Trojan.KillFiles.60029

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'winlogon' = '%WINDIR%\DriveLocker'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\reg.exe' ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v winlogon /t REG_SZ /d %WINDIR%\DriveLocker /f
'<SYSTEM32>\cmd.exe' del C:\*.* /s /f /q
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\2.bat" <Полный путь к файлу>"

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\Movie Maker\moviemk.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\trialoc.dll.new
%ProgramFiles%\Internet Explorer\Connection Wizard\isignup.exe.new
%ProgramFiles%\Movie Maker\wmm2ae.dll.new
%ProgramFiles%\Movie Maker\wmm2filt.dll.new
%ProgramFiles%\Movie Maker\wmm2ext.dll.new
%ProgramFiles%\Movie Maker\wmm2eres.dll.new
%ProgramFiles%\Internet Explorer\Connection Wizard\icwres.dll.new
%ProgramFiles%\Internet Explorer\Connection Wizard\icwhelp.dll.new
%ProgramFiles%\Internet Explorer\Connection Wizard\icwdl.dll.new
%ProgramFiles%\Internet Explorer\Connection Wizard\icwrmind.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\inetwiz.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\icwutil.dll.new
%ProgramFiles%\Internet Explorer\Connection Wizard\icwtutor.exe.new
%ProgramFiles%\MSN Gaming Zone\Windows\chkrzm.exe.new
%ProgramFiles%\MSN Gaming Zone\Windows\chkrres.dll.new
%ProgramFiles%\MSN Gaming Zone\Windows\chkr.dll.new
%ProgramFiles%\MSN Gaming Zone\Windows\cmnclim.dll.new
%ProgramFiles%\MSN Gaming Zone\Windows\hrtzres.dll.new
%ProgramFiles%\MSN Gaming Zone\Windows\hrtz.dll.new
%ProgramFiles%\MSN Gaming Zone\Windows\cmnresm.dll.new
%ProgramFiles%\Movie Maker\wmm2res.dll.new
%ProgramFiles%\Movie Maker\wmm2fxb.dll.new
%ProgramFiles%\Movie Maker\wmm2fxa.dll.new
%ProgramFiles%\Movie Maker\wmm2res2.dll.new
%ProgramFiles%\MSN Gaming Zone\Windows\bckgzm.exe.new
%ProgramFiles%\MSN Gaming Zone\Windows\bckgres.dll.new
%ProgramFiles%\MSN Gaming Zone\Windows\bckg.dll.new
<SYSTEM32>\dllcache\msdaosp.dll.new
<SYSTEM32>\dllcache\msdaorar.dll.new
<SYSTEM32>\dllcache\msdaora.dll.new
<SYSTEM32>\dllcache\msdaps.dll.new
<SYSTEM32>\dllcache\msdasqlr.dll.new
<SYSTEM32>\dllcache\msdasql.dll.new
<SYSTEM32>\dllcache\msdasc.dll.new
<SYSTEM32>\dllcache\msdaremr.dll.new
<SYSTEM32>\dllcache\msdarem.dll.new
<SYSTEM32>\dllcache\msdaprst.dll.new
<SYSTEM32>\dllcache\msdfmap.dll.new
<SYSTEM32>\dllcache\msdaer.dll.new
<SYSTEM32>\dllcache\msdaenum.dll.new
<SYSTEM32>\dllcache\msdadc.dll.new
%ProgramFiles%\Internet Explorer\iedw.exe.new
%ProgramFiles%\Internet Explorer\hmmapi.dll.new
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\fifo.log
%ProgramFiles%\Internet Explorer\iexplore.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\icwconn2.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\icwconn1.exe.new
%ProgramFiles%\Internet Explorer\Connection Wizard\icwconn.dll.new
<SYSTEM32>\dllcache\msdaurl.dll.new
<SYSTEM32>\dllcache\msdatt.dll.new
<SYSTEM32>\dllcache\msdatl3.dll.new
<SYSTEM32>\dllcache\msxactps.dll.new
<SYSTEM32>\dllcache\sqlxmlx.dll.new
<SYSTEM32>\dllcache\oledb32r.dll.new
<SYSTEM32>\dllcache\oledb32.dll.new
%ProgramFiles%\Outlook Express\oemiglib.dll.new
%ProgramFiles%\Outlook Express\oemig50.exe.new
%ProgramFiles%\Outlook Express\oeimport.dll.new
%ProgramFiles%\Outlook Express\setup50.exe.new
%ProgramFiles%\Outlook Express\wabimp.dll.new
%ProgramFiles%\Outlook Express\wabfind.dll.new
%ProgramFiles%\Outlook Express\wab.exe.new
%ProgramFiles%\NetMeeting\rrcm.dll.new
%ProgramFiles%\NetMeeting\nmwb.dll.new
%ProgramFiles%\NetMeeting\nmoldwb.dll.new
%ProgramFiles%\NetMeeting\wb32.exe.new
%ProgramFiles%\Outlook Express\msoeres.dll.new
%ProgramFiles%\Outlook Express\msoe.dll.new
%ProgramFiles%\Outlook Express\msimn.exe.new
%ProgramFiles%\Windows Media Player\wmpband.dll.new
%ProgramFiles%\Windows Media Player\setup_wm.exe.new
%ProgramFiles%\Windows Media Player\npwmsdrm.dll.new
%ProgramFiles%\Windows Media Player\wmplayer.exe.new
%ProgramFiles%\Windows NT\htrn_jis.dll.new
%ProgramFiles%\Windows NT\dialer.exe.new
%ProgramFiles%\Windows Media Player\wmpns.dll.new
%ProgramFiles%\Windows Media Player\migrate.exe.new
%ProgramFiles%\Windows Media Player\custsat.dll.new
%ProgramFiles%\Outlook Express\wabmig.exe.new
%ProgramFiles%\Windows Media Player\mplayer2.exe.new
%ProgramFiles%\Windows Media Player\npdsplay.dll.new
%ProgramFiles%\Windows Media Player\npdrmv2.dll.new
%ProgramFiles%\Windows Media Player\mpvis.dll.new
%ProgramFiles%\MSN Gaming Zone\Windows\zcorem.dll.new
%ProgramFiles%\MSN Gaming Zone\Windows\zclientm.exe.new
%ProgramFiles%\MSN Gaming Zone\Windows\uniansi.dll.new
%ProgramFiles%\MSN Gaming Zone\Windows\zeeverm.dll.new
%ProgramFiles%\MSN Gaming Zone\Windows\zonelibm.dll.new
%ProgramFiles%\MSN Gaming Zone\Windows\zoneclim.dll.new
%ProgramFiles%\MSN Gaming Zone\Windows\znetm.dll.new
%ProgramFiles%\MSN Gaming Zone\Windows\rvseres.dll.new
%ProgramFiles%\MSN Gaming Zone\Windows\rvse.dll.new
%ProgramFiles%\MSN Gaming Zone\Windows\hrtzzm.exe.new
%ProgramFiles%\MSN Gaming Zone\Windows\rvsezm.exe.new
%ProgramFiles%\MSN Gaming Zone\Windows\shvlzm.exe.new
%ProgramFiles%\MSN Gaming Zone\Windows\shvlres.dll.new
%ProgramFiles%\MSN Gaming Zone\Windows\shvl.dll.new
%ProgramFiles%\NetMeeting\nmas.dll.new
%ProgramFiles%\NetMeeting\nac.dll.new
%ProgramFiles%\NetMeeting\mst123.dll.new
%ProgramFiles%\NetMeeting\nmasnt.dll.new
%ProgramFiles%\NetMeeting\nmft.dll.new
%ProgramFiles%\NetMeeting\nmcom.dll.new
%ProgramFiles%\NetMeeting\nmchat.dll.new
%ProgramFiles%\NetMeeting\conf.exe.new
%ProgramFiles%\NetMeeting\cb32.exe.new
%ProgramFiles%\NetMeeting\callcont.dll.new
%ProgramFiles%\NetMeeting\confmrsl.dll.new
%ProgramFiles%\NetMeeting\mst120.dll.new
%ProgramFiles%\NetMeeting\h323cc.dll.new
%ProgramFiles%\NetMeeting\dcap32.dll.new
%CommonProgramFiles%\System\msadc\msadcer.dll.new
%CommonProgramFiles%\System\msadc\msadce.dll.new
%CommonProgramFiles%\System\ado\msjro.dll.new
%CommonProgramFiles%\System\msadc\msadcf.dll.new
%CommonProgramFiles%\System\msadc\msadcor.dll.new
%CommonProgramFiles%\System\msadc\msadco.dll.new
%CommonProgramFiles%\System\msadc\msadcfr.dll.new
%CommonProgramFiles%\System\ado\msado27.tlb.new
%CommonProgramFiles%\System\ado\msado26.tlb.new
%CommonProgramFiles%\System\ado\msado25.tlb.new
%CommonProgramFiles%\System\ado\msadomd.dll.new
%CommonProgramFiles%\System\ado\msadrh15.dll.new
%CommonProgramFiles%\System\ado\msadox.dll.new
%CommonProgramFiles%\System\ado\msador15.dll.new
%CommonProgramFiles%\System\Ole DB\msdaenum.dll.new
%CommonProgramFiles%\System\Ole DB\msdadc.dll.new
%CommonProgramFiles%\System\msadc\msdfmap.dll.new
%CommonProgramFiles%\System\Ole DB\msdaer.dll.new
%CommonProgramFiles%\System\Ole DB\msdaosp.dll.new
%CommonProgramFiles%\System\Ole DB\msdaorar.dll.new
%CommonProgramFiles%\System\Ole DB\msdaora.dll.new
%CommonProgramFiles%\System\msadc\msaddsr.dll.new
%CommonProgramFiles%\System\msadc\msadds.dll.new
%CommonProgramFiles%\System\msadc\msadcs.dll.new
%CommonProgramFiles%\System\msadc\msdaprsr.dll.new
%CommonProgramFiles%\System\msadc\msdaremr.dll.new
%CommonProgramFiles%\System\msadc\msdarem.dll.new
%CommonProgramFiles%\System\msadc\msdaprst.dll.new
%CommonProgramFiles%\Microsoft Shared\Triedit\triedit.dll.new
%CommonProgramFiles%\Microsoft Shared\Triedit\dhtmled.ocx.new
%CommonProgramFiles%\Microsoft Shared\Speech\1033\spcplui.dll.new
%CommonProgramFiles%\Microsoft Shared\VGX\vgx.dll.new
%CommonProgramFiles%\MSSoap\Binaries\wisc10.dll.new
%CommonProgramFiles%\MSSoap\Binaries\mssoap1.dll.new
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\fp4autl.dll.new
%CommonProgramFiles%\Microsoft Shared\MSInfo\ieinfo5.ocx.new
%CommonProgramFiles%\Microsoft Shared\DAO\dao360.dll.new
%TEMP%\1.tmp\2.bat
%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe.new
%CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe.new
%CommonProgramFiles%\Microsoft Shared\Speech\sapi.dll.new
%CommonProgramFiles%\Microsoft Shared\Speech\sapi.cpl.new
%CommonProgramFiles%\System\wab32res.dll.new
%CommonProgramFiles%\System\wab32.dll.new
%CommonProgramFiles%\System\directdb.dll.new
%CommonProgramFiles%\System\ado\msader15.dll.new
%CommonProgramFiles%\System\ado\msado21.tlb.new
%CommonProgramFiles%\System\ado\msado20.tlb.new
%CommonProgramFiles%\System\ado\msado15.dll.new
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\ltts1033.lxa.new
%CommonProgramFiles%\SpeechEngines\Microsoft\spcommon.dll.new
%CommonProgramFiles%\MSSoap\Binaries\Resources\1033\mssoapr.dll.new
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\r1033tts.lxa.new
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\spttseng.dll.new
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\sam.spd.new
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\sam.sdf.new
<SYSTEM32>\dllcache\msado21.tlb.new
<SYSTEM32>\dllcache\msado20.tlb.new
<SYSTEM32>\dllcache\msado15.dll.new
<SYSTEM32>\dllcache\msado25.tlb.new
<SYSTEM32>\dllcache\msadomd.dll.new
<SYSTEM32>\dllcache\msado27.tlb.new
<SYSTEM32>\dllcache\msado26.tlb.new
<SYSTEM32>\dllcache\spttseng.dll.new
<SYSTEM32>\dllcache\sam.spd.new
<SYSTEM32>\dllcache\sam.sdf.new
<SYSTEM32>\dllcache\directdb.dll.new
<SYSTEM32>\dllcache\msader15.dll.new
<SYSTEM32>\dllcache\wab32res.dll.new
<SYSTEM32>\dllcache\wab32.dll.new
<SYSTEM32>\dllcache\msadcor.dll.new
<SYSTEM32>\dllcache\msadco.dll.new
<SYSTEM32>\dllcache\msadcfr.dll.new
<SYSTEM32>\dllcache\msadcs.dll.new
<SYSTEM32>\dllcache\msdaprsr.dll.new
<SYSTEM32>\dllcache\msaddsr.dll.new
<SYSTEM32>\dllcache\msadds.dll.new
<SYSTEM32>\dllcache\msadrh15.dll.new
<SYSTEM32>\dllcache\msadox.dll.new
<SYSTEM32>\dllcache\msador15.dll.new
<SYSTEM32>\dllcache\msjro.dll.new
<SYSTEM32>\dllcache\msadcf.dll.new
<SYSTEM32>\dllcache\msadcer.dll.new
<SYSTEM32>\dllcache\msadce.dll.new
%CommonProgramFiles%\System\Ole DB\oledb32r.dll.new
%CommonProgramFiles%\System\Ole DB\oledb32.dll.new
%CommonProgramFiles%\System\Ole DB\msxactps.dll.new
%CommonProgramFiles%\System\Ole DB\sqlxmlx.dll.new
<SYSTEM32>\dllcache\msinfo32.exe.new
<SYSTEM32>\dllcache\ieinfo5.ocx.new
<SYSTEM32>\dllcache\dao360.dll.new
%CommonProgramFiles%\System\Ole DB\msdasql.dll.new
%CommonProgramFiles%\System\Ole DB\msdasc.dll.new
%CommonProgramFiles%\System\Ole DB\msdaps.dll.new
%CommonProgramFiles%\System\Ole DB\msdasqlr.dll.new
%CommonProgramFiles%\System\Ole DB\msdaurl.dll.new
%CommonProgramFiles%\System\Ole DB\msdatt.dll.new
%CommonProgramFiles%\System\Ole DB\msdatl3.dll.new
<SYSTEM32>\dllcache\wisc10.dll.new
<SYSTEM32>\dllcache\mssoap1.dll.new
<SYSTEM32>\dllcache\fp4autl.dll.new
<SYSTEM32>\dllcache\mssoapr.dll.new
<SYSTEM32>\dllcache\r1033tts.lxa.new
<SYSTEM32>\dllcache\ltts1033.lxa.new
<SYSTEM32>\dllcache\spcommon.dll.new
<SYSTEM32>\dllcache\sapisvr.exe.new
<SYSTEM32>\dllcache\sapi.dll.new
<SYSTEM32>\dllcache\sapi.cpl.new
<SYSTEM32>\dllcache\spcplui.dll.new
<SYSTEM32>\dllcache\vgx.dll.new
<SYSTEM32>\dllcache\triedit.dll.new
<SYSTEM32>\dllcache\dhtmled.ocx.new

Удаляет следующие файлы:

%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt
%WINDIR%\$NtUninstallWIC$\spuninst\updspapi.dll
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.exe
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.inf
%WINDIR%\AppPatch\AcGenral.dll
%WINDIR%\AppPatch\AcSpecfc.dll
%WINDIR%\AppPatch\AcXtrnal.dll
%WINDIR%\AppPatch\AcLayers.dll
%WINDIR%\AppPatch\AcLua.dll
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\updspapi.dll
