Trojan.KillFiles.23701

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\wbem\wmiadap.exe' /R /T
'<SYSTEM32>\cmd.exe' /c system.bat

Изменения в файловой системе:

Создает следующие файлы:

C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
<Текущая директория>\system.bat

Удаляет следующие файлы:

<SYSTEM32>\logman.exe
<SYSTEM32>\logagent.exe
<SYSTEM32>\logoff.exe
<SYSTEM32>\lpq.exe
<SYSTEM32>\logonui.exe
<SYSTEM32>\lights.exe
<SYSTEM32>\label.exe
<SYSTEM32>\lnkstub.exe
<SYSTEM32>\lodctr.exe
<SYSTEM32>\locator.exe
<SYSTEM32>\lpr.exe
<SYSTEM32>\mnmsrvc.exe
<SYSTEM32>\mmc.exe
<SYSTEM32>\mobsync.exe
<SYSTEM32>\mplay32.exe
<SYSTEM32>\mountvol.exe
<SYSTEM32>\magnify.exe
<SYSTEM32>\lsass.exe
<SYSTEM32>\makecab.exe
<SYSTEM32>\migpwd.exe
<SYSTEM32>\mem.exe
<SYSTEM32>\getmac.exe
<SYSTEM32>\gdi.exe
<SYSTEM32>\gpresult.exe
<SYSTEM32>\grpconv.exe
<SYSTEM32>\gpupdate.exe
<SYSTEM32>\freecell.exe
<SYSTEM32>\forcedos.exe
<SYSTEM32>\fsquirt.exe
<SYSTEM32>\ftp.exe
<SYSTEM32>\fsutil.exe
<SYSTEM32>\help.exe
<SYSTEM32>\ipsec6.exe
<SYSTEM32>\ipconfig.exe
<SYSTEM32>\ipv6.exe
<SYSTEM32>\krnl386.exe
<SYSTEM32>\ipxroute.exe
<SYSTEM32>\icardagt.exe
<SYSTEM32>\hostname.exe
<SYSTEM32>\ie4uinit.exe
<SYSTEM32>\imapi.exe
<SYSTEM32>\iexpress.exe
<SYSTEM32>\mpnotify.exe
<SYSTEM32>\ntkrnlpa.exe
<SYSTEM32>\ntbackup.exe
<SYSTEM32>\ntoskrnl.exe
<SYSTEM32>\ntvdm.exe
<SYSTEM32>\ntsd.exe
<SYSTEM32>\netstat.exe
<SYSTEM32>\netsh.exe
<SYSTEM32>\nlsfunc.exe
<SYSTEM32>\nslookup.exe
<SYSTEM32>\notepad.exe
<SYSTEM32>\nw16.exe
<SYSTEM32>\packager.exe
<SYSTEM32>\osuninst.exe
<SYSTEM32>\pathping.exe
<SYSTEM32>\perfmon.exe
<SYSTEM32>\pentnt.exe
<SYSTEM32>\odbcad32.exe
<SYSTEM32>\nwscript.exe
<SYSTEM32>\odbcconf.exe
<SYSTEM32>\osk.exe
<SYSTEM32>\openfiles.exe
<SYSTEM32>\msg.exe
<SYSTEM32>\msdtc.exe
<SYSTEM32>\mshearts.exe
<SYSTEM32>\msiexec.exe
<SYSTEM32>\mshta.exe
<SYSTEM32>\mqsvc.exe
<SYSTEM32>\mqbkup.exe
<SYSTEM32>\mqtgsvc.exe
<SYSTEM32>\mscdexnt.exe
<SYSTEM32>\mrinfo.exe
<SYSTEM32>\mspaint.exe
<SYSTEM32>\net.exe
<SYSTEM32>\nddeapir.exe
<SYSTEM32>\net1.exe
<SYSTEM32>\netsetup.exe
<SYSTEM32>\netdde.exe
<SYSTEM32>\mstinit.exe
<SYSTEM32>\msswchx.exe
<SYSTEM32>\mstsc.exe
<SYSTEM32>\nbtstat.exe
<SYSTEM32>\narrator.exe
<SYSTEM32>\cleanmgr.exe
<SYSTEM32>\ckcnv.exe
<SYSTEM32>\cliconfg.exe
<SYSTEM32>\clipsrv.exe
<SYSTEM32>\clipbrd.exe
<SYSTEM32>\chkntfs.exe
<SYSTEM32>\chkdsk.exe
<SYSTEM32>\cidaemon.exe
<SYSTEM32>\cisvc.exe
<SYSTEM32>\cipher.exe
<SYSTEM32>\cmd.exe
<SYSTEM32>\control.exe
<SYSTEM32>\conime.exe
<SYSTEM32>\convert.exe
<SYSTEM32>\ctfmon.exe
<SYSTEM32>\csrss.exe
<SYSTEM32>\cmmon32.exe
<SYSTEM32>\cmdl32.exe
<SYSTEM32>\cmstp.exe
<SYSTEM32>\compact.exe
<SYSTEM32>\comp.exe
<SYSTEM32>\at.exe
<SYSTEM32>\asr_pfu.exe
<SYSTEM32>\atmadm.exe
<SYSTEM32>\auditusr.exe
<SYSTEM32>\attrib.exe
<SYSTEM32>\append.exe
<SYSTEM32>\alg.exe
<SYSTEM32>\arp.exe
<SYSTEM32>\asr_ldm.exe
<SYSTEM32>\asr_fmt.exe
<SYSTEM32>\autochk.exe
<SYSTEM32>\bootvrfy.exe
<SYSTEM32>\bootok.exe
<SYSTEM32>\cacls.exe
<SYSTEM32>\charmap.exe
<SYSTEM32>\calc.exe
<SYSTEM32>\autofmt.exe
<SYSTEM32>\autoconv.exe
<SYSTEM32>\autolfn.exe
<SYSTEM32>\bootcfg.exe
<SYSTEM32>\blastcln.exe
<SYSTEM32>\dcomcnfg.exe
<SYSTEM32>\eudcedit.exe
<SYSTEM32>\esentutl.exe
<SYSTEM32>\eventcreate.exe
<SYSTEM32>\eventvwr.exe
<SYSTEM32>\eventtriggers.exe
<SYSTEM32>\dvdupgrd.exe
<SYSTEM32>\dvdplay.exe
<SYSTEM32>\dwwin.exe
<SYSTEM32>\edlin.exe
<SYSTEM32>\dxdiag.exe
<SYSTEM32>\exe2bin.exe
<SYSTEM32>\finger.exe
<SYSTEM32>\findstr.exe
<SYSTEM32>\fixmapi.exe
<SYSTEM32>\fontview.exe
<SYSTEM32>\fltMc.exe
<SYSTEM32>\extrac32.exe
<SYSTEM32>\expand.exe
<SYSTEM32>\fastopen.exe
<SYSTEM32>\find.exe
<SYSTEM32>\fc.exe
<SYSTEM32>\diskpart.exe
<SYSTEM32>\diantz.exe
<SYSTEM32>\diskperf.exe
<SYSTEM32>\dllhst3g.exe
<SYSTEM32>\dllhost.exe
<SYSTEM32>\debug.exe
<SYSTEM32>\ddeshare.exe
<SYSTEM32>\defrag.exe
<SYSTEM32>\dfrgntfs.exe
<SYSTEM32>\dfrgfat.exe
<SYSTEM32>\dmadmin.exe
<SYSTEM32>\driverquery.exe
<SYSTEM32>\dpvsetup.exe
<SYSTEM32>\drwatson.exe
<SYSTEM32>\dumprep.exe
<SYSTEM32>\drwtsn32.exe
<SYSTEM32>\doskey.exe
<SYSTEM32>\dmremote.exe
<SYSTEM32>\dosx.exe
<SYSTEM32>\dpnsvr.exe
<SYSTEM32>\dplaysvr.exe
<SYSTEM32>\ping.exe
<SYSTEM32>\usrprbda.exe
<SYSTEM32>\usrmlnka.exe
<SYSTEM32>\usrshuta.exe
<SYSTEM32>\verifier.exe
<SYSTEM32>\utilman.exe
<SYSTEM32>\upnpcont.exe
<SYSTEM32>\unlodctr.exe
<SYSTEM32>\ups.exe
<SYSTEM32>\userinit.exe
<SYSTEM32>\user.exe
<SYSTEM32>\vssadmin.exe
<SYSTEM32>\winhlp32.exe
<SYSTEM32>\winchat.exe
<SYSTEM32>\winlogon.exe
<SYSTEM32>\winmsd.exe
<SYSTEM32>\winmine.exe
<SYSTEM32>\vwipxspx.exe
<SYSTEM32>\vssvc.exe
<SYSTEM32>\w32tm.exe
<SYSTEM32>\wiaacmgr.exe
<SYSTEM32>\wextract.exe
<SYSTEM32>\tftp.exe
<SYSTEM32>\telnet.exe
<SYSTEM32>\tlntadmn.exe
<SYSTEM32>\tlntsvr.exe
<SYSTEM32>\tlntsess.exe
<SYSTEM32>\taskman.exe
<SYSTEM32>\tasklist.exe
<SYSTEM32>\taskmgr.exe
<SYSTEM32>\tcpsvcs.exe
<SYSTEM32>\tcmsetup.exe
<SYSTEM32>\tourstart.exe
<SYSTEM32>\tskill.exe
<SYSTEM32>\tsdiscon.exe
<SYSTEM32>\tsshutdn.exe
<SYSTEM32>\typeperf.exe
<SYSTEM32>\TsWpfWrp.exe
<SYSTEM32>\tracert.exe
<SYSTEM32>\tracerpt.exe
<SYSTEM32>\tracert6.exe
<SYSTEM32>\tscupgrd.exe
<SYSTEM32>\tscon.exe
<SYSTEM32>\winspool.exe
<SYSTEM32>\dllcache\attrib.exe
<SYSTEM32>\dllcache\atmadm.exe
<SYSTEM32>\dllcache\auditusr.exe
<SYSTEM32>\dllcache\autochk.exe
<SYSTEM32>\dllcache\author.exe
<SYSTEM32>\dllcache\asr_fmt.exe
<SYSTEM32>\dllcache\arp.exe
<SYSTEM32>\dllcache\asr_ldm.exe
<SYSTEM32>\dllcache\at.exe
<SYSTEM32>\dllcache\asr_pfu.exe
<SYSTEM32>\dllcache\autoconv.exe
<SYSTEM32>\dllcache\bootvrfy.exe
<SYSTEM32>\dllcache\bootok.exe
<SYSTEM32>\dllcache\cacls.exe
<SYSTEM32>\dllcache\cb32.exe
<SYSTEM32>\dllcache\calc.exe
<SYSTEM32>\dllcache\autolfn.exe
<SYSTEM32>\dllcache\autofmt.exe
<SYSTEM32>\dllcache\bckgzm.exe
<SYSTEM32>\dllcache\bootcfg.exe
<SYSTEM32>\dllcache\blastcln.exe
<SYSTEM32>\wscntfy.exe
<SYSTEM32>\write.exe
<SYSTEM32>\wscript.exe
<SYSTEM32>\wuauclt1.exe
<SYSTEM32>\wuauclt.exe
<SYSTEM32>\wowdeb.exe
<SYSTEM32>\winver.exe
<SYSTEM32>\wowexec.exe
<SYSTEM32>\wpnpinst.exe
<SYSTEM32>\wpabaln.exe
<SYSTEM32>\wupdmgr.exe
<SYSTEM32>\dllcache\agentsvr.exe
<SYSTEM32>\dllcache\admin.exe
<SYSTEM32>\dllcache\ahui.exe
<SYSTEM32>\dllcache\append.exe
<SYSTEM32>\dllcache\alg.exe
<SYSTEM32>\Com\comrepl.exe
<SYSTEM32>\xcopy.exe
<SYSTEM32>\Com\comrereg.exe
<SYSTEM32>\dllcache\actmovie.exe
<SYSTEM32>\dllcache\accwiz.exe
<SYSTEM32>\reset.exe
<SYSTEM32>\replace.exe
<SYSTEM32>\rexec.exe
<SYSTEM32>\routemon.exe
<SYSTEM32>\route.exe
<SYSTEM32>\regini.exe
<SYSTEM32>\regedt32.exe
<SYSTEM32>\regsvr32.exe
<SYSTEM32>\relog.exe
<SYSTEM32>\regwiz.exe
<SYSTEM32>\rsh.exe
<SYSTEM32>\rtcshare.exe
<SYSTEM32>\rsvp.exe
<SYSTEM32>\runas.exe
<SYSTEM32>\runonce.exe
<SYSTEM32>\rundll32.exe
<SYSTEM32>\rsmsink.exe
<SYSTEM32>\rsm.exe
<SYSTEM32>\rsmui.exe
<SYSTEM32>\rsopprov.exe
<SYSTEM32>\rsnotify.exe
<SYSTEM32>\proxycfg.exe
<SYSTEM32>\proquota.exe
<SYSTEM32>\qappsrv.exe
<SYSTEM32>\qwinsta.exe
<SYSTEM32>\qprocess.exe
<SYSTEM32>\powercfg.exe
<SYSTEM32>\ping6.exe
<SYSTEM32>\PresentationHost.exe
<SYSTEM32>\progman.exe
<SYSTEM32>\print.exe
<SYSTEM32>\rasautou.exe
<SYSTEM32>\rdshost.exe
<SYSTEM32>\rdsaddin.exe
<SYSTEM32>\recover.exe
<SYSTEM32>\reg.exe
<SYSTEM32>\redir.exe
<SYSTEM32>\rasphone.exe
<SYSTEM32>\rasdial.exe
<SYSTEM32>\rcimlby.exe
<SYSTEM32>\rdpclip.exe
<SYSTEM32>\rcp.exe
<SYSTEM32>\rwinsta.exe
<SYSTEM32>\spiisupd.exe
<SYSTEM32>\spider.exe
<SYSTEM32>\spnpinst.exe
<SYSTEM32>\sprestrt.exe
<SYSTEM32>\spoolsv.exe
<SYSTEM32>\sndrec32.exe
<SYSTEM32>\smss.exe
<SYSTEM32>\sndvol32.exe
<SYSTEM32>\sort.exe
<SYSTEM32>\sol.exe
<SYSTEM32>\spupdsvc.exe
<SYSTEM32>\sysocmgr.exe
<SYSTEM32>\syskey.exe
<SYSTEM32>\systeminfo.exe
<SYSTEM32>\taskkill.exe
<SYSTEM32>\systray.exe
<SYSTEM32>\subst.exe
<SYSTEM32>\stimon.exe
<SYSTEM32>\svchost.exe
<SYSTEM32>\sysedit.exe
<SYSTEM32>\syncapp.exe
<SYSTEM32>\services.exe
<SYSTEM32>\secedit.exe
<SYSTEM32>\sessmgr.exe
<SYSTEM32>\setup.exe
<SYSTEM32>\sethc.exe
<SYSTEM32>\sc.exe
<SYSTEM32>\savedump.exe
<SYSTEM32>\scardsvr.exe
<SYSTEM32>\sdbinst.exe
<SYSTEM32>\schtasks.exe
<SYSTEM32>\setver.exe
<SYSTEM32>\sigverif.exe
<SYSTEM32>\shutdown.exe
<SYSTEM32>\skeys.exe
<SYSTEM32>\smlogsvc.exe
<SYSTEM32>\smbinst.exe
<SYSTEM32>\shadow.exe
<SYSTEM32>\sfc.exe
<SYSTEM32>\share.exe
<SYSTEM32>\shrpubw.exe
<SYSTEM32>\shmgrate.exe
<SYSTEM32>\ahui.exe
<SYSTEM32>\oobe\images\newbtm8.jpg
<SYSTEM32>\oobe\images\newbtm1.jpg
<SYSTEM32>\oobe\images\newmark1.jpg
<SYSTEM32>\oobe\images\newtop1.jpg
<SYSTEM32>\oobe\images\newmark8.jpg
<SYSTEM32>\oobe\images\backoff.jpg
<SYSTEM32>\oobe\images\backdown.jpg
<SYSTEM32>\oobe\images\backover.jpg
<SYSTEM32>\oobe\images\mslogo.jpg
<SYSTEM32>\oobe\images\backup.jpg
<SYSTEM32>\oobe\images\newtop8.jpg
<SYSTEM32>\oobe\images\skipoff.jpg
<SYSTEM32>\oobe\images\skipdown.jpg
<SYSTEM32>\oobe\images\skipover.jpg
<SYSTEM32>\oobe\images\wpaback.jpg
<SYSTEM32>\oobe\images\skipup.jpg
<SYSTEM32>\oobe\images\nextoff.jpg
<SYSTEM32>\oobe\images\nextdown.jpg
<SYSTEM32>\oobe\images\nextover.jpg
<SYSTEM32>\oobe\images\oemcoa.jpg
<SYSTEM32>\oobe\images\nextup.jpg
<SYSTEM32>\oobe\html\mouse\images\bulzanom.jpg
<SYSTEM32>\oobe\html\mouse\images\bulzano.jpg
<SYSTEM32>\oobe\html\mouse\images\heidelb.jpg
<SYSTEM32>\oobe\html\mouse\images\paris.jpg
<SYSTEM32>\oobe\html\mouse\images\heidelbm.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\greendot.jpg
%WINDIR%\pchealth\helpctr\System\DVDUpgrd\stripe.jpg
<SYSTEM32>\oobe\html\mouse\images\parism.jpg
<SYSTEM32>\oobe\html\mouse\images\venice.jpg
<SYSTEM32>\oobe\html\mouse\images\tyrolm.jpg
<SYSTEM32>\oobe\html\mouse\images\venicem.jpg
<SYSTEM32>\oobe\html\mouse\images\veronam.jpg
<SYSTEM32>\oobe\html\mouse\images\verona.jpg
<SYSTEM32>\oobe\html\mouse\images\pisam.jpg
<SYSTEM32>\oobe\html\mouse\images\pisa.jpg
<SYSTEM32>\oobe\html\mouse\images\prague.jpg
<SYSTEM32>\oobe\html\mouse\images\tyrol.jpg
<SYSTEM32>\oobe\html\mouse\images\praguem.jpg
<SYSTEM32>\oobe\images\wpabtm.jpg
%WINDIR%\Gone Fishing.bmp
%WINDIR%\FeatherTexture.bmp
%WINDIR%\Greenstone.bmp
%WINDIR%\Rhododendron.bmp
%WINDIR%\Prairie Wind.bmp
<SYSTEM32>\config\systemprofile\Templates\excel.xls
%WINDIR%\Web\Wallpaper\Windows XP.jpg
<SYSTEM32>\config\systemprofile\Templates\excel4.xls
%WINDIR%\Coffee Bean.bmp
%WINDIR%\Blue Lace 16.bmp
%WINDIR%\River Sumida.bmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\watermark.bmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SplashScreen.bmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\header.bmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\watermark.bmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SplashScreen.bmp
%WINDIR%\Soap Bubbles.bmp
%WINDIR%\Santa Fe Stucco.bmp
%WINDIR%\Zapotec.bmp
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\header.bmp
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\logo.bmp
%WINDIR%\Web\Wallpaper\Crystal.jpg
%WINDIR%\Web\Wallpaper\Azul.jpg
%WINDIR%\Web\Wallpaper\Follow.jpg
%WINDIR%\Web\Wallpaper\Home.jpg
%WINDIR%\Web\Wallpaper\Friend.jpg
<SYSTEM32>\oobe\images\wpakey.jpg
<SYSTEM32>\oobe\images\wpaflag.jpg
<SYSTEM32>\oobe\images\wpatop.jpg
%WINDIR%\Web\Wallpaper\Autumn.jpg
%WINDIR%\Web\Wallpaper\Ascent.jpg
%WINDIR%\Web\Wallpaper\Moon flower.jpg
%WINDIR%\Web\Wallpaper\Stonehenge.jpg
%WINDIR%\Web\Wallpaper\Ripple.jpg
%WINDIR%\Web\Wallpaper\Tulips.jpg
%WINDIR%\Web\Wallpaper\Wind.jpg
%WINDIR%\Web\Wallpaper\Vortec space.jpg
%WINDIR%\Web\Wallpaper\Power.jpg
%WINDIR%\Web\Wallpaper\Peace.jpg
%WINDIR%\Web\Wallpaper\Purple flower.jpg
%WINDIR%\Web\Wallpaper\Red moon desert.jpg
%WINDIR%\Web\Wallpaper\Radiance.jpg
%WINDIR%\Help\Tours\htmlTour\gradient.jpg
%WINDIR%\Help\Tours\htmlTour\folder_up.jpg
%WINDIR%\Help\Tours\htmlTour\icon_up.jpg
%WINDIR%\Help\Tours\htmlTour\img014.jpg
%WINDIR%\Help\Tours\htmlTour\img004b.jpg
%WINDIR%\Help\Tours\htmlTour\control_up.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg
%WINDIR%\Help\Tours\htmlTour\end_up.jpg
%WINDIR%\Help\Tours\htmlTour\desktop_up.jpg
%WINDIR%\Help\Tours\htmlTour\img033.jpg
%WINDIR%\Help\Tours\htmlTour\img072.jpg
%WINDIR%\Help\Tours\htmlTour\img068.jpg
%WINDIR%\Help\Tours\htmlTour\img074a.jpg
%WINDIR%\Help\Tours\htmlTour\img100.jpg
%WINDIR%\Help\Tours\htmlTour\img089.jpg
%WINDIR%\Help\Tours\htmlTour\img034.jpg
%WINDIR%\Help\Tours\htmlTour\img033a.jpg
%WINDIR%\Help\Tours\htmlTour\img040.jpg
%WINDIR%\Help\Tours\htmlTour\img060.jpg
%WINDIR%\Help\Tours\htmlTour\img046.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_road.jpg
%TEMP%\~DF4198.tmp
%WINDIR%\Help\Tours\htmlTour\best_road_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust.jpg
%WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data.jpg
%WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_networks.jpg
%WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg
%WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg
%WINDIR%\Help\Tours\htmlTour\img103.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_optimized_big.jpg
%WINDIR%\Help\Tours\htmlTour\start_up.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\taskbar_up.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_built.jpg
%WINDIR%\Help\Tours\htmlTour\ul_logo.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg
%WINDIR%\Help\Tours\htmlTour\window_up.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
%WINDIR%\Help\Tours\htmlTour\img136.jpg
%WINDIR%\Help\Tours\htmlTour\img126.jpg
%WINDIR%\Help\Tours\htmlTour\img149.jpg
%WINDIR%\Help\Tours\htmlTour\logo.jpg
%WINDIR%\Help\Tours\htmlTour\intro_logo.jpg
%WINDIR%\Help\Tours\htmlTour\img110.jpg
%WINDIR%\Help\Tours\htmlTour\img109.jpg
%WINDIR%\Help\Tours\htmlTour\img116.jpg
%WINDIR%\Help\Tours\htmlTour\img123.jpg
%WINDIR%\Help\Tours\htmlTour\img121.jpg
%WINDIR%\Help\Tours\htmlTour\pen_icon.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster.jpg
%WINDIR%\Help\Tours\htmlTour\read_icon.jpg
%WINDIR%\Help\Tours\htmlTour\question_icon.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_better.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg
%WINDIR%\pchealth\helpctr\System\blurbs\watermark_300x.bmp
%WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\AddInProcess32.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\csc.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\AddInUtil.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\PerformanceCounterInstaller.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\MSBuild.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\EdmGen.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\vbc.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\DeleteTemp.exe
%WINDIR%\Microsoft.NET\Framework\v3.5\WFServicesReg.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
%WINDIR%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\jsc.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ngen.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SetupUtility.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Setup.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SetupUtility.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\vbc.exe
%WINDIR%\msagent\agentsvr.exe
%WINDIR%\pchealth\helpctr\binaries\notiflag.exe
%WINDIR%\pchealth\helpctr\binaries\msconfig.exe
%WINDIR%\pchealth\UploadLB\Binaries\UploadM.exe
<SYSTEM32>\actmovie.exe
<SYSTEM32>\accwiz.exe
%WINDIR%\pchealth\helpctr\binaries\HelpCtr.exe
%WINDIR%\mui\muisetup.exe
%WINDIR%\pchealth\helpctr\binaries\HelpHost.exe
%WINDIR%\pchealth\helpctr\binaries\HscUpd.exe
%WINDIR%\pchealth\helpctr\binaries\HelpSvc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe
%WINDIR%\Microsoft.NET\Framework\v4.0.30319\jsc.exe
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendVoice.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendFile.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\StopControl.bmp
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\up.bmp
%WINDIR%\pchealth\helpctr\System\sysinfo\graphics\down.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\TakeControl.bmp
%WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_generic.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\HelpCenter.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Quit.bmp
%WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Options.bmp
<SYSTEM32>\setup.bmp
%WINDIR%\sleep.exe
%WINDIR%\sfk.exe
%WINDIR%\TASKMAN.EXE
%WINDIR%\twunk_32.exe
%WINDIR%\twunk_16.exe
%WINDIR%\explorer.exe
%WINDIR%\Web\Wallpaper\Bliss.bmp
%WINDIR%\hh.exe
%WINDIR%\regedit.exe
%WINDIR%\NOTEPAD.EXE
%WINDIR%\pchealth\helpctr\System\images\16x16\arrow_blue_normal_shadow.bmp
%WINDIR%\pchealth\helpctr\System\images\icon_tutorials_12x.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\arrow_green_normal_shadow.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\errmsg.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\compat.bmp
%WINDIR%\pchealth\helpctr\System\images\icon_blank_12x.bmp
%WINDIR%\pchealth\helpctr\System\images\icon_articles_12x.bmp
%WINDIR%\pchealth\helpctr\System\images\icon_newwindow_12x.bmp
%WINDIR%\pchealth\helpctr\System\images\icon_tours_12x.bmp
%WINDIR%\pchealth\helpctr\System\images\icon_onlineinline_12x.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\support.bmp
%WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_01.bmp
%WINDIR%\pchealth\helpctr\System\images\32x32\logo.bmp
%WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_02.bmp
%WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_04.bmp
%WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_03.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\update.bmp
%WINDIR%\pchealth\helpctr\System\images\16x16\tools.bmp
%WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mousedown.bmp
%WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_normal.bmp
%WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mouseover.bmp
%WINDIR%\winhelp.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\csc.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\cvtres.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ilasm.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\IEExec.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe
%WINDIR%\Microsoft.NET\Framework\NETFXSBS10.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\CasPol.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\InstallUtil.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\vbc.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
%WINDIR%\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPol.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\jsc.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\RegAsm.exe
%WINDIR%\Microsoft.NET\Framework\v1.1.4322\ngen.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\dfsvc\a2865dcec9c5d3cc9c55f026cbad6fcc\dfsvc.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\19b50dd470540911fc5cc65331a769e4\ComSvcConfig.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\MSBuild\87c84ffaaad81d8d106a9aa9d68b5926\MSBuild.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\6781b87c8d3b55e6120b1e86bea6e040\ServiceModelReg.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\9469981a17c01dd154c540127e678b35\PresentationFontCache.ni.exe
%WINDIR%\$NtUninstallKB942288-v3$\msiexec.exe
%WINDIR%\winhlp32.exe
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\SMSvcHost\b9c1a29e684bc02e49226ff1e9eec253\SMSvcHost.ni.exe
%WINDIR%\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\XPSViewer_X86.exe
%WINDIR%\Installer\$PatchCache$\Managed\62287FAB00234BD4EB33D429A2978904\3.0.6920\PresentationHost_X86.exe
%WINDIR%\Installer\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}\places.exe
%WINDIR%\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5\Microsoft.Workflow.Compiler.exe
%WINDIR%\Microsoft.NET\NETFXRepair.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\ComSvcConfig\51819c709096229ee187a7feee395d9f\ComSvcConfig.ni.exe
%WINDIR%\assembly\NativeImages_v2.0.50727_32\WsatConfig\7d2a3adbdcb675f872eb2dbf21f73596\WsatConfig.ni.exe
%WINDIR%\assembly\NativeImages_v4.0.30319_32\dfsvc\b9b6069e6da06eb57e89cc544397f735\dfsvc.ni.exe
%WINDIR%\inf\unregmp2.exe
%WINDIR%\Help\Tours\mmTour\tour.exe

Самоудаляется.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней