Trojan.MulDrop5.34031

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SMRLogin' = '"%PROGRAM_FILES%\WW2010CF\hulogin.exe"'
[<HKLM>\SOFTWARE\Classes\.smr\shell\open\command] '' = '%PROGRAM_FILES%\WW2010CF\huEncryption.exe %1 encrypt'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SMRLogin' = '%PROGRAM_FILES%\WW2010CF\hulogin.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\HuService] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\Smrf] 'Start' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\Win-Win] 'ImagePath' = '"%PROGRAM_FILES%\WW2010CF\SERVICES.EXE"'
[<HKLM>\SYSTEM\ControlSet001\Services\Win-Win] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\ww2010cf\USB_SN.exe'
'%PROGRAM_FILES%\ww2010cf\SERVICES.exe'
'%PROGRAM_FILES%\ww2010cf\HuLogin.exe'
'%PROGRAM_FILES%\ww2010cf\HuExec.exe'
'%PROGRAM_FILES%\ww2010cf\HuCheck5.exe'
'%PROGRAM_FILES%\ww2010cf\dmidecode.exe'
'%PROGRAM_FILES%\ww2010cf\HuService.exe'
'C:\temp\temp\HuCheck5.exe'
'C:\temp\temp\ManualUpdate2011.exe'
'C:\temp\temp\RunManualUpdate2011.exe'
'%PROGRAM_FILES%\ww2010cf\HuService.exe' -i
'C:\temp\winet\sensetup.exe'
'%TEMP%\5f6d5g9gg5er9g3h5uj4e6sjh6u22i4t6\rms2.exe' -noui

Запускает на исполнение:

'<SYSTEM32>\grpconv.exe' -o
'<SYSTEM32>\runonce.exe' -r
'<SYSTEM32>\regsvr32.exe' /i /s "%PROGRAM_FILES%\WW2010CF\Starburnx86\StarBurn.dll"
'<SYSTEM32>\regsvr32.exe' /i /s "%PROGRAM_FILES%\WW2010CF\XceedCry.dll"
'<SYSTEM32>\regsvr32.exe' /i /s "%PROGRAM_FILES%\WW2010CF\Starburnx86\StarBurnX15.dll"
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe' /x {6ECF2098-BEE1-45D2-BD6F-5A4CCF4EC6D5} /qn /norestart
'<SYSTEM32>\netsh.exe' firewall set icmpsetting 8 disable
'<SYSTEM32>\rundll32.exe' setupapi.dll,InstallHinfSection DefaultInstall 128 <DRIVERS>\Smrf.inf
'<SYSTEM32>\reg.exe' export HKLM\SYSTEM\CurrentControlSet\Services\Win-Win "%PROGRAM_FILES%\WW2010CF\Presto.RegDebug.dll"

Изменяет следующие настройки проводника Windows (Windows Explorer):

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoControlPanel' = '00000000'

Принудительно разрешает автозапуск со съемных носителей.

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\ww2010cf\GetPc_s.exe
%PROGRAM_FILES%\ww2010cf\hodll.dll
%PROGRAM_FILES%\ww2010cf\GetInfo.dat
%PROGRAM_FILES%\ww2010cf\dmidecode.exe
%PROGRAM_FILES%\ww2010cf\FindFile.exe
%PROGRAM_FILES%\ww2010cf\Hu2hks.dll
%PROGRAM_FILES%\ww2010cf\Hu2lib.dll
%PROGRAM_FILES%\ww2010cf\Hu2egn.dll
%PROGRAM_FILES%\ww2010cf\HU.MUA
%PROGRAM_FILES%\ww2010cf\Hu.ss
%PROGRAM_FILES%\ww2010cf\Connects\winwin\Wait for Call.cnn
C:\temp\winet\Starburnx86\StarBurnX15.dll
C:\temp\winet\Connects\Wait for Call.cnn
C:\temp\winet\Starburnx86\StarBurn.dll
C:\temp\winet\WN_DataBurner.exe
C:\temp\winet\XceedCry.dll
%PROGRAM_FILES%\ww2010cf\Connects\Wait for Call.cnn
%PROGRAM_FILES%\ww2010cf\Connects\winwin\HU.INI
C:\temp\winet\HuRMS.exe
C:\temp\winet\Connects\winwin\HU.INI
C:\temp\winet\Connects\winwin\Wait for Call.cnn
%PROGRAM_FILES%\ww2010cf\hu2res.dll
%PROGRAM_FILES%\ww2010cf\HuLogin.exe
%PROGRAM_FILES%\ww2010cf\Huncomm.dll
%PROGRAM_FILES%\ww2010cf\Hulog.dll
%PROGRAM_FILES%\ww2010cf\HuInvenEx.dll
%PROGRAM_FILES%\ww2010cf\hulib.dll
%PROGRAM_FILES%\ww2010cf\HuRes2.dll
%PROGRAM_FILES%\ww2010cf\hures2_GB.dll
%PROGRAM_FILES%\ww2010cf\HuRes.dll
%PROGRAM_FILES%\ww2010cf\HuNCommEx.exe
%PROGRAM_FILES%\ww2010cf\HuREgn.dll
%PROGRAM_FILES%\ww2010cf\huinven.dll
%PROGRAM_FILES%\ww2010cf\hudriver2.dll
%PROGRAM_FILES%\ww2010cf\huEncryption.exe
%PROGRAM_FILES%\ww2010cf\Hudcomm.dll
%PROGRAM_FILES%\ww2010cf\Hu2sys.exe
%PROGRAM_FILES%\ww2010cf\HuCheck5.exe
%PROGRAM_FILES%\ww2010cf\Huft.dll
%PROGRAM_FILES%\ww2010cf\hufwalk.dll
%PROGRAM_FILES%\ww2010cf\HuFindFL.exe
%PROGRAM_FILES%\ww2010cf\HuEndeco.dll
%PROGRAM_FILES%\ww2010cf\HuExec.exe
C:\temp\winet\WNCall_GB.exe
C:\temp\winet\smrf.inf.208_x64
C:\temp\winet\smrf.inf.212_x64
C:\temp\winet\Smrf.inf.208
C:\temp\winet\smrf.cat.w8
C:\temp\winet\smrf.cat.w8_x64
C:\temp\winet\Smrf.inf.w7_x64
C:\temp\winet\smrf.inf.w8
C:\temp\winet\Smrf.inf.w7
C:\temp\winet\Smrf.inf.vis
C:\temp\winet\Smrf.inf.w23
C:\temp\winet\Smrf.cat.w7_x64
C:\temp\winet\SERVICES.exe
C:\temp\winet\smr.ico
C:\temp\winet\sensetup.exe
C:\temp\winet\sendinfo.dat
C:\temp\winet\Senini.exe
C:\temp\winet\smrf.cat.vis
C:\temp\winet\smrf.cat.w7
C:\temp\winet\smrf.cat.212_x64
C:\temp\winet\smrf.cat.208
C:\temp\winet\smrf.cat.208_x64
C:\temp\winet\smrf.inf.w8_x64
C:\temp\winet\wmAes.dll
C:\temp\winet\wmLock.exe
C:\temp\winet\winet.ln_
C:\temp\winet\USB_SN.exe
C:\temp\winet\WaterMark.dll
C:\temp\winet\wmTakeIM.dll
C:\temp\winet\WNCall.exe
C:\temp\winet\wmTakeHttp.dll
C:\temp\winet\wmLookProc.dll
C:\temp\winet\wmLookProc64.dll
C:\temp\winet\Smrf.sys.wxp
C:\temp\winet\smrf.sys.212_x64
C:\temp\winet\Smrf.sys.vis
C:\temp\winet\smrf.sys.208_x64
C:\temp\winet\Smrf.inf.wxp
C:\temp\winet\Smrf.sys.208
C:\temp\winet\smrf.sys.w8
C:\temp\winet\smrf.sys.w8_x64
C:\temp\winet\Smrf.sys.w7_x64
C:\temp\winet\Smrf.sys.w23
C:\temp\winet\Smrf.sys.w7
%PROGRAM_FILES%\ww2010cf\HuRMS.exe
%PROGRAM_FILES%\ww2010cf\WaterMark.dll
%PROGRAM_FILES%\ww2010cf\winet.ln_
%PROGRAM_FILES%\ww2010cf\USB_SN.exe
%PROGRAM_FILES%\ww2010cf\Starburnx86\StarBurn.dll
%PROGRAM_FILES%\ww2010cf\Starburnx86\StarBurnX15.dll
%PROGRAM_FILES%\ww2010cf\wmLookProc64.dll
%PROGRAM_FILES%\ww2010cf\wmTakeHttp.dll
%PROGRAM_FILES%\ww2010cf\wmLookProc.dll
%PROGRAM_FILES%\ww2010cf\wmAes.dll
%PROGRAM_FILES%\ww2010cf\wmLock.exe
%PROGRAM_FILES%\ww2010cf\Smrf.sys.wxp
%PROGRAM_FILES%\ww2010cf\smrf.sys.212_x64
%PROGRAM_FILES%\ww2010cf\Smrf.sys.vis
%PROGRAM_FILES%\ww2010cf\smrf.sys.208_x64
%PROGRAM_FILES%\ww2010cf\Smrf.inf.wxp
%PROGRAM_FILES%\ww2010cf\Smrf.sys.208
%PROGRAM_FILES%\ww2010cf\smrf.sys.w8
%PROGRAM_FILES%\ww2010cf\smrf.sys.w8_x64
%PROGRAM_FILES%\ww2010cf\Smrf.sys.w7_x64
%PROGRAM_FILES%\ww2010cf\Smrf.sys.w23
%PROGRAM_FILES%\ww2010cf\Smrf.sys.w7
%PROGRAM_FILES%\ww2010cf\wmTakeIM.dll
%PROGRAM_FILES%\ww2010cf\hulogin.dat
%PROGRAM_FILES%\ww2010cf\Presto.boot
<DRIVERS>\SET7.tmp
%WINDIR%\LastGood\TMP5.tmp
%WINDIR%\Temp\OLD6.tmp
%PROGRAM_FILES%\ww2010cf\Script.Log
%PROGRAM_FILES%\ww2010cf\DebugSentAsset.log
%PROGRAM_FILES%\ww2010cf\setup.txt
%PROGRAM_FILES%\ww2010cf\Presto.dom
%PROGRAM_FILES%\ww2010cf\DebugDiskAuth.log
%WINDIR%\inf\oem3.PNF
%PROGRAM_FILES%\ww2010cf\XceedCry.dll
<SYSTEM32>\HuRMS.exe
%PROGRAM_FILES%\ww2010cf\WN_DataBurner.exe
%PROGRAM_FILES%\ww2010cf\WNCall.exe
%PROGRAM_FILES%\ww2010cf\WNCall_GB.exe
<DRIVERS>\Smrf.sys
%WINDIR%\inf\oem3.inf
<DRIVERS>\Smrf.inf
%PROGRAM_FILES%\ww2010cf\Presto.RegDebug.dll
%WINDIR%\Debug\SMR\HuService\HuService_2014_06.log
%PROGRAM_FILES%\ww2010cf\smrf.inf.w8_x64
%PROGRAM_FILES%\ww2010cf\pc_s.dll
%PROGRAM_FILES%\ww2010cf\Pkwdcl.dll
%PROGRAM_FILES%\ww2010cf\PCInfo.exe
%PROGRAM_FILES%\ww2010cf\ntfsf6.inf.w2k
%PROGRAM_FILES%\ww2010cf\ntfsf6.sys.w2k
%PROGRAM_FILES%\ww2010cf\presto.reg
%PROGRAM_FILES%\ww2010cf\PTinfo_6.exe
%PROGRAM_FILES%\ww2010cf\Presto.opt
%PROGRAM_FILES%\ww2010cf\Presto.agn
%PROGRAM_FILES%\ww2010cf\presto.aip
%PROGRAM_FILES%\ww2010cf\ManualUpdate2011.exe
%PROGRAM_FILES%\ww2010cf\Hutcomm.dll
%PROGRAM_FILES%\ww2010cf\Huuacnt.dll
%PROGRAM_FILES%\ww2010cf\HuSK.exe
%PROGRAM_FILES%\ww2010cf\HuService.exe
%PROGRAM_FILES%\ww2010cf\HuService64.exe
%PROGRAM_FILES%\ww2010cf\install.dat
%PROGRAM_FILES%\ww2010cf\Interop.RocketDivision.StarBurnX.dll
%PROGRAM_FILES%\ww2010cf\Implode.dll
%PROGRAM_FILES%\ww2010cf\Huui.dll
%PROGRAM_FILES%\ww2010cf\HuWWin.exe
%PROGRAM_FILES%\ww2010cf\Reginfo.dat
%PROGRAM_FILES%\ww2010cf\smrf.inf.208_x64
%PROGRAM_FILES%\ww2010cf\smrf.inf.212_x64
%PROGRAM_FILES%\ww2010cf\Smrf.inf.208
%PROGRAM_FILES%\ww2010cf\smrf.cat.w8
%PROGRAM_FILES%\ww2010cf\smrf.cat.w8_x64
%PROGRAM_FILES%\ww2010cf\Smrf.inf.w7_x64
%PROGRAM_FILES%\ww2010cf\smrf.inf.w8
%PROGRAM_FILES%\ww2010cf\Smrf.inf.w7
%PROGRAM_FILES%\ww2010cf\Smrf.inf.vis
%PROGRAM_FILES%\ww2010cf\Smrf.inf.w23
%PROGRAM_FILES%\ww2010cf\Smrf.cat.w7_x64
%PROGRAM_FILES%\ww2010cf\SERVICES.exe
%PROGRAM_FILES%\ww2010cf\smr.ico
%PROGRAM_FILES%\ww2010cf\Senini.exe
%PROGRAM_FILES%\ww2010cf\SelfEncryption.exe
%PROGRAM_FILES%\ww2010cf\sendinfo.dat
%PROGRAM_FILES%\ww2010cf\smrf.cat.vis
%PROGRAM_FILES%\ww2010cf\smrf.cat.w7
%PROGRAM_FILES%\ww2010cf\smrf.cat.212_x64
%PROGRAM_FILES%\ww2010cf\smrf.cat.208
%PROGRAM_FILES%\ww2010cf\smrf.cat.208_x64
C:\temp\temp\rms.dll
C:\temp\temp\RMS_II(x64).exe
C:\temp\temp\Reginfo.dat
C:\temp\temp\presto.reg
C:\temp\temp\PTinfo_6.exe
C:\temp\temp\sendinfo.dat
C:\temp\temp\Senini.exe
C:\temp\temp\SelfEncryption.exe
C:\temp\temp\RMS_II(x86).exe
C:\temp\temp\RunManualUpdate2011.exe
C:\temp\temp\Presto.opt
C:\temp\temp\ntfsf6.inf.w2k
C:\temp\temp\ntfsf6.sys.w2k
C:\temp\temp\ManualUpdate2011_x64.exe
C:\temp\temp\Interop.RocketDivision.StarBurnX.dll
C:\temp\temp\ManualUpdate2011.exe
C:\temp\temp\Presto.agn
C:\temp\temp\presto.aip
C:\temp\temp\Pkwdcl.dll
C:\temp\temp\PCInfo.exe
C:\temp\temp\pc_s.dll
C:\temp\temp\sensetup.exe
C:\temp\temp\Smrf.inf.w23
C:\temp\temp\Smrf.inf.w7
C:\temp\temp\Smrf.inf.vis
C:\temp\temp\smrf.inf.208_x64
C:\temp\temp\smrf.inf.212_x64
C:\temp\temp\Smrf.inf.wxp
C:\temp\temp\Smrf.sys.208
C:\temp\temp\smrf.inf.w8_x64
C:\temp\temp\Smrf.inf.w7_x64
C:\temp\temp\smrf.inf.w8
C:\temp\temp\Smrf.inf.208
C:\temp\temp\smrf.cat.208_x64
C:\temp\temp\smrf.cat.212_x64
C:\temp\temp\smrf.cat.208
C:\temp\temp\SERVICES.exe
C:\temp\temp\smr.ico
C:\temp\temp\smrf.cat.w8
C:\temp\temp\smrf.cat.w8_x64
C:\temp\temp\Smrf.cat.w7_x64
C:\temp\temp\smrf.cat.vis
C:\temp\temp\smrf.cat.w7
C:\temp\temp\install.dat
C:\temp\temp\Hu2sys.exe
C:\temp\temp\HuCheck5.exe
C:\temp\temp\hu2res.dll
C:\temp\temp\Hu2hks.dll
C:\temp\temp\Hu2lib.dll
C:\temp\temp\HuEndeco.dll
C:\temp\temp\HuExec.exe
C:\temp\temp\huEncryption.exe
C:\temp\temp\Hudcomm.dll
C:\temp\temp\hudriver2.dll
C:\temp\temp\Hu2egn.dll
C:\temp\temp\dmidecode.exe
C:\temp\temp\FindFile.exe
C:\temp\temp\Connects\winwin\Wait for Call.cnn
C:\temp\temp\Connects\Wait for Call.cnn
C:\temp\temp\Connects\winwin\HU.INI
C:\temp\temp\HU.MUA
C:\temp\temp\Hu.ss
C:\temp\temp\hodll.dll
C:\temp\temp\GetInfo.dat
C:\temp\temp\GetPc_s.exe
C:\temp\temp\HuFindFL.exe
C:\temp\temp\HuService64.exe
C:\temp\temp\HuSK.exe
C:\temp\temp\HuService.exe
C:\temp\temp\HuRes2.dll
C:\temp\temp\hures2_GB.dll
C:\temp\temp\HuWWin.exe
C:\temp\temp\Implode.dll
C:\temp\temp\Huui.dll
C:\temp\temp\Hutcomm.dll
C:\temp\temp\Huuacnt.dll
C:\temp\temp\HuRes.dll
C:\temp\temp\HuInvenEx.dll
C:\temp\temp\hulib.dll
C:\temp\temp\huinven.dll
C:\temp\temp\Huft.dll
C:\temp\temp\hufwalk.dll
C:\temp\temp\HuNCommEx.exe
C:\temp\temp\HuREgn.dll
C:\temp\temp\Huncomm.dll
C:\temp\temp\Hulog.dll
C:\temp\temp\HuLogin.exe
C:\temp\temp\smrf.sys.208_x64
C:\temp\winet\HuREgn.dll
C:\temp\winet\HuRes.dll
C:\temp\winet\HuNCommEx.exe
C:\temp\winet\HuLogin.exe
C:\temp\winet\Huncomm.dll
C:\temp\winet\HuService64.exe
C:\temp\winet\HuSK.exe
C:\temp\winet\HuService.exe
C:\temp\winet\HuRes2.dll
C:\temp\winet\hures2_GB.dll
C:\temp\winet\Hulog.dll
C:\temp\winet\HuExec.exe
C:\temp\winet\HuFindFL.exe
C:\temp\winet\HuEndeco.dll
C:\temp\winet\hudriver2.dll
C:\temp\winet\huEncryption.exe
C:\temp\winet\HuInvenEx.dll
C:\temp\winet\hulib.dll
C:\temp\winet\huinven.dll
C:\temp\winet\Huft.dll
C:\temp\winet\hufwalk.dll
C:\temp\winet\Hutcomm.dll
C:\temp\winet\Presto.opt
C:\temp\winet\presto.reg
C:\temp\winet\presto.aip
C:\temp\winet\Pkwdcl.dll
C:\temp\winet\Presto.agn
C:\temp\winet\RMS_II(x86).exe
C:\temp\winet\SelfEncryption.exe
C:\temp\winet\RMS_II(x64).exe
C:\temp\winet\PTinfo_6.exe
C:\temp\winet\Reginfo.dat
C:\temp\winet\pc_s.dll
C:\temp\winet\Implode.dll
C:\temp\winet\install.dat
C:\temp\winet\HuWWin.exe
C:\temp\winet\Huuacnt.dll
C:\temp\winet\Huui.dll
C:\temp\winet\ntfsf6.sys.w2k
C:\temp\winet\PCInfo.exe
C:\temp\winet\ntfsf6.inf.w2k
C:\temp\winet\Interop.RocketDivision.StarBurnX.dll
C:\temp\winet\ManualUpdate2011.exe
C:\temp\winet\Hudcomm.dll
C:\temp\temp\wmLock.exe
C:\temp\temp\wmLookProc.dll
C:\temp\temp\wmAes.dll
C:\temp\temp\WaterMark.dll
C:\temp\temp\winet.ln_
C:\temp\temp\WNCall.exe
C:\temp\temp\WNCall_GB.exe
C:\temp\temp\wmTakeIM.dll
C:\temp\temp\wmLookProc64.dll
C:\temp\temp\wmTakeHttp.dll
C:\temp\temp\USB_SN.exe
C:\temp\temp\Smrf.sys.w7
C:\temp\temp\Smrf.sys.w7_x64
C:\temp\temp\Smrf.sys.w23
C:\temp\temp\smrf.sys.212_x64
C:\temp\temp\Smrf.sys.vis
C:\temp\temp\Starburnx86\StarBurn.dll
C:\temp\temp\Starburnx86\StarBurnX15.dll
C:\temp\temp\Smrf.sys.wxp
C:\temp\temp\smrf.sys.w8
C:\temp\temp\smrf.sys.w8_x64
C:\temp\temp\WN_DataBurner.exe
C:\temp\winet\Hu.ss
C:\temp\winet\Hu2egn.dll
C:\temp\winet\HU.MUA
C:\temp\winet\GetPc_s.exe
C:\temp\winet\hodll.dll
C:\temp\winet\Hu2sys.exe
C:\temp\winet\HuCheck5.exe
C:\temp\winet\hu2res.dll
C:\temp\winet\Hu2hks.dll
C:\temp\winet\Hu2lib.dll
C:\temp\winet\GetInfo.dat
%TEMP%\aut1.tmp
%TEMP%\5f6d5g9gg5er9g3h5uj4e6sjh6u22i4t6\rms2.exe
C:\temp\wwnew.ver
C:\temp\temp\XceedCry.dll
C:\temp\2014_06_11(CRNJEUFU)_ManualUpdate2011.log
C:\temp\winet\dmidecode.exe
C:\temp\winet\FindFile.exe
<SYSTEM32>\pcinfo.exe
%WINDIR%\Debug\SMR\RMSLog\20140611.log
%TEMP%\aut2.tmp

Удаляет следующие файлы:

C:\temp\winet\HuRes.dll
C:\temp\winet\HuREgn.dll
C:\temp\winet\HuNCommEx.exe
C:\temp\winet\HuRes2.dll
C:\temp\winet\HuService.exe
C:\temp\winet\HuRMS.exe
C:\temp\winet\hures2_GB.dll
C:\temp\winet\HuInvenEx.dll
C:\temp\winet\huinven.dll
C:\temp\winet\hufwalk.dll
C:\temp\winet\hulib.dll
C:\temp\winet\Huncomm.dll
C:\temp\winet\HuLogin.exe
C:\temp\winet\Hulog.dll
C:\temp\winet\ManualUpdate2011.exe
C:\temp\winet\Interop.RocketDivision.StarBurnX.dll
C:\temp\winet\install.dat
C:\temp\winet\ntfsf6.inf.w2k
C:\temp\winet\pc_s.dll
C:\temp\winet\PCInfo.exe
C:\temp\winet\ntfsf6.sys.w2k
C:\temp\winet\Hutcomm.dll
C:\temp\winet\HuSK.exe
C:\temp\winet\HuService64.exe
C:\temp\winet\Huuacnt.dll
C:\temp\winet\Implode.dll
C:\temp\winet\HuWWin.exe
C:\temp\winet\Huui.dll
C:\temp\winet\FindFile.exe
C:\temp\winet\dmidecode.exe
C:\temp\winet\Connects\winwin\Wait for Call.cnn
C:\temp\winet\GetInfo.dat
C:\temp\winet\HU.MUA
C:\temp\winet\hodll.dll
C:\temp\winet\GetPc_s.exe
C:\temp\winet\RMS_II(x64).exe
C:\temp\winet\RMS_II(x86).exe
C:\temp\temp\XceedCry.dll
<DRIVERS>\Smrf.sys
C:\temp\winet\Connects\winwin\HU.INI
C:\temp\winet\Connects\Wait for Call.cnn
%WINDIR%\Temp\OLD6.tmp
C:\temp\winet\huEncryption.exe
C:\temp\winet\hudriver2.dll
C:\temp\winet\Hudcomm.dll
C:\temp\winet\HuEndeco.dll
C:\temp\winet\Huft.dll
C:\temp\winet\HuFindFL.exe
C:\temp\winet\HuExec.exe
C:\temp\winet\Hu2hks.dll
C:\temp\winet\Hu2egn.dll
C:\temp\winet\Hu.ss
C:\temp\winet\Hu2lib.dll
C:\temp\winet\HuCheck5.exe
C:\temp\winet\Hu2sys.exe
C:\temp\winet\hu2res.dll
C:\temp\winet\Pkwdcl.dll
C:\temp\winet\smrf.sys.w8
C:\temp\winet\Smrf.sys.w7_x64
C:\temp\winet\Smrf.sys.w7
C:\temp\winet\smrf.sys.w8_x64
C:\temp\winet\Starburnx86\StarBurnX15.dll
C:\temp\winet\Starburnx86\StarBurn.dll
C:\temp\winet\Smrf.sys.wxp
C:\temp\winet\Smrf.sys.208
C:\temp\winet\Smrf.inf.wxp
C:\temp\winet\smrf.inf.w8_x64
C:\temp\winet\smrf.sys.208_x64
C:\temp\winet\Smrf.sys.w23
C:\temp\winet\Smrf.sys.vis
C:\temp\winet\smrf.sys.212_x64
C:\temp\winet\WNCall.exe
C:\temp\winet\wmTakeIM.dll
C:\temp\winet\wmTakeHttp.dll
C:\temp\winet\WNCall_GB.exe
C:\temp\wwnew.ver
C:\temp\winet\XceedCry.dll
C:\temp\winet\WN_DataBurner.exe
C:\temp\winet\winet.ln_
C:\temp\winet\WaterMark.dll
C:\temp\winet\USB_SN.exe
C:\temp\winet\wmAes.dll
C:\temp\winet\wmLookProc64.dll
C:\temp\winet\wmLookProc.dll
C:\temp\winet\wmLock.exe
C:\temp\winet\sensetup.exe
C:\temp\winet\Senini.exe
C:\temp\winet\sendinfo.dat
C:\temp\winet\SERVICES.exe
C:\temp\winet\smrf.cat.208_x64
C:\temp\winet\smrf.cat.208
C:\temp\winet\smr.ico
C:\temp\winet\Presto.opt
C:\temp\winet\presto.aip
C:\temp\winet\Presto.agn
C:\temp\winet\presto.reg
C:\temp\winet\SelfEncryption.exe
C:\temp\winet\Reginfo.dat
C:\temp\winet\PTinfo_6.exe
C:\temp\winet\Smrf.inf.vis
C:\temp\winet\smrf.inf.212_x64
C:\temp\winet\smrf.inf.208_x64
C:\temp\winet\Smrf.inf.w23
C:\temp\winet\smrf.inf.w8
C:\temp\winet\Smrf.inf.w7_x64
C:\temp\winet\Smrf.inf.w7
C:\temp\winet\smrf.cat.w7
C:\temp\winet\smrf.cat.vis
C:\temp\winet\smrf.cat.212_x64
C:\temp\winet\Smrf.cat.w7_x64
C:\temp\winet\Smrf.inf.208
C:\temp\winet\smrf.cat.w8_x64
C:\temp\winet\smrf.cat.w8
C:\temp\temp\HuREgn.dll
C:\temp\temp\HuNCommEx.exe
C:\temp\temp\Huncomm.dll
C:\temp\temp\HuRes.dll
C:\temp\temp\HuService.exe
C:\temp\temp\hures2_GB.dll
C:\temp\temp\HuRes2.dll
C:\temp\temp\huinven.dll
C:\temp\temp\hufwalk.dll
C:\temp\temp\Huft.dll
C:\temp\temp\HuInvenEx.dll
C:\temp\temp\HuLogin.exe
C:\temp\temp\Hulog.dll
C:\temp\temp\hulib.dll
C:\temp\temp\ManualUpdate2011.exe
C:\temp\temp\Interop.RocketDivision.StarBurnX.dll
C:\temp\temp\install.dat
C:\temp\temp\ntfsf6.inf.w2k
C:\temp\temp\pc_s.dll
C:\temp\temp\PCInfo.exe
C:\temp\temp\ntfsf6.sys.w2k
C:\temp\temp\Hutcomm.dll
C:\temp\temp\HuSK.exe
C:\temp\temp\HuService64.exe
C:\temp\temp\Huuacnt.dll
C:\temp\temp\Implode.dll
C:\temp\temp\HuWWin.exe
C:\temp\temp\Huui.dll
C:\temp\temp\dmidecode.exe
C:\temp\temp\Connects\winwin\Wait for Call.cnn
C:\temp\temp\Connects\winwin\HU.INI
C:\temp\temp\FindFile.exe
C:\temp\temp\hodll.dll
C:\temp\temp\GetPc_s.exe
C:\temp\temp\GetInfo.dat
%TEMP%\5f6d5g9gg5er9g3h5uj4e6sjh6u22i4t6\rms2.exe
%TEMP%\aut2.tmp
%TEMP%\aut1.tmp
C:\temp\temp\rms.dll
C:\temp\temp\Connects\Wait for Call.cnn
C:\temp\temp\ManualUpdate2011_x64.exe
C:\temp\temp\RunManualUpdate2011.exe
C:\temp\temp\hudriver2.dll
C:\temp\temp\Hudcomm.dll
C:\temp\temp\HuCheck5.exe
C:\temp\temp\huEncryption.exe
C:\temp\temp\HuFindFL.exe
C:\temp\temp\HuExec.exe
C:\temp\temp\HuEndeco.dll
C:\temp\temp\Hu2egn.dll
C:\temp\temp\Hu.ss
C:\temp\temp\HU.MUA
C:\temp\temp\Hu2hks.dll
C:\temp\temp\Hu2sys.exe
C:\temp\temp\hu2res.dll
C:\temp\temp\Hu2lib.dll
C:\temp\temp\Pkwdcl.dll
C:\temp\temp\Smrf.sys.w7
C:\temp\temp\Smrf.sys.w23
C:\temp\temp\Smrf.sys.vis
C:\temp\temp\Smrf.sys.w7_x64
C:\temp\temp\Smrf.sys.wxp
C:\temp\temp\smrf.sys.w8_x64
C:\temp\temp\smrf.sys.w8
C:\temp\temp\smrf.inf.w8_x64
C:\temp\temp\smrf.inf.w8
C:\temp\temp\Smrf.inf.w7_x64
C:\temp\temp\Smrf.inf.wxp
C:\temp\temp\smrf.sys.212_x64
C:\temp\temp\smrf.sys.208_x64
C:\temp\temp\Smrf.sys.208
C:\temp\temp\wmTakeHttp.dll
C:\temp\temp\wmLookProc64.dll
C:\temp\temp\wmLookProc.dll
C:\temp\temp\wmTakeIM.dll
C:\temp\temp\WN_DataBurner.exe
C:\temp\temp\WNCall_GB.exe
C:\temp\temp\WNCall.exe
C:\temp\temp\USB_SN.exe
C:\temp\temp\Starburnx86\StarBurnX15.dll
C:\temp\temp\Starburnx86\StarBurn.dll
C:\temp\temp\WaterMark.dll
C:\temp\temp\wmLock.exe
C:\temp\temp\wmAes.dll
C:\temp\temp\winet.ln_
C:\temp\temp\sendinfo.dat
C:\temp\temp\SelfEncryption.exe
C:\temp\temp\RMS_II(x86).exe
C:\temp\temp\Senini.exe
C:\temp\temp\smr.ico
C:\temp\temp\SERVICES.exe
C:\temp\temp\sensetup.exe
C:\temp\temp\Presto.opt
C:\temp\temp\presto.aip
C:\temp\temp\Presto.agn
C:\temp\temp\presto.reg
C:\temp\temp\RMS_II(x64).exe
C:\temp\temp\Reginfo.dat
C:\temp\temp\PTinfo_6.exe
C:\temp\temp\smrf.inf.208_x64
C:\temp\temp\Smrf.inf.208
C:\temp\temp\smrf.cat.w8_x64
C:\temp\temp\smrf.inf.212_x64
C:\temp\temp\Smrf.inf.w7
C:\temp\temp\Smrf.inf.w23
C:\temp\temp\Smrf.inf.vis
C:\temp\temp\smrf.cat.212_x64
C:\temp\temp\smrf.cat.208_x64
C:\temp\temp\smrf.cat.208
C:\temp\temp\smrf.cat.vis
C:\temp\temp\smrf.cat.w8
C:\temp\temp\Smrf.cat.w7_x64
C:\temp\temp\smrf.cat.w7

Перемещает следующие файлы:

<DRIVERS>\SET7.tmp в <DRIVERS>\Smrf.sys
%WINDIR%\LastGood\TMP5.tmp в %WINDIR%\LastGood\system32\DRIVERS\Smrf.sys

Другое:

Ищет следующие окна:

ClassName: 'SENSETUP' WindowName: '(null)'
ClassName: 'Win-Win 32 Launcher Class' WindowName: 'Win-Win 32 Launcher'
ClassName: '(null)' WindowName: 'SMR_SK'
ClassName: '(null)' WindowName: 'SMR_PT'
ClassName: '(null)' WindowName: 'SMR_HuNCommEx'
ClassName: 'Invenlib Window' WindowName: 'Presto'
ClassName: 'Invenlib Window' WindowName: 'WinMaster'
ClassName: 'SMR_WINMASTER_MISC' WindowName: '(null)'
ClassName: 'SMR_USB_SN' WindowName: '(null)'
ClassName: 'Progman' WindowName: 'Program Manager'
ClassName: '(null)' WindowName: 'SMR_CDinfo_V'
ClassName: 'SMR_HUEXEC' WindowName: '(null)'
ClassName: 'Win-Win 32 Commander Class' WindowName: '(null)'
ClassName: 'RMS_II' WindowName: '(null)'
ClassName: 'EDIT' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: '(null)' WindowName: 'SMR_WINMASTER_MISC'
ClassName: '(null)' WindowName: 'SMR_USB_SN'
ClassName: 'SMR_HULOGIN' WindowName: '(null)'
ClassName: 'Win-Win 32 Commander Class6' WindowName: '(null)'
ClassName: '(null)' WindowName: 'SMR_CDINFO'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней