Trojan.Siggen6.5417

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Okl' = '<Полный путь к вирусу>'

Подменяет следующие исполняемые системные файлы:

<SYSTEM32>\dllcache\wordpad.exe файлом <SYSTEM32>\dllcache\wordpad.exe.new
<SYSTEM32>\dllcache\dialer.exe файлом <SYSTEM32>\dllcache\dialer.exe.new
<SYSTEM32>\dllcache\pinball.exe файлом <SYSTEM32>\dllcache\pinball.exe.new
%WINDIR%\NOTEPAD.EXE файлом %WINDIR%\notepad.exe.new
%WINDIR%\hh.exe файлом %WINDIR%\hh.exe.new
<SYSTEM32>\dllcache\wmplayer.exe файлом <SYSTEM32>\dllcache\wmplayer.exe.new
<SYSTEM32>\dllcache\wabmig.exe файлом <SYSTEM32>\dllcache\wabmig.exe.new
<SYSTEM32>\dllcache\wab.exe файлом <SYSTEM32>\dllcache\wab.exe.new
<SYSTEM32>\dllcache\migrate.exe файлом <SYSTEM32>\dllcache\migrate.exe.new
<SYSTEM32>\dllcache\setup_wm.exe файлом <SYSTEM32>\dllcache\setup_wm.exe.new
<SYSTEM32>\dllcache\mplayer2.exe файлом <SYSTEM32>\dllcache\mplayer2.exe.new
%WINDIR%\regedit.exe файлом %WINDIR%\regedit.exe.new
<SYSTEM32>\dllcache\twunk_32.exe файлом <SYSTEM32>\dllcache\twunk_32.exe.new
<SYSTEM32>\dllcache\taskman.exe файлом <SYSTEM32>\dllcache\taskman.exe.new
<SYSTEM32>\dllcache\winhlp32.exe файлом <SYSTEM32>\dllcache\winhlp32.exe.new
%WINDIR%\inf\unregmp2.exe файлом %WINDIR%\inf\unregmp2.exe.new
%WINDIR%\Help\Tours\mmTour\tour.exe файлом %WINDIR%\Help\Tours\mmTour\tour.exe.new
<SYSTEM32>\dllcache\regedit.exe файлом <SYSTEM32>\dllcache\regedit.exe.new
%WINDIR%\twunk_32.exe файлом %WINDIR%\twunk_32.exe.new
%WINDIR%\TASKMAN.EXE файлом %WINDIR%\taskman.exe.new
%WINDIR%\winhlp32.exe файлом %WINDIR%\winhlp32.exe.new
<SYSTEM32>\dllcache\notepad.exe файлом <SYSTEM32>\dllcache\notepad.exe.new
<SYSTEM32>\dllcache\hh.exe файлом <SYSTEM32>\dllcache\hh.exe.new
<SYSTEM32>\dllcache\icwtutor.exe файлом <SYSTEM32>\dllcache\icwtutor.exe.new
<SYSTEM32>\dllcache\icwrmind.exe файлом <SYSTEM32>\dllcache\icwrmind.exe.new
<SYSTEM32>\dllcache\inetwiz.exe файлом <SYSTEM32>\dllcache\inetwiz.exe.new
<SYSTEM32>\dllcache\moviemk.exe файлом <SYSTEM32>\dllcache\moviemk.exe.new
<SYSTEM32>\dllcache\isignup.exe файлом <SYSTEM32>\dllcache\isignup.exe.new
<SYSTEM32>\dllcache\icwconn2.exe файлом <SYSTEM32>\dllcache\icwconn2.exe.new
<SYSTEM32>\dllcache\sapisvr.exe файлом <SYSTEM32>\dllcache\sapisvr.exe.new
<SYSTEM32>\dllcache\msinfo32.exe файлом <SYSTEM32>\dllcache\msinfo32.exe.new
<SYSTEM32>\dllcache\iedw.exe файлом <SYSTEM32>\dllcache\iedw.exe.new
<SYSTEM32>\dllcache\icwconn1.exe файлом <SYSTEM32>\dllcache\icwconn1.exe.new
<SYSTEM32>\dllcache\iexplore.exe файлом <SYSTEM32>\dllcache\iexplore.exe.new
<SYSTEM32>\dllcache\bckgzm.exe файлом <SYSTEM32>\dllcache\bckgzm.exe.new
<SYSTEM32>\dllcache\wb32.exe файлом <SYSTEM32>\dllcache\wb32.exe.new
<SYSTEM32>\dllcache\conf.exe файлом <SYSTEM32>\dllcache\conf.exe.new
<SYSTEM32>\dllcache\msimn.exe файлом <SYSTEM32>\dllcache\msimn.exe.new
<SYSTEM32>\dllcache\setup50.exe файлом <SYSTEM32>\dllcache\setup50.exe.new
<SYSTEM32>\dllcache\oemig50.exe файлом <SYSTEM32>\dllcache\oemig50.exe.new
<SYSTEM32>\dllcache\cb32.exe файлом <SYSTEM32>\dllcache\cb32.exe.new
<SYSTEM32>\dllcache\hrtzzm.exe файлом <SYSTEM32>\dllcache\hrtzzm.exe.new
<SYSTEM32>\dllcache\chkrzm.exe файлом <SYSTEM32>\dllcache\chkrzm.exe.new
<SYSTEM32>\dllcache\rvsezm.exe файлом <SYSTEM32>\dllcache\rvsezm.exe.new
<SYSTEM32>\dllcache\zclientm.exe файлом <SYSTEM32>\dllcache\zclientm.exe.new
<SYSTEM32>\dllcache\shvlzm.exe файлом <SYSTEM32>\dllcache\shvlzm.exe.new

Заражает следующие исполняемые файлы:

<SYSTEM32>\dllcache\migrate.exe.new
<SYSTEM32>\dllcache\wabmig.exe.new
<SYSTEM32>\dllcache\setup_wm.exe.new
<SYSTEM32>\dllcache\mplayer2.exe.new
<SYSTEM32>\dllcache\wab.exe.new
<SYSTEM32>\dllcache\msimn.exe.new
<SYSTEM32>\dllcache\wb32.exe.new
<SYSTEM32>\dllcache\setup50.exe.new
<SYSTEM32>\dllcache\oemig50.exe.new
<SYSTEM32>\dllcache\wmplayer.exe.new
<SYSTEM32>\dllcache\taskman.exe.new
<SYSTEM32>\dllcache\regedit.exe.new
<SYSTEM32>\dllcache\winhlp32.exe.new
<SYSTEM32>\dllcache\twunk_32.exe.new
<SYSTEM32>\dllcache\notepad.exe.new
<SYSTEM32>\dllcache\wordpad.exe.new
<SYSTEM32>\dllcache\dialer.exe.new
<SYSTEM32>\dllcache\hh.exe.new
<SYSTEM32>\dllcache\pinball.exe.new
<SYSTEM32>\dllcache\icwrmind.exe.new
<SYSTEM32>\dllcache\icwconn2.exe.new
<SYSTEM32>\dllcache\inetwiz.exe.new
<SYSTEM32>\dllcache\icwtutor.exe.new
<SYSTEM32>\dllcache\icwconn1.exe.new
<SYSTEM32>\dllcache\sapisvr.exe.new
<SYSTEM32>\dllcache\msinfo32.exe.new
<SYSTEM32>\dllcache\iexplore.exe.new
<SYSTEM32>\dllcache\iedw.exe.new
<SYSTEM32>\dllcache\isignup.exe.new
<SYSTEM32>\dllcache\zclientm.exe.new
<SYSTEM32>\dllcache\shvlzm.exe.new
<SYSTEM32>\dllcache\conf.exe.new
<SYSTEM32>\dllcache\cb32.exe.new
<SYSTEM32>\dllcache\rvsezm.exe.new
<SYSTEM32>\dllcache\bckgzm.exe.new
<SYSTEM32>\dllcache\moviemk.exe.new
<SYSTEM32>\dllcache\hrtzzm.exe.new
<SYSTEM32>\dllcache\chkrzm.exe.new

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\38696.dmp
%TEMP%\dw.log

Удаляет следующие файлы:

%WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg
%WINDIR%\Help\Tours\htmlTour\question_icon.jpg
%WINDIR%\Help\Tours\htmlTour\pen_icon.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_better.jpg
%WINDIR%\Help\Tours\htmlTour\read_icon.jpg
%WINDIR%\Help\Tours\htmlTour\taskbar_up.jpg
%WINDIR%\Help\Tours\htmlTour\start_up.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_built.jpg
%WINDIR%\Help\Tours\htmlTour\ul_logo.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg
%WINDIR%\Help\Tours\htmlTour\logo.jpg
%WINDIR%\Help\Tours\htmlTour\img100.jpg
%WINDIR%\Help\Tours\htmlTour\img089.jpg
%WINDIR%\Help\Tours\htmlTour\img109.jpg
%WINDIR%\Help\Tours\htmlTour\img103.jpg
%WINDIR%\Help\Tours\htmlTour\img068.jpg
%WINDIR%\Help\Tours\htmlTour\img060.jpg
%WINDIR%\Help\Tours\htmlTour\img074a.jpg
%WINDIR%\Help\Tours\htmlTour\img072.jpg
%WINDIR%\Help\Tours\htmlTour\img136.jpg
%WINDIR%\Help\Tours\htmlTour\img126.jpg
%WINDIR%\Help\Tours\htmlTour\intro_logo.jpg
%WINDIR%\Help\Tours\htmlTour\img149.jpg
%WINDIR%\Help\Tours\htmlTour\img116.jpg
%WINDIR%\Help\Tours\htmlTour\img110.jpg
%WINDIR%\Help\Tours\htmlTour\img123.jpg
%WINDIR%\Help\Tours\htmlTour\img121.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg
%WINDIR%\inf\unregmp2.exe
%WINDIR%\Help\Tours\mmTour\tour.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
%WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\Microsoft.Workflow.Compiler.exe
%WINDIR%\pchealth\helpctr\System\DVDUpgrd\stripe.jpg
<SYSTEM32>\MsDtc\Trace\msdtcvtr.bat
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\greendot.jpg
%WINDIR%\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\XPSViewer_X86.exe
%WINDIR%\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\PresentationHost_X86.exe
%WINDIR%\Microsoft.NET\NETFXRepair.exe
%WINDIR%\Installer\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}\places.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_optimized_big.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
%WINDIR%\assembly\NativeImages_v4.0.30319_32\dfsvc\b9b6069e6da06eb57e89cc544397f735\dfsvc.ni.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
%WINDIR%\ocx\_reg_all.bat
%WINDIR%\Help\Tours\htmlTour\window_up.jpg
%WINDIR%\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\51819c709096229ee187a7feee395d9f\ComSvcConfig.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\WsatConfig\7d2a3adbdcb675f872eb2dbf21f73596\WsatConfig.ni.exe
%WINDIR%\Help\Tours\htmlTour\img046.jpg
%WINDIR%\Santa Fe Stucco.bmp
%WINDIR%\River Sumida.bmp
%WINDIR%\Zapotec.bmp
%WINDIR%\Soap Bubbles.bmp
%WINDIR%\Greenstone.bmp
%WINDIR%\Gone Fishing.bmp
%WINDIR%\Rhododendron.bmp
%WINDIR%\Prairie Wind.bmp
%WINDIR%\Help\Tours\htmlTour\best_road.jpg
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\9469981a17c01dd154c540127e678b35\PresentationFontCache.ni.exe
%WINDIR%\Help\Tours\htmlTour\best_road_big.jpg
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\6781b87c8d3b55e6120b1e86bea6e040\ServiceModelReg.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\19b50dd470540911fc5cc65331a769e4\ComSvcConfig.ni.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\MSBuild\87c84ffaaad81d8d106a9aa9d68b5926\MSBuild.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\dfsvc\a2865dcec9c5d3cc9c55f026cbad6fcc\dfsvc.ni.exe
%WINDIR%\FeatherTexture.bmp
%WINDIR%\sleep.exe
%WINDIR%\sfk.exe
%WINDIR%\twunk_16.exe
%WINDIR%\TASKMAN.EXE
%WINDIR%\hh.exe
%WINDIR%\explorer.exe
%WINDIR%\regedit.exe
%WINDIR%\NOTEPAD.EXE
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.exe
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.exe
%WINDIR%\Coffee Bean.bmp
%WINDIR%\Blue Lace 16.bmp
%WINDIR%\winhelp.exe
%WINDIR%\twunk_32.exe
%WINDIR%\$NtUninstallKB942288-v3$\msiexec.exe
%WINDIR%\winhlp32.exe
%WINDIR%\Help\Tours\htmlTour\desktop_up.jpg
%WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg
%WINDIR%\Help\Tours\htmlTour\folder_up.jpg
%WINDIR%\Help\Tours\htmlTour\end_up.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg
%WINDIR%\Help\Tours\htmlTour\control_up.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\img033a.jpg
%WINDIR%\Help\Tours\htmlTour\img033.jpg
%WINDIR%\Help\Tours\htmlTour\img040.jpg
%WINDIR%\Help\Tours\htmlTour\img034.jpg
%WINDIR%\Help\Tours\htmlTour\icon_up.jpg
%WINDIR%\Help\Tours\htmlTour\gradient.jpg
%WINDIR%\Help\Tours\htmlTour\img014.jpg
%WINDIR%\Help\Tours\htmlTour\img004b.jpg
%WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust.jpg
%WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg
%WINDIR%\assembly\NativeImages_v2.0.50727_32\SMSvcHost\b9c1a29e684bc02e49226ff1e9eec253\SMSvcHost.ni.exe
%WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_networks.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data.jpg
%WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg

Перемещает следующие файлы:

%PROGRAM_FILES%\Windows NT\dialer.exe.new в %PROGRAM_FILES%\Windows NT\dialer.exe
%PROGRAM_FILES%\Windows Media Player\wmplayer.exe.new в %PROGRAM_FILES%\Windows Media Player\wmplayer.exe
%PROGRAM_FILES%\Windows NT\Accessories\wordpad.exe.new в %PROGRAM_FILES%\Windows NT\Accessories\wordpad.exe
<SYSTEM32>\dllcache\iedw.exe.new в <SYSTEM32>\dllcache\iedw.exe
%PROGRAM_FILES%\Windows NT\Pinball\pinball.exe.new в %PROGRAM_FILES%\Windows NT\Pinball\pinball.exe
%PROGRAM_FILES%\Windows Media Player\setup_wm.exe.new в %PROGRAM_FILES%\Windows Media Player\setup_wm.exe
%PROGRAM_FILES%\Outlook Express\wab.exe.new в %PROGRAM_FILES%\Outlook Express\wab.exe
%PROGRAM_FILES%\Outlook Express\setup50.exe.new в %PROGRAM_FILES%\Outlook Express\setup50.exe
%PROGRAM_FILES%\Outlook Express\wabmig.exe.new в %PROGRAM_FILES%\Outlook Express\wabmig.exe
%PROGRAM_FILES%\Windows Media Player\mplayer2.exe.new в %PROGRAM_FILES%\Windows Media Player\mplayer2.exe
%PROGRAM_FILES%\Windows Media Player\migrate.exe.new в %PROGRAM_FILES%\Windows Media Player\migrate.exe
<SYSTEM32>\dllcache\moviemk.exe.new в <SYSTEM32>\dllcache\moviemk.exe
<SYSTEM32>\dllcache\isignup.exe.new в <SYSTEM32>\dllcache\isignup.exe
<SYSTEM32>\dllcache\bckgzm.exe.new в <SYSTEM32>\dllcache\bckgzm.exe
<SYSTEM32>\dllcache\hrtzzm.exe.new в <SYSTEM32>\dllcache\hrtzzm.exe
<SYSTEM32>\dllcache\chkrzm.exe.new в <SYSTEM32>\dllcache\chkrzm.exe
<SYSTEM32>\dllcache\inetwiz.exe.new в <SYSTEM32>\dllcache\inetwiz.exe
<SYSTEM32>\dllcache\icwconn1.exe.new в <SYSTEM32>\dllcache\icwconn1.exe
<SYSTEM32>\dllcache\iexplore.exe.new в <SYSTEM32>\dllcache\iexplore.exe
<SYSTEM32>\dllcache\icwconn2.exe.new в <SYSTEM32>\dllcache\icwconn2.exe
<SYSTEM32>\dllcache\icwtutor.exe.new в <SYSTEM32>\dllcache\icwtutor.exe
<SYSTEM32>\dllcache\icwrmind.exe.new в <SYSTEM32>\dllcache\icwrmind.exe
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwtutor.exe.new в %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwtutor.exe
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwrmind.exe.new в %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwrmind.exe
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\inetwiz.exe.new в %PROGRAM_FILES%\Internet Explorer\Connection Wizard\inetwiz.exe
%PROGRAM_FILES%\Movie Maker\moviemk.exe.new в %PROGRAM_FILES%\Movie Maker\moviemk.exe
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\isignup.exe.new в %PROGRAM_FILES%\Internet Explorer\Connection Wizard\isignup.exe
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn2.exe.new в %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn2.exe
%CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe.new в %CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe.new в %CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe
%PROGRAM_FILES%\Internet Explorer\iedw.exe.new в %PROGRAM_FILES%\Internet Explorer\iedw.exe
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn1.exe.new в %PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn1.exe
%PROGRAM_FILES%\Internet Explorer\iexplore.exe.new в %PROGRAM_FILES%\Internet Explorer\iexplore.exe
%PROGRAM_FILES%\NetMeeting\conf.exe.new в %PROGRAM_FILES%\NetMeeting\conf.exe
%PROGRAM_FILES%\NetMeeting\cb32.exe.new в %PROGRAM_FILES%\NetMeeting\cb32.exe
%PROGRAM_FILES%\NetMeeting\wb32.exe.new в %PROGRAM_FILES%\NetMeeting\wb32.exe
%PROGRAM_FILES%\Outlook Express\oemig50.exe.new в %PROGRAM_FILES%\Outlook Express\oemig50.exe
%PROGRAM_FILES%\Outlook Express\msimn.exe.new в %PROGRAM_FILES%\Outlook Express\msimn.exe
%PROGRAM_FILES%\MSN Gaming Zone\Windows\zclientm.exe.new в %PROGRAM_FILES%\MSN Gaming Zone\Windows\zclientm.exe
%PROGRAM_FILES%\MSN Gaming Zone\Windows\chkrzm.exe.new в %PROGRAM_FILES%\MSN Gaming Zone\Windows\chkrzm.exe
%PROGRAM_FILES%\MSN Gaming Zone\Windows\bckgzm.exe.new в %PROGRAM_FILES%\MSN Gaming Zone\Windows\bckgzm.exe
%PROGRAM_FILES%\MSN Gaming Zone\Windows\hrtzzm.exe.new в %PROGRAM_FILES%\MSN Gaming Zone\Windows\hrtzzm.exe
%PROGRAM_FILES%\MSN Gaming Zone\Windows\shvlzm.exe.new в %PROGRAM_FILES%\MSN Gaming Zone\Windows\shvlzm.exe
%PROGRAM_FILES%\MSN Gaming Zone\Windows\rvsezm.exe.new в %PROGRAM_FILES%\MSN Gaming Zone\Windows\rvsezm.exe

Самоудаляется.

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'Indicator' WindowName: '(null)'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней