Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- %APPDATA%\microsoft\windows\start menu\programs\startup\5zy4hsui.lnk
Вредоносные функции
Для затруднения выявления своего присутствия в системе
удаляет теневые копии разделов.
Изменения в файловой системе
Создает следующие файлы
- C:\far2\addons\colors\custom_highlighting\import_colors.bat.pyrp
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.html
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemui.xml.pyrp
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemuiset.xml.pyrp
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\setup.xml.pyrp
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\accessmui.xml.pyrp
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\#decrypt_my_files#.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\#decrypt_my_files#.html
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\branding.xml.pyrp
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\accessmuiset.xml.pyrp
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.html
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\setup.xml.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\#decrypt_my_files#.txt
- %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\#decrypt_my_files#.html
- %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.html
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\branding.xml.pyrp
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml.pyrp
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.xml.pyrp
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.txt
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.html
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\setup.xml.pyrp
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\infopathmui.xml.pyrp
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.txt
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.html
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\setup.xml.pyrp
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\onenotemui.xml.pyrp
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.txt
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.html
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\setup.xml.pyrp
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\groovemui.xml.pyrp
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.txt
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.html
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\setup.xml.pyrp
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\#decrypt_my_files#.txt
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\#decrypt_my_files#.html
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\#decrypt_my_files#.txt
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\#decrypt_my_files#.html
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_pref.ico.pyrp
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_property.ico.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_.ico.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_property.ico.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_settings.ico.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml.pyrp
- %ALLUSERSPROFILE%\microsoft\ilscache\ilrcache.xml.pyrp
- %ALLUSERSPROFILE%\microsoft\ilscache\#decrypt_my_files#.txt
- %ALLUSERSPROFILE%\microsoft\ilscache\#decrypt_my_files#.html
- %ALLUSERSPROFILE%\microsoft\ilscache\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\wmp.ico.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-us\resource.xml.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\settings.ico.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\#decrypt_my_files#.txt
- %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\#decrypt_my_files#.html
- %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\resource.xml.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\#decrypt_my_files#.txt
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\#decrypt_my_files#.html
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-us\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\#decrypt_my_files#.txt
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\#decrypt_my_files#.html
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\netfol.ico.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\pictures.ico.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ringtones.ico.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\sync.ico.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml.pyrp
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml.pyrp
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\far2\documentation\eng\techinfo.txt.pyrp
- C:\far2\documentation\rus\arc_support.txt.pyrp
- C:\far2\documentation\rus\#decrypt_my_files#.txt
- C:\far2\documentation\rus\#decrypt_my_files#.html
- C:\far2\documentation\rus\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\far2\documentation\rus\bug_report.txt.pyrp
- C:\far2\documentation\rus\far_faq.txt.pyrp
- C:\far2\documentation\rus\plugins_install.txt.pyrp
- C:\far2\documentation\rus\plugins_review.txt.pyrp
- C:\far2\documentation\rus\techinfo.txt.pyrp
- C:\far2\plugins\ftp\ftpcmds.txt.pyrp
- C:\far2\plugins\ftp\#decrypt_my_files#.txt
- C:\far2\plugins\ftp\#decrypt_my_files#.html
- C:\far2\plugins\ftp\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\far2\plugins\ftp\ftpcmds_rus.txt.pyrp
- C:\far2\plugins\ftp\notes.txt.pyrp
- C:\far2\plugins\ftp\notes_rus.txt.pyrp
- C:\far2\pluginsdk\headers.pas\farcolorw.pas.pyrp
- C:\far2\documentation\eng\plugins_install.txt.pyrp
- C:\far2\pluginsdk\headers.pas\#decrypt_my_files#.txt
- C:\far2\documentation\eng\far_faq.txt.pyrp
- C:\far2\documentation\eng\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\far2\addons\colors\custom_highlighting\#decrypt_my_files#.txt
- C:\far2\addons\colors\custom_highlighting\#decrypt_my_files#.html
- C:\far2\addons\colors\custom_highlighting\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\far2\addons\colors\default_highlighting\import_colors.bat.pyrp
- C:\far2\addons\colors\default_highlighting\#decrypt_my_files#.txt
- C:\far2\addons\colors\default_highlighting\#decrypt_my_files#.html
- C:\far2\addons\colors\default_highlighting\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\far2\addons\colors\export_colors.bat.pyrp
- C:\far2\addons\colors\#decrypt_my_files#.txt
- C:\far2\addons\colors\#decrypt_my_files#.html
- C:\far2\addons\colors\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\far2\addons\colors\import_colors.bat.pyrp
- C:\far2\addons\readme.txt.pyrp
- C:\far2\addons\#decrypt_my_files#.txt
- C:\far2\addons\#decrypt_my_files#.html
- C:\far2\addons\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\far2\documentation\eng\arc_support.txt.pyrp
- C:\far2\documentation\eng\#decrypt_my_files#.txt
- C:\far2\documentation\eng\#decrypt_my_files#.html
- C:\far2\documentation\eng\bug_report.txt.pyrp
- C:\far2\pluginsdk\headers.pas\#decrypt_my_files#.html
- C:\far2\documentation\eng\plugins_review.txt.pyrp
- C:\far2\pluginsdk\headers.pas\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.html
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml.pyrp
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml.pyrp
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.txt
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.html
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml.pyrp
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml.pyrp
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\#decrypt_my_files#.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\#decrypt_my_files#.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml.pyrp
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\#decrypt_my_files#.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\#decrypt_my_files#.html
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.xml.pyrp
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\#decrypt_my_files#.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\#decrypt_my_files#.html
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.txt
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml.pyrp
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml.pyrp
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\far2\pluginsdk\headers.pas\farkeysw.pas.pyrp
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml.pyrp
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\#decrypt_my_files#.txt
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\#decrypt_my_files#.html
