Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\exefile\shell\open\command] '' = '"C:\recycled\SirC32.exe" "%1" %*'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] 'Driver32' = '<SYSTEM32>\SCam32.exe'
Изменения в файловой системе:
Создает следующие файлы:
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\RestorePointSize
- <SYSTEM32>\SCam32.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\SCam32.exe
Удаляет следующие файлы:
- %WINDIR%\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\IEExecRemote.dll
- %WINDIR%\assembly\GAC\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\IIEHost\1.0.5000.0__b03f5f7f11d50a3a\IIEHost.dll
- %WINDIR%\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\IEHost.dll
- %WINDIR%\assembly\GAC\Accessibility\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\Accessibility\1.0.5000.0__b03f5f7f11d50a3a\Accessibility.dll
- %WINDIR%\AppPatch\sysmain.sdb
- %WINDIR%\assembly\GAC\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- %WINDIR%\assembly\GAC\cscompmgd\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\cscompmgd\7.0.5000.0__b03f5f7f11d50a3a\cscompmgd.dll
- %WINDIR%\assembly\GAC\IIEHost\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\Microsoft.VisualC\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualC.dll
- %WINDIR%\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- %WINDIR%\assembly\GAC\Microsoft.Vsa\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\Microsoft.Vsa\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- %WINDIR%\assembly\GAC\Microsoft.VisualC\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
- %WINDIR%\assembly\GAC\ISymWrapper\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\ISymWrapper\1.0.5000.0__b03f5f7f11d50a3a\ISymWrapper.dll
- %WINDIR%\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- %WINDIR%\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\$NtUninstallKB942288-v3$\reg00114
- %WINDIR%\$NtUninstallKB942288-v3$\reg00113
- %WINDIR%\$NtUninstallKB942288-v3$\reg00112
- %WINDIR%\$NtUninstallKB942288-v3$\reg00117
- %WINDIR%\$NtUninstallKB942288-v3$\reg00116
- %WINDIR%\$NtUninstallKB942288-v3$\reg00115
- %WINDIR%\$NtUninstallKB942288-v3$\reg00108
- %WINDIR%\$NtUninstallKB942288-v3$\reg00107
- %WINDIR%\$NtUninstallKB942288-v3$\reg00106
- %WINDIR%\$NtUninstallKB942288-v3$\reg00111
- %WINDIR%\$NtUninstallKB942288-v3$\reg00110
- %WINDIR%\$NtUninstallKB942288-v3$\reg00109
- %WINDIR%\$NtUninstallWIC$\spuninst\spuninst.exe
- %WINDIR%\AppPatch\apphelp.sdb
- %WINDIR%\AppPatch\AcXtrnal.dll
- %WINDIR%\AppPatch\AcSpecfc.dll
- %WINDIR%\AppPatch\msimain.sdb
- %WINDIR%\AppPatch\drvmain.sdb
- %WINDIR%\AppPatch\apph_sp.sdb
- %WINDIR%\$NtUninstallWIC$\spuninst\updspapi.dll
- %WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt
- %WINDIR%\$NtUninstallWIC$\spuninst\spuninst.inf
- %WINDIR%\AppPatch\AcLua.dll
- %WINDIR%\AppPatch\AcLayers.dll
- %WINDIR%\AppPatch\AcGenral.dll
- %WINDIR%\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- %WINDIR%\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\System.Runtime.Remoting.dll
- %WINDIR%\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\System.Security.dll
- %WINDIR%\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\System.Management.dll
- %WINDIR%\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.Thunk.dll
- %WINDIR%\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\System.Messaging.dll
- %WINDIR%\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- %WINDIR%\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Services.dll
- %WINDIR%\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\System.Xml.dll
- %WINDIR%\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\System.Windows.Forms.dll
- %WINDIR%\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
- %WINDIR%\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
- %WINDIR%\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- %WINDIR%\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
- %WINDIR%\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\RegCode.dll
- %WINDIR%\assembly\GAC\System.Configuration.Install\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\System.Configuration.Install\1.0.5000.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
- %WINDIR%\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\Microsoft_VsaVb\7.0.5000.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- %WINDIR%\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- %WINDIR%\assembly\GAC\mscorcfg\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\mscorcfg\1.0.5000.0__b03f5f7f11d50a3a\mscorcfg.dll
- %WINDIR%\assembly\GAC\Microsoft_VsaVb\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\System.Data.dll
- %WINDIR%\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.dll
- %WINDIR%\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- %WINDIR%\assembly\GAC\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
- %WINDIR%\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\System.Data.OracleClient.dll
- %WINDIR%\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- %WINDIR%\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
- %WINDIR%\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Design.dll
- %WINDIR%\$NtUninstallKB942288-v3$\reg00036
- %WINDIR%\$NtUninstallKB942288-v3$\reg00035
- %WINDIR%\$NtUninstallKB942288-v3$\reg00034
- %WINDIR%\$NtUninstallKB942288-v3$\reg00040
- %WINDIR%\$NtUninstallKB942288-v3$\reg00039
- %WINDIR%\$NtUninstallKB942288-v3$\reg00037
- %WINDIR%\$NtUninstallKB942288-v3$\reg00030
- %WINDIR%\$NtUninstallKB942288-v3$\reg00029
- %WINDIR%\$NtUninstallKB942288-v3$\reg00028
- %WINDIR%\$NtUninstallKB942288-v3$\reg00033
- %WINDIR%\$NtUninstallKB942288-v3$\reg00032
- %WINDIR%\$NtUninstallKB942288-v3$\reg00031
- %WINDIR%\$NtUninstallKB942288-v3$\reg00041
- %WINDIR%\$NtUninstallKB942288-v3$\reg00052
- %WINDIR%\$NtUninstallKB942288-v3$\reg00049
- %WINDIR%\$NtUninstallKB942288-v3$\reg00048
- %WINDIR%\$NtUninstallKB942288-v3$\reg00055
- %WINDIR%\$NtUninstallKB942288-v3$\reg00054
- %WINDIR%\$NtUninstallKB942288-v3$\reg00053
- %WINDIR%\$NtUninstallKB942288-v3$\reg00044
- %WINDIR%\$NtUninstallKB942288-v3$\reg00043
- %WINDIR%\$NtUninstallKB942288-v3$\reg00042
- %WINDIR%\$NtUninstallKB942288-v3$\reg00047
- %WINDIR%\$NtUninstallKB942288-v3$\reg00046
- %WINDIR%\$NtUninstallKB942288-v3$\reg00045
- %WINDIR%\$NtUninstallKB942288-v3$\msimsg.dll
- %WINDIR%\$NtUninstallKB942288-v3$\msihnd.dll
- %WINDIR%\$NtUninstallKB942288-v3$\msiexec.exe
- %WINDIR%\$NtUninstallKB942288-v3$\reg00014
- %WINDIR%\$NtUninstallKB942288-v3$\reg00013
- %WINDIR%\$NtUninstallKB942288-v3$\msisip.dll
- %WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.inf
- %WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.exe
- <Служебный элемент>
- %WINDIR%\$NtUninstallKB942288-v3$\msi.dll
- %WINDIR%\$NtUninstallKB942288-v3$\spuninst\updspapi.dll
- %WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.txt
- %WINDIR%\$NtUninstallKB942288-v3$\reg00015
- %WINDIR%\$NtUninstallKB942288-v3$\reg00024
- %WINDIR%\$NtUninstallKB942288-v3$\reg00023
- %WINDIR%\$NtUninstallKB942288-v3$\reg00022
- %WINDIR%\$NtUninstallKB942288-v3$\reg00027
- %WINDIR%\$NtUninstallKB942288-v3$\reg00026
- %WINDIR%\$NtUninstallKB942288-v3$\reg00025
- %WINDIR%\$NtUninstallKB942288-v3$\reg00018
- %WINDIR%\$NtUninstallKB942288-v3$\reg00017
- %WINDIR%\$NtUninstallKB942288-v3$\reg00016
- %WINDIR%\$NtUninstallKB942288-v3$\reg00021
- %WINDIR%\$NtUninstallKB942288-v3$\reg00020
- %WINDIR%\$NtUninstallKB942288-v3$\reg00019
- %WINDIR%\$NtUninstallKB942288-v3$\reg00089
- %WINDIR%\$NtUninstallKB942288-v3$\reg00088
- %WINDIR%\$NtUninstallKB942288-v3$\reg00087
- %WINDIR%\$NtUninstallKB942288-v3$\reg00092
- %WINDIR%\$NtUninstallKB942288-v3$\reg00091
- %WINDIR%\$NtUninstallKB942288-v3$\reg00090
- %WINDIR%\$NtUninstallKB942288-v3$\reg00083
- %WINDIR%\$NtUninstallKB942288-v3$\reg00082
- %WINDIR%\$NtUninstallKB942288-v3$\reg00081
- %WINDIR%\$NtUninstallKB942288-v3$\reg00086
- %WINDIR%\$NtUninstallKB942288-v3$\reg00085
- %WINDIR%\$NtUninstallKB942288-v3$\reg00084
- %WINDIR%\$NtUninstallKB942288-v3$\reg00093
- %WINDIR%\$NtUninstallKB942288-v3$\reg00102
- %WINDIR%\$NtUninstallKB942288-v3$\reg00101
- %WINDIR%\$NtUninstallKB942288-v3$\reg00100
- %WINDIR%\$NtUninstallKB942288-v3$\reg00105
- %WINDIR%\$NtUninstallKB942288-v3$\reg00104
- %WINDIR%\$NtUninstallKB942288-v3$\reg00103
- %WINDIR%\$NtUninstallKB942288-v3$\reg00096
- %WINDIR%\$NtUninstallKB942288-v3$\reg00095
- %WINDIR%\$NtUninstallKB942288-v3$\reg00094
- %WINDIR%\$NtUninstallKB942288-v3$\reg00099
- %WINDIR%\$NtUninstallKB942288-v3$\reg00098
- %WINDIR%\$NtUninstallKB942288-v3$\reg00097
- %WINDIR%\$NtUninstallKB942288-v3$\reg00064
- %WINDIR%\$NtUninstallKB942288-v3$\reg00063
- %WINDIR%\$NtUninstallKB942288-v3$\reg00062
- %WINDIR%\$NtUninstallKB942288-v3$\reg00067
- %WINDIR%\$NtUninstallKB942288-v3$\reg00066
- %WINDIR%\$NtUninstallKB942288-v3$\reg00065
- %WINDIR%\$NtUninstallKB942288-v3$\reg00058
- %WINDIR%\$NtUninstallKB942288-v3$\reg00057
- %WINDIR%\$NtUninstallKB942288-v3$\reg00056
- %WINDIR%\$NtUninstallKB942288-v3$\reg00061
- %WINDIR%\$NtUninstallKB942288-v3$\reg00060
- %WINDIR%\$NtUninstallKB942288-v3$\reg00059
- %WINDIR%\$NtUninstallKB942288-v3$\reg00068
- %WINDIR%\$NtUninstallKB942288-v3$\reg00077
- %WINDIR%\$NtUninstallKB942288-v3$\reg00076
- %WINDIR%\$NtUninstallKB942288-v3$\reg00075
- %WINDIR%\$NtUninstallKB942288-v3$\reg00080
- %WINDIR%\$NtUninstallKB942288-v3$\reg00079
- %WINDIR%\$NtUninstallKB942288-v3$\reg00078
- %WINDIR%\$NtUninstallKB942288-v3$\reg00071
- %WINDIR%\$NtUninstallKB942288-v3$\reg00070
- %WINDIR%\$NtUninstallKB942288-v3$\reg00069
- %WINDIR%\$NtUninstallKB942288-v3$\reg00074
- %WINDIR%\$NtUninstallKB942288-v3$\reg00073
- %WINDIR%\$NtUninstallKB942288-v3$\reg00072
Самоудаляется.