%WINDIR%\$NtUninstallKB942288-v3$\reg00114
%WINDIR%\$NtUninstallKB942288-v3$\reg00115
%WINDIR%\$NtUninstallKB942288-v3$\reg00112
%WINDIR%\$NtUninstallKB942288-v3$\reg00113
%WINDIR%\$NtUninstallKB942288-v3$\reg00116
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.inf
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.txt
%WINDIR%\$NtUninstallKB942288-v3$\reg00117
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.exe
%WINDIR%\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\IEHost.dll
%WINDIR%\assembly\GAC\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\IEExecRemote.dll
%WINDIR%\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\ISymWrapper\1.0.5000.0__b03f5f7f11d50a3a\ISymWrapper.dll
%WINDIR%\assembly\GAC\ISymWrapper\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\IIEHost\1.0.5000.0__b03f5f7f11d50a3a\IIEHost.dll
%WINDIR%\assembly\GAC\IIEHost\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a\CustomMarshalers.dll
%WINDIR%\AppPatch\drvmain.sdb
%WINDIR%\AppPatch\msimain.sdb
%WINDIR%\AppPatch\apphelp.sdb
%WINDIR%\AppPatch\apph_sp.sdb
%WINDIR%\AppPatch\sysmain.sdb
%WINDIR%\assembly\GAC\cscompmgd\7.0.5000.0__b03f5f7f11d50a3a\cscompmgd.dll
%WINDIR%\assembly\GAC\cscompmgd\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\Accessibility\1.0.5000.0__b03f5f7f11d50a3a\Accessibility.dll
%WINDIR%\assembly\GAC\Accessibility\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\$NtUninstallKB942288-v3$\reg00086
%WINDIR%\$NtUninstallKB942288-v3$\reg00087
%WINDIR%\$NtUninstallKB942288-v3$\reg00084
%WINDIR%\$NtUninstallKB942288-v3$\reg00085
%WINDIR%\$NtUninstallKB942288-v3$\reg00088
%WINDIR%\$NtUninstallKB942288-v3$\reg00091
%WINDIR%\$NtUninstallKB942288-v3$\reg00092
%WINDIR%\$NtUninstallKB942288-v3$\reg00089
%WINDIR%\$NtUninstallKB942288-v3$\reg00090
%WINDIR%\$NtUninstallKB942288-v3$\reg00083
%WINDIR%\$NtUninstallKB942288-v3$\reg00076
%WINDIR%\$NtUninstallKB942288-v3$\reg00077
%WINDIR%\$NtUninstallKB942288-v3$\reg00074
%WINDIR%\$NtUninstallKB942288-v3$\reg00075
%WINDIR%\$NtUninstallKB942288-v3$\reg00078
%WINDIR%\$NtUninstallKB942288-v3$\reg00081
%WINDIR%\$NtUninstallKB942288-v3$\reg00082
%WINDIR%\$NtUninstallKB942288-v3$\reg00079
%WINDIR%\$NtUninstallKB942288-v3$\reg00080
%WINDIR%\$NtUninstallKB942288-v3$\reg00105
%WINDIR%\$NtUninstallKB942288-v3$\reg00106
%WINDIR%\$NtUninstallKB942288-v3$\reg00103
%WINDIR%\$NtUninstallKB942288-v3$\reg00104
%WINDIR%\$NtUninstallKB942288-v3$\reg00107
%WINDIR%\$NtUninstallKB942288-v3$\reg00110
%WINDIR%\$NtUninstallKB942288-v3$\reg00111
%WINDIR%\$NtUninstallKB942288-v3$\reg00108
%WINDIR%\$NtUninstallKB942288-v3$\reg00109
%WINDIR%\$NtUninstallKB942288-v3$\reg00102
%WINDIR%\$NtUninstallKB942288-v3$\reg00095
%WINDIR%\$NtUninstallKB942288-v3$\reg00096
%WINDIR%\$NtUninstallKB942288-v3$\reg00093
%WINDIR%\$NtUninstallKB942288-v3$\reg00094
%WINDIR%\$NtUninstallKB942288-v3$\reg00097
%WINDIR%\$NtUninstallKB942288-v3$\reg00100
%WINDIR%\$NtUninstallKB942288-v3$\reg00101
%WINDIR%\$NtUninstallKB942288-v3$\reg00098
%WINDIR%\$NtUninstallKB942288-v3$\reg00099
%WINDIR%\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
%WINDIR%\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
%WINDIR%\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
%WINDIR%\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
%WINDIR%\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\System.Windows.Forms.dll
%WINDIR%\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Services.dll
%WINDIR%\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\System.Runtime.Remoting.dll
%WINDIR%\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\System.Messaging.dll
%WINDIR%\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
%WINDIR%\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
%WINDIR%\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\System.Security.dll
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfd.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfkc.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normidna.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfc.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfkd.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\prc.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\prcp.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
%WINDIR%\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
%WINDIR%\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\System.Xml.dll
%WINDIR%\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bopomofo.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\ksc.nlp
%WINDIR%\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\big5.nlp
%WINDIR%\assembly\GAC\Microsoft_VsaVb\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\mscorcfg\1.0.5000.0__b03f5f7f11d50a3a\mscorcfg.dll
%WINDIR%\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\Microsoft_VsaVb\7.0.5000.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
%WINDIR%\assembly\GAC\mscorcfg\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
%WINDIR%\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\RegCode.dll
%WINDIR%\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
%WINDIR%\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
%WINDIR%\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
%WINDIR%\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\Microsoft.Vsa\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
%WINDIR%\assembly\GAC\Microsoft.Vsa\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\Microsoft.VisualC\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualC.dll
%WINDIR%\assembly\GAC\Microsoft.VisualC\7.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
%WINDIR%\assembly\GAC\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.dll
%WINDIR%\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
%WINDIR%\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\System.Management.dll
%WINDIR%\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.Thunk.dll
%WINDIR%\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\System.Data.dll
%WINDIR%\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Configuration.Install\1.0.5000.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
%WINDIR%\assembly\GAC\System.Configuration.Install\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\System.Data.OracleClient.dll
%WINDIR%\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
%WINDIR%\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\__AssemblyInfo__.ini
%WINDIR%\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Design.dll
%WINDIR%\$NtUninstallKB942288-v3$\reg00073
%WINDIR%\regedit.exe
%WINDIR%\REGLOCS.OLD
%WINDIR%\OEWABLog.txt
%WINDIR%\Prairie Wind.bmp
%WINDIR%\regopt.log
%WINDIR%\Santa Fe Stucco.bmp
%WINDIR%\sessmgr.setup.log
%WINDIR%\Rhododendron.bmp
%WINDIR%\River Sumida.bmp
%WINDIR%\ODBCINST.INI
%WINDIR%\msmqinst.log
%WINDIR%\netfxocm.log
%WINDIR%\msdfmap.ini
%WINDIR%\msgsocm.log
%WINDIR%\NOTEPAD.EXE
%WINDIR%\ocgen.log
%WINDIR%\ocmsn.log
%WINDIR%\nsreg.dat
%WINDIR%\ntdtcsetup.log
%WINDIR%\system.ini
%WINDIR%\tabletoc.log
%WINDIR%\spupdsvc.log
%WINDIR%\Sti_Trace.log
%WINDIR%\TASKMAN.EXE
%WINDIR%\twain_32.dll
%WINDIR%\twunk_16.exe
%WINDIR%\tsoc.log
%WINDIR%\twain.dll
%WINDIR%\Soap Bubbles.bmp
%WINDIR%\SET8.tmp
%WINDIR%\setupact.log
%WINDIR%\SET3.tmp
%WINDIR%\SET4.tmp
%WINDIR%\setupapi.log
%WINDIR%\sfk.exe
%WINDIR%\sleep.exe
%WINDIR%\setuperr.log
%WINDIR%\setuplog.txt
C:\Muldrop\dmp_0x88_0x30000
C:\Muldrop\dmp_0x8c_0x10000
C:\Muldrop\dmp_0x88_0x10000
C:\Muldrop\dmp_0x88_0x20000
C:\Muldrop\dmp_0x8c_0x20000
%WINDIR%\Blue Lace 16.bmp
%WINDIR%\clock.avi
C:\Muldrop\dmp_0x8c_0x30000
%WINDIR%\0.log
C:\Muldrop\dmp_0x80_0x30000
C:\Muldrop\dmp_0x198_0x20000
C:\Muldrop\dmp_0x198_0x30000
C:\Muldrop\2.cbu_0
C:\Muldrop\dmp_0x198_0x10000
C:\Muldrop\dmp_0x7c_0x10000
C:\Muldrop\dmp_0x80_0x10000
C:\Muldrop\dmp_0x80_0x20000
C:\Muldrop\dmp_0x7c_0x20000
C:\Muldrop\dmp_0x7c_0x30000
%WINDIR%\Greenstone.bmp
%WINDIR%\hh.exe
%WINDIR%\FeatherTexture.bmp
%WINDIR%\Gone Fishing.bmp
%WINDIR%\iis6.log
%WINDIR%\KB942288-v3.log
%WINDIR%\MedCtrOC.log
%WINDIR%\imsins.BAK
%WINDIR%\imsins.log
%WINDIR%\FaxSetup.log
%WINDIR%\COM+.log
%WINDIR%\comsetup.log
%WINDIR%\cmsetacl.log
%WINDIR%\Coffee Bean.bmp
%WINDIR%\control.ini
%WINDIR%\explorer.exe
%WINDIR%\explorer.scf
%WINDIR%\desktop.ini
%WINDIR%\DtcInstall.log
%WINDIR%\twunk_32.exe
%WINDIR%\$NtUninstallKB942288-v3$\reg00045
%WINDIR%\$NtUninstallKB942288-v3$\reg00046
%WINDIR%\$NtUninstallKB942288-v3$\reg00043
%WINDIR%\$NtUninstallKB942288-v3$\reg00044
%WINDIR%\$NtUninstallKB942288-v3$\reg00047
%WINDIR%\$NtUninstallKB942288-v3$\reg00052
%WINDIR%\$NtUninstallKB942288-v3$\reg00053
%WINDIR%\$NtUninstallKB942288-v3$\reg00048
%WINDIR%\$NtUninstallKB942288-v3$\reg00049
%WINDIR%\$NtUninstallKB942288-v3$\reg00042
%WINDIR%\$NtUninstallKB942288-v3$\reg00034
%WINDIR%\$NtUninstallKB942288-v3$\reg00035
%WINDIR%\$NtUninstallKB942288-v3$\reg00032
%WINDIR%\$NtUninstallKB942288-v3$\reg00033
%WINDIR%\$NtUninstallKB942288-v3$\reg00036
%WINDIR%\$NtUninstallKB942288-v3$\reg00040
%WINDIR%\$NtUninstallKB942288-v3$\reg00041
%WINDIR%\$NtUninstallKB942288-v3$\reg00037
%WINDIR%\$NtUninstallKB942288-v3$\reg00039
%WINDIR%\$NtUninstallKB942288-v3$\reg00066
%WINDIR%\$NtUninstallKB942288-v3$\reg00067
%WINDIR%\$NtUninstallKB942288-v3$\reg00064
%WINDIR%\$NtUninstallKB942288-v3$\reg00065
%WINDIR%\$NtUninstallKB942288-v3$\reg00068
%WINDIR%\$NtUninstallKB942288-v3$\reg00071
%WINDIR%\$NtUninstallKB942288-v3$\reg00072
%WINDIR%\$NtUninstallKB942288-v3$\reg00069
%WINDIR%\$NtUninstallKB942288-v3$\reg00070
%WINDIR%\$NtUninstallKB942288-v3$\reg00063
%WINDIR%\$NtUninstallKB942288-v3$\reg00056
%WINDIR%\$NtUninstallKB942288-v3$\reg00057
%WINDIR%\$NtUninstallKB942288-v3$\reg00054
%WINDIR%\$NtUninstallKB942288-v3$\reg00055
%WINDIR%\$NtUninstallKB942288-v3$\reg00058
%WINDIR%\$NtUninstallKB942288-v3$\reg00061
%WINDIR%\$NtUninstallKB942288-v3$\reg00062
%WINDIR%\$NtUninstallKB942288-v3$\reg00059
%WINDIR%\$NtUninstallKB942288-v3$\reg00060
%WINDIR%\Zapotec.bmp
%WINDIR%\_default.pif
%WINDIR%\wmsetup.log
%WINDIR%\WMSysPr9.prx
%WINDIR%\$NtUninstallKB942288-v3$\msi.dll
%WINDIR%\$NtUninstallKB942288-v3$\msimsg.dll
%WINDIR%\$NtUninstallKB942288-v3$\msisip.dll
%WINDIR%\$NtUninstallKB942288-v3$\msiexec.exe
%WINDIR%\$NtUninstallKB942288-v3$\msihnd.dll
%WINDIR%\winhlp32.exe
%WINDIR%\vbaddin.ini
%WINDIR%\vmmreg32.dll
%WINDIR%\updspapi.log
%WINDIR%\vb.ini
%WINDIR%\wiadebug.log
%WINDIR%\WindowsUpdate.log
%WINDIR%\winhelp.exe
%WINDIR%\wiaservc.log
%WINDIR%\win.ini
%WINDIR%\$NtUninstallKB942288-v3$\reg00025
%WINDIR%\$NtUninstallKB942288-v3$\reg00026
%WINDIR%\$NtUninstallKB942288-v3$\reg00023
%WINDIR%\$NtUninstallKB942288-v3$\reg00024
%WINDIR%\$NtUninstallKB942288-v3$\reg00027
%WINDIR%\$NtUninstallKB942288-v3$\reg00030
%WINDIR%\$NtUninstallKB942288-v3$\reg00031
%WINDIR%\$NtUninstallKB942288-v3$\reg00028
%WINDIR%\$NtUninstallKB942288-v3$\reg00029
%WINDIR%\$NtUninstallKB942288-v3$\reg00022
%WINDIR%\$NtUninstallKB942288-v3$\reg00015
%WINDIR%\$NtUninstallKB942288-v3$\reg00016
%WINDIR%\$NtUninstallKB942288-v3$\reg00013
%WINDIR%\$NtUninstallKB942288-v3$\reg00014
%WINDIR%\$NtUninstallKB942288-v3$\reg00017
%WINDIR%\$NtUninstallKB942288-v3$\reg00020
%WINDIR%\$NtUninstallKB942288-v3$\reg00021
%WINDIR%\$NtUninstallKB942288-v3$\reg00018
%WINDIR%\$NtUninstallKB942288-v3$\reg00019

Самоудаляется.

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней