Trojan.DownLoader30.26284

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\Windows Help System Myss] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\Windows Help System Myss] 'ImagePath' = '%WINDIR%\jahxas.exe'

Creates the following files on removable media

<Drive name for removable media>:\lpk.dll

Modifies file system

Creates the following files

%WINDIR%\jahxas.exe
%ProgramFiles%\ccproxy\lpk.dll
%ProgramFiles%\ccsetmgr\lpk.dll
%ProgramFiles%\cemrep\lpk.dll
%ProgramFiles%\chrome\lpk.dll
%ProgramFiles%\clamscan\lpk.dll
%ProgramFiles%\clamtray\lpk.dll
%ProgramFiles%\clamwin\lpk.dll
%ProgramFiles%\claw95\lpk.dll
%ProgramFiles%\claw95cf\lpk.dll
%ProgramFiles%\cleaner\lpk.dll
%ProgramFiles%\cleaner3\lpk.dll
%ProgramFiles%\clisvc\lpk.dll
%ProgramFiles%\clrcche\lpk.dll
%ProgramFiles%\cmain\lpk.dll
%ProgramFiles%\cmgrdian\lpk.dll
%CommonProgramFiles%\microsoft shared\dw\lpk.dll
%CommonProgramFiles%\microsoft shared\equation\lpk.dll
%CommonProgramFiles%\microsoft shared\ink\lpk.dll
%CommonProgramFiles%\microsoft shared\msinfo\lpk.dll
%CommonProgramFiles%\microsoft shared\office14\lpk.dll
%CommonProgramFiles%\microsoft shared\office14\office setup controller\lpk.dll
%ProgramFiles%\ccleaner\lpk.dll
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\lpk.dll
%ProgramFiles%\ccevtmgr\lpk.dll
%ProgramFiles%\cavvl\lpk.dll
%ProgramFiles%\blackice\lpk.dll
%ProgramFiles%\blindman\lpk.dll
%ProgramFiles%\btini\lpk.dll
%ProgramFiles%\btinint\lpk.dll
%ProgramFiles%\cabalmain\lpk.dll
%ProgramFiles%\cafix\lpk.dll
%ProgramFiles%\cavapp\lpk.dll
%ProgramFiles%\cavasm\lpk.dll
%ProgramFiles%\cavaud\lpk.dll
%ProgramFiles%\cavemsrv\lpk.dll
%ProgramFiles%\cavmr\lpk.dll
%ProgramFiles%\cavmud\lpk.dll
%ProgramFiles%\cavoar\lpk.dll
%ProgramFiles%\cavq\lpk.dll
%ProgramFiles%\cavscons\lpk.dll
%ProgramFiles%\cavse\lpk.dll
%ProgramFiles%\cavsn\lpk.dll
%ProgramFiles%\cavsub\lpk.dll
%ProgramFiles%\cavsubmit\lpk.dll
%ProgramFiles%\cavumas\lpk.dll
%ProgramFiles%\cavuserupd\lpk.dll
%ProgramFiles%\ccapp\lpk.dll
%CommonProgramFiles%\microsoft shared\smart tag\lpk.dll
%CommonProgramFiles%\microsoft shared\source engine\lpk.dll
%CommonProgramFiles%\microsoft shared\vsto\10.0\lpk.dll
%ProgramFiles%\drwebupw\lpk.dll
%ProgramFiles%\drwebwcl\lpk.dll
%ProgramFiles%\drwreg\lpk.dll
%ProgramFiles%\dvd maker\lpk.dll
%ProgramFiles%\ecmd\lpk.dll
%ProgramFiles%\egni\lpk.dll
%ProgramFiles%\ehsniffer\lpk.dll
%ProgramFiles%\ekrn\lpk.dll
%ProgramFiles%\elementclient\lpk.dll
%ProgramFiles%\filezilla\lpk.dll
%ProgramFiles%\etherd\lpk.dll
%ProgramFiles%\ewidoctrl\lpk.dll
%ProgramFiles%\exit_av\lpk.dll
%ProgramFiles%\ezantivirusregistrationcheck\lpk.dll
%ProgramFiles%\f-sched\lpk.dll
%ProgramFiles%\fameh32\lpk.dll
%ProgramFiles%\far\lpk.dll
%ProgramFiles%\fch32\lpk.dll
%ProgramFiles%\fdm\lpk.dll
%ProgramFiles%\fdmwi\lpk.dll
%ProgramFiles%\drweb386\lpk.dll
%ProgramFiles%\drwebscd\lpk.dll
%ProgramFiles%\drweb32w\lpk.dll
%ProgramFiles%\drweb\lpk.dll
%ProgramFiles%\drwadins\lpk.dll
%ProgramFiles%\courier\lpk.dll
%ProgramFiles%\cpd\lpk.dll
%ProgramFiles%\csendto\lpk.dll
%ProgramFiles%\cssexc\lpk.dll
%ProgramFiles%\custinstall\lpk.dll
%ProgramFiles%\custsetup\lpk.dll
%ProgramFiles%\cuteftp\lpk.dll
%ProgramFiles%\dbconvert\lpk.dll
%ProgramFiles%\dbtool\lpk.dll
%ProgramFiles%\blackd\lpk.dll
%ProgramFiles%\defwatch\lpk.dll
%ProgramFiles%\defensewall\lpk.dll
%ProgramFiles%\digsby\lpk.dll
%ProgramFiles%\digsby-app\lpk.dll
%ProgramFiles%\directftp\lpk.dll
%ProgramFiles%\dislite\lpk.dll
%ProgramFiles%\dnf\lpk.dll
%ProgramFiles%\dpatrolq\lpk.dll
%ProgramFiles%\drvctl\lpk.dll
%ProgramFiles%\drvirus\lpk.dll
%ProgramFiles%\drvmap\lpk.dll
%ProgramFiles%\copyx64\lpk.dll
%ProgramFiles%\dekaron\lpk.dll
%ProgramFiles%\eudora\lpk.dll
%ProgramFiles%\bdwizreg\lpk.dll
%ProgramFiles%\avsynmgr\lpk.dll
%ProgramFiles%\almon\lpk.dll
%ProgramFiles%\alsvc\lpk.dll
%ProgramFiles%\amon\lpk.dll
%ProgramFiles%\amsn\lpk.dll
%ProgramFiles%\anti-trojan\lpk.dll
%ProgramFiles%\antivirus\lpk.dll
%ProgramFiles%\aoltbserver\lpk.dll
%ProgramFiles%\armor2net\lpk.dll
%ProgramFiles%\armorsurf\lpk.dll
%ProgramFiles%\ash\lpk.dll
%ProgramFiles%\ashavast\lpk.dll
%ProgramFiles%\ashavsrv\lpk.dll
%ProgramFiles%\ashchest\lpk.dll
%ProgramFiles%\ashdisp\lpk.dll
%ProgramFiles%\ashdug\lpk.dll
%ProgramFiles%\ashenhcd\lpk.dll
%ProgramFiles%\ashlogv\lpk.dll
%ProgramFiles%\ashmaisv\lpk.dll
%ProgramFiles%\ashpopwz\lpk.dll
%ProgramFiles%\ashquick\lpk.dll
%ProgramFiles%\ashserv\lpk.dll
%ProgramFiles%\airdefense\lpk.dll
%ProgramFiles%\ashsimp2\lpk.dll
%ProgramFiles%\aimpro\lpk.dll
%ProgramFiles%\ahnsd\lpk.dll
%WINDIR%\syswow64\hra8.dll
C:\rcxbf9d.tmp
%WINDIR%\temp\hrlbfbe.tmp
C:\far2\lpk.dll
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\lpk.dll
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\lpk.dll
%ProgramFiles%\360tray\lpk.dll
%ProgramFiles%\a2cmd\lpk.dll
%ProgramFiles%\a2guard\lpk.dll
%ProgramFiles%\a2hijackfree\lpk.dll
%ProgramFiles%\a2scan\lpk.dll
%ProgramFiles%\a2service\lpk.dll
%ProgramFiles%\a2start\lpk.dll
%ProgramFiles%\a2upd\lpk.dll
%ProgramFiles%\a2wizard\lpk.dll
%ProgramFiles%\aavshield\lpk.dll
%ProgramFiles%\about\lpk.dll
%ProgramFiles%\ackwin32\lpk.dll
%ProgramFiles%\admunch\lpk.dll
%ProgramFiles%\agb5\lpk.dll
%ProgramFiles%\ageofconan\lpk.dll
%ProgramFiles%\aim6\lpk.dll
%ProgramFiles%\ashsimpl\lpk.dll
%ProgramFiles%\ashskpcc\lpk.dll
%ProgramFiles%\ashskpck\lpk.dll
%ProgramFiles%\avgw\lpk.dll
%ProgramFiles%\avgwizfw\lpk.dll
%ProgramFiles%\avinitnt\lpk.dll
%ProgramFiles%\avkserv\lpk.dll
%ProgramFiles%\avkservice\lpk.dll
%ProgramFiles%\avkwctl\lpk.dll
%ProgramFiles%\avnotify\lpk.dll
%ProgramFiles%\avpcc\lpk.dll
%ProgramFiles%\avpm\lpk.dll
%ProgramFiles%\bdsurvey\lpk.dll
%ProgramFiles%\avscan\lpk.dll
%ProgramFiles%\b2\lpk.dll
%ProgramFiles%\backweb-4476822\lpk.dll
%ProgramFiles%\bdagent\lpk.dll
%ProgramFiles%\bdmcon\lpk.dll
%ProgramFiles%\bdnews\lpk.dll
%ProgramFiles%\bdoesrv\lpk.dll
%ProgramFiles%\bdss\lpk.dll
%ProgramFiles%\bdsubmit\lpk.dll
%ProgramFiles%\bdsubmitwiz\lpk.dll
%ProgramFiles%\avgupsvc\lpk.dll
%ProgramFiles%\avgvv\lpk.dll
%ProgramFiles%\avgupden\lpk.dll
%ProgramFiles%\avgscan\lpk.dll
%ProgramFiles%\avgrssvc\lpk.dll
%ProgramFiles%\ashwebsv\lpk.dll
%ProgramFiles%\ash_updatemediator\lpk.dll
%ProgramFiles%\aswregsvr\lpk.dll
%ProgramFiles%\aswupdsv\lpk.dll
%ProgramFiles%\autodown\lpk.dll
%ProgramFiles%\autostartexplorer\lpk.dll
%ProgramFiles%\autotrace\lpk.dll
%ProgramFiles%\avadmin\lpk.dll
%ProgramFiles%\avcenter\lpk.dll
%ProgramFiles%\bdswitch\lpk.dll
%ProgramFiles%\avcmd\lpk.dll
%ProgramFiles%\avciman\lpk.dll
%ProgramFiles%\avconsol\lpk.dll
%ProgramFiles%\avgamsvr\lpk.dll
%ProgramFiles%\avgcc\lpk.dll
%ProgramFiles%\avgdiag\lpk.dll
%ProgramFiles%\avgemc\lpk.dll
%ProgramFiles%\avgfwsrv\lpk.dll
%ProgramFiles%\avginet\lpk.dll
%ProgramFiles%\avgnpdln\lpk.dll
%ProgramFiles%\avgnpsvc\lpk.dll
%ProgramFiles%\ashupd\lpk.dll
%ProgramFiles%\avconfig\lpk.dll
%ProgramFiles%\firebird\lpk.dll

