTP POST:

http://ex###ation.info/plugins/phsys.php
http://co######nseprotection.com/phsys.php
http://eb#####oreforyou.com/phsys.php
http://es##ok.com/phsys.php
http://hm##me.net/phsys.php
http://sh####oherbal.com/phsys.php

UDP:

DNS ASK ex###ation.info
DNS ASK co######nseprotection.com
DNS ASK eb#####oreforyou.com
DNS ASK es##ok.com
DNS ASK hm##me.net
DNS ASK sh####oherbal.com

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней