Техническая информация
Вредоносные функции
Завершает или пытается завершить
следующие пользовательские процессы:
- firefox.exe
Изменения в файловой системе
Создает следующие файлы
- C:\far2\addons\xlat\russian\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proplus\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proofing.en-us\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.fr\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.en\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\proof.es\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.en-us\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\powerpoint.en-us\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\outlook.en-us\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\onenote.en-us\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office32.ww\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\infopath.en-us\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\groove.en-us\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\access.en-us\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\excel.en-us\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\cultures\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\1033\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\symbols\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\web\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskpred\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\osknumpad\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\main\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\numbers\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\publisher.en-us\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\themes14\evrgreen\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\proof\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\themes14\expeditn\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\themes14\eclipse\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\themes14\edge\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\themes14\echo\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\themes14\compass\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\themes14\concrete\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\themes14\deepblue\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\themes14\cascade\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\themes14\blueprnt\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\themes14\breeze\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\themes14\capsules\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\themes14\canyon\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\themes14\bluecalm\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\themes14\axis\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\themes14\blends\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\themes14\boldstri\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\themes14\arctic\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\themes14\aftrnoon\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\themes14\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\textconv\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\stationery\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\smart tag\lists\1033\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\smart tag\lists\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\smart tag\1033\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\smart tag\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\oskmenu\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\word.en-us\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\keypad\!!!read to recover your data!!!.txt
- C:\far2\plugins\hlfviewer\!!!read to recover your data!!!.txt
- C:\far2\plugins\ftp\!!!read to recover your data!!!.txt
- C:\far2\plugins\farcmds\!!!read to recover your data!!!.txt
- C:\far2\plugins\filecase\!!!read to recover your data!!!.txt
- C:\far2\plugins\emenu\!!!read to recover your data!!!.txt
- C:\far2\plugins\editcase\!!!read to recover your data!!!.txt
- C:\far2\plugins\drawline\!!!read to recover your data!!!.txt
- C:\far2\encyclopedia\!!!read to recover your data!!!.txt
- C:\far2\plugins\brackets\!!!read to recover your data!!!.txt
- C:\far2\plugins\autowrap\!!!read to recover your data!!!.txt
- C:\far2\plugins\align\!!!read to recover your data!!!.txt
- C:\far2\plugins\arclite\!!!read to recover your data!!!.txt
- C:\far2\plugins\compare\!!!read to recover your data!!!.txt
- C:\far2\fexcept\!!!read to recover your data!!!.txt
- C:\far2\encyclopedia\tap\!!!read to recover your data!!!.txt
- C:\far2\!!!read to recover your data!!!.txt
- C:\far2\addons\!!!read to recover your data!!!.txt
- C:\far2\addons\setup\!!!read to recover your data!!!.txt
- C:\far2\addons\shell\!!!read to recover your data!!!.txt
- C:\far2\documentation\rus\!!!read to recover your data!!!.txt
- C:\far2\addons\macros\!!!read to recover your data!!!.txt
- C:\far2\addons\colors\default_highlighting\!!!read to recover your data!!!.txt
- C:\far2\addons\xlat\!!!read to recover your data!!!.txt
- C:\far2\documentation\eng\!!!read to recover your data!!!.txt
- C:\far2\addons\colors\!!!read to recover your data!!!.txt
- C:\far2\addons\colors\custom_highlighting\!!!read to recover your data!!!.txt
- C:\far2\plugins\ftp\lib\!!!read to recover your data!!!.txt
- C:\far2\plugins\macroview\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\!!!read to recover your data!!!.txt
- C:\far2\plugins\network\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\ink\en-us\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\ink\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\grphflt\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\equation\!!!read to recover your data!!!.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\access.en-us\!!!read to recover your data!!!.txt
- C:\msocache\all users\{90140000-0117-0409-1000-0000000ff1ce}-c\!!!read to recover your data!!!.txt
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\!!!read to recover your data!!!.txt
- C:\msocache\all users\{90140000-00a1-0409-1000-0000000ff1ce}-c\!!!read to recover your data!!!.txt
- C:\msocache\all users\{90140000-00ba-0409-1000-0000000ff1ce}-c\!!!read to recover your data!!!.txt
- C:\msocache\all users\{90140000-0044-0409-1000-0000000ff1ce}-c\!!!read to recover your data!!!.txt
- C:\msocache\all users\{90140000-0043-0409-1000-0000000ff1ce}-c\!!!read to recover your data!!!.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.fr\!!!read to recover your data!!!.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\!!!read to recover your data!!!.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\!!!read to recover your data!!!.txt
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\!!!read to recover your data!!!.txt
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\!!!read to recover your data!!!.txt
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\!!!read to recover your data!!!.txt
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\!!!read to recover your data!!!.txt
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\!!!read to recover your data!!!.txt
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\!!!read to recover your data!!!.txt
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\!!!read to recover your data!!!.txt
- C:\far2\plugins\tmppanel\!!!read to recover your data!!!.txt
- C:\far2\pluginsdk\headers.pas\!!!read to recover your data!!!.txt
- C:\far2\pluginsdk\headers.c\!!!read to recover your data!!!.txt
- C:\far2\plugins\proclist\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\ink\fsdefinitions\auxpad\!!!read to recover your data!!!.txt
- %CommonProgramFiles%\microsoft shared\themes14\ice\!!!read to recover your data!!!.txt
Изменяет следующие файлы
- C:\far2\documentation\rus\arc_support.txt
- C:\far2\documentation\eng\plugins_review.txt
- C:\far2\documentation\eng\far_faq.txt
- C:\far2\documentation\eng\bug_report.txt
- C:\far2\farhun.hlf
- C:\far2\documentation\eng\plugins_install.txt
- C:\far2\addons\setup\descript.ion
- C:\far2\documentation\eng\techinfo.txt
- C:\far2\documentation\eng\arc_support.txt
- C:\far2\farger.lng
- C:\far2\changelog
- C:\far2\addons\shell\descript.ion
- C:\far2\addons\colors\default_highlighting\descript.ion
- C:\far2\addons\colors\default_highlighting\import_colors.bat
- C:\far2\addons\xlat\russian\descript.ion
- C:\far2\farpol.lng
- C:\far2\file_id.diz
- C:\far2\addons\colors\export_colors.bat
- C:\far2\addons\colors\import_colors.bat
- C:\far2\addons\colors\descript.ion
- C:\far2\addons\colors\custom_highlighting\import_colors.bat
- C:\far2\clearpluginscache.cmd
- C:\far2\addons\descript.ion
- C:\far2\addons\macros\descript.ion
- C:\far2\addons\xlat\descript.ion
- C:\far2\restoresettings.cmd
- C:\far2\documentation\rus\bug_report.txt
- C:\far2\addons\colors\custom_highlighting\descript.ion
- C:\far2\farcze.lng
- C:\far2\farrus.lng
Изменяет множество файлов.
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
