Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Kingsoft Antivirus WebShield Service] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%ALLUSERSPROFILE%\Application Data\wangdun\KSWebShield.exe'
- '%TEMP%\RarSFX0\b.exe'
- '%TEMP%\is-QJI7O.tmp\b.tmp' /SL5="$20104,1078705,67072,%TEMP%\RarSFX0\b.exe"
- '%ALLUSERSPROFILE%\Application Data\wangdun\KSWebShield.exe' -start
- '%TEMP%\RarSFX0\xdownvipsetup0628.exe'
- '%TEMP%\nsw2.tmp\ns3.tmp' cmd.exe /c "%ALLUSERSPROFILE%\Application Data\wangdun\u.bat"
- '%ALLUSERSPROFILE%\Application Data\wangdun\KSWebShield.exe' -install
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-7CIDB.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-H1F64.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-ALE9H.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-1VOKL.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-408MO.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-MP8GU.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-6OUF3.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-6T4KN.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-92FOB.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-J6J31.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-DPVJG.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-5D1V2.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-LH4UD.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-LTN2U.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-8QISK.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-R38L6.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-DDDOR.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-H0CEC.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-DA2F6.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-DON7L.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-1RHEH.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-JQQ82.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-B5O9H.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-QKSU5.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-T2GRS.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-1JO68.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-DRFGU.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-S083B.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-H4RAV.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-63KGM.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-RM5ER.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-UDK0J.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-HGOS4.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-8DSNH.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-0TUM8.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-3CTCQ.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-G0MUT.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-R706L.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-5IPVP.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-QTQUC.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-A834N.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-IQ6F2.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-HCL3H.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-1VJ04.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-O49AR.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-149EK.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-16HG9.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-5BHV9.tmp
- %ALLUSERSPROFILE%\Start Menu\°ІИ«дЇААЖч.lnk
- %ALLUSERSPROFILE%\Templates\°ІИ«дЇААЖч.lnk
- %PROGRAM_FILES%\°ІИ«дЇААЖч\unins000.dat
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\°ІИ«дЇААЖч.lnk
- %ALLUSERSPROFILE%\Desktop\°ІИ«дЇААЖч.lnk
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-S8GBS.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-S91BB.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\°ІИ«дЇААЖч\4224°ІИ«дЇААЖч.lnk
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-9EE3R.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-F75ML.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-SOLR1.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-89TO4.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-9UB71.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-D1GLP.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-F6567.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-HCCF0.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-7N77V.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-SB8FF.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-61L9P.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-I8K6H.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-T4OGN.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-BEFK1.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-RI97T.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-VBA47.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-2MUDC.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-JHPFB.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-MT6E5.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-V1FEP.tmp
- %HOMEPATH%\Favorites\88yyФЪПЯРЎУОП·.url
- %HOMEPATH%\Favorites\БґЅУ\ФЪПЯСФЗйРЎЛµФД¶Б.url
- %HOMEPATH%\Favorites\К®Т»ЅЦµҐ»ъУОП·.url
- %HOMEPATH%\Favorites\°¬µПЙо¶ИЛСЛч.url
- %HOMEPATH%\Favorites\БґЅУ\НЕ№є_ГлЙ±Нш.url
- %HOMEPATH%\Favorites\БґЅУ\°¬µПЙо¶ИЛСЛч.url
- %HOMEPATH%\Favorites\БґЅУ\88yyФЪПЯРЎУОП·.url
- %HOMEPATH%\Favorites\БґЅУ\МФ±¦МШВф.url
- %HOMEPATH%\Favorites\БґЅУ\К®Т»ЅЦµҐ»ъУОП·.url
- %HOMEPATH%\Favorites\МФ±¦МШВф.url
- %PROGRAM_FILES%\°ІИ«дЇААЖч\is-KKSFC.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\is-MHMG1.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Language\is-UJDLC.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\is-QTMHB.tmp
- %TEMP%\is-3FKQK.tmp\_isetup\_shfoldr.dll
- %HOMEPATH%\Favorites\ФЪПЯСФЗйРЎЛµФД¶Б.url
- %HOMEPATH%\Favorites\НЕ№є_ГлЙ±Нш.url
- %TEMP%\is-3FKQK.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-QJI7O.tmp\b.tmp
- %ALLUSERSPROFILE%\Application Data\wangdun\kswebshield.dll
- %ALLUSERSPROFILE%\Application Data\wangdun\KSWebShield.exe
- %ALLUSERSPROFILE%\Application Data\wangdun\kwsui.dll
- %ALLUSERSPROFILE%\Application Data\wangdun\kswbc.dll
- %ALLUSERSPROFILE%\Application Data\wangdun\kwssp.dll
- %TEMP%\RarSFX0\b.exe
- %TEMP%\RarSFX0\xdownvipsetup0628.exe
- %ALLUSERSPROFILE%\Application Data\kingsoft\kws\spitesp.dat
- %ALLUSERSPROFILE%\Application Data\kingsoft\kws\kws.ini
- %ALLUSERSPROFILE%\Application Data\wangdun\u.bat
- %ALLUSERSPROFILE%\Desktop\ФЪПЯРЎУОП·.url
- <SYSTEM32>\ie.ico
- %TEMP%\nsw2.tmp\System.dll
- %ALLUSERSPROFILE%\Desktop\НшЙПМФ±¦.url
- <SYSTEM32>\xyx.ico
- %TEMP%\nsw2.tmp\ns3.tmp
- %TEMP%\nsw2.tmp\nsExec.dll
- <SYSTEM32>\tb.ico
- %ALLUSERSPROFILE%\Application Data\wangdun\KWSSVC.log
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\Translate\is-TRV91.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\Translate\is-670NC.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\ТіГжКу±кЅвЛш\is-RG2H0.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\ТіГжКу±кЅвЛш\is-44IQL.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\Translate\is-9PRBS.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\Tools\is-LDABU.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\Tools\is-VHV7Q.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\Tools\is-ULTV1.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\Tools\is-58UST.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\ТіГжКу±кЅвЛш\is-OHUNS.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-0BF98.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-TLRHG.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-J7IOO.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-HQ4F4.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-KO3H7.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-UE057.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-C4OEI.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-L0HE7.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-C1IGR.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\PageZoomMore\is-USCB3.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\MouseUnlock\is-4DUBB.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\PageZoomMore\is-590CL.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\PageZoomMore\is-M1OS5.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\MouseUnlock\is-O1OU1.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\LiquidLayout\is-ILSHT.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\LiquidLayout\is-PIHCO.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\MouseUnlock\is-39FAK.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\LiquidLayout\is-O5MT0.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\ShowPassword\is-IDQ7D.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\TipPassword\is-5N78R.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\SnapShot\is-E58EV.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\TipPassword\is-7TJJK.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\TipPassword\is-J2PAE.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\SnapShot\is-JUNDL.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\ShowPassword\is-54RFM.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\ShowPassword\is-PP8MD.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\SnapShot\is-MKDLR.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\SnapShot\is-RGLLB.tmp
Удаляет следующие файлы:
- %TEMP%\is-QJI7O.tmp\b.tmp
- %TEMP%\is-3FKQK.tmp\_isetup\_shfoldr.dll
- %TEMP%\RarSFX0\xdownvipsetup0628.exe
- %TEMP%\RarSFX0\b.exe
- %TEMP%\is-3FKQK.tmp\_isetup\_RegDLL.tmp
- %TEMP%\nsw2.tmp\nsExec.dll
- %TEMP%\nsw2.tmp\ns3.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\JJBrowser.exe
- %TEMP%\nsw2.tmp\System.dll
Перемещает следующие файлы:
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-H0CEC.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\MainTool16.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-8QISK.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\MainToolGray16.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-5D1V2.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\MainToolGray24.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-DA2F6.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\MainMenu.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-J6J31.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\gongju.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-DDDOR.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\IE.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-R38L6.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\left.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-F6567.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\SearchBar.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-SB8FF.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\SearchBarLeft.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-7N77V.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\SearchBarMid.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-HCCF0.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\right.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-DPVJG.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\NormalToolBar.png
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-LTN2U.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\OK.png
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-LH4UD.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\PressToolBar.png
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-UDK0J.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\ce.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-6OUF3.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\core1.png
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-MP8GU.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\core2.png
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-HGOS4.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\Border.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-8DSNH.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\BackGround.png
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-RM5ER.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\biaoqian.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-63KGM.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\biaoti.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-7CIDB.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\Go.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-1VOKL.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\go.png
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-ALE9H.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\go.png.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-H1F64.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\FleetToolBar.png
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-92FOB.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\dibian.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-6T4KN.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\DisableToolBar.png
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-408MO.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\FavBar.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-149EK.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\User\Filter.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-HCL3H.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\User\FormData.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-QTQUC.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\User\JJBrowser.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-16HG9.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\User\DownManager.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-BEFK1.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\User\ad.html
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-O49AR.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\User\AD.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-1VJ04.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\User\baidu.ico
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-S91BB.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\User\update.info
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-S8GBS.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\User\Updater.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-9EE3R.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\User\Visiting.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-5BHV9.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\User\SearchEngine.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-5IPVP.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\User\LastClose.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-IQ6F2.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\User\LastVisit.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\User\is-A834N.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\User\Proxy.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-89TO4.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\StatusTool.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-61L9P.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\SysBtn.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-JHPFB.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\TabActive.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-9UB71.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\Skin.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-D1GLP.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\SearchBarRight.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-SOLR1.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\SearchGo.png
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-F75ML.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\SearchGo.png.tmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-T4OGN.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\TaskBar.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-I8K6H.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\top.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-RI97T.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\zhuangtai.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-VBA47.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\TabNormal.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-2MUDC.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\TabCtrlBG.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-V1FEP.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\TabNew.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-MT6E5.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\TabNewActive.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\SnapShot\is-JUNDL.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\SnapShot\setting.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\SnapShot\is-E58EV.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\SnapShot\SnapShot.exe
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\TipPassword\is-5N78R.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\TipPassword\plugin.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\SnapShot\is-MKDLR.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\SnapShot\plugin.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\ShowPassword\is-PP8MD.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\ShowPassword\plugin.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\ShowPassword\is-54RFM.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\ShowPassword\script.htm
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\SnapShot\is-RGLLB.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\SnapShot\CameraDll.dll
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\Tools\is-58UST.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\Tools\QuickTools.exe
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\Tools\is-ULTV1.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\Tools\QuickTools.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\Translate\is-9PRBS.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\Translate\plugin.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\Tools\is-LDABU.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\Tools\QuickProcess.exe
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\TipPassword\is-J2PAE.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\TipPassword\script.htm
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\TipPassword\is-7TJJK.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\TipPassword\TipPassword.ico
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\Tools\is-VHV7Q.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\Tools\QuickMute.exe
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\LiquidLayout\is-PIHCO.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\LiquidLayout\icon.ico
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\LiquidLayout\is-ILSHT.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\LiquidLayout\plugin.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\LiquidLayout\is-O5MT0.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\LiquidLayout\script.htm
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Language\is-UJDLC.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Language\ChineseGB.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\is-MHMG1.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\unins000.exe
- %PROGRAM_FILES%\°ІИ«дЇААЖч\is-KKSFC.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\JJBrowser.exe
- %PROGRAM_FILES%\°ІИ«дЇААЖч\is-QTMHB.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\JJBrowser.exe
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\PageZoomMore\is-M1OS5.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\PageZoomMore\plugin.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\PageZoomMore\is-590CL.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\PageZoomMore\script.htm
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\ShowPassword\is-IDQ7D.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\ShowPassword\password.ico
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\PageZoomMore\is-USCB3.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\PageZoomMore\icon.ico
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\MouseUnlock\is-39FAK.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\MouseUnlock\MouseUnlock.htm
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\MouseUnlock\is-O1OU1.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\MouseUnlock\MouseUnlock.ico
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\MouseUnlock\is-4DUBB.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\MouseUnlock\plugin.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-QKSU5.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\resource.htm.bak
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-1RHEH.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\SearchEngine.ini.default
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-DON7L.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\shopping.ico
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-DRFGU.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\Proxy.ini.default
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-1JO68.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\KillFly.htm
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-T2GRS.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\music.ico
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-S083B.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\PopFilter.WAV
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-0TUM8.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\Arrow.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-R706L.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\ArrowToolBar.png
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-G0MUT.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\BackGround.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-3CTCQ.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\AddressRight.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-B5O9H.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\taobao.ico
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-JQQ82.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\AddressLeft.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\is-H4RAV.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Skin\default\AddressMid.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\ТіГжКу±кЅвЛш\is-OHUNS.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\ТіГжКу±кЅвЛш\plugin.ini
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-C4OEI.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\baidu.bmp
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-UE057.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\baidu.ico
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\ТіГжКу±кЅвЛш\is-RG2H0.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\ТіГжКу±кЅвЛш\MouseUnlock.ico
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\Translate\is-670NC.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\Translate\translate.htm
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\Translate\is-TRV91.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\Translate\translate.ico
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\ТіГжКу±кЅвЛш\is-44IQL.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Plugin\ТіГжКу±кЅвЛш\MouseUnlock.htm
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-0BF98.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\ie.ico
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-HQ4F4.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\image.ico
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-J7IOO.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\JJBrowser.ini.default
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-TLRHG.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\google.ico
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-C1IGR.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\CollectorScript.txt.default
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-L0HE7.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\DownManager.ini.default
- %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\is-KO3H7.tmp в %PROGRAM_FILES%\°ІИ«дЇААЖч\Resource\Filter.ini.default
Другое:
Ищет следующие окна:
- ClassName: 'kws::OSUCWindowClass' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