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml.pyrp
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml.pyrp
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml.pyrp
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.txt
- %ALLUSERSPROFILE%\microsoft\ilscache\imcrcache.xml.pyrp
- %ALLUSERSPROFILE%\microsoft\device stage\task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_queue.ico.pyrp
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.html
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml.pyrp
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.txt
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.html
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\#key-06c5ac6e236753ab3d20ef5da73a8905.key
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml.pyrp
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml.pyrp
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.txt
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\#decrypt_my_files#.html
- C:\far2\pluginsdk\headers.pas\pluginw.pas.pyrp
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml.pyrp
- %ALLUSERSPROFILE%\microsoft\network\downloader\qmgr0.dat.pyrp
Перемещает следующие файлы
- C:\far2\addons\colors\custom_highlighting\import_colors.bat в C:\far2\addons\colors\custom_highlighting\import_colors.bat.saturn
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml в C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml.saturn
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml в C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml.saturn
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml в C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml.saturn
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml в C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml.saturn
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml в C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml.saturn
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml в C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml.saturn
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.xml в C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.xml.saturn
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml в C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml.saturn
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml в C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml.saturn
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.xml в C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.xml.saturn
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\setup.xml в C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\setup.xml.saturn
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml в C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml.saturn
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml в C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml.saturn
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\infopathmui.xml в C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\infopathmui.xml.saturn
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\setup.xml в C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\setup.xml.saturn
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\groovemui.xml в C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\groovemui.xml.saturn
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\setup.xml в C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\setup.xml.saturn
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\branding.xml в C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\branding.xml.saturn
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemui.xml в C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemui.xml.saturn
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemuiset.xml в C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemuiset.xml.saturn
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\setup.xml в C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\setup.xml.saturn
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\accessmui.xml в C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\accessmui.xml.saturn
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\branding.xml в C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\branding.xml.saturn
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\accessmuiset.xml в C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\accessmuiset.xml.saturn
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\setup.xml в C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\setup.xml.saturn
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\setup.xml в C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\setup.xml.saturn
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\onenotemui.xml в C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\onenotemui.xml.saturn
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml в C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml.saturn
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml в C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml.saturn
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml в C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml.saturn
- C:\far2\addons\colors\export_colors.bat в C:\far2\addons\colors\export_colors.bat.saturn
- C:\far2\addons\colors\import_colors.bat в C:\far2\addons\colors\import_colors.bat.saturn
- C:\far2\addons\readme.txt в C:\far2\addons\readme.txt.saturn
- C:\far2\documentation\eng\arc_support.txt в C:\far2\documentation\eng\arc_support.txt.saturn
- C:\far2\documentation\eng\bug_report.txt в C:\far2\documentation\eng\bug_report.txt.saturn
- C:\far2\documentation\eng\far_faq.txt в C:\far2\documentation\eng\far_faq.txt.saturn
- C:\far2\documentation\eng\plugins_install.txt в C:\far2\documentation\eng\plugins_install.txt.saturn
- C:\far2\documentation\eng\plugins_review.txt в C:\far2\documentation\eng\plugins_review.txt.saturn
- C:\far2\documentation\eng\techinfo.txt в C:\far2\documentation\eng\techinfo.txt.saturn
- C:\far2\documentation\rus\arc_support.txt в C:\far2\documentation\rus\arc_support.txt.saturn
- C:\far2\documentation\rus\bug_report.txt в C:\far2\documentation\rus\bug_report.txt.saturn
- C:\far2\documentation\rus\far_faq.txt в C:\far2\documentation\rus\far_faq.txt.saturn
- C:\far2\addons\colors\default_highlighting\import_colors.bat в C:\far2\addons\colors\default_highlighting\import_colors.bat.saturn
- C:\far2\documentation\rus\plugins_install.txt в C:\far2\documentation\rus\plugins_install.txt.saturn
- C:\far2\documentation\rus\techinfo.txt в C:\far2\documentation\rus\techinfo.txt.saturn
- C:\far2\plugins\ftp\ftpcmds.txt в C:\far2\plugins\ftp\ftpcmds.txt.saturn
- C:\far2\plugins\ftp\ftpcmds_rus.txt в C:\far2\plugins\ftp\ftpcmds_rus.txt.saturn
- C:\far2\plugins\ftp\notes.txt в C:\far2\plugins\ftp\notes.txt.saturn
- C:\far2\plugins\ftp\notes_rus.txt в C:\far2\plugins\ftp\notes_rus.txt.saturn
- C:\far2\pluginsdk\headers.pas\farcolorw.pas в C:\far2\pluginsdk\headers.pas\farcolorw.pas.saturn
- C:\far2\pluginsdk\headers.pas\farkeysw.pas в C:\far2\pluginsdk\headers.pas\farkeysw.pas.saturn
- C:\far2\pluginsdk\headers.pas\pluginw.pas в C:\far2\pluginsdk\headers.pas\pluginw.pas.saturn
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml в C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml.saturn
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml в C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml.saturn
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml в C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml.saturn
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml в C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml.saturn
- C:\far2\documentation\rus\plugins_review.txt в C:\far2\documentation\rus\plugins_review.txt.saturn
- %ALLUSERSPROFILE%\microsoft\ilscache\ilrcache.xml в %ALLUSERSPROFILE%\microsoft\ilscache\ilrcache.xml.saturn
- %ALLUSERSPROFILE%\microsoft\ilscache\imcrcache.xml в %ALLUSERSPROFILE%\microsoft\ilscache\imcrcache.xml.saturn
Другое
Создает и запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin.exe delete shadows /all /quiet & wmic.exe shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete ...' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin.exe delete shadows /all /quiet & wmic.exe shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete ...
- '<SYSTEM32>\vssvc.exe'
