Trojan.KillFiles.24258

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\EPOL] 'Logon' = 'WLEventLogon'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\EPOL] 'DllName' = 'EPolWLNF.DLL'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ESCCControl' = '%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\ESCCControl.Exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\tdifw_drv] 'Start' = '00000001'
[<HKLM>\SYSTEM\ControlSet001\Services\EPolSDAgent] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\ESCCService] 'Start' = '00000002'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\SDAgent.exe' = '%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\SDAgent.exe:*:Enabled:软件分发客户端'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\ESCC.exe' = '%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\ESCC.exe:*:Enabled:天珣客户端'

Создает и запускает на исполнение:

'%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\xpfirewall.exe'
'%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\xpfirewall2.exe'
'%TEMP%\RarSFX1\Setup.exe' /a
'%TEMP%\RarSFX0\AutoRun.exe' fw
'%TEMP%\RarSFX0\Setup2000-fw.exe'

Запускает на исполнение:

'<SYSTEM32>\wbem\wmiadap.exe' /R /T

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User(F).htm
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\filelist.xml
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\ext_route.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\FWSetup.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image003.png
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image004.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image001.png
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image002.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\eposfsf.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\EPOSFSFSetup.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\EPolWLNF.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\eposdfapi.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\ext_account.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\ext_hotfix.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\ESCC.exe
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\ESCCControl.exe
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image015.png
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image016.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image013.png
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image014.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image019.png
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image020.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image017.png
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image018.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image007.gif
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image008.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image005.png
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image006.gif
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image011.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image012.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image009.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image010.png
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\EPolUpdate363.exe
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\disksn32.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\driver\diskperf.inf
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\CommonFunc.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\dbghelp.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\driver\eposfsf.sys
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\DrvSetup\DrvSetup.exe
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\driver\diskperf.sys
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\driver\eposfsf.inf
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\3rdParty\WindowsUpdateAgent20-x86.exe
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\assetid.js
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\3rdParty\msxml4sp2\msxml4r.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\3rdParty\scr56chs-2k.exe
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\CCMon.exe
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\CheckNtAdmin.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\CC.ini
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\CCControlResTX.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\DrvSetup\winXP\lpsimd.sys
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\DrvSetup\winXP\tdifw_drv.sys
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\DrvSetup\winVista\lpsimd.sys
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\DrvSetup\winVista\tdifw_drv.sys
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\emcClient.exe
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\EPolCCSetup.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\EAP\eap_epol.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\EAP\eap_epolmd5.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\DrvSetup\netsf.inf
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\DrvSetup\netsf_m.inf
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\DrvSetup\installDrv.bat
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\DrvSetup\lpsimd.dl_
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\DrvSetup\win2003\lpsimd.sys
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\DrvSetup\win2003\tdifw_drv.sys
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\DrvSetup\win2000\lpsimd.sys
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\DrvSetup\win2000\tdifw_drv.sys
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image021.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\StatusDialog.exe
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\unicows.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\SpOrder.Dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\startccmon.exe
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\xpfirewall2.exe
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Zip32.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\XMLWrapper.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\xpfirewall.exe
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\SDAgent.exe
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\SDAgent.ini
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\PrintAuditHook.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\SCriptObject.tlb
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Setup.ini
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\SetupFrameResTX.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\ServCOM.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Setup.exe
%WINDIR%\inf\oem3.inf
%WINDIR%\inf\oem3.PNF
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\DrvSetup\lpsimd.sys
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\DrvSetup\tdifw_drv.sys
<DRIVERS>\SET5.tmp
<DRIVERS>\SET6.tmp
%WINDIR%\inf\INFCACHE.0
<SYSTEM32>\SET4.tmp
<SYSTEM32>\msxml4a.dll
<SYSTEM32>\EPolWLNF.DLL
<SYSTEM32>\msxml4.dll
<SYSTEM32>\msxml4r.dll
%ALLUSERSPROFILE%\Start Menu\Programs\Venustech\ESCC\РЮёДWinXP·А»рЗЅЙи¶Ё.lnk
%WINDIR%\LPSIMDSetup.log
%TEMP%\RGI1.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Venustech\ESCC\Мм«‘їН»§¶Л.lnk
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\PrintAudit.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image032.png
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image033.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image030.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image031.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image036.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image037.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image034.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image035.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image025.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image026.png
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image023.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image024.png
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image028.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image029.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image027.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image027_F.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\MSEAPCLTC.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\msvcp60.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\mfc42.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Microsoft.VC80.CRT.manifest
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\PM.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\PM.ini
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\msvcr80.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\msvcrt.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\HotfixAgent.exe
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\images\hotfixinstall.gif
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.files\image038.jpg
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Help\User.htm
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\linkworkHDS2.exe
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\Logviewer.exe
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\images\ruleerror.gif
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\images\ruleok.gif
%TEMP%\RarSFX1\SetupFiles\emcClient.exe
%TEMP%\RarSFX1\SetupFiles\EPolCCSetup.dll
%TEMP%\RarSFX1\SetupFiles\EAP\eap_epol.dll
%TEMP%\RarSFX1\SetupFiles\EAP\eap_epolmd5.dll
%TEMP%\RarSFX1\SetupFiles\eposdfapi.dll
%TEMP%\RarSFX1\SetupFiles\eposfsf.dll
%TEMP%\RarSFX1\SetupFiles\EPolUpdate363.exe
%TEMP%\RarSFX1\SetupFiles\EPolWLNF.dll
%TEMP%\RarSFX1\SetupFiles\DrvSetup\win2003\tdifw_drv.sys
%TEMP%\RarSFX1\SetupFiles\DrvSetup\winVista\lpsimd.sys
%TEMP%\RarSFX1\SetupFiles\DrvSetup\win2000\tdifw_drv.sys
%TEMP%\RarSFX1\SetupFiles\DrvSetup\win2003\lpsimd.sys
%TEMP%\RarSFX1\SetupFiles\DrvSetup\winXP\tdifw_drv.sys
%TEMP%\RarSFX1\SetupFiles\DrvSetup\按需支援管理员端程序.lnk
%TEMP%\RarSFX1\SetupFiles\DrvSetup\winVista\tdifw_drv.sys
%TEMP%\RarSFX1\SetupFiles\DrvSetup\winXP\lpsimd.sys
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image002.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image003.png
%TEMP%\RarSFX1\SetupFiles\Help\User.files\filelist.xml
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image001.png
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image006.gif
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image007.gif
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image004.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image005.png
%TEMP%\RarSFX1\SetupFiles\ESCCControl.exe
%TEMP%\RarSFX1\SetupFiles\ext_account.dll
%TEMP%\RarSFX1\SetupFiles\EPOSFSFSetup.dll
%TEMP%\RarSFX1\SetupFiles\ESCC.exe
%TEMP%\RarSFX1\SetupFiles\FWSetup.dll
%TEMP%\RarSFX1\SetupFiles\Help\User(F).htm
%TEMP%\RarSFX1\SetupFiles\ext_hotfix.dll
%TEMP%\RarSFX1\SetupFiles\ext_route.dll
%TEMP%\RarSFX1\SetupFiles\DrvSetup\win2000\lpsimd.sys
%TEMP%\RarSFX1\SetupFiles\3rdParty\msxml4sp2\msxml4.dll
%TEMP%\RarSFX1\SetupFiles\3rdParty\msxml4sp2\msxml4a.dll
%TEMP%\RarSFX1\Setup.exe
%TEMP%\RarSFX1\Setup.ini
%TEMP%\RarSFX1\SetupFiles\3rdParty\WindowsUpdateAgent20-x86.exe
%TEMP%\RarSFX1\SetupFiles\assetid.js
%TEMP%\RarSFX1\SetupFiles\3rdParty\msxml4sp2\msxml4r.dll
%TEMP%\RarSFX1\SetupFiles\3rdParty\scr56chs-2k.exe
%TEMP%\RarSFX1\CheckNtAdmin.dll
%TEMP%\RarSFX1\EPolCCSetup.dll
%TEMP%\RarSFX0\Setup2000-fw.exe
%TEMP%\RarSFX0\AutoRun.exe
%TEMP%\RarSFX1\License.txt
%TEMP%\RarSFX1\MSEAPCLTC.dll
%TEMP%\RarSFX1\EPOSFSFSetup.dll
%TEMP%\RarSFX1\FWSetup.dll
%TEMP%\RarSFX1\SetupFiles\driver\eposfsf.sys
%TEMP%\RarSFX1\SetupFiles\DrvSetup\DrvSetup.exe
%TEMP%\RarSFX1\SetupFiles\driver\diskperf.sys
%TEMP%\RarSFX1\SetupFiles\driver\eposfsf.inf
%TEMP%\RarSFX1\SetupFiles\DrvSetup\netsf.inf
%TEMP%\RarSFX1\SetupFiles\DrvSetup\netsf_m.inf
%TEMP%\RarSFX1\SetupFiles\DrvSetup\installDrv.bat
%TEMP%\RarSFX1\SetupFiles\DrvSetup\lpsimd.dl_
%TEMP%\RarSFX1\SetupFiles\CCMon.exe
%TEMP%\RarSFX1\SetupFiles\CheckNtAdmin.dll
%TEMP%\RarSFX1\SetupFiles\CC.ini
%TEMP%\RarSFX1\SetupFiles\CCControlResTX.dll
%TEMP%\RarSFX1\SetupFiles\disksn32.dll
%TEMP%\RarSFX1\SetupFiles\driver\diskperf.inf
%TEMP%\RarSFX1\SetupFiles\CommonFunc.dll
%TEMP%\RarSFX1\SetupFiles\dbghelp.dll
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image008.jpg
%TEMP%\RarSFX1\SetupFiles\PM.dll
%TEMP%\RarSFX1\SetupFiles\PM.ini
%TEMP%\RarSFX1\SetupFiles\msvcr80.dll
%TEMP%\RarSFX1\SetupFiles\msvcrt.dll
%TEMP%\RarSFX1\SetupFiles\SCriptObject.tlb
%TEMP%\RarSFX1\SetupFiles\SDAgent.exe
%TEMP%\RarSFX1\SetupFiles\PrintAudit.dll
%TEMP%\RarSFX1\SetupFiles\PrintAuditHook.dll
%TEMP%\RarSFX1\SetupFiles\linkworkHDS2.exe
%TEMP%\RarSFX1\SetupFiles\Logviewer.exe
%TEMP%\RarSFX1\SetupFiles\images\ruleerror.gif
%TEMP%\RarSFX1\SetupFiles\images\ruleok.gif
%TEMP%\RarSFX1\SetupFiles\MSEAPCLTC.dll
%TEMP%\RarSFX1\SetupFiles\msvcp60.dll
%TEMP%\RarSFX1\SetupFiles\mfc42.dll
%TEMP%\RarSFX1\SetupFiles\Microsoft.VC80.CRT.manifest
%TEMP%\RarSFX1\SetupFiles\xpfirewall.exe
%TEMP%\RarSFX1\SetupFiles\xpfirewall2.exe
%TEMP%\RarSFX1\SetupFiles\unicows.dll
%TEMP%\RarSFX1\SetupFiles\XMLWrapper.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\3rdParty\msxml4sp2\msxml4.dll
%PROGRAM_FILES%\Venustech\Endpoint Security\ESCC\3rdParty\msxml4sp2\msxml4a.dll
%TEMP%\RarSFX1\SetupFiles\Zip32.dll
%TEMP%\RarSFX1\SetupFrameResTX.dll
%TEMP%\RarSFX1\SetupFiles\Setup.exe
%TEMP%\RarSFX1\SetupFiles\Setup.ini
%TEMP%\RarSFX1\SetupFiles\SDAgent.ini
%TEMP%\RarSFX1\SetupFiles\ServCOM.dll
%TEMP%\RarSFX1\SetupFiles\startccmon.exe
%TEMP%\RarSFX1\SetupFiles\StatusDialog.exe
%TEMP%\RarSFX1\SetupFiles\SetupFrameResTX.dll
%TEMP%\RarSFX1\SetupFiles\SpOrder.Dll
%TEMP%\RarSFX1\SetupFiles\images\hotfixinstall.gif
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image019.png
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image020.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image017.png
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image018.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image024.png
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image025.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image021.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image023.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image011.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image012.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image009.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image010.png
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image015.png
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image016.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image013.png
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image014.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image035.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image036.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image033.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image034.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.htm
%TEMP%\RarSFX1\SetupFiles\HotfixAgent.exe
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image037.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image038.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image027_F.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image028.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image026.png
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image027.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image031.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image032.png
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image029.jpg
%TEMP%\RarSFX1\SetupFiles\Help\User.files\image030.jpg

Удаляет следующие файлы:

<SYSTEM32>\wbem\Performance\WmiApRpl.ini
<SYSTEM32>\PerfStringBackup.TMP
%TEMP%\RarSFX0\AutoRun.exe
%TEMP%\RGI1.tmp

Перемещает следующие системные файлы:

%WINDIR%\inf\INFCACHE.2 в %WINDIR%\inf\OLDCACHE.000
%WINDIR%\inf\INFCACHE.1 в %WINDIR%\inf\INFCACHE.2

Перемещает следующие файлы:

<DRIVERS>\SET6.tmp в <DRIVERS>\tdifw_drv.sys
<DRIVERS>\SET5.tmp в <DRIVERS>\lpsimd.sys
<SYSTEM32>\SET4.tmp в <SYSTEM32>\lpsimd.dll

Другое:

Ищет следующие окна:

ClassName: '' WindowName: 'EPolCCControl'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'EDIT' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней