Техническая информация
Вредоносные функции
Для затруднения выявления своего присутствия в системе
удаляет теневые копии разделов.
Изменения в файловой системе
Создает следующие файлы
- <Текущая директория>\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\babygirl\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\babyboy\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\services\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\web server extensions\14\bin\1033\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\watermar\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\water\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\sumipntg\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\strtedge\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\full\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\spring\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\sonora\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\slate\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\sky\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\satin\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\rmnsque\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\studio\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\iris\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\huecycle\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\vignette\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\videowall\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\travel\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\stacking\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\sports\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\ripple\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\flippage\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\resizingpanels\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\rectangles\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\push\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\pets\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\performance\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\oldage\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\memories\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\shatter\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\layeredtitles\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\ricepapr\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\refined\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\radial\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\arctic\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\canyon\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\breeze\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\boldstri\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\blueprnt\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\bluecalm\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\blends\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\java\jre1.8.0_45\bin\server\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\cascade\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\aftrnoon\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\stationery\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\smart tag\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\ink\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\ink\en-us\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\grphflt\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\equation\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\axis\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\dvd maker\shared\dvdstyles\specialoccasion\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\compass\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\echo\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\concrete\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\quad\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\profile\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\pixel\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\papyrus\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\network\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\level\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\deepblue\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\layers\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\capsules\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\indust\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\ice\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\expeditn\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\evrgreen\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\edge\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\eclipse\readme_liesmich_encryptor_raas.txt
- %CommonProgramFiles%\microsoft shared\themes14\journal\readme_liesmich_encryptor_raas.txt
- %ProgramFiles%\java\jre1.8.0_45\lib\amd64\readme_liesmich_encryptor_raas.txt
Изменяет следующие файлы
- %CommonProgramFiles%\microsoft shared\equation\eqnedt32.cnt
- %CommonProgramFiles%\microsoft shared\themes14\cascade\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\capsules\thmbnail.png
- %CommonProgramFiles%\microsoft shared\themes14\capsules\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\canyon\thmbnail.png
- %CommonProgramFiles%\microsoft shared\themes14\canyon\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\breeze\thmbnail.png
- %CommonProgramFiles%\microsoft shared\themes14\breeze\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\boldstri\thmbnail.png
- %CommonProgramFiles%\microsoft shared\themes14\boldstri\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\blueprnt\thmbnail.png
- %CommonProgramFiles%\microsoft shared\themes14\blueprnt\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\bluecalm\thmbnail.png
- %CommonProgramFiles%\microsoft shared\themes14\bluecalm\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\blends\thmbnail.png
- %CommonProgramFiles%\microsoft shared\themes14\blends\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\axis\thmbnail.png
- %CommonProgramFiles%\microsoft shared\themes14\axis\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\arctic\thmbnail.png
- %CommonProgramFiles%\microsoft shared\themes14\arctic\preview.gif
- %CommonProgramFiles%\microsoft shared\themes14\aftrnoon\thmbnail.png
- %CommonProgramFiles%\microsoft shared\themes14\aftrnoon\preview.gif
- %CommonProgramFiles%\microsoft shared\smart tag\metconv.txt
- %CommonProgramFiles%\microsoft shared\grphflt\ms.png
- %CommonProgramFiles%\microsoft shared\grphflt\ms.jpg
- %CommonProgramFiles%\microsoft shared\grphflt\ms.gif
- %CommonProgramFiles%\microsoft shared\grphflt\ms.eps
- %CommonProgramFiles%\microsoft shared\grphflt\cgmimp32.cfg
- %CommonProgramFiles%\microsoft shared\themes14\cascade\thmbnail.png
- %CommonProgramFiles%\microsoft shared\themes14\compass\preview.gif
Изменяет множество файлов.
Другое
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /C vssadmin Delete Shadows /Quiet /All (со скрытым окном)
