Техническая информация
Для обеспечения автозапуска и распространения:
Заражает следующие исполняемые файлы:
- %ProgramFiles%\FireFox\nspr4.dll
- %ProgramFiles%\FireFox\nsinstall.exe
- %ProgramFiles%\FireFox\mozsqlite3.dll
- %ProgramFiles%\FireFox\nss3.dll
- %ProgramFiles%\FireFox\nssutil3.dll
- %ProgramFiles%\FireFox\nssdbm3.dll
- %ProgramFiles%\FireFox\nssckbi.dll
- %ProgramFiles%\FireFox\mozjs.dll
- %ProgramFiles%\FireFox\freebl3.dll
- %ProgramFiles%\FireFox\firefox.exe
- %ProgramFiles%\FireFox\crashreporter.exe
- %ProgramFiles%\FireFox\IA2Marshal.dll
- %ProgramFiles%\FireFox\mozalloc.dll
- %ProgramFiles%\FireFox\mangle.exe
- %ProgramFiles%\FireFox\js.exe
- %ProgramFiles%\FireFox\xpidl.exe
- %ProgramFiles%\FireFox\xpcshell.exe
- %ProgramFiles%\FireFox\xpcom.dll
- %ProgramFiles%\FireFox\xpt_dump.exe
- %ProgramFiles%\FireFox\uninstall\helper.exe
- %ProgramFiles%\FireFox\xul.dll
- %ProgramFiles%\FireFox\xpt_link.exe
- %ProgramFiles%\FireFox\updater.exe
- %ProgramFiles%\FireFox\plugin-container.exe
- %ProgramFiles%\FireFox\plds4.dll
- %ProgramFiles%\FireFox\plc4.dll
- %ProgramFiles%\FireFox\shlibsign.exe
- %ProgramFiles%\FireFox\ssl3.dll
- %ProgramFiles%\FireFox\softokn3.dll
- %ProgramFiles%\FireFox\smime3.dll
- %ProgramFiles%\FireFox\AccessibleMarshal.dll
- %ProgramFiles%\NetMeeting\nmas.dll
- %ProgramFiles%\NetMeeting\nac.dll
- %ProgramFiles%\NetMeeting\MST123.DLL
- %ProgramFiles%\NetMeeting\nmasnt.dll
- %ProgramFiles%\NetMeeting\nmft.dll
- %ProgramFiles%\NetMeeting\nmcom.dll
- %ProgramFiles%\NetMeeting\nmchat.dll
- %ProgramFiles%\NetMeeting\MST120.DLL
- %ProgramFiles%\NetMeeting\cb32.exe
- %ProgramFiles%\NetMeeting\callcont.dll
- <STUBS_DIR>\test.exe
- %ProgramFiles%\NetMeeting\conf.exe
- %ProgramFiles%\NetMeeting\h323cc.dll
- %ProgramFiles%\NetMeeting\dcap32.dll
- %ProgramFiles%\NetMeeting\confmrsl.dll
- %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\Msncli.exe
- %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\Digcore.exe
- %ProgramFiles%\MSN\MSNCoreFiles\Install\msnsusii.exe
- %ProgramFiles%\Messenger\custsat.dll
- %ProgramFiles%\Messenger\msmsgs.exe
- %ProgramFiles%\Messenger\msgslang.dll
- %ProgramFiles%\Messenger\msgsc.dll
- %ProgramFiles%\MSN\MSNCoreFiles\OOBE\obepopc.dll
- %ProgramFiles%\NetMeeting\rrcm.dll
- %ProgramFiles%\NetMeeting\nmwb.dll
- %ProgramFiles%\NetMeeting\nmoldwb.dll
- %ProgramFiles%\NetMeeting\wb32.exe
- %ProgramFiles%\MSN\MSNCoreFiles\OOBE\obemtllc.dll
- %ProgramFiles%\MSN\MSNCoreFiles\OOBE\obemetal.dll
- %ProgramFiles%\MSN\MSNCoreFiles\OOBE\obelog.dll
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\dllcache\mst123.dll.new
- <SYSTEM32>\dllcache\mst120.dll.new
- <SYSTEM32>\dllcache\h323cc.dll.new
- <SYSTEM32>\dllcache\nac.dll.new
- <SYSTEM32>\dllcache\nmchat.dll.new
- <SYSTEM32>\dllcache\nmasnt.dll.new
- <SYSTEM32>\dllcache\nmas.dll.new
- <SYSTEM32>\dllcache\cb32.exe.new
- <SYSTEM32>\dllcache\callcont.dll.new
- %ProgramFiles%\NetMeeting\wb32.exe.new
- <SYSTEM32>\dllcache\conf.exe.new
- <SYSTEM32>\dllcache\dcap32.dll.new
- <SYSTEM32>\dllcache\confmrsl.dll.new
- %ProgramFiles%\FireFox\how_to_back_files.html
- %ProgramFiles%\FireFox\res\html\how_to_back_files.html
- %ProgramFiles%\FireFox\res\how_to_back_files.html
- %ProgramFiles%\FireFox\searchplugins\how_to_back_files.html
- %ProgramFiles%\FireFox\res\fonts\how_to_back_files.html
- %ProgramFiles%\FireFox\modules\how_to_back_files.html
- %ProgramFiles%\FireFox\res\dtd\how_to_back_files.html
- %ProgramFiles%\FireFox\res\entityTables\how_to_back_files.html
- <SYSTEM32>\dllcache\nmoldwb.dll.new
- <SYSTEM32>\dllcache\nmft.dll.new
- <SYSTEM32>\dllcache\nmcom.dll.new
- <SYSTEM32>\dllcache\nmwb.dll.new
- %ProgramFiles%\FireFox\uninstall\how_to_back_files.html
- <SYSTEM32>\dllcache\wb32.exe.new
- <SYSTEM32>\dllcache\rrcm.dll.new
- %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\how_to_back_files.html
- %ProgramFiles%\MSN\MSNCoreFiles\Install\how_to_back_files.html
- %ProgramFiles%\MSN\MSNCoreFiles\OOBE\how_to_back_files.html
- %ProgramFiles%\NetMeeting\callcont.dll.new
- %ProgramFiles%\NetMeeting\confmrsl.dll.new
- %ProgramFiles%\NetMeeting\conf.exe.new
- %ProgramFiles%\NetMeeting\cb32.exe.new
- C:\how_to_back_files.html
- %ALLUSERSPROFILE%\DBA32093B485EAFC35989C5805FFCFF6700AEDCF8C6D540D0D9EA4DBB1063AE5
- %APPDATA%\<Имя файла>.exe
- <STUBS_DIR>\how_to_back_files.html
- %ProgramFiles%\NetMeeting\how_to_back_files.html
- %ProgramFiles%\Online Services\how_to_back_files.html
- C:\RECYCLER\S-1-5-21-2052111302-484763869-725345543-1003\how_to_back_files.html
- %ProgramFiles%\NetMeeting\nmft.dll.new
- %ProgramFiles%\NetMeeting\nmcom.dll.new
- %ProgramFiles%\NetMeeting\nmchat.dll.new
- %ProgramFiles%\NetMeeting\nmoldwb.dll.new
- %ProgramFiles%\NetMeeting\rrcm.dll.new
- %ProgramFiles%\Messenger\how_to_back_files.html
- %ProgramFiles%\NetMeeting\nmwb.dll.new
- %ProgramFiles%\NetMeeting\mst120.dll.new
- %ProgramFiles%\NetMeeting\h323cc.dll.new
- %ProgramFiles%\NetMeeting\dcap32.dll.new
- %ProgramFiles%\NetMeeting\mst123.dll.new
- %ProgramFiles%\NetMeeting\nmasnt.dll.new
- %ProgramFiles%\NetMeeting\nmas.dll.new
- %ProgramFiles%\NetMeeting\nac.dll.new
Перемещает следующие файлы:
- %ProgramFiles%\FireFox\res\langGroups.properties в %ProgramFiles%\FireFox\res\langGroups.properties.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\grabber.gif в %ProgramFiles%\FireFox\res\grabber.gif.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\svg.css в %ProgramFiles%\FireFox\res\svg.css.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\language.properties в %ProgramFiles%\FireFox\res\language.properties.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\EditorOverride.css в %ProgramFiles%\FireFox\res\EditorOverride.css.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\searchplugins\yahoo.xml в %ProgramFiles%\FireFox\searchplugins\yahoo.xml.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\searchplugins\wikipedia.xml в %ProgramFiles%\FireFox\searchplugins\wikipedia.xml.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\designmode.css в %ProgramFiles%\FireFox\res\designmode.css.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\contenteditable.css в %ProgramFiles%\FireFox\res\contenteditable.css.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\table-add-column-after-active.gif в %ProgramFiles%\FireFox\res\table-add-column-after-active.gif.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\table-add-row-after-hover.gif в %ProgramFiles%\FireFox\res\table-add-row-after-hover.gif.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\table-add-row-after-active.gif в %ProgramFiles%\FireFox\res\table-add-row-after-active.gif.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\table-add-row-before-active.gif в %ProgramFiles%\FireFox\res\table-add-row-before-active.gif.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\table-add-row-after.gif в %ProgramFiles%\FireFox\res\table-add-row-after.gif.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\table-add-column-before.gif в %ProgramFiles%\FireFox\res\table-add-column-before.gif.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\table-add-column-after.gif в %ProgramFiles%\FireFox\res\table-add-column-after.gif.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\table-add-column-after-hover.gif в %ProgramFiles%\FireFox\res\table-add-column-after-hover.gif.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\table-add-column-before-hover.gif в %ProgramFiles%\FireFox\res\table-add-column-before-hover.gif.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\table-add-column-before-active.gif в %ProgramFiles%\FireFox\res\table-add-column-before-active.gif.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\searchplugins\google.xml в %ProgramFiles%\FireFox\searchplugins\google.xml.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\update.locale в %ProgramFiles%\FireFox\update.locale.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\ssl3.dll в %ProgramFiles%\FireFox\ssl3.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\updater.ini в %ProgramFiles%\FireFox\updater.ini.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\updater.exe в %ProgramFiles%\FireFox\updater.exe.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\softokn3.dll в %ProgramFiles%\FireFox\softokn3.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\shlibsign.exe в %ProgramFiles%\FireFox\shlibsign.exe.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\README.txt в %ProgramFiles%\FireFox\README.txt.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\softokn3.chk в %ProgramFiles%\FireFox\softokn3.chk.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\smime3.dll в %ProgramFiles%\FireFox\smime3.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\xpcom.dll в %ProgramFiles%\FireFox\xpcom.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\searchplugins\amazondotcom.xml в %ProgramFiles%\FireFox\searchplugins\amazondotcom.xml.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\uninstall\helper.exe в %ProgramFiles%\FireFox\uninstall\helper.exe.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\searchplugins\eBay.xml в %ProgramFiles%\FireFox\searchplugins\eBay.xml.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\searchplugins\bing.xml в %ProgramFiles%\FireFox\searchplugins\bing.xml.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\xul.dll в %ProgramFiles%\FireFox\xul.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\xpidl.exe в %ProgramFiles%\FireFox\xpidl.exe.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\xpcshell.exe в %ProgramFiles%\FireFox\xpcshell.exe.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\xpt_link.exe в %ProgramFiles%\FireFox\xpt_link.exe.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\xpt_dump.exe в %ProgramFiles%\FireFox\xpt_dump.exe.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\table-add-row-before-hover.gif в %ProgramFiles%\FireFox\res\table-add-row-before-hover.gif.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\modules\AddonUpdateChecker.jsm в %ProgramFiles%\FireFox\modules\AddonUpdateChecker.jsm.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\modules\AddonRepository.jsm в %ProgramFiles%\FireFox\modules\AddonRepository.jsm.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\modules\CommonDialog.jsm в %ProgramFiles%\FireFox\modules\CommonDialog.jsm.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\modules\CertUtils.jsm в %ProgramFiles%\FireFox\modules\CertUtils.jsm.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\modules\AddonManager.jsm в %ProgramFiles%\FireFox\modules\AddonManager.jsm.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\dtd\mathml.dtd в %ProgramFiles%\FireFox\res\dtd\mathml.dtd.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\entityTables\transliterate.properties в %ProgramFiles%\FireFox\res\entityTables\transliterate.properties.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\modules\AddonLogging.jsm в %ProgramFiles%\FireFox\modules\AddonLogging.jsm.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\dtd\xhtml11.dtd в %ProgramFiles%\FireFox\res\dtd\xhtml11.dtd.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\modules\CrashSubmit.jsm в %ProgramFiles%\FireFox\modules\CrashSubmit.jsm.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\modules\DownloadPaths.jsm в %ProgramFiles%\FireFox\modules\DownloadPaths.jsm.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\modules\DownloadLastDir.jsm в %ProgramFiles%\FireFox\modules\DownloadLastDir.jsm.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\modules\DownloadUtils.jsm в %ProgramFiles%\FireFox\modules\DownloadUtils.jsm.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\modules\DownloadTaskbarProgress.jsm в %ProgramFiles%\FireFox\modules\DownloadTaskbarProgress.jsm.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\modules\domplate.jsm в %ProgramFiles%\FireFox\modules\domplate.jsm.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\modules\ctypes.jsm в %ProgramFiles%\FireFox\modules\ctypes.jsm.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\modules\CSPUtils.jsm в %ProgramFiles%\FireFox\modules\CSPUtils.jsm.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\modules\distribution.js в %ProgramFiles%\FireFox\modules\distribution.js.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\modules\debug.js в %ProgramFiles%\FireFox\modules\debug.js.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\entityTables\mathml20.properties в %ProgramFiles%\FireFox\res\entityTables\mathml20.properties.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\table-remove-row.gif в %ProgramFiles%\FireFox\res\table-remove-row.gif.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\table-remove-row-hover.gif в %ProgramFiles%\FireFox\res\table-remove-row-hover.gif.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\fonts\mathfont.properties в %ProgramFiles%\FireFox\res\fonts\mathfont.properties.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\html\folder.png в %ProgramFiles%\FireFox\res\html\folder.png.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\table-remove-row-active.gif в %ProgramFiles%\FireFox\res\table-remove-row-active.gif.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\table-remove-column-active.gif в %ProgramFiles%\FireFox\res\table-remove-column-active.gif.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\table-add-row-before.gif в %ProgramFiles%\FireFox\res\table-add-row-before.gif.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\table-remove-column.gif в %ProgramFiles%\FireFox\res\table-remove-column.gif.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\table-remove-column-hover.gif в %ProgramFiles%\FireFox\res\table-remove-column-hover.gif.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\fonts\mathfontStandardSymbolsL.properties в %ProgramFiles%\FireFox\res\fonts\mathfontStandardSymbolsL.properties.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\entityTables\html40Special.properties в %ProgramFiles%\FireFox\res\entityTables\html40Special.properties.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\entityTables\html40Latin1.properties в %ProgramFiles%\FireFox\res\entityTables\html40Latin1.properties.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\entityTables\htmlEntityVersions.properties в %ProgramFiles%\FireFox\res\entityTables\htmlEntityVersions.properties.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\entityTables\html40Symbols.properties в %ProgramFiles%\FireFox\res\entityTables\html40Symbols.properties.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\fonts\mathfontUnicode.properties в %ProgramFiles%\FireFox\res\fonts\mathfontUnicode.properties.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\fonts\mathfontSTIXSize1.properties в %ProgramFiles%\FireFox\res\fonts\mathfontSTIXSize1.properties.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\fonts\mathfontSTIXNonUnicode.properties в %ProgramFiles%\FireFox\res\fonts\mathfontSTIXNonUnicode.properties.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\fonts\mathfontSymbol.properties в %ProgramFiles%\FireFox\res\fonts\mathfontSymbol.properties.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\res\fonts\mathfontSTIXSizeOneSym.properties в %ProgramFiles%\FireFox\res\fonts\mathfontSTIXSizeOneSym.properties.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\MSN\MSNCoreFiles\OOBE\obemtllc.dll в %ProgramFiles%\MSN\MSNCoreFiles\OOBE\obemtllc.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\MSN\MSNCoreFiles\OOBE\obemetal.dll в %ProgramFiles%\MSN\MSNCoreFiles\OOBE\obemetal.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\MSN\MSNCoreFiles\OOBE\signup.mar в %ProgramFiles%\MSN\MSNCoreFiles\OOBE\signup.mar.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\MSN\MSNCoreFiles\OOBE\obepopc.dll в %ProgramFiles%\MSN\MSNCoreFiles\OOBE\obepopc.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\MSN\MSNCoreFiles\OOBE\obelog.dll в %ProgramFiles%\MSN\MSNCoreFiles\OOBE\obelog.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\NetMeeting\TestSnd.wav в %ProgramFiles%\NetMeeting\TestSnd.wav.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\NetMeeting\rrcm.dll в %ProgramFiles%\NetMeeting\rrcm.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\MSN\MSNCoreFiles\OOBE\market.mar в %ProgramFiles%\MSN\MSNCoreFiles\OOBE\market.mar.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\NetMeeting\wb32.exe в %ProgramFiles%\NetMeeting\wb32.exe.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\MSN\MSNCoreFiles\Install\cinfo.xml в %ProgramFiles%\MSN\MSNCoreFiles\Install\cinfo.xml.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\Msncli.exe в %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\Msncli.exe.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\digreqEx.msi в %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\digreqEx.msi.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\Messenger\custsat.dll в %ProgramFiles%\Messenger\custsat.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\msnmsgs.msi в %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\msnmsgs.msi.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\digopt.msi в %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\digopt.msi.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\MSN\MSNCoreFiles\Install\msnsusii.exe в %ProgramFiles%\MSN\MSNCoreFiles\Install\msnsusii.exe.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\MSN\MSNCoreFiles\Install\msnms.ico в %ProgramFiles%\MSN\MSNCoreFiles\Install\msnms.ico.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\Digcore.exe в %ProgramFiles%\MSN\MSNCoreFiles\Install\MSN9Components\Digcore.exe.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\MSN\MSNCoreFiles\Install\xfp.xml в %ProgramFiles%\MSN\MSNCoreFiles\Install\xfp.xml.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\NetMeeting\nmwb.dll в %ProgramFiles%\NetMeeting\nmwb.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\NetMeeting\confmrsl.dll в %ProgramFiles%\NetMeeting\confmrsl.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\NetMeeting\conf.exe в %ProgramFiles%\NetMeeting\conf.exe.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\NetMeeting\h323cc.dll в %ProgramFiles%\NetMeeting\h323cc.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\NetMeeting\dcap32.dll в %ProgramFiles%\NetMeeting\dcap32.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\NetMeeting\cb32.exe в %ProgramFiles%\NetMeeting\cb32.exe.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\Online Services\Use MSN Explorer to sign up for Internet Access (US only).lnk в %ProgramFiles%\Online Services\Use MSN Explorer to sign up for Internet Access (US only).lnk.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\Online Services\Refer me to more Internet Service Providers.lnk в %ProgramFiles%\Online Services\Refer me to more Internet Service Providers.lnk.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\NetMeeting\callcont.dll в %ProgramFiles%\NetMeeting\callcont.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\NetMeeting\Blip.wav в %ProgramFiles%\NetMeeting\Blip.wav.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\NetMeeting\MST120.DLL в %ProgramFiles%\NetMeeting\MST120.DLL.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\NetMeeting\nmcom.dll в %ProgramFiles%\NetMeeting\nmcom.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\NetMeeting\nmchat.dll в %ProgramFiles%\NetMeeting\nmchat.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\NetMeeting\nmoldwb.dll в %ProgramFiles%\NetMeeting\nmoldwb.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\NetMeeting\nmft.dll в %ProgramFiles%\NetMeeting\nmft.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\NetMeeting\nmasnt.dll в %ProgramFiles%\NetMeeting\nmasnt.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\NetMeeting\nac.dll в %ProgramFiles%\NetMeeting\nac.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\NetMeeting\MST123.DLL в %ProgramFiles%\NetMeeting\MST123.DLL.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\NetMeeting\nmas.dll в %ProgramFiles%\NetMeeting\nmas.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\NetMeeting\netmeet.htm в %ProgramFiles%\NetMeeting\netmeet.htm.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\Messenger\logowin.gif в %ProgramFiles%\Messenger\logowin.gif.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\mozjs.dll в %ProgramFiles%\FireFox\mozjs.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\mozalloc.dll в %ProgramFiles%\FireFox\mozalloc.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\nsinstall.exe в %ProgramFiles%\FireFox\nsinstall.exe.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\mozsqlite3.dll в %ProgramFiles%\FireFox\mozsqlite3.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\mangle.exe в %ProgramFiles%\FireFox\mangle.exe.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\IA2Marshal.dll в %ProgramFiles%\FireFox\IA2Marshal.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\greprefs.js в %ProgramFiles%\FireFox\greprefs.js.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\js.log в %ProgramFiles%\FireFox\js.log.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\js.exe в %ProgramFiles%\FireFox\js.exe.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\nspr4.dll в %ProgramFiles%\FireFox\nspr4.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\plc4.dll в %ProgramFiles%\FireFox\plc4.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\platform.ini в %ProgramFiles%\FireFox\platform.ini.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\plugin-container.exe в %ProgramFiles%\FireFox\plugin-container.exe.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\plds4.dll в %ProgramFiles%\FireFox\plds4.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\nssutil3.dll в %ProgramFiles%\FireFox\nssutil3.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\nssckbi.dll в %ProgramFiles%\FireFox\nssckbi.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\nss3.dll в %ProgramFiles%\FireFox\nss3.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\nssdbm3.dll в %ProgramFiles%\FireFox\nssdbm3.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\nssdbm3.chk в %ProgramFiles%\FireFox\nssdbm3.chk.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\freebl3.dll в %ProgramFiles%\FireFox\freebl3.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\Messenger\online.wav в %ProgramFiles%\Messenger\online.wav.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\Messenger\newemail.wav в %ProgramFiles%\Messenger\newemail.wav.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\Messenger\xpmsgr.chm в %ProgramFiles%\Messenger\xpmsgr.chm.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\Messenger\type.wav в %ProgramFiles%\Messenger\type.wav.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\Messenger\newalert.wav в %ProgramFiles%\Messenger\newalert.wav.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\Messenger\msgsc.dll в %ProgramFiles%\Messenger\msgsc.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\Messenger\lvback.gif в %ProgramFiles%\Messenger\lvback.gif.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\Messenger\msmsgs.exe в %ProgramFiles%\Messenger\msmsgs.exe.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\Messenger\msgslang.dll в %ProgramFiles%\Messenger\msgslang.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\AccessibleMarshal.dll в %ProgramFiles%\FireFox\AccessibleMarshal.dll.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\dependentlibs.list в %ProgramFiles%\FireFox\dependentlibs.list.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\crashreporter.ini в %ProgramFiles%\FireFox\crashreporter.ini.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\freebl3.chk в %ProgramFiles%\FireFox\freebl3.chk.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\firefox.exe в %ProgramFiles%\FireFox\firefox.exe.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\crashreporter.exe в %ProgramFiles%\FireFox\crashreporter.exe.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\blocklist.xml в %ProgramFiles%\FireFox\blocklist.xml.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\application.ini в %ProgramFiles%\FireFox\application.ini.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\crashreporter-override.ini в %ProgramFiles%\FireFox\crashreporter-override.ini.{GALAXYGUARDS@PROTONMAIL.COM}IQ
- %ProgramFiles%\FireFox\chrome.manifest в %ProgramFiles%\FireFox\chrome.manifest.{GALAXYGUARDS@PROTONMAIL.COM}IQ
Подменяет следующие файлы:
- <SYSTEM32>\dllcache\mst120.dll.new
- <SYSTEM32>\dllcache\h323cc.dll.new
- <SYSTEM32>\dllcache\nac.dll.new
- <SYSTEM32>\dllcache\mst123.dll.new
- <SYSTEM32>\dllcache\dcap32.dll.new
- <SYSTEM32>\dllcache\cb32.exe.new
- <SYSTEM32>\dllcache\callcont.dll.new
- <SYSTEM32>\dllcache\confmrsl.dll.new
- <SYSTEM32>\dllcache\conf.exe.new
