Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'syswin' = '"C:\boots\syswin.exe"'
Изменения в файловой системе
Создает следующие файлы
- C:\boots\syswin.exe
Удаляет следующие файлы
- C:\boots\syswin.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_regbrowsers.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_regiis.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_regsql.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_state.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_wp.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\caspol.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\comsvcconfig.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\dfsvc.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\edmgen.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\ilasm.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\jsc.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.workflow.compiler.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\datasvcutil.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\addinutil.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\al.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\aspnet_regiis.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\aspnet_state.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\aspnet_wp.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\caspol.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\configwizards.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\csc.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\cvtres.exe
- %WINDIR%\microsoft.net\assembly\gac_msil\microsoft.workflow.compiler\v4.0_4.0.0.0__31bf3856ad364e35\microsoft.workflow.compiler.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\ieexec.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\installutil.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\jsc.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\migpol.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\migpolwin.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\ngen.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\regasm.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\regsvcs.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\vbc.exe
- %WINDIR%\microsoft.net\framework\v1.1.4322\ilasm.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\ngen.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\installutil.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\jsc.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\microsoft.workflow.compiler.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\msbuild.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\mscorsvw.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\ngen.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\regsvcs.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\regtlibv12.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\servicemodelreg.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\smsvchost.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\vbc.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\wsatconfig.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\v4.5.51209\setup.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\v4.5.51209\setuputility.exe
- %WINDIR%\syswow64\flashplayerapp.exe
- %WINDIR%\syswow64\macromed\flash\flashplayerplugin_18_0_0_261.exe
- %WINDIR%\syswow64\macromed\flash\flashplayerupdateservice.exe
- %WINDIR%\syswow64\macromed\flash\flashutil32_18_0_0_261_plugin.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\ilasm.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\dfsvc.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\edmgen.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\datasvcutil.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\regtlibv12.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\servicemodelreg.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\smsvchost.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe
- %WINDIR%\microsoft.net\framework\v4.0.30319\wsatconfig.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\addinprocess.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\addinprocess32.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\addinutil.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\applaunch.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_compiler.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_regbrowsers.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_regiis.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_regsql.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_state.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_wp.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\caspol.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\comsvcconfig.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe
- %WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe
- %WINDIR%\syswow64\macromed\flash\flashutil32_19_0_0_207_activex.exe
- %WINDIR%\microsoft.net\netfxrepair.exe
- %WINDIR%\installer\{eb9bd1d5-8dfb-48c4-927b-10bb47ca59b3}\misc.exe.d0df3458_a845_11d3_8d0a_0050046416b9.exe
- %WINDIR%\installer\{ac76ba86-0804-1033-1959-001824166751}\arpproducticon.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\wsatconfig\557ed13bc768e12c99db60675ee3f666\wsatconfig.ni.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\comsvcconfig\024a8715894b4f4fd34d3db21f752975\comsvcconfig.ni.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\dfsvc\e257ef38aa03c274e9aba207fd54f77f\dfsvc.ni.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.w71daf281#\b143dd261ebe20e9b0845ba27c3f76ac\microsoft.workflow.compiler.ni.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\msbuild\25eb7b1618ca1545c7ec84456d074d6f\msbuild.ni.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\smsvchost\51d826d83a75f90dae1d6db7117a939e\smsvchost.ni.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_64\wsatconfig\687681ea1f0c808fb363da30dd01dd20\wsatconfig.ni.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\msbuild\bacab0e3cfcf2d9d29aceb5bab5be124\msbuild.ni.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\smsvchost\34ca727f3ea92f523f55c683024fb3a0\smsvchost.ni.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\accicons.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\excel.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\fltldr.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\graph.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\groove.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\groovemn.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\iecontentservice.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\infopath.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\clview.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\dwtrig20.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.w71daf281#\e03f7e1ad3da330ea8d4abf8770169e9\microsoft.workflow.compiler.ni.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\dfsvc\8a45f6b74acf0c603a3fe2f544bdc6f5\dfsvc.ni.exe
- %WINDIR%\assembly\nativeimages_v4.0.30319_32\comsvcconfig\1ab92037cd03e6512831746186aa21ae\comsvcconfig.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\comsvcconfig\5f1a06c0108b2c81cde1dc491d74043d\comsvcconfig.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\dfsvc.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\ehexthost32\c899de3549784161aa66610d5735e4f0\ehexthost32.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\msbuild\af28543d9b3e7d9f110448ecce53cd72\msbuild.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\narrator\0bae62c3fc6c327ed24989263988173d\narrator.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\presentationfontcac#\b3ade8d5c0d4bb5d4940bcafd3453642\presentationfontcache.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\smsvchost\1bc1ee3c3aa45d28dcf4657bceb2fcb4\smsvchost.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_32\wsatconfig\96a8bdafba9f9d3e33cd974bfaa67e58\wsatconfig.ni.exe
- %WINDIR%\flash_sa.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\comsvcconfig\d632b7434f821829827657e23ac98589\comsvcconfig.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\ehexthost\ad37b6e3a1cb1081592f1c5797ae9dad\ehexthost.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\loadmxf\d09b54cd68bc772b3be3832926e940d4\loadmxf.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\mcupdate\f30beba36940b5a2b55a32ea7f42d694\mcupdate.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\msbuild\1a154709cdfe214029ea88c51ab2b579\msbuild.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\narrator\4cc02fad33053737088d4c18267ca0a0\narrator.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\presentationfontcac#\0246845f487e5f33d3564eff578665a3\presentationfontcache.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\smsvchost\04d794428d635f6a82ac57dd3d6f3628\smsvchost.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\wsatconfig\36ca2928b2191011831ab673861c6ac6\wsatconfig.ni.exe
- %WINDIR%\assembly\nativeimages_v2.0.50727_64\dfsvc\9bc0d921859b039d6e9f642148333949\dfsvc.ni.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\misc.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\msaccess.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\msoicons.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\msosync.exe
- %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\adobecollabsync.exe
- %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\logtransport2.exe
- %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\rdrservicesupdater.exe
- %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\_4bitmapibroker.exe
- %WINDIR%\installer\{0699cbd6-fff5-4211-97a7-9c32e744f5f4}\arpproducticon.exe
- %WINDIR%\installer\{70f0f88a-387b-40eb-93bd-9877db9d668d}\arpproducticon.exe
- %WINDIR%\installer\{90140000-0011-0000-1000-0000000ff1ce}\accicons.exe
- %WINDIR%\installer\{90140000-0011-0000-1000-0000000ff1ce}\cagicon.exe
- %WINDIR%\installer\{90140000-0011-0000-1000-0000000ff1ce}\grvicons.exe
- %WINDIR%\installer\{90140000-0011-0000-1000-0000000ff1ce}\inficon.exe
- %WINDIR%\installer\{90140000-0011-0000-1000-0000000ff1ce}\joticon.exe
- %WINDIR%\installer\{90140000-0011-0000-1000-0000000ff1ce}\misc.exe
- %WINDIR%\installer\{90140000-0011-0000-1000-0000000ff1ce}\msouc.exe
- %WINDIR%\installer\{90140000-0011-0000-1000-0000000ff1ce}\oisicon.exe
- %WINDIR%\installer\{90140000-0011-0000-1000-0000000ff1ce}\outicon.exe
- %WINDIR%\installer\{90140000-0011-0000-1000-0000000ff1ce}\pptico.exe
- %WINDIR%\installer\{90140000-0011-0000-1000-0000000ff1ce}\pubs.exe
- %WINDIR%\installer\{90140000-0011-0000-1000-0000000ff1ce}\wordicon.exe
- %WINDIR%\installer\{90140000-0011-0000-1000-0000000ff1ce}\xlicons.exe
- %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\adelrcp.exe
- %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\acrord32.exe
- %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\acrord32info.exe
- %WINDIR%\installer\$patchcache$\managed\68ab67ca7da73301b744caf070e41400\15.7.20033\acrobroker.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\msouc.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\mspub.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\mstordb.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\oarpmany.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\odeploy.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\ois.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\onenote.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\onenotem.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\outlook.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\powerpnt.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\pptico.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\selfcert.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\setup.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\vpreview.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\winword.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\wkconv.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\wordicon.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\xl12cnv.exe
- %WINDIR%\installer\$patchcache$\managed\00004109110000000100000000f01fec\14.0.4763\xlicons.exe
- %WINDIR%\installer\{90140000-006e-0409-1000-0000000ff1ce}\misc.exe
- %WINDIR%\syswow64\urttemp\regtlib.exe
Другое
Создает и запускает на исполнение
- 'C:\boots\syswin.exe'
Запускает на исполнение
- '%WINDIR%\syswow64\tasklist.exe' /fo csv
