Trojan.Encoder.34019

Техническая информация

Изменения в файловой системе

Создает следующие файлы

C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\desktop.ini.henry217
%ALLUSERSPROFILE%\microsoft help\hx_1033_mvalidator.hxd.henry217
%ALLUSERSPROFILE%\microsoft help\hx_1033_mvalidator.lck.henry217
%ALLUSERSPROFILE%\microsoft help\ms.dexplore.hxn.henry217
%ALLUSERSPROFILE%\microsoft help\ms.dexplore_1033_mkwd_a.hxw.henry217
%ALLUSERSPROFILE%\microsoft help\ms.dexplore_1033_mkwd_f.hxw.henry217
%ALLUSERSPROFILE%\microsoft help\ms.dexplore_1033_mkwd_k.hxw.henry217
%ALLUSERSPROFILE%\microsoft help\ms.dexplore_1033_mvalidator.hxd.henry217
%ALLUSERSPROFILE%\microsoft help\ms.infopatheditor.14.1033.hxn.henry217
%ALLUSERSPROFILE%\microsoft help\ms.dexplore_1033_mvalidator.lck.henry217
%ALLUSERSPROFILE%\microsoft help\ms.excel.14.1033.hxn.henry217
%ALLUSERSPROFILE%\microsoft help\ms.excel.dev.14.1033.hxn.henry217
%ALLUSERSPROFILE%\microsoft help\ms.graph.14.1033.hxn.henry217
%ALLUSERSPROFILE%\microsoft help\ms.groove.14.1033.hxn.henry217
%ALLUSERSPROFILE%\microsoft help\ms.infopath.14.1033.hxn.henry217
%ALLUSERSPROFILE%\microsoft help\hx_1033_mtoc_hx.hxh.henry217
%ALLUSERSPROFILE%\microsoft help\ms.dexplore_1033_mkwd_vs70namedurl.hxw.henry217
%ALLUSERSPROFILE%\microsoft help\hx_1033_mkwd_namedurl.hxw.henry217
%ALLUSERSPROFILE%\adobe\arm\s\armmanifest.msi.henry217
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\accessmui.xml.henry217
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\acclr.cab.henry217
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\branding.xml.henry217
%ALLUSERSPROFILE%\ntuser.pol.henry217
%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\acrordrdcupd1500920077.msp.henry217
%ALLUSERSPROFILE%\adobe\arm\reader_15.007.20033\readerdcmanifest.msi.henry217
%ALLUSERSPROFILE%\adobe\arm\s\10428\adobearmhelper.exe.henry217
%ALLUSERSPROFILE%\microsoft help\hx.hxn.henry217
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\abcpy.ini.henry217
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acrordrdcupd1500820082.msp.henry217
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\acroread.msi.henry217
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\data1.cab.henry217
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.exe.henry217
%ALLUSERSPROFILE%\adobe\setup\{ac76ba86-7ad7-1033-7b44-ac0f074e4100}\setup.ini.henry217
%ALLUSERSPROFILE%\microsoft help\hx_1033_mkwd_k.hxw.henry217
%ALLUSERSPROFILE%\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_k.hxw.henry217
%ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\vcruntimeminimum_amd64\cab1.cab.henry217
%ALLUSERSPROFILE%\microsoft help\ms.msouc.14.1033.hxn.henry217
%ALLUSERSPROFILE%\microsoft help\ms.setlang.14.1033.hxn.henry217
%ALLUSERSPROFILE%\microsoft help\ms.winword.14.1033.hxn.henry217
%ALLUSERSPROFILE%\microsoft help\ms.winword.dev.14.1033.hxn.henry217
%ALLUSERSPROFILE%\microsoft help\nslist.hxl.henry217
%ALLUSERSPROFILE%\microsoft toolkit\settings.xml.henry217
%ALLUSERSPROFILE%\mozilla\logs\maintenanceservice-install.log.henry217
%ALLUSERSPROFILE%\oracle\java\installcache_x64\baseimagefam8.henry217
%ALLUSERSPROFILE%\microsoft help\ms.msaccess.dev.14.1033.hxn.henry217
%ALLUSERSPROFILE%\oracle\java\javapath\java.exe.henry217
%ALLUSERSPROFILE%\oracle\java\javapath\javaw.exe.henry217
%ALLUSERSPROFILE%\oracle\java\javapath\javaws.exe.henry217
%ALLUSERSPROFILE%\package cache\42d5bec7ddfbd49e76467529cbc2868987bf8460\packages\patch\x64\windows6.1-kb2999226-x64.msu.henry217
%ALLUSERSPROFILE%\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\state.rsm.henry217
%ALLUSERSPROFILE%\package cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\vcredist_x86.exe.henry217
%ALLUSERSPROFILE%\microsoft help\ms.powerpnt.dev.14.1033.hxn.henry217
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\accessmui.msi.henry217
%ALLUSERSPROFILE%\microsoft help\ms.powerpnt.14.1033.hxn.henry217
%ALLUSERSPROFILE%\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_f.hxw.henry217
%ALLUSERSPROFILE%\microsoft help\ms.mspub.14.1033.hxn.henry217