Sets the 'hidden' attribute to the following files

<Drive name for removable media>:\lpk.dll
%ProgramFiles%\chrome\lpk.dll
%ProgramFiles%\clamscan\lpk.dll
%ProgramFiles%\clamtray\lpk.dll
%ProgramFiles%\clamwin\lpk.dll
%ProgramFiles%\claw95\lpk.dll
%ProgramFiles%\claw95cf\lpk.dll
%ProgramFiles%\cleaner\lpk.dll
%ProgramFiles%\cleaner3\lpk.dll
%ProgramFiles%\ccsetmgr\lpk.dll
%ProgramFiles%\cemrep\lpk.dll
%ProgramFiles%\clisvc\lpk.dll
%ProgramFiles%\cmgrdian\lpk.dll
%CommonProgramFiles%\microsoft shared\dw\lpk.dll
%CommonProgramFiles%\microsoft shared\equation\lpk.dll
%CommonProgramFiles%\microsoft shared\ink\lpk.dll
%CommonProgramFiles%\microsoft shared\msinfo\lpk.dll
%CommonProgramFiles%\microsoft shared\office14\lpk.dll
%CommonProgramFiles%\microsoft shared\office14\office setup controller\lpk.dll
%CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\lpk.dll
%ProgramFiles%\clrcche\lpk.dll
%ProgramFiles%\cmain\lpk.dll
%ProgramFiles%\ccproxy\lpk.dll
%ProgramFiles%\ccevtmgr\lpk.dll
%CommonProgramFiles%\microsoft shared\source engine\lpk.dll
%ProgramFiles%\cabalmain\lpk.dll
%ProgramFiles%\cafix\lpk.dll
%ProgramFiles%\cavapp\lpk.dll
%ProgramFiles%\cavasm\lpk.dll
%ProgramFiles%\cavaud\lpk.dll
%ProgramFiles%\cavemsrv\lpk.dll
%ProgramFiles%\cavmr\lpk.dll
%ProgramFiles%\cavmud\lpk.dll
%ProgramFiles%\cavoar\lpk.dll
%ProgramFiles%\cavq\lpk.dll
%ProgramFiles%\cavscons\lpk.dll
%ProgramFiles%\cavse\lpk.dll
%ProgramFiles%\cavsn\lpk.dll
%ProgramFiles%\cavsub\lpk.dll
%ProgramFiles%\cavsubmit\lpk.dll
%ProgramFiles%\cavumas\lpk.dll
%ProgramFiles%\cavuserupd\lpk.dll
%ProgramFiles%\cavvl\lpk.dll
%ProgramFiles%\ccapp\lpk.dll
%CommonProgramFiles%\microsoft shared\smart tag\lpk.dll
%ProgramFiles%\btini\lpk.dll
%ProgramFiles%\ccleaner\lpk.dll
%ProgramFiles%\avgupsvc\lpk.dll
%CommonProgramFiles%\microsoft shared\vsto\10.0\lpk.dll
%ProgramFiles%\drwebscd\lpk.dll
%ProgramFiles%\drwebupw\lpk.dll
%ProgramFiles%\drwebwcl\lpk.dll
%ProgramFiles%\drwreg\lpk.dll
%ProgramFiles%\dvd maker\lpk.dll
%ProgramFiles%\ecmd\lpk.dll
%ProgramFiles%\egni\lpk.dll
%ProgramFiles%\ehsniffer\lpk.dll
%ProgramFiles%\ekrn\lpk.dll
%ProgramFiles%\elementclient\lpk.dll
%ProgramFiles%\etherd\lpk.dll
%ProgramFiles%\eudora\lpk.dll
%ProgramFiles%\ewidoctrl\lpk.dll
%ProgramFiles%\exit_av\lpk.dll
%ProgramFiles%\ezantivirusregistrationcheck\lpk.dll
%ProgramFiles%\f-sched\lpk.dll
%ProgramFiles%\fameh32\lpk.dll
%ProgramFiles%\far\lpk.dll
%ProgramFiles%\fch32\lpk.dll
%ProgramFiles%\fdm\lpk.dll
%ProgramFiles%\fdmwi\lpk.dll
%ProgramFiles%\drweb386\lpk.dll
%ProgramFiles%\blindman\lpk.dll
%ProgramFiles%\btinint\lpk.dll
%ProgramFiles%\drwadins\lpk.dll
%ProgramFiles%\courier\lpk.dll
%ProgramFiles%\cpd\lpk.dll
%ProgramFiles%\csendto\lpk.dll
%ProgramFiles%\cssexc\lpk.dll
%ProgramFiles%\custinstall\lpk.dll
%ProgramFiles%\custsetup\lpk.dll
%ProgramFiles%\cuteftp\lpk.dll
%ProgramFiles%\dbconvert\lpk.dll
%ProgramFiles%\dbtool\lpk.dll
%ProgramFiles%\defensewall\lpk.dll
%ProgramFiles%\defwatch\lpk.dll
%ProgramFiles%\dekaron\lpk.dll
%ProgramFiles%\digsby\lpk.dll
%ProgramFiles%\digsby-app\lpk.dll
%ProgramFiles%\directftp\lpk.dll
%ProgramFiles%\dislite\lpk.dll
%ProgramFiles%\dnf\lpk.dll
%ProgramFiles%\dpatrolq\lpk.dll
%ProgramFiles%\drvctl\lpk.dll
%ProgramFiles%\drvirus\lpk.dll
%ProgramFiles%\drvmap\lpk.dll
%ProgramFiles%\drweb\lpk.dll
%ProgramFiles%\copyx64\lpk.dll
%ProgramFiles%\blackice\lpk.dll
%ProgramFiles%\blackd\lpk.dll
%ProgramFiles%\bdwizreg\lpk.dll
%ProgramFiles%\antivirus\lpk.dll
%ProgramFiles%\aoltbserver\lpk.dll
%ProgramFiles%\armor2net\lpk.dll
%ProgramFiles%\armorsurf\lpk.dll
%ProgramFiles%\ash\lpk.dll
%ProgramFiles%\ashavast\lpk.dll
%ProgramFiles%\ashavsrv\lpk.dll
%ProgramFiles%\ashchest\lpk.dll
%ProgramFiles%\ashdisp\lpk.dll
%ProgramFiles%\ashdug\lpk.dll
%ProgramFiles%\ashenhcd\lpk.dll
%ProgramFiles%\ashlogv\lpk.dll
%ProgramFiles%\ashmaisv\lpk.dll
%ProgramFiles%\ashpopwz\lpk.dll
%ProgramFiles%\ashquick\lpk.dll
%ProgramFiles%\ashserv\lpk.dll
%ProgramFiles%\ashsimp2\lpk.dll
%ProgramFiles%\ashsimpl\lpk.dll
%ProgramFiles%\ashskpcc\lpk.dll
%ProgramFiles%\amon\lpk.dll
%ProgramFiles%\almon\lpk.dll
%ProgramFiles%\anti-trojan\lpk.dll
%ProgramFiles%\filezilla\lpk.dll
%ProgramFiles%\ashskpck\lpk.dll
%ProgramFiles%\airdefense\lpk.dll
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\lpk.dll
C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\lpk.dll
%ProgramFiles%\360tray\lpk.dll
%ProgramFiles%\a2cmd\lpk.dll
%ProgramFiles%\a2guard\lpk.dll
%ProgramFiles%\a2hijackfree\lpk.dll
%ProgramFiles%\a2scan\lpk.dll
%ProgramFiles%\a2service\lpk.dll
%ProgramFiles%\a2start\lpk.dll
C:\far2\lpk.dll
%ProgramFiles%\a2upd\lpk.dll
%ProgramFiles%\aavshield\lpk.dll
%ProgramFiles%\about\lpk.dll
%ProgramFiles%\ackwin32\lpk.dll
%ProgramFiles%\admunch\lpk.dll
%ProgramFiles%\agb5\lpk.dll
%ProgramFiles%\ageofconan\lpk.dll
%ProgramFiles%\ahnsd\lpk.dll
%ProgramFiles%\aim6\lpk.dll
%ProgramFiles%\aimpro\lpk.dll
%ProgramFiles%\a2wizard\lpk.dll
%ProgramFiles%\alsvc\lpk.dll
%ProgramFiles%\drweb32w\lpk.dll
%ProgramFiles%\ashupd\lpk.dll
%ProgramFiles%\aswregsvr\lpk.dll
%ProgramFiles%\avinitnt\lpk.dll
%ProgramFiles%\avkserv\lpk.dll
%ProgramFiles%\avkservice\lpk.dll
%ProgramFiles%\avkwctl\lpk.dll
%ProgramFiles%\avnotify\lpk.dll
%ProgramFiles%\avpcc\lpk.dll
%ProgramFiles%\avpm\lpk.dll
%ProgramFiles%\avscan\lpk.dll
%ProgramFiles%\avsynmgr\lpk.dll
%ProgramFiles%\b2\lpk.dll
%ProgramFiles%\backweb-4476822\lpk.dll
%ProgramFiles%\bdagent\lpk.dll
%ProgramFiles%\bdmcon\lpk.dll
%ProgramFiles%\bdnews\lpk.dll
%ProgramFiles%\bdoesrv\lpk.dll
%ProgramFiles%\bdss\lpk.dll
%ProgramFiles%\bdsubmit\lpk.dll
%ProgramFiles%\bdsubmitwiz\lpk.dll
%ProgramFiles%\bdsurvey\lpk.dll
%ProgramFiles%\bdswitch\lpk.dll
%ProgramFiles%\ashwebsv\lpk.dll
%ProgramFiles%\avgwizfw\lpk.dll
%ProgramFiles%\ash_updatemediator\lpk.dll
%ProgramFiles%\avgw\lpk.dll
%ProgramFiles%\amsn\lpk.dll
%ProgramFiles%\aswupdsv\lpk.dll
%ProgramFiles%\autodown\lpk.dll
%ProgramFiles%\autostartexplorer\lpk.dll
%ProgramFiles%\autotrace\lpk.dll
%ProgramFiles%\avadmin\lpk.dll
%ProgramFiles%\avcenter\lpk.dll
%ProgramFiles%\avciman\lpk.dll
%ProgramFiles%\avcmd\lpk.dll
%ProgramFiles%\avconfig\lpk.dll
%ProgramFiles%\avconsol\lpk.dll
%ProgramFiles%\avgamsvr\lpk.dll
%ProgramFiles%\avgcc\lpk.dll
%ProgramFiles%\avgdiag\lpk.dll
%ProgramFiles%\avgemc\lpk.dll
%ProgramFiles%\avgfwsrv\lpk.dll
%ProgramFiles%\avginet\lpk.dll
%ProgramFiles%\avgnpdln\lpk.dll
%ProgramFiles%\avgnpsvc\lpk.dll
%ProgramFiles%\avgrssvc\lpk.dll
%ProgramFiles%\avgscan\lpk.dll
%ProgramFiles%\avgupden\lpk.dll
%ProgramFiles%\avgvv\lpk.dll
%ProgramFiles%\firebird\lpk.dll

Moves the following files

from C:\rcxbf9d.tmp to %WINDIR%\syswow64\hra8.dll

Moves itself

from <Full path to file> to %TEMP%\bce3ec

Network activity

Connects to

'12#.#0.168.56':6745

UDP

DNS ASK my##.ter.tf

Miscellaneous

Creates and executes the following

'%WINDIR%\jahxas.exe'
'%WINDIR%\temp\hrlbfbe.tmp'
'%WINDIR%\syswow64\cmd.exe' /c %ProgramFiles%\WinRAR\rar.exe vb "<Drive name for removable media>:\removedtitles_records.zip" lpk.dll|find /i "lpk.dll"' (with hidden window)
'%ProgramFiles%\WinRAR\Rar.exe' a -r -ep1"%WINDIR%\TEMP\IRA754.tmp" "<Drive name for removable media>:\excel_example.zip" "%WINDIR%\TEMP\IRA754.tmp\lpk.dll"' (with hidden window)
'%ProgramFiles%\WinRAR\Rar.exe' x "<Drive name for removable media>:\excel_example.zip" *.exe "%WINDIR%\TEMP\IRA754.tmp\"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %ProgramFiles%\WinRAR\rar.exe vb "<Drive name for removable media>:\excel_example.zip" lpk.dll|find /i "lpk.dll"' (with hidden window)
'%ProgramFiles%\WinRAR\Rar.exe' a -r -ep1"%WINDIR%\TEMP\IRA754.tmp" "<Drive name for removable media>:\price030215.zip" "%WINDIR%\TEMP\IRA754.tmp\lpk.dll"' (with hidden window)
'%ProgramFiles%\WinRAR\Rar.exe' x "<Drive name for removable media>:\price030215.zip" *.exe "%WINDIR%\TEMP\IRA754.tmp\"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %ProgramFiles%\WinRAR\rar.exe vb "<Drive name for removable media>:\price030215.zip" lpk.dll|find /i "lpk.dll"' (with hidden window)
'%ProgramFiles%\WinRAR\Rar.exe' a -r -ep1"%WINDIR%\TEMP\IRA754.tmp" "<Drive name for removable media>:\calculatorworksheet.zip" "%WINDIR%\TEMP\IRA754.tmp\lpk.dll"' (with hidden window)
'%ProgramFiles%\WinRAR\Rar.exe' x "<Drive name for removable media>:\calculatorworksheet.zip" *.exe "%WINDIR%\TEMP\IRA754.tmp\"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %ProgramFiles%\WinRAR\rar.exe vb "<Drive name for removable media>:\calculatorworksheet.zip" lpk.dll|find /i "lpk.dll"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c RD /s /q "%WINDIR%\TEMP\IRA754.tmp"' (with hidden window)
'%ProgramFiles%\WinRAR\Rar.exe' a -r -ep1"%WINDIR%\TEMP\IRA754.tmp" "<Drive name for removable media>:\subjectclassification.zip" "%WINDIR%\TEMP\IRA754.tmp\lpk.dll"' (with hidden window)
'%ProgramFiles%\WinRAR\Rar.exe' x "<Drive name for removable media>:\subjectclassification.zip" *.exe "%WINDIR%\TEMP\IRA754.tmp\"' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c %ProgramFiles%\WinRAR\rar.exe vb "<Drive name for removable media>:\subjectclassification.zip" lpk.dll|find /i "lpk.dll"' (with hidden window)
'%WINDIR%\temp\hrlbfbe.tmp' ' (with hidden window)
'%ProgramFiles%\WinRAR\Rar.exe' x "<Drive name for removable media>:\removedtitles_records.zip" *.exe "%WINDIR%\TEMP\IRA754.tmp\"' (with hidden window)
'%ProgramFiles%\WinRAR\Rar.exe' a -r -ep1"%WINDIR%\TEMP\IRA754.tmp" "<Drive name for removable media>:\removedtitles_records.zip" "%WINDIR%\TEMP\IRA754.tmp\lpk.dll"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c %ProgramFiles%\WinRAR\rar.exe vb "<Drive name for removable media>:\subjectclassification.zip" lpk.dll|find /i "lpk.dll"
'%ProgramFiles%\WinRAR\Rar.exe' vb "<Drive name for removable media>:\removedtitles_records.zip" lpk.dll
'%WINDIR%\syswow64\cmd.exe' /c %ProgramFiles%\WinRAR\rar.exe vb "<Drive name for removable media>:\removedtitles_records.zip" lpk.dll|find /i "lpk.dll"
'%ProgramFiles%\WinRAR\Rar.exe' a -r -ep1"%WINDIR%\TEMP\IRA754.tmp" "<Drive name for removable media>:\excel_example.zip" "%WINDIR%\TEMP\IRA754.tmp\lpk.dll"
'%ProgramFiles%\WinRAR\Rar.exe' x "<Drive name for removable media>:\excel_example.zip" *.exe "%WINDIR%\TEMP\IRA754.tmp\"
'%ProgramFiles%\WinRAR\Rar.exe' vb "<Drive name for removable media>:\excel_example.zip" lpk.dll
'%WINDIR%\syswow64\cmd.exe' /c %ProgramFiles%\WinRAR\rar.exe vb "<Drive name for removable media>:\excel_example.zip" lpk.dll|find /i "lpk.dll"
'%ProgramFiles%\WinRAR\Rar.exe' a -r -ep1"%WINDIR%\TEMP\IRA754.tmp" "<Drive name for removable media>:\price030215.zip" "%WINDIR%\TEMP\IRA754.tmp\lpk.dll"
'%ProgramFiles%\WinRAR\Rar.exe' x "<Drive name for removable media>:\price030215.zip" *.exe "%WINDIR%\TEMP\IRA754.tmp\"
'%ProgramFiles%\WinRAR\Rar.exe' vb "<Drive name for removable media>:\price030215.zip" lpk.dll
'%WINDIR%\syswow64\cmd.exe' /c %ProgramFiles%\WinRAR\rar.exe vb "<Drive name for removable media>:\price030215.zip" lpk.dll|find /i "lpk.dll"
'%ProgramFiles%\WinRAR\Rar.exe' a -r -ep1"%WINDIR%\TEMP\IRA754.tmp" "<Drive name for removable media>:\calculatorworksheet.zip" "%WINDIR%\TEMP\IRA754.tmp\lpk.dll"
'%ProgramFiles%\WinRAR\Rar.exe' x "<Drive name for removable media>:\calculatorworksheet.zip" *.exe "%WINDIR%\TEMP\IRA754.tmp\"
'%ProgramFiles%\WinRAR\Rar.exe' vb "<Drive name for removable media>:\calculatorworksheet.zip" lpk.dll
'%WINDIR%\syswow64\cmd.exe' /c %ProgramFiles%\WinRAR\rar.exe vb "<Drive name for removable media>:\calculatorworksheet.zip" lpk.dll|find /i "lpk.dll"
'%WINDIR%\syswow64\cmd.exe' /c RD /s /q "%WINDIR%\TEMP\IRA754.tmp"
'%ProgramFiles%\WinRAR\Rar.exe' a -r -ep1"%WINDIR%\TEMP\IRA754.tmp" "<Drive name for removable media>:\subjectclassification.zip" "%WINDIR%\TEMP\IRA754.tmp\lpk.dll"
'%ProgramFiles%\WinRAR\Rar.exe' x "<Drive name for removable media>:\subjectclassification.zip" *.exe "%WINDIR%\TEMP\IRA754.tmp\"
'%WINDIR%\syswow64\find.exe' /i "lpk.dll"
'%ProgramFiles%\WinRAR\Rar.exe' vb "<Drive name for removable media>:\subjectclassification.zip" lpk.dll
'%ProgramFiles%\WinRAR\Rar.exe' x "<Drive name for removable media>:\removedtitles_records.zip" *.exe "%WINDIR%\TEMP\IRA754.tmp\"
'%ProgramFiles%\WinRAR\Rar.exe' a -r -ep1"%WINDIR%\TEMP\IRA754.tmp" "<Drive name for removable media>:\removedtitles_records.zip" "%WINDIR%\TEMP\IRA754.tmp\lpk.dll"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней