Trojan.KillProc.31073

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe] 'Debugger' = 'C:\die.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe] 'Debugger' = 'C:\die.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe] 'Debugger' = 'C:\die.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe] 'Debugger' = 'C:\die.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MS' = '%WINDIR%\system\csrss.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe] 'Debugger' = 'C:\die.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe] 'Debugger' = 'C:\die.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MS' = '<Текущая директория>\install.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '%WINDIR%\system\csrss.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '%WINDIR%\system\csrss.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe] 'Debugger' = 'C:\die.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\command.com] 'Debugger' = 'C:\die.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe] 'Debugger' = 'C:\die.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'Debugger' = 'C:\die.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%WINDIR%\system\csrss.exe'
'<Текущая директория>\install.exe'

Завершает или пытается завершить

следующие системные процессы:

<SYSTEM32>\cmd.exe
%WINDIR%\Explorer.EXE

следующие пользовательские процессы:

firefox.exe
opera.exe
chrome.exe

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\system\cl32.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\avc[1].php
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\avc[1].php
<Текущая директория>\install.exe
<Текущая директория>\cl32.dll
%WINDIR%\system\csrss.exe

Удаляет следующие файлы:

<SYSTEM32>\DirectX\Dinput\mse_2.png
<SYSTEM32>\DirectX\Dinput\mse_10.png
<SYSTEM32>\DirectX\Dinput\mse_3.png
<SYSTEM32>\DirectX\Dinput\mse_5.png
<SYSTEM32>\DirectX\Dinput\mse_4.png
<SYSTEM32>\DirectX\Dinput\ms8_8.png
<SYSTEM32>\DirectX\Dinput\ms8_7.png
<SYSTEM32>\DirectX\Dinput\ms8_9.png
<SYSTEM32>\DirectX\Dinput\mse_1.png
<SYSTEM32>\DirectX\Dinput\mse.png
<SYSTEM32>\DirectX\Dinput\msf1f_10.png
<SYSTEM32>\DirectX\Dinput\msf1f_1.png
<SYSTEM32>\DirectX\Dinput\msf1f_2.png
<SYSTEM32>\DirectX\Dinput\msf1f_4.png
<SYSTEM32>\DirectX\Dinput\msf1f_3.png
<SYSTEM32>\DirectX\Dinput\mse_7.png
<SYSTEM32>\DirectX\Dinput\mse_6.png
<SYSTEM32>\DirectX\Dinput\mse_8.png
<SYSTEM32>\DirectX\Dinput\msf1f.png
<SYSTEM32>\DirectX\Dinput\mse_9.png
<SYSTEM32>\DirectX\Dinput\ms8_6.png
<SYSTEM32>\DirectX\Dinput\ms7_3.png
<SYSTEM32>\DirectX\Dinput\ms7_2.png
<SYSTEM32>\DirectX\Dinput\ms7_4.png
<SYSTEM32>\DirectX\Dinput\ms7_6.png
<SYSTEM32>\DirectX\Dinput\ms7_5.png
<SYSTEM32>\DirectX\Dinput\ms6_8.png
<SYSTEM32>\DirectX\Dinput\ms6_7.png
<SYSTEM32>\DirectX\Dinput\ms6_9.png
<SYSTEM32>\DirectX\Dinput\ms7_1.png
<SYSTEM32>\DirectX\Dinput\ms7.png
<SYSTEM32>\DirectX\Dinput\ms8_2.png
<SYSTEM32>\DirectX\Dinput\ms8_10.png
<SYSTEM32>\DirectX\Dinput\ms8_3.png
<SYSTEM32>\DirectX\Dinput\ms8_5.png
<SYSTEM32>\DirectX\Dinput\ms8_4.png
<SYSTEM32>\DirectX\Dinput\ms7_8.png
<SYSTEM32>\DirectX\Dinput\ms7_7.png
<SYSTEM32>\DirectX\Dinput\ms7_9.png
<SYSTEM32>\DirectX\Dinput\ms8_1.png
<SYSTEM32>\DirectX\Dinput\ms8.png
<SYSTEM32>\DirectX\Dinput\msf1f_5.png
%WINDIR%\Soap Bubbles.bmp
%WINDIR%\Santa Fe Stucco.bmp
%WINDIR%\winnt.bmp
%WINDIR%\Zapotec.bmp
%WINDIR%\winnt256.bmp
%WINDIR%\Greenstone.bmp
%WINDIR%\Gone Fishing.bmp
%WINDIR%\Prairie Wind.bmp
%WINDIR%\River Sumida.bmp
%WINDIR%\Rhododendron.bmp
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1028.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1025.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1029.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1031.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1030.rtf
%WINDIR%\setuplog.txt
%WINDIR%\OEWABLog.txt
%WINDIR%\clock.avi
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\logo.bmp
%WINDIR%\imsins.BAK
%WINDIR%\FeatherTexture.bmp
<SYSTEM32>\DirectX\Dinput\msprw_2.png
<SYSTEM32>\DirectX\Dinput\msprw_1.png
<SYSTEM32>\DirectX\Dinput\msprw_3.png
<SYSTEM32>\DirectX\Dinput\msprw_5.png
<SYSTEM32>\DirectX\Dinput\msprw_4.png
<SYSTEM32>\DirectX\Dinput\msf1f_7.png
<SYSTEM32>\DirectX\Dinput\msf1f_6.png
<SYSTEM32>\DirectX\Dinput\msf1f_8.png
<SYSTEM32>\DirectX\Dinput\msprw.png
<SYSTEM32>\DirectX\Dinput\msf1f_9.png
<SYSTEM32>\DirectX\Dinput\sv2511.png
<SYSTEM32>\DirectX\Dinput\SV-262e4.png
<SYSTEM32>\DirectX\Dinput\sv2512.png
%WINDIR%\Coffee Bean.bmp
%WINDIR%\Blue Lace 16.bmp
<SYSTEM32>\DirectX\Dinput\msprw_7.png
<SYSTEM32>\DirectX\Dinput\msprw_6.png
<SYSTEM32>\DirectX\Dinput\msprw_8.png
<SYSTEM32>\DirectX\Dinput\SV-262e3.png
<SYSTEM32>\DirectX\Dinput\SV-262e1.png
<SYSTEM32>\DirectX\Dinput\ms6_6.png
<SYSTEM32>\DirectX\Dinput\ms26_04.png
<SYSTEM32>\DirectX\Dinput\ms26_03.png
<SYSTEM32>\DirectX\Dinput\ms26_05.png
<SYSTEM32>\DirectX\Dinput\ms26_07.png
<SYSTEM32>\DirectX\Dinput\ms26_06.png
<SYSTEM32>\DirectX\Dinput\ms1b_10.png
<SYSTEM32>\DirectX\Dinput\ms1b_09.png
<SYSTEM32>\DirectX\Dinput\ms26.png
<SYSTEM32>\DirectX\Dinput\ms26_02.png
<SYSTEM32>\DirectX\Dinput\ms26_01.png
<SYSTEM32>\DirectX\Dinput\ms27_5.png
<SYSTEM32>\DirectX\Dinput\ms27_4.png
<SYSTEM32>\DirectX\Dinput\ms28.png
<SYSTEM32>\DirectX\Dinput\ms28_2.png
<SYSTEM32>\DirectX\Dinput\ms28_1.png
<SYSTEM32>\DirectX\Dinput\ms27.png
<SYSTEM32>\DirectX\Dinput\ms26_08.png
<SYSTEM32>\DirectX\Dinput\ms27_1.png
<SYSTEM32>\DirectX\Dinput\ms27_3.png
<SYSTEM32>\DirectX\Dinput\ms27_2.png
<SYSTEM32>\DirectX\Dinput\ms1b_08.png
<SYSTEM32>\DirectX\Dinput\lgc202.png
<SYSTEM32>\DirectX\Dinput\ia3002_2.png
<SYSTEM32>\DirectX\Dinput\lgc207.png
<SYSTEM32>\DirectX\Dinput\lgc20a.png
<SYSTEM32>\DirectX\Dinput\lgc209.png
<SYSTEM32>\DirectX\Dinput\gr4001_g.png
<SYSTEM32>\DirectX\Dinput\gr4001.png
<SYSTEM32>\DirectX\Dinput\gr4003.png
<SYSTEM32>\DirectX\Dinput\ia3002_1.png
<SYSTEM32>\DirectX\Dinput\gr4005.png
<SYSTEM32>\DirectX\Dinput\ms1b_04.png
<SYSTEM32>\DirectX\Dinput\glmdiggp.png
<SYSTEM32>\DirectX\Dinput\ms1b_05.png
<SYSTEM32>\DirectX\Dinput\ms1b_07.png
<SYSTEM32>\DirectX\Dinput\ms1b_06.png
<SYSTEM32>\DirectX\Dinput\ms1b.png
<SYSTEM32>\DirectX\Dinput\lgc291.png
<SYSTEM32>\DirectX\Dinput\ms1b_01.png
<SYSTEM32>\DirectX\Dinput\ms1b_03.png
<SYSTEM32>\DirectX\Dinput\ms1b_02.png
<SYSTEM32>\DirectX\Dinput\ms28_3.png
<SYSTEM32>\DirectX\Dinput\ms56_3.png
<SYSTEM32>\DirectX\Dinput\ms56_2.png
<SYSTEM32>\DirectX\Dinput\ms56_4.png
<SYSTEM32>\DirectX\Dinput\ms56_6.png
<SYSTEM32>\DirectX\Dinput\ms56_5.png
<SYSTEM32>\DirectX\Dinput\ms3b_t.png
<SYSTEM32>\DirectX\Dinput\ms3b_m.png
<SYSTEM32>\DirectX\Dinput\ms56.png
<SYSTEM32>\DirectX\Dinput\ms56_10.png
<SYSTEM32>\DirectX\Dinput\ms56_1.png
<SYSTEM32>\DirectX\Dinput\ms6_2.png
<SYSTEM32>\DirectX\Dinput\ms6_10.png
<SYSTEM32>\DirectX\Dinput\ms6_3.png
<SYSTEM32>\DirectX\Dinput\ms6_5.png
<SYSTEM32>\DirectX\Dinput\ms6_4.png
<SYSTEM32>\DirectX\Dinput\ms56_8.png
<SYSTEM32>\DirectX\Dinput\ms56_7.png
<SYSTEM32>\DirectX\Dinput\ms56_9.png
<SYSTEM32>\DirectX\Dinput\ms6_1.png
<SYSTEM32>\DirectX\Dinput\ms6.png
<SYSTEM32>\DirectX\Dinput\ms3b_c.png
<SYSTEM32>\DirectX\Dinput\ms34_01.png
<SYSTEM32>\DirectX\Dinput\ms34.png
<SYSTEM32>\DirectX\Dinput\ms34_02.png
<SYSTEM32>\DirectX\Dinput\ms34_04.png
<SYSTEM32>\DirectX\Dinput\ms34_03.png
<SYSTEM32>\DirectX\Dinput\ms28_5.png
<SYSTEM32>\DirectX\Dinput\ms28_4.png
<SYSTEM32>\DirectX\Dinput\ms28_6.png
<SYSTEM32>\DirectX\Dinput\ms28_8.png
<SYSTEM32>\DirectX\Dinput\ms28_7.png
<SYSTEM32>\DirectX\Dinput\ms3b_2.png
<SYSTEM32>\DirectX\Dinput\ms3b_1.png
<SYSTEM32>\DirectX\Dinput\ms3b_3.png
<SYSTEM32>\DirectX\Dinput\ms3b_a.png
<SYSTEM32>\DirectX\Dinput\ms3b_4.png
<SYSTEM32>\DirectX\Dinput\ms34_06.png
<SYSTEM32>\DirectX\Dinput\ms34_05.png
<SYSTEM32>\DirectX\Dinput\ms34_07.png
<SYSTEM32>\DirectX\Dinput\ms3b.png
<SYSTEM32>\DirectX\Dinput\ms34_08.png
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\DividerBar2.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\DividerBar1.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\RAChatServer.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\RAServerToolBar.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\RAServer.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\StopControl.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\VOIPMsgs.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\ESC_key.gif
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\StopControl.gif
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\Helpee_line.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud2.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud1.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud3.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud5.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud4.wav
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\TakeControlMsgs.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\SettingServer.htm
<SYSTEM32>\setup.bmp
<SYSTEM32>\ntimage.gif
<SYSTEM32>\eula.txt
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\voicefirewallmsg.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendFile.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Quit.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendVoice.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\hide-chat.gif
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\HelpCenter.gif
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\rctoolScreen1.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\rcscreen6_head.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\setting.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Options.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\HelpCenter.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendVoiceOn.gif
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendVoice.gif
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\show-chat.gif
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\RCFileXfer.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\ErrorMsgs.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Options.gif
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\info.gif
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Quit.gif
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendFile.gif
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendChat.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud6.wav
%WINDIR%\Media\Windows XP Minimize.wav
%WINDIR%\Media\Windows XP Menu Command.wav
%WINDIR%\Media\Windows XP Notify.wav
%WINDIR%\Media\Windows XP Print complete.wav
%WINDIR%\Media\Windows XP Pop-up Blocked.wav
%WINDIR%\Media\Windows XP Hardware Remove.wav
%WINDIR%\Media\Windows XP Hardware Insert.wav
%WINDIR%\Media\Windows XP Information Bar.wav
%WINDIR%\Media\Windows XP Logon Sound.wav
%WINDIR%\Media\Windows XP Logoff Sound.wav
%WINDIR%\Media\Windows XP Startup.wav
%WINDIR%\Media\Windows XP Start.wav
%WINDIR%\Media\flourish.mid
%WINDIR%\Media\town.mid
%WINDIR%\Media\onestop.mid
%WINDIR%\Media\Windows XP Restore.wav
%WINDIR%\Media\Windows XP Recycle.wav
%WINDIR%\Media\Windows XP Ringin.wav
%WINDIR%\Media\Windows XP Shutdown.wav
%WINDIR%\Media\Windows XP Ringout.wav
%WINDIR%\Media\Windows XP Hardware Fail.wav
%WINDIR%\Media\notify.wav
%WINDIR%\Media\ding.wav
%WINDIR%\Media\recycle.wav
%WINDIR%\Media\ringout.wav
%WINDIR%\Media\ringin.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud8.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud7.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud9.wav
%WINDIR%\Media\chord.wav
%WINDIR%\Media\chimes.wav
%WINDIR%\Media\Windows XP Default.wav
%WINDIR%\Media\Windows XP Critical Stop.wav
%WINDIR%\Media\Windows XP Ding.wav
%WINDIR%\Media\Windows XP Exclamation.wav
%WINDIR%\Media\Windows XP Error.wav
%WINDIR%\Media\tada.wav
%WINDIR%\Media\start.wav
%WINDIR%\Media\Windows XP Balloon.wav
%WINDIR%\Media\Windows XP Battery Low.wav
%WINDIR%\Media\Windows XP Battery Critical.wav
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAToolBar.htm
%WINDIR%\pchealth\helpctr\System\blurbs\watermark_300x.bmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\DHtmlHeader.html
%WINDIR%\pchealth\helpctr\System\blurbs\about_support.htm
%WINDIR%\pchealth\helpctr\System\blurbs\ftshelp.htm
%WINDIR%\pchealth\helpctr\System\blurbs\Favorites.htm
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\DHtmlHeader.html
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\watermark.bmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\header.bmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\watermark.bmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SplashScreen.bmp
%WINDIR%\pchealth\helpctr\System\blurbs\searchtips.htm
%WINDIR%\pchealth\helpctr\System\blurbs\searchblurb.htm
%WINDIR%\pchealth\helpctr\System\blurbs\tools.htm
%WINDIR%\pchealth\helpctr\System\images\icon_articles_12x.bmp
%WINDIR%\pchealth\helpctr\System\blurbs\windows_newsgroups.htm
%WINDIR%\pchealth\helpctr\System\blurbs\Index.htm
%WINDIR%\pchealth\helpctr\System\blurbs\History.htm
%WINDIR%\pchealth\helpctr\System\blurbs\isupport.htm
%WINDIR%\pchealth\helpctr\System\blurbs\options.htm
%WINDIR%\pchealth\helpctr\System\blurbs\keywordhelp.htm
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SplashScreen.bmp
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1040.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1038.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1041.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1043.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1042.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1033.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1032.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1035.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1037.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1036.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2052.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1055.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.2070.rtf
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\header.bmp
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.3082.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1045.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1044.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1046.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1053.rtf
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\eula.1049.rtf
%WINDIR%\pchealth\helpctr\System\images\icon_blank_12x.bmp
%WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_04.bmp
%WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_03.bmp
%WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_generic.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\Animation.gif
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\TakeControl.bmp
%WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_normal.bmp
%WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mouseover.bmp
%WINDIR%\pchealth\helpctr\System\images\32x32\logo.bmp
%WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_02.bmp
%WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_01.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\DividerBar.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\UpArrow.gif
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAChatClient.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAStatusBar.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\RAClient.htm
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\connected.gif
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\combobox_line.gif
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\DividerBar.gif
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\TakeControl.gif
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\DownArrow.gif
%WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mousedown.bmp
%WINDIR%\pchealth\helpctr\System\images\flyout_arrow.gif
%WINDIR%\pchealth\helpctr\System\images\feedback.gif
%WINDIR%\pchealth\helpctr\System\images\get_conn.gif
%WINDIR%\pchealth\helpctr\System\images\progbar.gif
%WINDIR%\pchealth\helpctr\System\images\info.gif
%WINDIR%\pchealth\helpctr\System\images\icon_onlineinline_12x.bmp
%WINDIR%\pchealth\helpctr\System\images\icon_newwindow_12x.bmp
%WINDIR%\pchealth\helpctr\System\images\icon_tours_12x.bmp
%WINDIR%\pchealth\helpctr\System\images\error.gif
%WINDIR%\pchealth\helpctr\System\images\icon_tutorials_12x.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\support.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\errmsg.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\tools.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\warning.gif
%WINDIR%\pchealth\helpctr\System\images\16x16\update.bmp
%WINDIR%\pchealth\helpctr\System\images\wrapperhelp.gif
%WINDIR%\pchealth\helpctr\System\images\warning.gif
%WINDIR%\pchealth\helpctr\System\images\16x16\arrow_blue_normal_shadow.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\compat.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\arrow_green_normal_shadow.bmp
%WINDIR%\Help\Tours\htmlTour\start_files.htm
%WINDIR%\Help\Tours\htmlTour\start_ending.htm
%WINDIR%\Help\Tours\htmlTour\start_fr.htm
%WINDIR%\Help\Tours\htmlTour\start_menu.htm
%WINDIR%\Help\Tours\htmlTour\start_icons.htm
%WINDIR%\Help\Tours\htmlTour\safe_faster.htm
%WINDIR%\Help\Tours\htmlTour\safe_easier.htm
%WINDIR%\Help\Tours\htmlTour\safe_fr.htm
%WINDIR%\Help\Tours\htmlTour\start_desktop.htm
%WINDIR%\Help\Tours\htmlTour\start_control.htm
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_playing.htm
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg
%WINDIR%\Help\Tours\htmlTour\start_windows.htm
%WINDIR%\Help\Tours\htmlTour\start_taskbar.htm
%WINDIR%\Help\Tours\htmlTour\unlock_built.htm
%WINDIR%\Help\Tours\htmlTour\unlock_optimized.htm
%WINDIR%\Help\Tours\htmlTour\unlock_fr.htm
%WINDIR%\Help\Tours\htmlTour\safe_better.htm
%WINDIR%\Help\Tours\htmlTour\nav_unlock.gif
%WINDIR%\Help\Tours\htmlTour\nav_start_here_down.gif
%WINDIR%\Help\Tours\htmlTour\nav_unlock_down.gif
%WINDIR%\Help\Tours\htmlTour\best_fr.htm
%WINDIR%\Help\Tours\htmlTour\spacer.gif
%WINDIR%\Help\Tours\htmlTour\nav_gray.gif
%WINDIR%\Help\Tours\htmlTour\nav_connected_down.gif
%WINDIR%\Help\Tours\htmlTour\nav_safe_easy.gif
%WINDIR%\Help\Tours\htmlTour\nav_start_here.gif
%WINDIR%\Help\Tours\htmlTour\nav_safe_easy_down.gif
%WINDIR%\Help\Tours\htmlTour\connected_networks.htm
%WINDIR%\Help\Tours\htmlTour\connected_multiple.htm
%WINDIR%\Help\Tours\htmlTour\connected_wizard.htm
%WINDIR%\Help\Tours\htmlTour\footer.htm
%WINDIR%\Help\Tours\htmlTour\default.htm
%WINDIR%\Help\Tours\htmlTour\best_robust.htm
%WINDIR%\Help\Tours\htmlTour\best_road.htm
%WINDIR%\Help\Tours\htmlTour\best_secure.htm
%WINDIR%\Help\Tours\htmlTour\connected_fr.htm
%WINDIR%\Help\Tours\htmlTour\connected_data.htm
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_1x1.gif
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_1x1.gif
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif
%WINDIR%\Help\Tours\htmlTour\nav_connected.gif
%WINDIR%\Help\Tours\htmlTour\gradient.jpg
%WINDIR%\Help\Tours\htmlTour\folder_up.jpg
%WINDIR%\Help\Tours\htmlTour\icon_up.jpg
%WINDIR%\Help\Tours\htmlTour\img014.jpg
%WINDIR%\Help\Tours\htmlTour\img004b.jpg
%WINDIR%\Help\Tours\htmlTour\control_up.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg
%WINDIR%\Help\Tours\htmlTour\end_up.jpg
%WINDIR%\Help\Tours\htmlTour\desktop_up.jpg
%WINDIR%\Help\Tours\htmlTour\img068.jpg
%WINDIR%\Help\Tours\htmlTour\img060.jpg
%WINDIR%\Help\Tours\htmlTour\img072.jpg
%WINDIR%\Help\Tours\htmlTour\img089.jpg
%WINDIR%\Help\Tours\htmlTour\img074a.jpg
%WINDIR%\Help\Tours\htmlTour\img033a.jpg
%WINDIR%\Help\Tours\htmlTour\img033.jpg
%WINDIR%\Help\Tours\htmlTour\img034.jpg
%WINDIR%\Help\Tours\htmlTour\img046.jpg
%WINDIR%\Help\Tours\htmlTour\img040.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\best_road.jpg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\avc[1].php
%WINDIR%\Help\Tours\htmlTour\best_road_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust.jpg
%WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_networks.jpg
%WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg
%WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg
%WINDIR%\Help\Tours\htmlTour\img100.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_built.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_optimized_big.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg
%WINDIR%\Help\Tours\htmlTour\start_up.jpg
%WINDIR%\Help\Tours\htmlTour\ul_logo.jpg
%WINDIR%\Help\Tours\htmlTour\taskbar_up.jpg
%WINDIR%\Help\Tours\htmlTour\bot_bar.gif
%WINDIR%\Help\Tours\htmlTour\bluearrow.gif
%WINDIR%\Help\Tours\htmlTour\nav_best.gif
%WINDIR%\Help\Tours\htmlTour\nav_blank.gif
%WINDIR%\Help\Tours\htmlTour\nav_best_down.gif
%WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg
%WINDIR%\Help\Tours\htmlTour\window_up.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster.jpg
%WINDIR%\Help\Tours\htmlTour\img126.jpg
%WINDIR%\Help\Tours\htmlTour\img123.jpg
%WINDIR%\Help\Tours\htmlTour\img136.jpg
%WINDIR%\Help\Tours\htmlTour\intro_logo.jpg
%WINDIR%\Help\Tours\htmlTour\img149.jpg
%WINDIR%\Help\Tours\htmlTour\img109.jpg
%WINDIR%\Help\Tours\htmlTour\img103.jpg
%WINDIR%\Help\Tours\htmlTour\img110.jpg
%WINDIR%\Help\Tours\htmlTour\img121.jpg
%WINDIR%\Help\Tours\htmlTour\img116.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big.jpg
%WINDIR%\Help\Tours\htmlTour\pen_icon.jpg
%WINDIR%\Help\Tours\htmlTour\logo.jpg
%WINDIR%\Help\Tours\htmlTour\question_icon.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_better.jpg
%WINDIR%\Help\Tours\htmlTour\read_icon.jpg
<SYSTEM32>\oobe\images\mousewn1.gif
<SYSTEM32>\oobe\images\mouse.gif
<SYSTEM32>\oobe\images\oemlogo.gif
<SYSTEM32>\oobe\images\progress.gif
<SYSTEM32>\oobe\images\prodkey.gif
<SYSTEM32>\oobe\images\magnify.gif
<SYSTEM32>\oobe\images\hand2.gif
<SYSTEM32>\oobe\images\merlin.gif
<SYSTEM32>\oobe\images\monitor2.gif
<SYSTEM32>\oobe\images\monitor.gif
%WINDIR%\Web\Wallpaper\Follow.jpg
%WINDIR%\Web\Wallpaper\Crystal.jpg
%WINDIR%\Web\Wallpaper\Friend.jpg
%WINDIR%\Web\Wallpaper\Moon flower.jpg
%WINDIR%\Web\Wallpaper\Home.jpg
<SYSTEM32>\oobe\images\redshd.gif
<SYSTEM32>\oobe\images\qmark.gif
%WINDIR%\Web\Wallpaper\Ascent.jpg
%WINDIR%\Web\Wallpaper\Azul.jpg
%WINDIR%\Web\Wallpaper\Autumn.jpg
<SYSTEM32>\oobe\images\hand1.gif
<SYSTEM32>\oobe\images\thanks8.png
<SYSTEM32>\oobe\images\thanks10.png
<SYSTEM32>\oobe\images\clickerx.wav
<SYSTEM32>\oobe\images\title.wma
<SYSTEM32>\oobe\images\intro.wmv
<SYSTEM32>\oobe\images\wpabtm.jpg
<SYSTEM32>\oobe\images\wpaback.jpg
<SYSTEM32>\oobe\images\wpaflag.jpg
<SYSTEM32>\oobe\images\wpatop.jpg
<SYSTEM32>\oobe\images\wpakey.jpg
<SYSTEM32>\oobe\images\dialtone.gif
<SYSTEM32>\oobe\images\clickhr.gif
<SYSTEM32>\oobe\images\dialup.gif
<SYSTEM32>\oobe\images\grn_btn.gif
<SYSTEM32>\oobe\images\greenshd.gif
<SYSTEM32>\oobe\images\btn1.gif
<SYSTEM32>\oobe\images\arrow.gif
<SYSTEM32>\oobe\images\btn2.gif
<SYSTEM32>\oobe\images\bullet1.gif
<SYSTEM32>\oobe\images\btn3.gif
%WINDIR%\Web\Wallpaper\Peace.jpg
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\logon_anim.gif
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\info.gif
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\messenger_big.gif
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\monitor_right.gif
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\monitor_left.gif
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\floppy.gif
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Envelope.gif
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\generic_mail.gif
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\IM_icon.gif
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\icon_extweb.gif
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcscreen3.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcscreen2.htm
<SYSTEM32>\DirectX\Dinput\act_rs.png
<SYSTEM32>\DirectX\Dinput\gr3001.png
<SYSTEM32>\DirectX\Dinput\glmda.png
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\outlook_express.gif
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\outlook.gif
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\square_bullet.gif
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcscreen1.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcConnection.htm
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy_offline.gif
%WINDIR%\Web\Wallpaper\Tulips.jpg
%WINDIR%\Web\Wallpaper\Stonehenge.jpg
%WINDIR%\Web\Wallpaper\Vortec space.jpg
%WINDIR%\Web\Wallpaper\Windows XP.jpg
%WINDIR%\Web\Wallpaper\Wind.jpg
%WINDIR%\Web\Wallpaper\Purple flower.jpg
%WINDIR%\Web\Wallpaper\Power.jpg
%WINDIR%\Web\Wallpaper\Radiance.jpg
%WINDIR%\Web\Wallpaper\Ripple.jpg
%WINDIR%\Web\Wallpaper\Red moon desert.jpg
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy_attention.gif
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy.gif
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy_away.gif
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy_none.gif
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\buddy_busy.gif
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Remote_Assistance_Graphic.png
%WINDIR%\Web\Wallpaper\Bliss.bmp
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\address_book.gif
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\attention.gif
%WINDIR%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\arrow.gif
<SYSTEM32>\oobe\images\skipup.jpg
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\spacer.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\r3_c2.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\system.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\usb.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\Untitled.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\printer.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\PieWhite.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\r1_c1.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\r1_c3.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\r1_c2.gif
<SYSTEM32>\oobe\html\mouse\images\parism.jpg
<SYSTEM32>\oobe\html\mouse\images\paris.jpg
<SYSTEM32>\oobe\html\mouse\images\pisa.jpg
<SYSTEM32>\oobe\html\mouse\images\prague.jpg
<SYSTEM32>\oobe\html\mouse\images\pisam.jpg
<SYSTEM32>\oobe\html\mouse\images\bulzano.jpg
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\windows.gif
<SYSTEM32>\oobe\html\mouse\images\bulzanom.jpg
<SYSTEM32>\oobe\html\mouse\images\heidelbm.jpg
<SYSTEM32>\oobe\html\mouse\images\heidelb.jpg
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\PieGrey.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\BArrow.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\alert.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\card.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\check.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\cd.gif
%WINDIR%\pchealth\helpctr\System\DVDUpgrd\dvdupgrd.htm
%WINDIR%\pchealth\helpctr\System\DVDUpgrd\stripe.jpg
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\greendot.jpg
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\up.bmp
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\down.bmp
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\info.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\gears.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\monitor.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\PieChart.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\personalizing.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\drive.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\chip.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\error.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\GArrow.gif
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\floppy.gif
<SYSTEM32>\oobe\html\mouse\images\praguem.jpg
<SYSTEM32>\oobe\images\newbtm1.jpg
<SYSTEM32>\oobe\images\mslogo.jpg
<SYSTEM32>\oobe\images\newbtm8.jpg
<SYSTEM32>\oobe\images\newmark8.jpg
<SYSTEM32>\oobe\images\newmark1.jpg
<SYSTEM32>\oobe\images\backdown.jpg
<SYSTEM32>\oobe\html\mouse\images\mouseimg.gif
<SYSTEM32>\oobe\images\backoff.jpg
<SYSTEM32>\oobe\images\backup.jpg
<SYSTEM32>\oobe\images\backover.jpg
<SYSTEM32>\oobe\images\oemcoa.jpg
<SYSTEM32>\oobe\images\nextup.jpg
<SYSTEM32>\oobe\images\skipdown.jpg
<SYSTEM32>\oobe\images\skipover.jpg
<SYSTEM32>\oobe\images\skipoff.jpg
<SYSTEM32>\oobe\images\newtop8.jpg
<SYSTEM32>\oobe\images\newtop1.jpg
<SYSTEM32>\oobe\images\nextdown.jpg
<SYSTEM32>\oobe\images\nextover.jpg
<SYSTEM32>\oobe\images\nextoff.jpg
<SYSTEM32>\oobe\html\mouse\images\mouse4.gif
<SYSTEM32>\oobe\html\mouse\images\but1_dwn.gif
<SYSTEM32>\oobe\html\mouse\images\veronam.jpg
<SYSTEM32>\oobe\html\mouse\images\but1_idl.gif
<SYSTEM32>\oobe\html\mouse\images\but2_dwn.gif
<SYSTEM32>\oobe\html\mouse\images\but1_up.gif
<SYSTEM32>\oobe\html\mouse\images\tyrolm.jpg
<SYSTEM32>\oobe\html\mouse\images\tyrol.jpg
<SYSTEM32>\oobe\html\mouse\images\venice.jpg
<SYSTEM32>\oobe\html\mouse\images\verona.jpg
<SYSTEM32>\oobe\html\mouse\images\venicem.jpg
<SYSTEM32>\oobe\html\mouse\images\but4_idl.gif
<SYSTEM32>\oobe\html\mouse\images\but4_dwn.gif
<SYSTEM32>\oobe\html\mouse\images\but4_up.gif
<SYSTEM32>\oobe\html\mouse\images\desktop3.gif
<SYSTEM32>\oobe\html\mouse\images\clicking.gif
<SYSTEM32>\oobe\html\mouse\images\but2_up.gif
<SYSTEM32>\oobe\html\mouse\images\but2_idl.gif
<SYSTEM32>\oobe\html\mouse\images\but3_dwn.gif
<SYSTEM32>\oobe\html\mouse\images\but3_up.gif
<SYSTEM32>\oobe\html\mouse\images\but3_idl.gif

Сетевая активность:

Подключается к:

'localhost':1038
'sz###esz.2u.se':80
'localhost':1035

TCP:

Запросы HTTP GET:

sz###esz.2u.se/avc.php

UDP:

DNS ASK sz###esz.2u.se

Другое:

Ищет следующие окна:

ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
ClassName: 'Indicator' WindowName: '(null)'
ClassName: 'EDIT' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней