Техническая информация
Вредоносные функции
Для затруднения выявления своего присутствия в системе
удаляет теневые копии разделов.
Изменения в файловой системе
Создает следующие файлы
- <Текущая директория>\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\edge\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\evrgreen\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\expeditn\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\ice\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\indust\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\iris\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\journal\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\layers\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\level\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\echo\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\eclipse\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\network\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\profile\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\quad\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\radial\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\refined\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\ricepapr\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\ripple\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\rmnsque\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\satin\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\sky\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\papyrus\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\pixel\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\deepblue\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\concrete\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\compass\readme_liesmich_encryptor_raas.txt
- C:\far2\documentation\eng\readme_liesmich_encryptor_raas.txt
- C:\far2\documentation\rus\readme_liesmich_encryptor_raas.txt
- C:\far2\plugins\ftp\readme_liesmich_encryptor_raas.txt
- C:\far2\pluginsdk\headers.c\readme_liesmich_encryptor_raas.txt
- C:\far2\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\equation\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\grphflt\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\ink\en-us\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\ink\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\smart tag\readme_liesmich_encryptor_raas.txt
- C:\far2\addons\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\stationery\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\arctic\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\axis\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\blends\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\bluecalm\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\blueprnt\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\boldstri\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\breeze\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\canyon\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\capsules\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\cascade\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\aftrnoon\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\slate\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\sonora\readme_liesmich_encryptor_raas.txt
Изменяет следующие файлы
- C:\far2\addons\readme.txt
- %CommonProgramFiles%\microsoft shared\smart tag\metconv.txt
- %CommonProgramFiles%\microsoft shared\grphflt\ms.png
- %CommonProgramFiles%\microsoft shared\grphflt\ms.jpg
- %CommonProgramFiles%\microsoft shared\grphflt\ms.gif
- %CommonProgramFiles%\microsoft shared\grphflt\ms.eps
- %CommonProgramFiles%\microsoft shared\grphflt\cgmimp32.cfg
- %CommonProgramFiles%\microsoft shared\equation\eqnedt32.cnt
- C:\far2\pluginsdk\headers.c\plugin.hpp
- C:\far2\pluginsdk\headers.c\farkeys.hpp
- C:\far2\pluginsdk\headers.c\farcolor.hpp
- C:\far2\plugins\ftp\notes_rus.txt
- C:\far2\plugins\ftp\notes.txt
- C:\far2\plugins\ftp\ftpcmds_rus.txt
- C:\far2\plugins\ftp\ftpcmds.txt
- C:\far2\file_id.diz
- C:\far2\documentation\rus\techinfo.txt
- C:\far2\documentation\rus\plugins_review.txt
- C:\far2\documentation\rus\plugins_install.txt
- C:\far2\documentation\rus\far_faq.txt
- C:\far2\documentation\rus\bug_report.txt
- C:\far2\documentation\rus\arc_support.txt
- C:\far2\documentation\eng\techinfo.txt
- C:\far2\documentation\eng\plugins_review.txt
- C:\far2\documentation\eng\plugins_install.txt
- C:\far2\documentation\eng\far_faq.txt
- C:\far2\documentation\eng\bug_report.txt
- C:\far2\documentation\eng\arc_support.txt
- %CommonProgramFiles%\microsoft shared\themes14\aftrnoon\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\aftrnoon\thmbnail.png
Изменяет множество файлов.
Другое
Создает и запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin Delete Shadows /Quiet /All' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin Delete Shadows /Quiet /All
