Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '<Имя файла>' = '<Полный путь к файлу>'
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\tsoc.log.exe
- %WINDIR%\TASKMAN.EXE.exe
- %WINDIR%\twain.dll.exe
- %WINDIR%\twunk_16.exe.exe
- %WINDIR%\twain_32.dll.exe
- %WINDIR%\spupdsvc.log.exe
- %WINDIR%\Soap Bubbles.bmp.exe
- %WINDIR%\Sti_Trace.log.exe
- %WINDIR%\tabletoc.log.exe
- %WINDIR%\system.ini.exe
- %WINDIR%\wiaservc.log.exe
- %WINDIR%\wiadebug.log.exe
- %WINDIR%\win.ini.exe
- %WINDIR%\WindowsUpdate.log.exe
- %WINDIR%\WindowsShell.Manifest.exe
- %WINDIR%\updspapi.log.exe
- %WINDIR%\twunk_32.exe.exe
- %WINDIR%\vb.ini.exe
- %WINDIR%\vmmreg32.dll.exe
- %WINDIR%\vbaddin.ini.exe
- %WINDIR%\Rhododendron.bmp.exe
- %WINDIR%\regopt.log.exe
- %WINDIR%\River Sumida.bmp.exe
- %WINDIR%\SchedLgU.Txt.exe
- %WINDIR%\Santa Fe Stucco.bmp.exe
- %WINDIR%\OEWABLog.txt.exe
- %WINDIR%\ODBCINST.INI.exe
- %WINDIR%\Prairie Wind.bmp.exe
- %WINDIR%\REGLOCS.OLD.exe
- %WINDIR%\regedit.exe.exe
- %WINDIR%\setuperr.log.exe
- %WINDIR%\setupapi.log.exe
- %WINDIR%\setuplog.txt.exe
- %WINDIR%\sleep.exe.exe
- %WINDIR%\sfk.exe.exe
- %WINDIR%\SET3.tmp.exe
- %WINDIR%\sessmgr.setup.log.exe
- %WINDIR%\SET4.tmp.exe
- %WINDIR%\setupact.log.exe
- %WINDIR%\SET8.tmp.exe
- %WINDIR%\winhelp.exe.exe
- %WINDIR%\vmmreg32.dll.new
- %WINDIR%\twunk_32.exe.new
- %WINDIR%\winhelp.exe.new
- <SYSTEM32>\dllcache\hh.exe.new
- %WINDIR%\winhlp32.exe.new
- %WINDIR%\taskman.exe.new
- %WINDIR%\regedit.exe.new
- %WINDIR%\twain.dll.new
- %WINDIR%\twunk_16.exe.new
- %WINDIR%\twain_32.dll.new
- <SYSTEM32>\dllcache\twunk_32.exe.new
- <SYSTEM32>\dllcache\twunk_16.exe.new
- <SYSTEM32>\dllcache\vmmreg32.dll.new
- <SYSTEM32>\dllcache\winhlp32.exe.new
- <SYSTEM32>\dllcache\winhelp.exe.new
- <SYSTEM32>\dllcache\regedit.exe.new
- <SYSTEM32>\dllcache\notepad.exe.new
- <SYSTEM32>\dllcache\taskman.exe.new
- <SYSTEM32>\dllcache\twain_32.dll.new
- <SYSTEM32>\dllcache\twain.dll.new
- %WINDIR%\_default.pif.exe
- %WINDIR%\Zapotec.bmp.exe
- C:\AUTOEXEC.BAT.exe
- C:\CONFIG.SYS.exe
- C:\boot.ini.exe
- %WINDIR%\winnt.bmp.exe
- %WINDIR%\winhlp32.exe.exe
- %WINDIR%\winnt256.bmp.exe
- %WINDIR%\WMSysPr9.prx.exe
- %WINDIR%\wmsetup.log.exe
- C:\pagefile.sys.exe
- C:\ntldr.exe
- C:\startup_local.bat.exe
- %WINDIR%\notepad.exe.new
- %WINDIR%\hh.exe.new
- C:\IO.SYS.exe
- C:\DbgLog.log.exe
- C:\MSDOS.SYS.exe
- C:\NTDETECT.COM.exe
- C:\network.pcap.exe
- %WINDIR%\ocmsn.log.exe
- C:\Muldrop\FbsEoh.img.fyf_0.exe
- C:\Muldrop\FbsCaf.moh.fyf_0.exe
- C:\Muldrop\FbsEoh.moh.fyf_0.exe
- C:\Muldrop\FbsHvo.img.fyf_0.exe
- C:\Muldrop\FbsGfs.moh.fyf_0.exe
- C:\Muldrop\CmfbsPmvhjotCbdif.dne.fyf_0.exe
- C:\Muldrop\c662fg49.fyf.fyf_0.exe
- C:\Muldrop\dibohfmph.fyf_0.exe
- C:\Muldrop\Fbs.fyf.fyf_0.exe
- C:\Muldrop\dibohfmph_foh.fyf_0.exe
- C:\Muldrop\gbs.nbq.fyf_0.exe
- C:\Muldrop\Fjmf_je.eja.fyf_0.exe
- C:\Muldrop\RftupsfSfuujoht.dne.fyf_0.exe
- <STUBS_DIR>\list_full.txt.exe
- C:\Muldrop\SbwfSfuujoht.dne.fyf_0.exe
- C:\Muldrop\FbsPpm.moh.fyf_0.exe
- C:\Muldrop\FbsHvo.moh.fyf_0.exe
- C:\Muldrop\FbsRvt.img.fyf_0.exe
- C:\Muldrop\FbsSqb.moh.fyf_0.exe
- C:\Muldrop\FbsRvt.moh.fyf_0.exe
- C:\Far2\far.map.exe
- C:\Far2\Far.exe.exe
- C:\Far2\FarCze.lng.exe
- C:\Far2\FarEng.lng.exe
- C:\Far2\FarEng.hlf.exe
- <Полный путь к файлу>.exe
- %TEMP%\~DF3D73.tmp
- C:\Far2\changelog.exe
- C:\Far2\ClearPluginsCache.cmd.exe
- C:\Far2\changelog_eng.exe
- C:\Far2\FarSpa.lng.exe
- C:\Far2\FarRus.lng.exe
- C:\Far2\File_id.diz.exe
- C:\Far2\SaveSettings.cmd.exe
- C:\Far2\RestoreSettings.cmd.exe
- C:\Far2\FarHun.hlf.exe
- C:\Far2\FarGer.lng.exe
- C:\Far2\FarHun.lng.exe
- C:\Far2\FarRus.hlf.exe
- C:\Far2\FarPol.lng.exe
- <STUBS_DIR>\list_short.txt.exe
- %WINDIR%\hh.exe.exe
- %WINDIR%\Greenstone.bmp.exe
- %WINDIR%\iis6.log.exe
- %WINDIR%\imsins.log.exe
- %WINDIR%\imsins.BAK.exe
- %WINDIR%\explorer.scf.exe
- %WINDIR%\explorer.exe.exe
- %WINDIR%\FaxSetup.log.exe
- %WINDIR%\Gone Fishing.bmp.exe
- %WINDIR%\FeatherTexture.bmp.exe
- %WINDIR%\NOTEPAD.EXE.exe
- %WINDIR%\netfxocm.log.exe
- %WINDIR%\nsreg.dat.exe
- %WINDIR%\ocgen.log.exe
- %WINDIR%\ntdtcsetup.log.exe
- %WINDIR%\MedCtrOC.log.exe
- %WINDIR%\KB942288-v3.log.exe
- %WINDIR%\msdfmap.ini.exe
- %WINDIR%\msmqinst.log.exe
- %WINDIR%\msgsocm.log.exe
- <STUBS_DIR>\proc_tools.txt.exe
- <STUBS_DIR>\proc_im.txt.exe
- <STUBS_DIR>\runall.bat.exe
- %WINDIR%\0.log.exe
- <STUBS_DIR>\test.exe.exe
- <STUBS_DIR>\proc_banks.txt.exe
- <STUBS_DIR>\proc_av.txt.exe
- <STUBS_DIR>\proc_browsers.txt.exe
- <STUBS_DIR>\proc_games.txt.exe
- <STUBS_DIR>\proc_fake.txt.exe
- %WINDIR%\comsetup.log.exe
- %WINDIR%\COM+.log.exe
- %WINDIR%\control.ini.exe
- %WINDIR%\DtcInstall.log.exe
- %WINDIR%\desktop.ini.exe
- %WINDIR%\bootstat.dat.exe
- %WINDIR%\Blue Lace 16.bmp.exe
- %WINDIR%\clock.avi.exe
- %WINDIR%\Coffee Bean.bmp.exe
- %WINDIR%\cmsetacl.log.exe
Удаляет следующие файлы:
- %WINDIR%\setupact.log
- %WINDIR%\setupapi.log
- %WINDIR%\setuperr.log
- %WINDIR%\SET3.tmp
- %WINDIR%\SET4.tmp
- %WINDIR%\SET8.tmp
- %WINDIR%\Soap Bubbles.bmp
- %WINDIR%\spupdsvc.log
- %WINDIR%\Sti_Trace.log
- %WINDIR%\setuplog.txt
- %WINDIR%\sfk.exe
- %WINDIR%\sleep.exe
- %WINDIR%\OEWABLog.txt
- %WINDIR%\Prairie Wind.bmp
- %WINDIR%\regedit.exe
- %WINDIR%\ocgen.log
- %WINDIR%\ocmsn.log
- %WINDIR%\ODBCINST.INI
- %WINDIR%\River Sumida.bmp
- %WINDIR%\Santa Fe Stucco.bmp
- %WINDIR%\sessmgr.setup.log
- %WINDIR%\REGLOCS.OLD
- %WINDIR%\regopt.log
- %WINDIR%\Rhododendron.bmp
- %WINDIR%\system.ini
- %WINDIR%\WindowsUpdate.log
- %WINDIR%\winhelp.exe
- %WINDIR%\winhlp32.exe
- %WINDIR%\wiaservc.log
- %WINDIR%\win.ini
- %WINDIR%\WindowsShell.Manifest
- %WINDIR%\WMSysPr9.prx
- %WINDIR%\Zapotec.bmp
- %WINDIR%\_default.pif
- %WINDIR%\winnt.bmp
- %WINDIR%\winnt256.bmp
- %WINDIR%\wmsetup.log
- %WINDIR%\twain.dll
- %WINDIR%\twain_32.dll
- %WINDIR%\twunk_16.exe
- %WINDIR%\tabletoc.log
- %WINDIR%\TASKMAN.EXE
- %WINDIR%\tsoc.log
- %WINDIR%\vbaddin.ini
- %WINDIR%\vmmreg32.dll
- %WINDIR%\wiadebug.log
- %WINDIR%\twunk_32.exe
- %WINDIR%\updspapi.log
- %WINDIR%\vb.ini
- %WINDIR%\ntdtcsetup.log
- C:\Muldrop\FbsSqb.moh.fyf_0
- C:\Muldrop\Fjmf_je.eja.fyf_0
- C:\Muldrop\gbs.nbq.fyf_0
- C:\Muldrop\FbsPpm.moh.fyf_0
- C:\Muldrop\FbsRvt.img.fyf_0
- C:\Muldrop\FbsRvt.moh.fyf_0
- %WINDIR%\Blue Lace 16.bmp
- %WINDIR%\bootstat.dat
- %WINDIR%\clock.avi
- C:\Muldrop\RftupsfSfuujoht.dne.fyf_0
- C:\Muldrop\SbwfSfuujoht.dne.fyf_0
- %WINDIR%\0.log
- C:\Muldrop\dibohfmph.fyf_0
- C:\Muldrop\dibohfmph_foh.fyf_0
- C:\Muldrop\Fbs.fyf.fyf_0
- <Полный путь к файлу>
- C:\Muldrop\c662fg49.fyf.fyf_0
- C:\Muldrop\CmfbsPmvhjotCbdif.dne.fyf_0
- C:\Muldrop\FbsGfs.moh.fyf_0
- C:\Muldrop\FbsHvo.img.fyf_0
- C:\Muldrop\FbsHvo.moh.fyf_0
- C:\Muldrop\FbsCaf.moh.fyf_0
- C:\Muldrop\FbsEoh.img.fyf_0
- C:\Muldrop\FbsEoh.moh.fyf_0
- %WINDIR%\cmsetacl.log
- %WINDIR%\imsins.log
- %WINDIR%\KB942288-v3.log
- %WINDIR%\MedCtrOC.log
- %WINDIR%\hh.exe
- %WINDIR%\iis6.log
- %WINDIR%\imsins.BAK
- %WINDIR%\netfxocm.log
- %WINDIR%\NOTEPAD.EXE
- %WINDIR%\nsreg.dat
- %WINDIR%\msdfmap.ini
- %WINDIR%\msgsocm.log
- %WINDIR%\msmqinst.log
- %WINDIR%\control.ini
- %WINDIR%\desktop.ini
- %WINDIR%\DtcInstall.log
- %WINDIR%\Coffee Bean.bmp
- %WINDIR%\COM+.log
- %WINDIR%\comsetup.log
- %WINDIR%\FeatherTexture.bmp
- %WINDIR%\Gone Fishing.bmp
- %WINDIR%\Greenstone.bmp
- %WINDIR%\explorer.exe
- %WINDIR%\explorer.scf
- %WINDIR%\FaxSetup.log
Подменяет следующие файлы:
- <SYSTEM32>\dllcache\vmmreg32.dll.new
- <SYSTEM32>\dllcache\winhelp.exe.new
- <SYSTEM32>\dllcache\winhlp32.exe.new
- <SYSTEM32>\dllcache\twunk_16.exe.new
- <SYSTEM32>\dllcache\taskman.exe.new
- <SYSTEM32>\dllcache\twain.dll.new
- <SYSTEM32>\dllcache\twain_32.dll.new