%ALLUSERSPROFILE%\microsoft help\ms.mspub.dev.14.1033.hxn.henry217
%ALLUSERSPROFILE%\microsoft help\ms.mstore.14.1033.hxn.henry217
%ALLUSERSPROFILE%\microsoft help\ms.netframeworksdkv1.1.hxn.henry217
%ALLUSERSPROFILE%\microsoft help\ms.netframeworksdkv1.1_1033_cvalidator.hxd.henry217
%ALLUSERSPROFILE%\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_a.hxw.henry217
%ALLUSERSPROFILE%\microsoft help\ms.msaccess.14.1033.hxn.henry217
%ALLUSERSPROFILE%\microsoft help\ms.outlook.14.1033.hxn.henry217
%ALLUSERSPROFILE%\microsoft help\ms.netframeworksdkv1.1_1033_mkwd_netsdknamedurls.hxw.henry217
%ALLUSERSPROFILE%\microsoft help\ms.netframeworksdkv1.1_1033_mtoc_netsdk.hxh.henry217
%ALLUSERSPROFILE%\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.hxd.henry217
%ALLUSERSPROFILE%\microsoft help\ms.netframeworksdkv1.1_1033_mvalidator.lck.henry217
%ALLUSERSPROFILE%\microsoft help\ms.ois.14.1033.hxn.henry217
%ALLUSERSPROFILE%\microsoft help\ms.onenote.14.1033.hxn.henry217
%ALLUSERSPROFILE%\microsoft help\ms.outlook.dev.14.1033.hxn.henry217
%ALLUSERSPROFILE%\mozilla\logs\maintenanceservice-uninstall.log.henry217
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\setup.xml.henry217
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemuiset.msi.henry217
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml.henry217
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml.henry217
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordlr.cab.henry217
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.msi.henry217
C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml.henry217
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.msi.henry217
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml.henry217
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.cab.henry217
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.cab.henry217
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.msi.henry217
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml.henry217
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.cab.henry217
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.msi.henry217
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml.henry217
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml.henry217
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml.henry217
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.msi.henry217
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml.henry217
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww2.cab.henry217
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.exe.henry217
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml.henry217
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excellr.cab.henry217
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.msi.henry217
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml.henry217
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.msi.henry217
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml.henry217
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml.henry217
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\pptlr.cab.henry217
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml.henry217
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.msi.henry217
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml.henry217
C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publr.cab.henry217
C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlklr.cab.henry217
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\onenotemui.msi.henry217
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\accessmuiset.msi.henry217
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.msi.henry217
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\dwtrig20.exe.henry217
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\microsoft.vc90.crt.manifest.henry217
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\msvcr90.dll.henry217
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officelr.cab.henry217
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemui.msi.henry217
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemui.xml.henry217
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\officemuiset.xml.henry217
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.xml.henry217
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\osetupui.dll.henry217
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\pss10r.chm.henry217
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\setup.chm.henry217
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\setup.xml.henry217
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\shellui.mst.henry217
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\1033\dwintl20.dll.henry217
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\dwdcw20.dll.henry217
C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\accessmuiset.xml.henry217
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\dw20.exe.henry217
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\setup.xml.henry217
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\office32mui.xml.henry217
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\owow32lr.cab.henry217
C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\setup.xml.henry217
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\inflr.cab.henry217
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\infopathmui.msi.henry217
C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\infopathmui.xml.henry217
C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\proof.msi.henry217
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\setup.xml.henry217
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\onenotemui.xml.henry217
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\onotelr.cab.henry217
C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\setup.xml.henry217
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\groovelr.cab.henry217
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\groovemui.msi.henry217
C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\groovemui.xml.henry217
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\branding.xml.henry217
C:\totalcmd\noclose64.exe.henry217
C:\users\public\pictures\desktop.ini.henry217
%ALLUSERSPROFILE%\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\vcredist_x64.exe.henry217
C:\totalcmd\language\wcmd_ita.inc.henry217
C:\totalcmd\language\wcmd_ita.lng.henry217
C:\totalcmd\language\wcmd_ita.mnu.henry217
C:\totalcmd\language\wcmd_kor.inc.henry217
C:\totalcmd\language\wcmd_kor.lng.henry217
C:\totalcmd\language\wcmd_kor.mnu.henry217
C:\totalcmd\language\wcmd_nor.mnu.henry217
C:\totalcmd\language\wcmd_rus.lng.henry217
C:\totalcmd\language\wcmd_pol.lng.henry217
C:\totalcmd\language\wcmd_pol.mnu.henry217
C:\totalcmd\language\wcmd_rom.inc.henry217
C:\totalcmd\language\wcmd_rom.lng.henry217
C:\totalcmd\language\wcmd_rom.mnu.henry217
C:\totalcmd\language\wcmd_rus.inc.henry217
C:\totalcmd\language\wcmd_hun.mnu.henry217
C:\totalcmd\language\wcmd_nor.lng.henry217
C:\totalcmd\language\wcmd_hun.lng.henry217
C:\totalcmd\language\wcmd_dut.lng.henry217
C:\totalcmd\language\wcmd_dan.lng.henry217
C:\totalcmd\language\wcmd_dan.mnu.henry217
C:\totalcmd\language\wcmd_deu.inc.henry217
C:\totalcmd\language\wcmd_deu.lng.henry217
C:\totalcmd\language\wcmd_deu.mnu.henry217
C:\totalcmd\language\wcmd_dut.inc.henry217
C:\totalcmd\language\wcmd_dut.mnu.henry217
C:\totalcmd\language\wcmd_fra.mnu.henry217
C:\totalcmd\language\wcmd_eng.mnu.henry217
C:\totalcmd\language\wcmd_esp.inc.henry217
C:\totalcmd\language\wcmd_esp.lng.henry217
C:\totalcmd\language\wcmd_esp.mnu.henry217
C:\totalcmd\language\wcmd_fra.inc.henry217
C:\totalcmd\language\wcmd_fra.lng.henry217
C:\totalcmd\language\wcmd_hun.inc.henry217
C:\users\default\ntuser.dat.log.henry217
%ALLUSERSPROFILE%\package cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\state.rsm.henry217
C:\totalcmd\language\wcmd_sk.mnu.henry217
C:\users\public\desktop\mozilla firefox.lnk.henry217
C:\users\public\desktop\mozilla thunderbird.lnk.henry217
C:\users\public\desktop\opera.lnk.henry217
C:\users\public\desktop\steam.lnk.henry217
C:\users\public\desktop\winamp.lnk.henry217
C:\users\public\documents\desktop.ini.henry217
C:\users\public\libraries\desktop.ini.henry217
C:\totalcmd\language\wcmd_sk.lng.henry217
C:\users\public\libraries\recordedtv.library-ms.henry217
C:\users\public\music\desktop.ini.henry217
C:\users\public\music\sample music\desktop.ini.henry217
C:\users\public\music\sample music\kalimba.mp3.henry217
C:\users\public\music\sample music\maid with the flaxen hair.mp3.henry217
C:\users\public\music\sample music\sleep away.mp3.henry217
C:\users\public\desktop\mirc.lnk.henry217
C:\totalcmd\language\wcmd_dan.inc.henry217
C:\users\public\desktop\google chrome.lnk.henry217
C:\users\default\ntuser.dat.henry217
C:\totalcmd\language\wcmd_svn.inc.henry217
C:\totalcmd\language\wcmd_svn.lng.henry217
C:\totalcmd\language\wcmd_svn.mnu.henry217
C:\totalcmd\language\wcmd_swe.lng.henry217
C:\totalcmd\language\wcmd_swe.mnu.henry217
C:\users\desktop.ini.henry217
C:\totalcmd\language\wcmd_rus.mnu.henry217
C:\users\public\desktop\acrobat reader dc.lnk.henry217
C:\users\default\ntuser.dat.log1.henry217
C:\users\default\ntuser.dat.log2.henry217
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf.henry217
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms.henry217
C:\users\default\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms.henry217
C:\users\public\desktop.ini.henry217
C:\users\public\desktop\desktop.ini.henry217
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab.henry217
C:\totalcmd\language\wcmd_cz.mnu.henry217
C:\totalcmd\unrar64.dll.henry217
%ALLUSERSPROFILE%\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\state.rsm.henry217
%ALLUSERSPROFILE%\package cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\vcredist_x86.exe.henry217
%ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeadditional_amd64\cab1.cab.henry217
%ALLUSERSPROFILE%\package cache\{bc958bd2-5dac-3862-bb1a-c1be0790438d}v14.0.23026\packages\vcruntimeadditional_amd64\vc_runtimeadditional_x64.msi.henry217
%ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\cab1.cab.henry217
%ALLUSERSPROFILE%\package cache\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\packages\vcruntimeadditional_x86\vc_runtimeadditional_x86.msi.henry217
%ALLUSERSPROFILE%\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\vcredist_x86.exe.henry217
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\state.rsm.henry217
%ALLUSERSPROFILE%\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\state.rsm.henry217
%ALLUSERSPROFILE%\package cache\{dde2682b-961a-41ea-8d44-6005991b7947}\vcredist_x64.exe.henry217
%ALLUSERSPROFILE%\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\state.rsm.henry217
%ALLUSERSPROFILE%\package cache\{e46eca4f-393b-40df-9f49-076faf788d83}\vc_redist.x64.exe.henry217
%ALLUSERSPROFILE%\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\state.rsm.henry217
%ALLUSERSPROFILE%\package cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\vcredist_x86.exe.henry217
%ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\vc_runtimeminimum_x86.msi.henry217
%ALLUSERSPROFILE%\package cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\state.rsm.henry217
%ALLUSERSPROFILE%\package cache\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\packages\vcruntimeminimum_x86\cab1.cab.henry217
%ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\state.rsm.henry217
%ALLUSERSPROFILE%\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\state.rsm.henry217
%ALLUSERSPROFILE%\package cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\vcredist_x86.exe.henry217
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm.henry217
%ALLUSERSPROFILE%\package cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe.henry217
%ALLUSERSPROFILE%\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\state.rsm.henry217
%ALLUSERSPROFILE%\package cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\vcredist_x64.exe.henry217
%ALLUSERSPROFILE%\package cache\{51adbf11-493f-431c-a862-967a0fae2944}\vcredist_x64.exe.henry217
%ALLUSERSPROFILE%\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\state.rsm.henry217
%ALLUSERSPROFILE%\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\state.rsm.henry217
%ALLUSERSPROFILE%\package cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\vcredist_x86.exe.henry217
%ALLUSERSPROFILE%\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\state.rsm.henry217
%ALLUSERSPROFILE%\package cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\vcredist_x86.exe.henry217
%ALLUSERSPROFILE%\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\state.rsm.henry217
%ALLUSERSPROFILE%\package cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\vc_redist.x86.exe.henry217
%ALLUSERSPROFILE%\package cache\{a2199617-3609-410f-a8e8-e8806c73545b}\vcredist_x64.exe.henry217
%ALLUSERSPROFILE%\package cache\{0d3e9e15-de7a-300b-96f1-b4af12b96488}v14.0.23026\packages\vcruntimeminimum_amd64\vc_runtimeminimum_x64.msi.henry217
C:\totalcmd\language\wcmd_cz.inc.henry217
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\boot.sdi.henry217
C:\totalcmd\tcunzl64.dll.henry217
C:\totalcmd\tcusbrun.exe.henry217
C:\totalcmd\totalcmd.chm.henry217
C:\totalcmd\totalcmd.inc.henry217
C:\totalcmd\totalcmd64.exe.henry217
C:\totalcmd\totalcmd64.exe.manifest.henry217
C:\totalcmd\wcmicons.dll.henry217
%ALLUSERSPROFILE%\sun\java\java update\jaureglist.xml.henry217
C:\totalcmd\wcmicons.inc.henry217
C:\totalcmd\wcmzip64.dll.henry217
C:\totalcmd\wcuninst.wul.henry217
C:\totalcmd\language\wcmd_chn.inc.henry217
C:\totalcmd\language\wcmd_chn.lng.henry217
C:\totalcmd\language\wcmd_chn.mnu.henry217
C:\totalcmd\tcuninst.wul.henry217
C:\totalcmd\language\wcmd_cz.lng.henry217
C:\totalcmd\tcunin64.wul.henry217
C:\totalcmd\no.bar.henry217
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\winre.wim.henry217
C:\totalcmd\cglpt64.sys.henry217
C:\totalcmd\default.bar.henry217
C:\totalcmd\descript.ion.henry217
C:\totalcmd\history.txt.henry217
C:\totalcmd\keyboard.txt.henry217
%ALLUSERSPROFILE%\package cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe.henry217
C:\totalcmd\tcmdx32.exe.henry217
C:\totalcmd\register.rtf.henry217
C:\totalcmd\sfxhead.sfx.henry217
C:\totalcmd\size!.txt.henry217
C:\totalcmd\tc7z64.dll.henry217
C:\totalcmd\tclzma64.dll.henry217
C:\totalcmd\tcmadm64.exe.henry217
C:\totalcmd\tcunin64.exe.henry217
C:\users\public\downloads\desktop.ini.henry217
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml.henry217
C:\far2\pluginsdk\headers.pas\pluginw.pas.henry217
C:\far2\addons\macros\view_nextprevfile.reg.henry217
C:\far2\addons\macros\view_pgdn.reg.henry217
C:\far2\addons\macros\view_shiftinssearch.reg.henry217
C:\far2\addons\macros\view_space.reg.henry217
C:\far2\addons\macros\wheelscreenswitch.reg.henry217
C:\far2\addons\setup\default165.reg.henry217
C:\far2\addons\setup\executor_4nt.reg.henry217
C:\far2\addons\xlat\russian\apps.reg.henry217
C:\far2\addons\setup\executor_cmd.reg.henry217
C:\far2\addons\setup\windowsgui.reg.henry217
C:\far2\addons\shell\descript.ion.henry217
C:\far2\addons\shell\farhere.inf.henry217
C:\far2\addons\xlat\descript.ion.henry217
C:\far2\addons\xlat\russian\altr.reg.henry217
C:\far2\addons\macros\view_ctrlupdown.reg.henry217
C:\far2\addons\setup\descript.ion.henry217
C:\far2\addons\macros\shifttab.reg.henry217
C:\far2\addons\macros\panel_del.reg.henry217
C:\far2\addons\macros\panel_ctrlins__.reg.henry217
C:\far2\addons\macros\panel_ctrlleft.reg.henry217
C:\far2\addons\macros\panel_ctrlq.reg.henry217
C:\far2\addons\macros\panel_ctrlright.reg.henry217
C:\far2\addons\macros\panel_ctrlshiftbackslash.reg.henry217
C:\far2\addons\macros\panel_ctrlshiftpgupdn.reg.henry217
C:\far2\addons\macros\panel_esc.reg.henry217
C:\far2\addons\macros\shiftbs.reg.henry217
C:\far2\addons\macros\panel_jumptoselectedfile.reg.henry217
C:\far2\addons\macros\panel_lynx_mot.reg.henry217
C:\far2\addons\macros\panel_mousewheeltilt.reg.henry217
C:\far2\addons\macros\panel_numpad.reg.henry217
C:\far2\addons\macros\panel_selectfromclipboard.reg.henry217
C:\far2\addons\macros\panel_spacetoselect.reg.henry217
C:\far2\addons\macros\shiftf1.reg.henry217
C:\far2\documentation\rus\arc_support.txt.henry217
C:\far2\plugins\arclite\7zsd.sfx.henry217
C:\far2\addons\xlat\russian\descript.ion.henry217
C:\far2\fexcept\demangle32.dll.henry217
C:\far2\fexcept\excdump.dll.henry217
C:\far2\fexcept\fexcept.dll.henry217
C:\far2\fexcept\setfarexceptionhandler.reg.henry217
C:\far2\plugins\align\align.dll.henry217
C:\far2\plugins\align\align.map.henry217
C:\far2\plugins\align\alignrus.lng.henry217
C:\far2\addons\xlat\russian\ctrlshiftx.reg.henry217
C:\far2\plugins\align\changelog.henry217
C:\far2\plugins\arclite\7z.dll.henry217
C:\far2\plugins\arclite\7z.sfx.henry217
C:\far2\plugins\arclite\7zcon.sfx.henry217
C:\far2\plugins\arclite\7zs2.sfx.henry217
C:\far2\plugins\arclite\7zs2con.sfx.henry217
C:\far2\fexcept\changelog.henry217
C:\far2\addons\macros\panel_bs.reg.henry217
C:\far2\encyclopedia\tap\code.idb.henry217
C:\far2\documentation\eng\techinfo.txt.henry217
C:\far2\addons\xlat\russian\qwerty.reg.henry217
C:\far2\documentation\eng\arc_support.txt.henry217
C:\far2\documentation\eng\bug_report.txt.henry217
C:\far2\documentation\eng\far_faq.txt.henry217
C:\far2\documentation\eng\plugins_install.txt.henry217
C:\far2\documentation\eng\plugins_review.txt.henry217
C:\far2\addons\xlat\russian\ctrlr.reg.henry217
C:\far2\encyclopedia\tap\12_r0m.tap.henry217
C:\far2\documentation\rus\bug_report.txt.henry217
C:\far2\documentation\rus\far_faq.txt.henry217
C:\far2\documentation\rus\plugins_install.txt.henry217
C:\far2\documentation\rus\plugins_review.txt.henry217
C:\far2\documentation\rus\techinfo.txt.henry217
C:\far2\encyclopedia\farencyclopedia_ru.chm.henry217
C:\far2\encyclopedia\tap\code.bin.henry217
C:\far2\plugins\align\aligneng.lng.henry217
C:\far2\addons\macros\panel_apps.reg.henry217
C:\far2\addons\macros\dialog_altdown.reg.henry217
C:\far2\addons\descript.ion.henry217
C:\far2\addons\readme.txt.henry217
C:\far2\addons\colors\descript.ion.henry217
C:\far2\addons\colors\export_colors.bat.henry217
C:\far2\addons\colors\import_colors.bat.henry217
C:\far2\addons\colors\custom_highlighting\black_from_fonarev.reg.henry217
C:\far2\addons\colors\custom_highlighting\black_from_myodov.reg.henry217
C:\far2\addons\colors\custom_highlighting\greenmile.reg.henry217
C:\far2\addons\colors\custom_highlighting\colors_from_admin_essp_ru.reg.henry217
C:\far2\addons\colors\custom_highlighting\colors_from_gernichenko.reg.henry217
C:\far2\addons\colors\custom_highlighting\colors_from_sadovoj.reg.henry217
C:\far2\addons\colors\custom_highlighting\descript.ion.henry217
C:\far2\addons\colors\custom_highlighting\dn_like.reg.henry217
C:\far2\addons\colors\custom_highlighting\farcolors242.reg.henry217
C:\far2\savesettings.cmd.henry217
C:\far2\addons\colors\custom_highlighting\black_from_july.reg.henry217
C:\far2\restoresettings.cmd.henry217
C:\far2\fareng.hlf.henry217
C:\far2\changelog.henry217
C:\far2\changelog_eng.henry217
C:\far2\clearpluginscache.cmd.henry217
C:\far2\far.exe.henry217
C:\far2\far.map.henry217
C:\far2\farcze.lng.henry217
C:\far2\fareng.lng.henry217
C:\far2\farspa.lng.henry217
C:\far2\farger.lng.henry217
C:\far2\farhun.hlf.henry217
C:\far2\farhun.lng.henry217
C:\far2\farpol.lng.henry217
C:\far2\farrus.hlf.henry217
C:\far2\farrus.lng.henry217
C:\far2\file_id.diz.henry217
C:\far2\addons\colors\default_highlighting\colors_from_sadovoj.reg.henry217
C:\far2\addons\macros\openinglastfile.reg.henry217
C:\far2\addons\colors\custom_highlighting\nc5pal2.reg.henry217
C:\far2\addons\macros\altscreens.reg.henry217
C:\far2\addons\macros\altsearch.reg.henry217
C:\far2\addons\macros\altx.reg.henry217
C:\far2\addons\macros\ctrldel.reg.henry217
C:\far2\addons\macros\ctrlf10.reg.henry217
C:\far2\addons\macros\descript.ion.henry217
C:\far2\addons\macros\edit_notepad.reg.henry217
C:\far2\addons\colors\custom_highlighting\import_colors.bat.henry217
C:\far2\addons\macros\edit_saveandexit.reg.henry217
C:\far2\addons\macros\edit_savefile.reg.henry217
C:\far2\addons\macros\f3.reg.henry217
C:\far2\addons\macros\f9deactivatemenu.reg.henry217
C:\far2\addons\macros\f9table.reg.henry217
C:\far2\addons\macros\macroconsts.reg.henry217
C:\far2\addons\macros\altmenu.reg.henry217
C:\far2\addons\macros\panel_altbs.reg.henry217
C:\far2\addons\colors\default_highlighting\vaxcolors.reg.henry217
C:\far2\addons\colors\default_highlighting\colors_from_gernichenko.reg.henry217
C:\far2\addons\colors\custom_highlighting\rodion_doroshkevich.reg.henry217
C:\far2\addons\colors\custom_highlighting\vaxcolors.reg.henry217
C:\far2\addons\colors\default_highlighting\black_from_fonarev.reg.henry217
C:\far2\addons\colors\default_highlighting\black_from_july.reg.henry217
C:\far2\addons\colors\default_highlighting\black_from_myodov.reg.henry217
C:\far2\addons\colors\default_highlighting\colors_from_admin_essp_ru.reg.henry217
C:\far2\addons\colors\custom_highlighting\hell.reg.henry217
C:\far2\addons\colors\default_highlighting\nc5pal2.reg.henry217
C:\far2\addons\colors\default_highlighting\descript.ion.henry217
C:\far2\addons\colors\default_highlighting\dn_like.reg.henry217
C:\far2\addons\colors\default_highlighting\farcolors242.reg.henry217
C:\far2\addons\colors\default_highlighting\greenmile.reg.henry217
C:\far2\addons\colors\default_highlighting\hell.reg.henry217
C:\far2\addons\colors\default_highlighting\import_colors.bat.henry217
C:\far2\addons\colors\default_highlighting\rodion_doroshkevich.reg.henry217
C:\far2\plugins\emenu\emenudel.reg.henry217
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms.henry217
C:\far2\plugins\arclite\arclite_eng.hlf.henry217
C:\far2\plugins\hlfviewer\hlfviewereng.lng.henry217
C:\far2\plugins\hlfviewer\hlfviewerrus.hlf.henry217
C:\far2\plugins\hlfviewer\hlfviewerrus.lng.henry217
C:\far2\plugins\macroview\changelog.henry217
C:\far2\plugins\macroview\macroeng.hlf.henry217
C:\far2\plugins\macroview\macroeng.lng.henry217
C:\far2\plugins\macroview\macrorus.lng.henry217
C:\far2\plugins\network\netrus.lng.henry217
C:\far2\plugins\macroview\macroview.dll.henry217
C:\far2\plugins\macroview\macroview.map.henry217
C:\far2\plugins\network\changelog.henry217
C:\far2\plugins\network\neteng.hlf.henry217
C:\far2\plugins\network\neteng.lng.henry217
C:\far2\plugins\network\netrus.hlf.henry217
C:\far2\plugins\hlfviewer\hlfviewereng.hlf.henry217
C:\far2\plugins\macroview\macrorus.hlf.henry217
C:\far2\plugins\hlfviewer\hlfviewer.map.henry217
C:\far2\plugins\ftp\lib\ftpdirlist.fll.henry217
C:\far2\plugins\ftp\ftprus.hlf.henry217
C:\far2\plugins\ftp\ftprus.lng.henry217
C:\far2\plugins\ftp\notes.txt.henry217
C:\far2\plugins\ftp\notes_rus.txt.henry217
C:\far2\plugins\ftp\techinfo.reg.henry217
C:\far2\plugins\ftp\techinfo_rus.reg.henry217
C:\far2\plugins\ftp\lib\ftpdirlist.map.henry217
C:\far2\plugins\hlfviewer\changelog.henry217
C:\far2\plugins\ftp\lib\ftpprogress.fll.henry217
C:\far2\plugins\ftp\lib\ftpprogress.map.henry217
C:\far2\plugins\ftp\lib\progress_farcopy.reg.henry217
C:\far2\plugins\ftp\lib\progress_jm.reg.henry217
C:\far2\plugins\ftp\lib\progress_wesha.reg.henry217
C:\far2\plugins\ftp\lib\progress_zema.reg.henry217
C:\far2\plugins\hlfviewer\hlfviewer.dll.henry217
C:\far2\plugins\tmppanel\disks_eng.temp.henry217
C:\far2\plugins\arclite\arclite.map.henry217
C:\far2\plugins\proclist\changelog.henry217
C:\far2\plugins\tmppanel\tmprus.lng.henry217
C:\far2\pluginsdk\headers.c\farcolor.hpp.henry217
C:\far2\pluginsdk\headers.c\farkeys.hpp.henry217
C:\far2\pluginsdk\headers.c\plugin.hpp.henry217
C:\far2\pluginsdk\headers.pas\farcolorw.pas.henry217
C:\far2\pluginsdk\headers.pas\farkeysw.pas.henry217
<Полный путь к файлу>.henry217
C:\far2\plugins\network\network.map.henry217
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.msi.henry217
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml.henry217
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\ose.exe.henry217
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\osetup.dll.henry217
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab.henry217
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pidgenx.dll.henry217
C:\far2\plugins\tmppanel\tmprus.hlf.henry217
C:\far2\plugins\ftp\ftpeng.lng.henry217
C:\far2\plugins\tmppanel\tmppanel.map.henry217
C:\far2\plugins\tmppanel\changelog.henry217
C:\far2\plugins\proclist\proceng.hlf.henry217
C:\far2\plugins\proclist\proceng.lng.henry217
C:\far2\plugins\proclist\proclist.dll.henry217
C:\far2\plugins\proclist\proclist.map.henry217
C:\far2\plugins\proclist\procrus.hlf.henry217
C:\far2\plugins\proclist\procrus.lng.henry217
C:\far2\plugins\network\network.dll.henry217
C:\far2\plugins\tmppanel\tmpeng.lng.henry217
C:\far2\plugins\tmppanel\disks_rus.temp.henry217
C:\far2\plugins\tmppanel\shortcuts_eng.reg.henry217
C:\far2\plugins\tmppanel\shortcuts_eng.temp.henry217
C:\far2\plugins\tmppanel\shortcuts_rus.reg.henry217
C:\far2\plugins\tmppanel\shortcuts_rus.temp.henry217
C:\far2\plugins\tmppanel\tmpeng.hlf.henry217
C:\far2\plugins\tmppanel\tmppanel.dll.henry217
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.msi.henry217
C:\far2\plugins\ftp\ftpeng.hlf.henry217
C:\far2\plugins\filecase\caserus.hlf.henry217
C:\far2\plugins\brackets\changelog.henry217
C:\far2\plugins\compare\changelog.henry217
C:\far2\plugins\compare\cmpeng.hlf.henry217
C:\far2\plugins\compare\cmprus.hlf.henry217
C:\far2\plugins\compare\compare.dll.henry217
C:\far2\plugins\compare\compare.map.henry217
C:\far2\plugins\compare\comprus.lng.henry217
C:\far2\plugins\drawline\drawrus.lng.henry217
C:\far2\plugins\drawline\changelog.henry217
C:\far2\plugins\drawline\draweng.hlf.henry217
C:\far2\plugins\drawline\draweng.lng.henry217
C:\far2\plugins\drawline\drawline.dll.henry217
C:\far2\plugins\drawline\drawline.map.henry217
C:\far2\plugins\drawline\drawrus.hlf.henry217
C:\far2\plugins\brackets\brackrus.reg.henry217
C:\far2\plugins\compare\compeng.lng.henry217
C:\far2\plugins\brackets\brackrus.lng.henry217
C:\far2\plugins\autowrap\changelog.henry217
C:\far2\plugins\arclite\arclite_eng.lng.henry217
C:\far2\plugins\arclite\arclite_rus.hlf.henry217
C:\far2\plugins\arclite\arclite_rus.lng.henry217
C:\far2\plugins\arclite\changelog.henry217
C:\far2\plugins\autowrap\autowrap.dll.henry217
C:\far2\plugins\autowrap\autowrap.map.henry217
C:\far2\plugins\autowrap\wrapeng.lng.henry217
C:\far2\plugins\brackets\brackets.map.henry217
C:\far2\plugins\autowrap\wraprus.lng.henry217
C:\far2\plugins\brackets\brackdel.reg.henry217
C:\far2\plugins\brackets\brackeng.hlf.henry217
C:\far2\plugins\brackets\brackeng.lng.henry217
C:\far2\plugins\brackets\brackeng.reg.henry217
C:\far2\plugins\brackets\brackets.dll.henry217
C:\far2\plugins\brackets\brackrus.hlf.henry217
C:\far2\plugins\arclite\arclite.dll.henry217
C:\far2\plugins\ftp\ftpcmds.txt.henry217
C:\far2\plugins\editcase\ecaseeng.lng.henry217
C:\far2\plugins\farcmds\farcmdseng.hlf.henry217
C:\far2\plugins\farcmds\farcmdseng.lng.henry217
C:\far2\plugins\farcmds\farcmdsrus.hlf.henry217
C:\far2\plugins\farcmds\farcmdsrus.lng.henry217
C:\far2\plugins\filecase\caseeng.hlf.henry217
C:\far2\plugins\filecase\caseeng.lng.henry217
C:\far2\plugins\filecase\caserus.lng.henry217
C:\far2\plugins\editcase\ecaseeng.hlf.henry217
C:\far2\plugins\filecase\changelog.henry217
C:\far2\plugins\filecase\filecase.dll.henry217
C:\far2\plugins\filecase\filecase.map.henry217
C:\far2\plugins\ftp\changelog.henry217
C:\far2\plugins\ftp\farftp.dll.henry217
C:\far2\plugins\ftp\farftp.map.henry217
C:\far2\plugins\farcmds\farcmds.map.henry217
C:\far2\plugins\ftp\ftpcmds_rus.txt.henry217
C:\far2\plugins\farcmds\farcmds.dll.henry217
C:\far2\plugins\emenu\emenu.map.henry217
C:\far2\plugins\editcase\ecaserus.hlf.henry217
C:\far2\plugins\editcase\ecaserus.lng.henry217
C:\far2\plugins\editcase\editcase.dll.henry217
C:\far2\plugins\editcase\editcase.map.henry217
C:\far2\plugins\emenu\changelog.henry217
C:\far2\plugins\emenu\emenu.dll.henry217
C:\far2\plugins\editcase\changelog.henry217
C:\far2\plugins\emenu\hotkeyproperties.reg.henry217
C:\far2\plugins\emenu\emenueng.hlf.henry217
C:\far2\plugins\emenu\emenueng.lng.henry217
C:\far2\plugins\emenu\emenurus.hlf.henry217
C:\far2\plugins\emenu\emenurus.lng.henry217
C:\far2\plugins\emenu\hotkey.reg.henry217
C:\far2\plugins\emenu\hotkeyclipboard.reg.henry217
C:\far2\plugins\farcmds\changelog.henry217
C:\users\public\pictures\sample pictures\desktop.ini.henry217

Самоудаляется.

Изменяет расширения файлов пользовательских данных (Trojan.Encoder).

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней