Техническая информация
Вредоносные функции:
Запускает на исполнение:
- '<SYSTEM32>\notepad.exe' %HOMEPATH%\Desktop\Read_Me.txt
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Desktop\Read_Me.txt
- %HOMEPATH%\my.jpg
Перемещает следующие системные файлы:
- %WINDIR%\setuplog.txt в %WINDIR%\setuplog.txt.locked
- %WINDIR%\OEWABLog.txt в %WINDIR%\OEWABLog.txt.locked
Перемещает следующие файлы:
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up-sharp.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up-sharp.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\checkbox\cbox-check-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\checkbox\cbox-check-dis.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\console\console-error-caret.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\console\console-error-caret.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\checkbox\cbox-check.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\checkbox\cbox-check.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up-hov.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up-hov.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-sharp-end.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-sharp-end.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-hov.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-hov.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-sharp.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-sharp.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-up-dis.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\console\console-error-dash.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\console\console-error-dash.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-left.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-left.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-bottom.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-bottom.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-right.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-right.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\toolbar\chevron.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\toolbar\chevron.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-top.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\splitter\grip-top.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\scrollbar\slider.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\scrollbar\slider.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\Minimize.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\Minimize.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\Close.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\Close.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\Restore.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\icons\Restore.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\radio\radio-check.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\radio\radio-check.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\radio\radio-check-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\radio\radio-check-dis.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-rit-dis.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-bottom.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-bottom.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\scrollbar\slider.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\scrollbar\slider.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-left.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-left.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-top.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-top.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-right.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\splitter\grip-right.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\radio-check.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\radio-check.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Close.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Close.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console-error-dash.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console-error-dash.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Minimize.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Minimize.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\radio-check-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\radio\radio-check-dis.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Restore.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\icons\Restore.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\toolbar\chevron.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\toolbar\chevron.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-hov.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-hov.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-dis.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-sharp-end.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-sharp-end.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-sharp.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-lft-sharp.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\globalBindings.xml в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\globalBindings.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\tree\columnpicker.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\tree\columnpicker.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn-dis.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn-sharp.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn-sharp.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn-hov.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\arrow\arrow-dn-hov.gif.locked
- %ProgramFiles%\Messenger\type.wav в %ProgramFiles%\Messenger\type.wav.locked
- %ProgramFiles%\Messenger\online.wav в %ProgramFiles%\Messenger\online.wav.locked
- %ProgramFiles%\Microsoft.NET\RedistList\AssemblyList_4_client.xml в %ProgramFiles%\Microsoft.NET\RedistList\AssemblyList_4_client.xml.locked
- %ProgramFiles%\Movie Maker\Shared\Empty.txt в %ProgramFiles%\Movie Maker\Shared\Empty.txt.locked
- %ProgramFiles%\Microsoft.NET\RedistList\AssemblyList_4_extended.xml в %ProgramFiles%\Microsoft.NET\RedistList\AssemblyList_4_extended.xml.locked
- %ProgramFiles%\Messenger\newemail.wav в %ProgramFiles%\Messenger\newemail.wav.locked
- %ProgramFiles%\FireFox\searchplugins\yahoo.xml в %ProgramFiles%\FireFox\searchplugins\yahoo.xml.locked
- %ProgramFiles%\FireFox\searchplugins\wikipedia.xml в %ProgramFiles%\FireFox\searchplugins\wikipedia.xml.locked
- %ProgramFiles%\Messenger\logowin.gif в %ProgramFiles%\Messenger\logowin.gif.locked
- %ProgramFiles%\Messenger\newalert.wav в %ProgramFiles%\Messenger\newalert.wav.locked
- %ProgramFiles%\Messenger\lvback.gif в %ProgramFiles%\Messenger\lvback.gif.locked
- %ProgramFiles%\Movie Maker\Shared\Filters.xml в %ProgramFiles%\Movie Maker\Shared\Filters.xml.locked
- %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml в %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml.locked
- %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml в %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml.locked
- %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\Client.xml в %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\Client.xml.locked
- %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\Client.xml в %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\Client.xml.locked
- %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml в %ProgramFiles%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml.locked
- %ProgramFiles%\Outlook Express\msoe.txt в %ProgramFiles%\Outlook Express\msoe.txt.locked
- %ProgramFiles%\MSN\MSNCoreFiles\Install\cinfo.xml в %ProgramFiles%\MSN\MSNCoreFiles\Install\cinfo.xml.locked
- %ProgramFiles%\Movie Maker\Shared\Profiles\Blank.txt в %ProgramFiles%\Movie Maker\Shared\Profiles\Blank.txt.locked
- %ProgramFiles%\MSN\MSNCoreFiles\Install\xfp.xml в %ProgramFiles%\MSN\MSNCoreFiles\Install\xfp.xml.locked
- %ProgramFiles%\NetMeeting\TestSnd.wav в %ProgramFiles%\NetMeeting\TestSnd.wav.locked
- %ProgramFiles%\NetMeeting\Blip.wav в %ProgramFiles%\NetMeeting\Blip.wav.locked
- %ProgramFiles%\FireFox\searchplugins\google.xml в %ProgramFiles%\FireFox\searchplugins\google.xml.locked
- %ProgramFiles%\FireFox\res\table-add-column-before.gif в %ProgramFiles%\FireFox\res\table-add-column-before.gif.locked
- %ProgramFiles%\FireFox\res\table-add-column-before-hover.gif в %ProgramFiles%\FireFox\res\table-add-column-before-hover.gif.locked
- %ProgramFiles%\FireFox\res\table-add-row-after-active.gif в %ProgramFiles%\FireFox\res\table-add-row-after-active.gif.locked
- %ProgramFiles%\FireFox\res\table-add-row-after.gif в %ProgramFiles%\FireFox\res\table-add-row-after.gif.locked
- %ProgramFiles%\FireFox\res\table-add-row-after-hover.gif в %ProgramFiles%\FireFox\res\table-add-row-after-hover.gif.locked
- %ProgramFiles%\FireFox\res\table-add-column-before-active.gif в %ProgramFiles%\FireFox\res\table-add-column-before-active.gif.locked
- %ProgramFiles%\FireFox\res\grabber.gif в %ProgramFiles%\FireFox\res\grabber.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\tree\columnpicker.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\global\tree\columnpicker.gif.locked
- %ProgramFiles%\FireFox\res\table-add-column-after-active.gif в %ProgramFiles%\FireFox\res\table-add-column-after-active.gif.locked
- %ProgramFiles%\FireFox\res\table-add-column-after.gif в %ProgramFiles%\FireFox\res\table-add-column-after.gif.locked
- %ProgramFiles%\FireFox\res\table-add-column-after-hover.gif в %ProgramFiles%\FireFox\res\table-add-column-after-hover.gif.locked
- %ProgramFiles%\FireFox\res\table-add-row-before-active.gif в %ProgramFiles%\FireFox\res\table-add-row-before-active.gif.locked
- %ProgramFiles%\FireFox\res\table-remove-row.gif в %ProgramFiles%\FireFox\res\table-remove-row.gif.locked
- %ProgramFiles%\FireFox\res\table-remove-row-hover.gif в %ProgramFiles%\FireFox\res\table-remove-row-hover.gif.locked
- %ProgramFiles%\FireFox\searchplugins\amazondotcom.xml в %ProgramFiles%\FireFox\searchplugins\amazondotcom.xml.locked
- %ProgramFiles%\FireFox\searchplugins\eBay.xml в %ProgramFiles%\FireFox\searchplugins\eBay.xml.locked
- %ProgramFiles%\FireFox\searchplugins\bing.xml в %ProgramFiles%\FireFox\searchplugins\bing.xml.locked
- %ProgramFiles%\FireFox\res\table-remove-row-active.gif в %ProgramFiles%\FireFox\res\table-remove-row-active.gif.locked
- %ProgramFiles%\FireFox\res\table-add-row-before.gif в %ProgramFiles%\FireFox\res\table-add-row-before.gif.locked
- %ProgramFiles%\FireFox\res\table-add-row-before-hover.gif в %ProgramFiles%\FireFox\res\table-add-row-before-hover.gif.locked
- %ProgramFiles%\FireFox\res\table-remove-column-active.gif в %ProgramFiles%\FireFox\res\table-remove-column-active.gif.locked
- %ProgramFiles%\FireFox\res\table-remove-column.gif в %ProgramFiles%\FireFox\res\table-remove-column.gif.locked
- %ProgramFiles%\FireFox\res\table-remove-column-hover.gif в %ProgramFiles%\FireFox\res\table-remove-column-hover.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console-error-caret.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\console\console-error-caret.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\expander.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\expander.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\editor.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\editor.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\filefield.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\filefield.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\general.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\general.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\findbar.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\findbar.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\dialog.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\dialog.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\button.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\button.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\browser.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\browser.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\checkbox.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\checkbox.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\datetimepicker.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\datetimepicker.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\colorpicker.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\colorpicker.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\groupbox.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\groupbox.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\progressmeter.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\progressmeter.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\preferences.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\preferences.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\radio.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\radio.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\richlistbox.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\richlistbox.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\resizer.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\resizer.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\popup.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\popup.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\menu.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\menu.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\listbox.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\listbox.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\menulist.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\menulist.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\numberbox.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\numberbox.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\notification.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\notification.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\autocomplete.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\autocomplete.xml.locked
- %ProgramFiles%\FireFox\chrome\browser\content\browser\browser-tabPreviews.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\browser-tabPreviews.xml.locked
- %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSyncTabs-bindings.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\aboutSyncTabs-bindings.xml.locked
- %ProgramFiles%\FireFox\chrome\browser\content\browser\syncNotification.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\syncNotification.xml.locked
- %ProgramFiles%\FireFox\chrome\browser\content\browser\urlbarBindings.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\urlbarBindings.xml.locked
- %ProgramFiles%\FireFox\chrome\browser\content\browser\tabbrowser.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\tabbrowser.xml.locked
- %ProgramFiles%\FireFox\README.txt в %ProgramFiles%\FireFox\README.txt.locked
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.locked
- %APPDATA%\Microsoft\Internet Explorer\brndlog.txt в %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.locked
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.locked
- %ProgramFiles%\FireFox\blocklist.xml в %ProgramFiles%\FireFox\blocklist.xml.locked
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.locked
- %ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\subscribe.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\subscribe.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\notfound.wav в %ProgramFiles%\FireFox\chrome\toolkit\content\global\notfound.wav.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\consoleBindings.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\consoleBindings.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\platformHTMLBindings.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\platformHTMLBindings.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\tabprompts.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\tabprompts.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\printPreviewBindings.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\printPreviewBindings.xml.locked
- %ProgramFiles%\FireFox\chrome\browser\content\browser\search\search.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\search\search.xml.locked
- %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.xml.locked
- %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\feeds.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\feeds.xml.locked
- %ProgramFiles%\FireFox\chrome\browser\content\browser\places\menu.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\places\menu.xml.locked
- %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\handlers.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\handlers.xml.locked
- %ProgramFiles%\FireFox\chrome\browser\content\browser\places\tree.xml в %ProgramFiles%\FireFox\chrome\browser\content\browser\places\tree.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-dis.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-hov.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-hov.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-sharp.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-sharp.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-sharp-end.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft-sharp-end.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn-sharp.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn-sharp.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\res\arrowd.gif в %ProgramFiles%\FireFox\chrome\toolkit\res\arrowd.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\res\arrow.gif в %ProgramFiles%\FireFox\chrome\toolkit\res\arrow.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\globalBindings.xml в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\globalBindings.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn-hov.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn-hov.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-dn-dis.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-lft.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up-sharp.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up-sharp.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up-hov.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up-hov.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\cbox-check.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\cbox-check.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\cbox-check-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\checkbox\cbox-check-dis.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-up-dis.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-hov.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-hov.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-dis.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-dis.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-sharp-end.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-sharp-end.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-sharp.gif в %ProgramFiles%\FireFox\chrome\toolkit\skin\classic\aero\global\arrow\arrow-rit-sharp.gif.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\xbl-marquee\xbl-marquee.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\xbl-marquee\xbl-marquee.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\text.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\text.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\tabbox.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\tabbox.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\textbox.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\textbox.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\toolbarbutton.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\toolbarbutton.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\toolbar.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\toolbar.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\stringbundle.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\stringbundle.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\scrollbar.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\scrollbar.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\scale.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\scale.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\scrollbox.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\scrollbox.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\splitter.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\splitter.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\spinbuttons.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\spinbuttons.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\tree.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\tree.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\handling\handler.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\handling\handler.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\extensions\extensions.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\extensions\extensions.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\plugins\pluginProblem.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\plugins\pluginProblem.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\xpinstall\xpinstallItem.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\xpinstall\xpinstallItem.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\update\updates.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\update\updates.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\extensions\blocklist.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\extensions\blocklist.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\wizard.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\wizard.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\videocontrols.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\bindings\videocontrols.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\svg\svgBindings.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\svg\svgBindings.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\downloads\download.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\mozapps\downloads\download.xml.locked
- %ProgramFiles%\FireFox\chrome\toolkit\content\global\xml\XMLPrettyPrint.xml в %ProgramFiles%\FireFox\chrome\toolkit\content\global\xml\XMLPrettyPrint.xml.locked
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
Изменяет расширения файлов пользовательских данных (Trojan.Encoder).
Сетевая активность:
Подключается к:
- 'www.he###airway.tk':80
- 'wp#d':80
TCP:
Запросы HTTP GET:
- http://www.he###airway.tk/h.jpg
- http://www.he###airway.tk/log.php?ma#######################################################
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK www.he###airway.tk
- DNS ASK wp#d
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
