Trojan.AVKill.11715

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

<Текущая директория>\nircmd.exe killprocess GTA_SA.EXE killprocess SYSTEM killprocess firefox.exe killprocess Steam.exe killprocess ts3client_win32.exe monitor off monitor on killprocess ts3client_win64.exe setdisplay 800 600 32 killprocess explorer.exe cdrom open c: cdrom open d: cdrom open a: cdrom open b: cdrom open e: cdrom open h: emptybin cdrom open f: cdrom open g:

Запускает на исполнение:

%WINDIR%\explorer.exe
<SYSTEM32>\net1.exe user %USERNAME% lol
<SYSTEM32>\cmd.exe /c ""%TEMP%\1.tmp\test.bat" "

Завершает или пытается завершить

следующие системные процессы:

%WINDIR%\Explorer.EXE

следующие пользовательские процессы:

firefox.exe

Изменения в файловой системе:

Создает следующие файлы:

<Текущая директория>\you_were_hackted.txt
C:\RECYCLER\S-1-5-21-1275210071-117609710-1801674531-500\desktop.ini
<Текущая директория>\nircmdc.exe
%TEMP%\1.tmp\test.bat
<Текущая директория>\nircmd.exe

Удаляет следующие файлы:

<SYSTEM32>\config\systemprofile\Templates\wordpfct.wpd
<SYSTEM32>\config\systemprofile\Templates\wordpfct.wpg
<SYSTEM32>\config\TempKey.LOG
<SYSTEM32>\config\systemprofile\Templates\winword2.doc
<SYSTEM32>\config\systemprofile\Templates\quattro.wb2
<SYSTEM32>\config\systemprofile\Templates\sndrec.wav
<SYSTEM32>\config\systemprofile\Templates\winword.doc
<SYSTEM32>\config\userdiff
<SYSTEM32>\conime.exe
<SYSTEM32>\console.dll
<SYSTEM32>\control.exe
<SYSTEM32>\confmsp.dll
<SYSTEM32>\config\userdiff.LOG
<SYSTEM32>\CONFIG.NT
<SYSTEM32>\CONFIG.TMP
<SYSTEM32>\config\systemprofile\Templates\presenta.shw
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Tour Windows XP.lnk
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Windows Explorer.lnk
<SYSTEM32>\config\systemprofile\Start Menu\Programs\desktop.ini
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Synchronize.lnk
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Entertainment\Windows Media Player.lnk
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Notepad.lnk
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Program Compatibility Wizard.lnk
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Remote Assistance.lnk
<SYSTEM32>\config\systemprofile\Templates\excel4.xls
<SYSTEM32>\config\systemprofile\Templates\lotus.wk4
<SYSTEM32>\config\systemprofile\Templates\powerpnt.ppt
<SYSTEM32>\config\systemprofile\Templates\excel.xls
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Startup\desktop.ini
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Windows Media Player.lnk
<SYSTEM32>\config\systemprofile\Templates\amipro.sam
<SYSTEM32>\ctype.nls
<SYSTEM32>\cygwin1.dll
<SYSTEM32>\c_037.nls
<SYSTEM32>\ctl3dv2.dll
<SYSTEM32>\csseqchk.dll
<SYSTEM32>\ctfmon.exe
<SYSTEM32>\ctl3d32.dll
<SYSTEM32>\c_10000.nls
<SYSTEM32>\c_10029.nls
<SYSTEM32>\c_10079.nls
<SYSTEM32>\c_10081.nls
<SYSTEM32>\c_10017.nls
<SYSTEM32>\c_10006.nls
<SYSTEM32>\c_10007.nls
<SYSTEM32>\c_10010.nls
<SYSTEM32>\csrss.exe
<SYSTEM32>\crtdll.dll
<SYSTEM32>\crypt32.dll
<SYSTEM32>\cryptdlg.dll
<SYSTEM32>\credui.dll
<SYSTEM32>\convert.exe
<SYSTEM32>\corpol.dll
<SYSTEM32>\country.sys
<SYSTEM32>\cryptdll.dll
<SYSTEM32>\cscdll.dll
<SYSTEM32>\cscui.dll
<SYSTEM32>\csrsrv.dll
<SYSTEM32>\cryptui.dll
<SYSTEM32>\cryptext.dll
<SYSTEM32>\cryptnet.dll
<SYSTEM32>\cryptsvc.dll
<SYSTEM32>\comsnap.dll
<SYSTEM32>\comsvcs.dll
<SYSTEM32>\comuid.dll
<SYSTEM32>\comres.dll
<SYSTEM32>\compobj.dll
<SYSTEM32>\compstui.dll
<SYSTEM32>\comrepl.dll
<SYSTEM32>\config\AppEvent.Evt
<SYSTEM32>\config\system.sav
<SYSTEM32>\config\systemprofile\Application Data\desktop.ini
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9
<SYSTEM32>\config\SysEvent.Evt
<SYSTEM32>\config\default.sav
<SYSTEM32>\config\SecEvent.Evt
<SYSTEM32>\config\software.sav
<SYSTEM32>\compmgmt.msc
<SYSTEM32>\Com\mtsadmin.tlb
<SYSTEM32>\comaddin.dll
<SYSTEM32>\comcat.dll
<SYSTEM32>\Com\comrereg.exe
<SYSTEM32>\Com\comempty.dat
<SYSTEM32>\Com\comexp.msc
<SYSTEM32>\Com\comrepl.exe
<SYSTEM32>\comctl32.dll
<SYSTEM32>\comp.exe
<SYSTEM32>\compact.exe
<SYSTEM32>\compatUI.dll
<SYSTEM32>\commdlg.dll
<SYSTEM32>\comdlg32.dll
<SYSTEM32>\comm.drv
<SYSTEM32>\command.com
<SYSTEM32>\config\systemprofile\SendTo\desktop.ini
<SYSTEM32>\config\systemprofile\SendTo\Mail Recipient.MAPIMail
<SYSTEM32>\config\systemprofile\Start Menu\desktop.ini
<SYSTEM32>\config\systemprofile\SendTo\Desktop (create shortcut).DeskLink
<SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\desktop.ini
<SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\desktop.ini
<SYSTEM32>\config\systemprofile\SendTo\Compressed (zipped) Folder.ZFSendToTarget
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\desktop.ini
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Command Prompt.lnk
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\desktop.ini
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Entertainment\desktop.ini
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\Utility Manager.lnk
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\Magnifier.lnk
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk
<SYSTEM32>\config\systemprofile\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk
<SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\desktop.ini
<SYSTEM32>\config\systemprofile\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_59R.wmdb
<SYSTEM32>\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.DTD
<SYSTEM32>\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML
<SYSTEM32>\config\systemprofile\Cookies\index.dat
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\Internet Explorer\brndlog.bak
<SYSTEM32>\config\systemprofile\Application Data\Microsoft\Internet Explorer\brndlog.txt
<SYSTEM32>\config\systemprofile\Local Settings\desktop.ini
<SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\desktop.ini
<SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini
<SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
<SYSTEM32>\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\desktop.ini
<SYSTEM32>\config\systemprofile\Local Settings\History\desktop.ini
<SYSTEM32>\config\systemprofile\Local Settings\History\History.IE5\desktop.ini
<SYSTEM32>\config\systemprofile\Local Settings\History\History.IE5\index.dat
<SYSTEM32>\c_10082.nls
<SYSTEM32>\dfrgfat.exe
<SYSTEM32>\dfrgntfs.exe
<SYSTEM32>\dfrgres.dll
<SYSTEM32>\dfrg.msc
<SYSTEM32>\devenum.dll
<SYSTEM32>\devmgmt.msc
<SYSTEM32>\devmgr.dll
<SYSTEM32>\dfrgsnap.dll
<SYSTEM32>\dgrpsetu.dll
<SYSTEM32>\dgsetup.dll
<SYSTEM32>\dhcpcsvc.dll
<SYSTEM32>\dgnet.dll
<SYSTEM32>\dfrgui.dll
<SYSTEM32>\dfshim.dll
<SYSTEM32>\dfsshlex.dll
<SYSTEM32>\desktop.ini
<SYSTEM32>\dcomcnfg.exe
<SYSTEM32>\ddeml.dll
<SYSTEM32>\ddeshare.exe
<SYSTEM32>\dciman32.dll
<SYSTEM32>\dbnetlib.dll
<SYSTEM32>\dbnmpntw.dll
<SYSTEM32>\Dcache.bin
<SYSTEM32>\ddraw.dll
<SYSTEM32>\deskadp.dll
<SYSTEM32>\deskmon.dll
<SYSTEM32>\deskperf.dll
<SYSTEM32>\desk.cpl
<SYSTEM32>\ddrawex.dll
<SYSTEM32>\debug.exe
<SYSTEM32>\defrag.exe
<SYSTEM32>\DirectX\Dinput\gr4001_g.png
<SYSTEM32>\DirectX\Dinput\gr4003.ini
<SYSTEM32>\DirectX\Dinput\gr4003.png
<SYSTEM32>\DirectX\Dinput\gr4001_g.ini
<SYSTEM32>\DirectX\Dinput\gr3001_g.ini
<SYSTEM32>\DirectX\Dinput\gr4001.ini
<SYSTEM32>\DirectX\Dinput\gr4001.png
<SYSTEM32>\DirectX\Dinput\gr4005.ini
<SYSTEM32>\DirectX\Dinput\ia3002_2.png
<SYSTEM32>\DirectX\Dinput\lgc202.ini
<SYSTEM32>\DirectX\Dinput\lgc202.png
<SYSTEM32>\DirectX\Dinput\ia3002_1.png
<SYSTEM32>\DirectX\Dinput\gr4005.png
<SYSTEM32>\DirectX\Dinput\hammer.ini
<SYSTEM32>\DirectX\Dinput\ia3002.ini
<SYSTEM32>\DirectX\Dinput\gr3001.png
<SYSTEM32>\digest.dll
<SYSTEM32>\dimap.dll
<SYSTEM32>\dinput.dll
<SYSTEM32>\diantz.exe
<SYSTEM32>\dhcpmon.dll
<SYSTEM32>\dhcpsapi.dll
<SYSTEM32>\diactfrm.dll
<SYSTEM32>\dinput8.dll
<SYSTEM32>\DirectX\Dinput\glmdiggp.ini
<SYSTEM32>\DirectX\Dinput\glmdiggp.png
<SYSTEM32>\DirectX\Dinput\gr3001.ini
<SYSTEM32>\DirectX\Dinput\glmda.png
<SYSTEM32>\DirectX\Dinput\actc094.ini
<SYSTEM32>\DirectX\Dinput\act_rs.png
<SYSTEM32>\DirectX\Dinput\glmda.ini
<SYSTEM32>\C_28597.NLS
<SYSTEM32>\c_28598.nls
<SYSTEM32>\c_28599.nls
<SYSTEM32>\C_28595.NLS
<SYSTEM32>\c_28592.nls
<SYSTEM32>\c_28593.nls
<SYSTEM32>\C_28594.NLS
<SYSTEM32>\c_28603.nls
<SYSTEM32>\c_775.nls
<SYSTEM32>\c_850.nls
<SYSTEM32>\c_852.nls
<SYSTEM32>\c_737.nls
<SYSTEM32>\c_28605.nls
<SYSTEM32>\c_437.nls
<SYSTEM32>\c_500.nls
<SYSTEM32>\c_28591.nls
<SYSTEM32>\c_1253.nls
<SYSTEM32>\c_1254.nls
<SYSTEM32>\c_1255.nls
<SYSTEM32>\c_1252.nls
<SYSTEM32>\c_1026.nls
<SYSTEM32>\c_1250.nls
<SYSTEM32>\c_1251.nls
<SYSTEM32>\c_1256.nls
<SYSTEM32>\c_20866.nls
<SYSTEM32>\c_20905.nls
<SYSTEM32>\c_21866.nls
<SYSTEM32>\c_20261.nls
<SYSTEM32>\c_1257.nls
<SYSTEM32>\c_1258.nls
<SYSTEM32>\c_20127.nls
<SYSTEM32>\d3dramp.dll
<SYSTEM32>\d3drm.dll
<SYSTEM32>\d3dxof.dll
<SYSTEM32>\d3dpmesh.dll
<SYSTEM32>\d3d9.dll
<SYSTEM32>\d3dim.dll
<SYSTEM32>\d3dim700.dll
<SYSTEM32>\danim.dll
<SYSTEM32>\dbgeng.dll
<SYSTEM32>\dbghelp.dll
<SYSTEM32>\dbmsrpcn.dll
<SYSTEM32>\daxctle.ocx
<SYSTEM32>\dataclen.dll
<SYSTEM32>\datime.dll
<SYSTEM32>\davclnt.dll
<SYSTEM32>\d3d8thk.dll
<SYSTEM32>\c_863.nls
<SYSTEM32>\c_865.nls
<SYSTEM32>\c_866.nls
<SYSTEM32>\c_861.nls
<SYSTEM32>\c_855.nls
<SYSTEM32>\c_857.nls
<SYSTEM32>\c_860.nls
<SYSTEM32>\c_869.nls
<SYSTEM32>\c_949.nls
<SYSTEM32>\c_950.nls
<SYSTEM32>\d3d8.dll
<SYSTEM32>\c_936.nls
<SYSTEM32>\c_874.nls
<SYSTEM32>\c_875.nls
<SYSTEM32>\c_932.nls
<SYSTEM32>\audiosrv.dll
<SYSTEM32>\auditusr.exe
<SYSTEM32>\authz.dll
<SYSTEM32>\attrib.exe
<SYSTEM32>\atmlib.dll
<SYSTEM32>\atmpvcno.dll
<SYSTEM32>\atrace.dll
<SYSTEM32>\autochk.exe
<SYSTEM32>\autolfn.exe
<SYSTEM32>\avicap.dll
<SYSTEM32>\avicap32.dll
<SYSTEM32>\autofmt.exe
<SYSTEM32>\autoconv.exe
<SYSTEM32>\autodisc.dll
<SYSTEM32>\AUTOEXEC.NT
<SYSTEM32>\atmfd.dll
<SYSTEM32>\asferror.dll
<SYSTEM32>\aspnet_counters.dll
<SYSTEM32>\asr_fmt.exe
<SYSTEM32>\asctrls.ocx
<SYSTEM32>\appmgr.dll
<SYSTEM32>\appwiz.cpl
<SYSTEM32>\arp.exe
<SYSTEM32>\asr_ldm.exe
<SYSTEM32>\atl.dll
<SYSTEM32>\atl100.dll
<SYSTEM32>\atmadm.exe
<SYSTEM32>\atkctrs.dll
<SYSTEM32>\asr_pfu.exe
<SYSTEM32>\asycfilt.dll
<SYSTEM32>\at.exe
<SYSTEM32>\borlndmm.dll
<SYSTEM32>\browselc.dll
<SYSTEM32>\browser.dll
<SYSTEM32>\bopomofo.uce
<SYSTEM32>\bootok.exe
<SYSTEM32>\bootvid.dll
<SYSTEM32>\bootvrfy.exe
<SYSTEM32>\browseui.dll
<SYSTEM32>\btpanui.dll
<SYSTEM32>\cabinet.dll
<SYSTEM32>\cabview.dll
<SYSTEM32>\bthserv.dll
<SYSTEM32>\browsewm.dll
<SYSTEM32>\bthci.dll
<SYSTEM32>\bthprops.cpl
<SYSTEM32>\bootcfg.exe
<SYSTEM32>\avwav.dll
<SYSTEM32>\basesrv.dll
<SYSTEM32>\batmeter.dll
<SYSTEM32>\avtapi.dll
<SYSTEM32>\avifil32.dll
<SYSTEM32>\avifile.dll
<SYSTEM32>\avmeter.dll
<SYSTEM32>\batt.dll
<SYSTEM32>\bitsprx3.dll
<SYSTEM32>\blackbox.dll
<SYSTEM32>\blastcln.exe
<SYSTEM32>\bitsprx2.dll
<SYSTEM32>\bidispl.dll
<SYSTEM32>\bios1.rom
<SYSTEM32>\bios4.rom
%WINDIR%\system\TIMER.DRV
%WINDIR%\system\VER.DLL
%WINDIR%\system\VGA.DRV
%WINDIR%\system\TAPI.DLL
%WINDIR%\system\SOUND.DRV
%WINDIR%\system\stdole.tlb
%WINDIR%\system\SYSTEM.DRV
%WINDIR%\system\WFWNET.DRV
<SYSTEM32>\12520437.cpx
<SYSTEM32>\12520850.cpx
<SYSTEM32>\6to4svc.dll
<SYSTEM32>\1033\dwintl.dll
%WINDIR%\system\WINSPOOL.DRV
<SYSTEM32>\$winnt$.inf
<SYSTEM32>\-1
%WINDIR%\system\SHELL.DLL
%WINDIR%\system\LZEXPAND.DLL
%WINDIR%\system\MCIAVI.DRV
%WINDIR%\system\MCISEQ.DRV
%WINDIR%\system\KEYBOARD.DRV
%WINDIR%\system\AVICAP.DLL
%WINDIR%\system\AVIFILE.DLL
%WINDIR%\system\COMMDLG.DLL
%WINDIR%\system\MCIWAVE.DRV
%WINDIR%\system\OLECLI.DLL
%WINDIR%\system\OLESVR.DLL
%WINDIR%\system\setup.inf
%WINDIR%\system\MSVIDEO.DLL
%WINDIR%\system\MMSYSTEM.DLL
%WINDIR%\system\MMTASK.TSK
%WINDIR%\system\MOUSE.DRV
<SYSTEM32>\advpack.dll
<SYSTEM32>\ahui.exe
<SYSTEM32>\alg.exe
<SYSTEM32>\advapi32.dll
<SYSTEM32>\adsnds.dll
<SYSTEM32>\adsnt.dll
<SYSTEM32>\adsnw.dll
<SYSTEM32>\alrsvc.dll
<SYSTEM32>\append.exe
<SYSTEM32>\apphelp.dll
<SYSTEM32>\appmgmts.dll
<SYSTEM32>\apcups.dll
<SYSTEM32>\amcompat.tlb
<SYSTEM32>\amstream.dll
<SYSTEM32>\ansi.sys
<SYSTEM32>\adsmsext.dll
<SYSTEM32>\acelpdec.ax
<SYSTEM32>\acledit.dll
<SYSTEM32>\aclui.dll
<SYSTEM32>\accwiz.exe
<SYSTEM32>\aaaamon.dll
<SYSTEM32>\access.cpl
<SYSTEM32>\acctres.dll
<SYSTEM32>\activeds.dll
<SYSTEM32>\adptif.dll
<SYSTEM32>\adsldp.dll
<SYSTEM32>\adsldpc.dll
<SYSTEM32>\admparse.dll
<SYSTEM32>\activeds.tlb
<SYSTEM32>\actmovie.exe
<SYSTEM32>\actxprxy.dll
<SYSTEM32>\cacls.exe
<SYSTEM32>\cfgmgr32.dll
<SYSTEM32>\charmap.exe
<SYSTEM32>\chcp.com
<SYSTEM32>\cfgbkend.dll
<SYSTEM32>\certmgr.dll
<SYSTEM32>\certmgr.msc
<SYSTEM32>\cewmdm.dll
<SYSTEM32>\chkdsk.exe
<SYSTEM32>\cidaemon.exe
<SYSTEM32>\ciodm.dll
<SYSTEM32>\cipher.exe
<SYSTEM32>\cic.dll
<SYSTEM32>\chkntfs.exe
<SYSTEM32>\ciadmin.dll
<SYSTEM32>\ciadv.msc
<SYSTEM32>\certcli.dll
<SYSTEM32>\cc3270mt.dll
<SYSTEM32>\cc3280.dll
<SYSTEM32>\cc3280mt.dll
<SYSTEM32>\cc3270.dll
<SYSTEM32>\cc3250mt.dll
<SYSTEM32>\cc3260.dll
<SYSTEM32>\cc3260mt.dll
<SYSTEM32>\cc3290.dll
<SYSTEM32>\cdmodem.dll
<SYSTEM32>\cdosys.dll
<SYSTEM32>\cdplayer.exe.manifest
<SYSTEM32>\cdm.dll
<SYSTEM32>\cc3290mt.dll
<SYSTEM32>\ccfgnt.dll
<SYSTEM32>\cdfview.dll
<SYSTEM32>\cmos.ram
<SYSTEM32>\cmpbk32.dll
<SYSTEM32>\cmprops.dll
<SYSTEM32>\cmmon32.exe
<SYSTEM32>\cmdl32.exe
<SYSTEM32>\cmdlib.wsc
<SYSTEM32>\cmmgr32.hlp
<SYSTEM32>\cmsetACL.dll
<SYSTEM32>\cnvfat.dll
<SYSTEM32>\colbact.dll
<SYSTEM32>\Com\comadmin.dll
<SYSTEM32>\cnetcfg.dll
<SYSTEM32>\cmstp.exe
<SYSTEM32>\cmutil.dll
<SYSTEM32>\cnbjmon.dll
<SYSTEM32>\cmdial32.dll
<SYSTEM32>\clbcatq.dll
<SYSTEM32>\cleanmgr.exe
<SYSTEM32>\cliconf.chm
<SYSTEM32>\clbcatex.dll
<SYSTEM32>\cisvc.exe
<SYSTEM32>\ckcnv.exe
<SYSTEM32>\clb.dll
<SYSTEM32>\cliconfg.dll
<SYSTEM32>\clusapi.dll
<SYSTEM32>\cmcfg32.dll
<SYSTEM32>\cmd.exe
<SYSTEM32>\clipsrv.exe
<SYSTEM32>\cliconfg.exe
<SYSTEM32>\cliconfg.rll
<SYSTEM32>\clipbrd.exe
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\NT5.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\NT5IIS.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\NT5INF.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\netfx.cat
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\MSTSWEB.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\msxpsdrv.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\MW770.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\NTPRINT.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem5.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem6.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem0.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem1.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem2.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\msn9.cat
<SYSTEM32>\CatRoot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\TimeStamp
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\FP4.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HPCRDP.CAT
<SYSTEM32>\cards.dll
<SYSTEM32>\calc.exe
<SYSTEM32>\camocx.dll
<SYSTEM32>\capesnpn.dll
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\IASNT4.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\mediactr.cat
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\MSMSGS.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\msn7.cat
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\MAPIMIG.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\IMS.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB893803v2_wxp.cat
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB954550-v5.cat
<SYSTEM32>\CatRoot2\res1.log
<SYSTEM32>\CatRoot2\res2.log
<SYSTEM32>\CatRoot2\tmp.edb
<SYSTEM32>\CatRoot2\edb00018.log
<SYSTEM32>\CatRoot2\edb00015.log
<SYSTEM32>\CatRoot2\edb00016.log
<SYSTEM32>\CatRoot2\edb00017.log
<SYSTEM32>\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb
<SYSTEM32>\catsrvps.dll
<SYSTEM32>\catsrvut.dll
<SYSTEM32>\cc3250.dll
<SYSTEM32>\catsrv.dll
<SYSTEM32>\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\TimeStamp
<SYSTEM32>\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
<SYSTEM32>\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\TimeStamp
<SYSTEM32>\CatRoot2\edb00014.log
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\TimeStamp
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WIC.cat
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\wmerrenu.cat
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\tabletpc.cat
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem7.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\OEMBIOS.CAT
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\SP2.CAT
<SYSTEM32>\CatRoot2\dberr.txt
<SYSTEM32>\CatRoot2\edb00011.log
<SYSTEM32>\CatRoot2\edb00012.log
<SYSTEM32>\CatRoot2\edb00013.log
<SYSTEM32>\CatRoot2\edb00010.log
<SYSTEM32>\CatRoot2\edb.chk
<SYSTEM32>\CatRoot2\edb0000E.log
<SYSTEM32>\CatRoot2\edb0000F.log

Другое:

Ищет следующие окна:

ClassName: 'SysListView32' WindowName: ''
ClassName: 'OleMainThreadWndClass' WindowName: ''
ClassName: 'BaseBar' WindowName: 'ChanApp'
ClassName: 'Proxy Desktop' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней