Trojan.MulDrop11.20310

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{5885C17B-E8C2-4649-941F-1C7FB6F29C03}] 'Script' = '<Current directory>\config\ieext\网博士保存网页.htm'
[<HKLM>\Software\Classes\PROTOCOLS\Handler\its] 'CLSID' = '{9D148291-B9C8-11D0-A4CC-0000F80149F6}'
[<HKLM>\Software\Classes\PROTOCOLS\Handler\ms-its] 'CLSID' = '{9D148291-B9C8-11D0-A4CC-0000F80149F6}'
[<HKLM>\Software\Classes\WebSaver.file\shell\open\command] '' = '"<Current directory>\WebSaver.exe" "%1"'

Modifies file system

Creates the following files

%TEMP%\evb1deb.tmp
<Current directory>\config\template\htmledit\emot_files\mark\53.png
<Current directory>\config\template\htmledit\emot_files\mark\52.png
<Current directory>\config\template\htmledit\emot_files\mark\51.png
<Current directory>\config\template\htmledit\emot_files\mark\50.png
<Current directory>\config\template\htmledit\emot_files\mark\5.png
<Current directory>\config\template\htmledit\emot_files\mark\49.png
<Current directory>\config\template\htmledit\emot_files\mark\48.png
<Current directory>\config\template\htmledit\emot_files\mark\47.png
<Current directory>\config\template\htmledit\emot_files\mark\46.png
<Current directory>\config\template\htmledit\emot_files\mark\45.png
<Current directory>\config\template\htmledit\emot_files\mark\44.png
<Current directory>\config\template\htmledit\emot_files\mark\43.png
<Current directory>\config\template\htmledit\emot_files\mark\42.png
<Current directory>\config\template\htmledit\emot_files\mark\41.png
<Current directory>\config\template\htmledit\emot_files\mark\40.png
<Current directory>\config\template\htmledit\emot_files\mark\4.png
<Current directory>\config\template\htmledit\emot_files\mark\39.png
<Current directory>\config\template\htmledit\emot_files\mark\38.png
<Current directory>\config\template\htmledit\emot_files\mark\37.png
<Current directory>\config\template\htmledit\emot_files\mark\36.png
<Current directory>\config\template\htmledit\emot_files\mark\35.png
<Current directory>\config\template\htmledit\emot_files\mark\54.png
<Current directory>\config\template\htmledit\emot_files\mark\56.png
<Current directory>\config\template\htmledit\emot_files\mark\77.png
<Current directory>\config\template\htmledit\emot_files\mark\57.png
<Current directory>\config\template\htmledit\emot_files\mark\76.png
<Current directory>\config\template\htmledit\emot_files\mark\75.png
<Current directory>\config\template\htmledit\emot_files\mark\74.png
<Current directory>\config\template\htmledit\emot_files\mark\73.png
<Current directory>\config\template\htmledit\emot_files\mark\72.png
<Current directory>\config\template\htmledit\emot_files\mark\71.png
<Current directory>\config\template\htmledit\emot_files\mark\70.png
<Current directory>\config\template\htmledit\emot_files\mark\7.png
<Current directory>\config\template\htmledit\emot_files\mark\69.png
<Current directory>\config\template\htmledit\emot_files\mark\68.png
<Current directory>\config\template\htmledit\emot_files\mark\67.png
<Current directory>\config\template\htmledit\emot_files\mark\66.png
<Current directory>\config\template\htmledit\emot_files\mark\65.png
<Current directory>\config\template\htmledit\emot_files\mark\64.png
<Current directory>\config\template\htmledit\emot_files\mark\63.png
<Current directory>\config\template\htmledit\emot_files\mark\62.png
<Current directory>\config\template\htmledit\emot_files\mark\61.png
<Current directory>\config\template\htmledit\emot_files\mark\60.png
<Current directory>\config\template\htmledit\emot_files\mark\6.png
<Current directory>\config\template\htmledit\emot_files\mark\59.png
<Current directory>\config\template\htmledit\emot_files\mark\58.png
<Current directory>\config\template\htmledit\emot_files\mark\34.png
<Current directory>\config\template\htmledit\emot_files\mark\55.png
<Current directory>\config\template\htmledit\emot_files\mark\33.png
<Current directory>\config\template\htmledit\emot_files\mark\110.png
<Current directory>\config\template\htmledit\emot_files\mark\109.png
<Current directory>\config\template\htmledit\emot_files\mark\108.png
<Current directory>\config\template\htmledit\emot_files\mark\107.png
<Current directory>\config\template\htmledit\emot_files\mark\106.png
<Current directory>\config\template\htmledit\emot_files\mark\105.png
<Current directory>\config\template\htmledit\emot_files\mark\104.png
<Current directory>\config\template\htmledit\emot_files\mark\103.png
<Current directory>\config\template\htmledit\emot_files\mark\102.png
<Current directory>\config\template\htmledit\emot_files\mark\101.png
<Current directory>\config\template\htmledit\emot_files\mark\100.png
<Current directory>\config\template\htmledit\emot_files\mark\10.png
<Current directory>\config\template\htmledit\emot_files\mark\1.png
<Current directory>\config\template\htmledit\emot_files\hsplit\9.gif
<Current directory>\config\template\htmledit\emot_files\hsplit\8.gif
<Current directory>\config\template\htmledit\emot_files\hsplit\7.gif
<Current directory>\config\template\htmledit\emot_files\hsplit\6.png
<Current directory>\config\template\htmledit\emot_files\hsplit\6.gif
<Current directory>\config\template\htmledit\emot_files\hsplit\5.gif
<Current directory>\config\template\htmledit\emot_files\hsplit\4.png
<Current directory>\config\template\htmledit\emot_files\hsplit\4.gif
<Current directory>\config\template\htmledit\emot_files\hsplit\3.png
<Current directory>\config\template\htmledit\emot_files\mark\11.png
<Current directory>\config\template\htmledit\emot_files\mark\111.png
<Current directory>\config\template\htmledit\emot_files\mark\31.png
<Current directory>\config\template\htmledit\emot_files\mark\112.png
<Current directory>\config\template\htmledit\emot_files\mark\30.png
<Current directory>\config\template\htmledit\emot_files\mark\3.png
<Current directory>\config\template\htmledit\emot_files\mark\29.png
<Current directory>\config\template\htmledit\emot_files\mark\28.png
<Current directory>\config\template\htmledit\emot_files\mark\27.png
<Current directory>\config\template\htmledit\emot_files\mark\26.png
<Current directory>\config\template\htmledit\emot_files\mark\25.png
<Current directory>\config\template\htmledit\emot_files\mark\24.png
<Current directory>\config\template\htmledit\emot_files\mark\23.png
<Current directory>\config\template\htmledit\emot_files\mark\22.png
<Current directory>\config\template\htmledit\emot_files\mark\21.png
<Current directory>\config\template\htmledit\emot_files\mark\20.png
<Current directory>\config\template\htmledit\emot_files\mark\2.png
<Current directory>\config\template\htmledit\emot_files\mark\19.png
<Current directory>\config\template\htmledit\emot_files\mark\18.png
<Current directory>\config\template\htmledit\emot_files\mark\17.png
<Current directory>\config\template\htmledit\emot_files\mark\16.png
<Current directory>\config\template\htmledit\emot_files\mark\15.png
<Current directory>\config\template\htmledit\emot_files\mark\14.png
<Current directory>\config\template\htmledit\emot_files\mark\13.png
<Current directory>\config\template\htmledit\emot_files\mark\12.png
<Current directory>\config\template\htmledit\emot_files\mark\32.png
<Current directory>\config\template\htmledit\emot_files\mark\78.png
<Current directory>\config\template\htmledit\emot_files\mark\79.png
<Current directory>\config\template\htmledit\emot_files\mark\8.png
<Current directory>\config\template\merge\5.Г¬ГВјГіВ·Г¶ВёГґВ·Г»ВµВјВєВЅВ°ВґГҐВҐВјГІВµВҐГ«Г·ГІГЅ.htm
<Current directory>\config\template\merge\4.Г¬ГВјГіВ·Г¶ВёГґВ·Г»ВјГІВµВҐГ«Г·ГІГЅ.htm
<Current directory>\config\template\merge\3.Г¬ГВјГіВ·Г¶ВёГґВ·Г»ВµВјВєВЅВ°ВґГҐВҐ.htm
<Current directory>\config\template\merge\2.Г¬ГВјГіВ·Г¶ВёГґВ·Г».htm
<Current directory>\config\template\merge\1.ВЅГ¶ВєГЇВІВў.htm
<Current directory>\config\template\lexport\word16.gif
<Current directory>\config\template\lexport\text16.gif
<Current directory>\config\template\lexport\tablebgimage.gif
<Current directory>\config\template\lexport\image16.gif
<Current directory>\config\template\lexport\html16.gif
<Current directory>\config\template\lexport\folder16.gif
<Current directory>\config\template\lexport\flash16.gif
<Current directory>\config\template\lexport\exporttree.js
<Current directory>\config\template\lexport\exporttree.htm
<Current directory>\config\template\lexport\exportframe.htm
<Current directory>\config\template\lexport\exportflat.xsl
<Current directory>\config\template\lexport\expand.gif
<Current directory>\config\template\lexport\collapse.gif
<Current directory>\config\template\lexport\category.gif
<Current directory>\config\template\htmlformat\4.Г¬ГВјГіВµВјВєВЅВјВ°ВёВЅГ—Вў(ГВ·ВІВїВјВ°Г®ВІВІВї).htm
<Current directory>\config\template\htmlformat\3.Г¬ГВјГіВµВјВєВЅВјВ°ВёВЅГ—Вў(Г®ВІВІВї-ГµВ№ВїВЄ).htm
<Current directory>\config\template\htmlformat\1.Г¤В¬ГЁГЇ.htm
<Current directory>\config\template\htmlformat\2.Г¬ГВјГіВµВјВєВЅВјВ°ВёВЅГ—Вў(Г®ВІВІВї).htm
<Current directory>\config\template\merge\6.Г¬ГВјГіВ·Г¶ВёГґВ·Г»ВµВјВєВЅВ°ВґГҐВҐВёВґГґГіГ«Г·ГІГЅ.htm
<Current directory>\config\template\newfile\new.doc
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\background_gradient[2]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\httperrorpagesscripts[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagetemplate[1]
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\dnserrordiagoff_weboc[1]
<Current directory>\config\public.ini
%WINDIR%\syswow64\hha.dll
%WINDIR%\syswow64\pflt.dll
%WINDIR%\syswow64\itcc.dll
<Current directory>\config\ieext\网博士保存当前链接.htm
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bullet[1]
<Current directory>\config\ieext\网博士保存当前图片.htm
<Current directory>\config\ieext\网博士保存选中部分.htm
<Current directory>\config\ieext\网博士保存网页.htm
<Current directory>\config\labels.wsb-journal
<Current directory>\config\picktable.js
<Current directory>\config\labels.wsb
<Current directory>\config\ieext.ini
<Current directory>\config\chmoptions.ini
<Current directory>\config\book.ini
<Current directory>\config\template\newfile\new.xls
<Current directory>\config\template\htmledit\zh-cn.js
<Current directory>\config\template\htmledit\tablecell.htm
<Current directory>\config\template\htmledit\table.htm
<Current directory>\config\template\htmledit\emot_files\mark\98.png
<Current directory>\config\template\htmledit\emot_files\mark\97.png
<Current directory>\config\template\htmledit\emot_files\mark\96.png
<Current directory>\config\template\htmledit\emot_files\mark\95.png
<Current directory>\config\template\htmledit\emot_files\mark\94.png
<Current directory>\config\template\htmledit\emot_files\mark\93.png
<Current directory>\config\template\htmledit\emot_files\mark\92.png
<Current directory>\config\template\htmledit\emot_files\mark\91.png
<Current directory>\config\template\htmledit\emot_files\mark\90.png
<Current directory>\config\template\htmledit\emot_files\mark\9.png
<Current directory>\config\template\htmledit\emot_files\mark\89.png
<Current directory>\config\template\htmledit\emot_files\mark\88.png
<Current directory>\config\template\htmledit\emot_files\mark\87.png
<Current directory>\config\template\htmledit\emot_files\mark\86.png
<Current directory>\config\template\htmledit\emot_files\mark\85.png
<Current directory>\config\template\htmledit\emot_files\mark\84.png
<Current directory>\config\template\htmledit\emot_files\mark\83.png
<Current directory>\config\template\htmledit\emot_files\mark\82.png
<Current directory>\config\template\htmledit\emot_files\mark\81.png
<Current directory>\config\template\htmledit\emot_files\mark\80.png
<Current directory>\config\template\htmledit\emot_files\vsplit\1.gif
<Current directory>\config\template\htmledit\emot_files\vsplit\10.gif
<Current directory>\config\template\htmledit\emot_files\mark\99.png
<Current directory>\config\template\htmledit\emot_files\vsplit\11.gif
<Current directory>\config\template\htmledit\symbol.htm
<Current directory>\config\template\htmledit\emot_files\vsplit\12.gif
<Current directory>\config\template\htmledit\reference.htm
<Current directory>\config\template\htmledit\paragraph.htm
<Current directory>\config\template\htmledit\owcexcel.htm
<Current directory>\config\template\htmledit\media.htm
<Current directory>\config\template\htmledit\img.htm
<Current directory>\config\template\htmledit\hyperlink.htm
<Current directory>\config\template\htmledit\fontcolor.htm
<Current directory>\config\template\htmledit\flash.htm
<Current directory>\config\template\htmledit\findreplace.htm
<Current directory>\config\template\htmledit\emot_files\vsplit\9.gif
<Current directory>\config\template\htmledit\emot_files\hsplit\2.png
<Current directory>\config\template\htmledit\emot_files\vsplit\8.gif
<Current directory>\config\template\htmledit\emot_files\vsplit\7.gif
<Current directory>\config\template\htmledit\emot_files\vsplit\6.gif
<Current directory>\config\template\htmledit\emot_files\vsplit\5.gif
<Current directory>\config\template\htmledit\emot_files\vsplit\4.gif
<Current directory>\config\template\htmledit\emot_files\vsplit\3.gif
<Current directory>\config\template\htmledit\emot_files\vsplit\2.gif
<Current directory>\config\template\htmledit\emot_files\vsplit\15.gif
<Current directory>\config\template\htmledit\emot_files\vsplit\14.gif
<Current directory>\config\template\htmledit\emot_files\vsplit\13.gif
<Current directory>\config\template\htmledit\fieldset.htm
<Current directory>\config\ieext\网博士上次设置快速保存.htm
<Current directory>\config\template\htmledit\emot_files\hsplit\18.gif
<Current directory>\config\template\htmledit\emot_files\general\81.gif
<Current directory>\config\scheme\pageonlythml.wss
<Current directory>\config\scheme\pagealllinks.wss
<Current directory>\config\scheme\pageall.wss
<Current directory>\config\scheme\pageall-slow.wss
<Current directory>\config\scheme\page2text.wss
<Current directory>\config\scheme\page-selall-link-merge.wss
<Current directory>\config\scheme\largepics.wss
<Current directory>\config\scheme\flashall.wss
<Current directory>\config\scheme\ebook.wss
<Current directory>\config\scheme\currentlink.wss
<Current directory>\config\scheme\currentimage.wss
<Current directory>\config\scheme\allimages.wss
<Current directory>\config\media\zoomout.gif
<Current directory>\config\media\zoomin.gif
<Current directory>\config\media\zoom.gif
<Current directory>\config\media\zip16.gif
<Current directory>\config\media\word16.gif
<Current directory>\config\media\video16.gif
<Current directory>\config\media\unsel.gif
<Current directory>\config\media\unknown16.gif
<Current directory>\config\media\text16.gif
<Current directory>\config\scheme\pagetext.wss
<Current directory>\config\scheme\pagewithlast.wss
<Current directory>\config\template\htmledit\code_files\inblock.gif
<Current directory>\config\scheme\save all links.wss
<Current directory>\config\template\htmledit\code_files\expandedsubblockstart.gif
<Current directory>\config\template\htmledit\code_files\expandedsubblockend.gif
<Current directory>\config\template\htmledit\code_files\expandedblockstart.gif
<Current directory>\config\template\htmledit\code_files\expandedblockend.gif
<Current directory>\config\template\htmledit\code_files\contractedsubblock.gif
<Current directory>\config\template\htmledit\code_files\contractedblock.gif
<Current directory>\config\template\htmledit\code.js
<Current directory>\config\template\htmledit\code.htm
<Current directory>\config\template\htmledit\backcolor.htm
<Current directory>\config\template\htmledit\art_files\italic.gif
<Current directory>\config\template\htmledit\art_files\bold.gif
<Current directory>\config\template\htmledit\art.htm
<Current directory>\config\template\htmledit\anchor.htm
<Current directory>\config\scheme\selwithlast.wss
<Current directory>\config\scheme\seltext.wss
<Current directory>\config\scheme\selpuretext.wss
<Current directory>\config\scheme\selhtml.wss
<Current directory>\config\scheme\selection.wss
<Current directory>\config\scheme\selalllinkspage.wss
<Current directory>\config\scheme\selalllinks-merge.wss
<Current directory>\config\scheme\selall-link.wss
<Current directory>\config\media\tablebgimage.gif
<Current directory>\config\scheme\pagewithattach.wss
<Current directory>\config\media\stop.gif
<Current directory>\config\media\icon1.ico
<Current directory>\config\media\folderopen.gif
<Current directory>\config\media\folder16.gif
<Current directory>\config\media\flash16.gif
<Current directory>\config\media\first.gif
<Current directory>\config\media\file16.gif
<Current directory>\config\media\desc.gif
<Current directory>\config\media\category.gif
<Current directory>\config\media\catalog.gif
<Current directory>\config\media\bookopen.gif
<Current directory>\config\media\book16.gif
<Current directory>\config\media\book.ico
<Current directory>\config\media\audio16.gif
<Current directory>\config\media\asc.gif
<Current directory>\config\ieext\ГГёВІВ©ГЄВїВ±ВЈВґГ¦Г±ВЎГ¶Г°ВІВїВ·Г¶.htm
<Current directory>\config\ieext\ГГёВІВ©ГЄВїВ±ВЈВґГ¦ГГёГІВі.htm
<Current directory>\config\ieext\ГГёВІВ©ГЄВїВ±ВЈВґГ¦ВµВ±Г§В°ГЎВґВЅГі.htm
<Current directory>\config\ieext\ГГёВІВ©ГЄВїВ±ВЈВґГ¦ВµВ±Г§В°ГВјГ¦В¬.htm
<Current directory>\config\ieext\ГГёВІВ©ГЄВїГ©ГЇВґГ®Г©ГЁГ¶ГЈВїГ¬Г«Г№В±ВЈВґГ¦.htm
<Current directory>\config\ieext\save.ico
<Current directory>\config\ieext\quicksave.ico
<Current directory>\config\savescheme.ini
<Current directory>\config\media\html16.gif
<Current directory>\config\media\icon10.ico
<Current directory>\config\media\root16.gif
<Current directory>\config\media\icon2.ico
<Current directory>\config\media\recyclefull16.gif
<Current directory>\config\media\recycle16.gif
<Current directory>\config\media\prev.gif
<Current directory>\config\media\play.gif
<Current directory>\config\media\pdf16.gif
<Current directory>\config\media\over.gif
<Current directory>\config\media\normal.gif
<Current directory>\config\media\next.gif
<Current directory>\config\media\mark.gif
<Current directory>\config\media\lock.gif
<Current directory>\config\media\last.gif
<Current directory>\config\media\kawjj_571.ico
<Current directory>\config\media\kawjj_549.ico
<Current directory>\config\media\image16.gif
<Current directory>\config\media\icon9.ico
<Current directory>\config\media\icon8.ico
<Current directory>\config\media\icon7.ico
<Current directory>\config\media\icon6.ico
<Current directory>\config\media\icon5.ico
<Current directory>\config\media\icon4.ico
<Current directory>\config\media\icon3.ico
<Current directory>\config\media\selected.gif
<Current directory>\config\template\htmledit\code_files\none.gif
<Current directory>\config\template\htmledit\color_files\space.gif
<Current directory>\config\template\htmledit\css.css
<Current directory>\config\template\htmledit\emot_files\general\67.gif
<Current directory>\config\template\htmledit\emot_files\general\66.gif
<Current directory>\config\template\htmledit\emot_files\general\65.gif
<Current directory>\config\template\htmledit\emot_files\general\64.gif
<Current directory>\config\template\htmledit\emot_files\general\63.gif
<Current directory>\config\template\htmledit\emot_files\general\62.gif
<Current directory>\config\template\htmledit\emot_files\general\61.gif
<Current directory>\config\template\htmledit\emot_files\general\60.gif
<Current directory>\config\template\htmledit\emot_files\general\59.gif
<Current directory>\config\template\htmledit\emot_files\general\58.gif
<Current directory>\config\template\htmledit\emot_files\general\57.gif
<Current directory>\config\template\htmledit\emot_files\general\56.gif
<Current directory>\config\template\htmledit\emot_files\general\55.gif
<Current directory>\config\template\htmledit\emot_files\general\54.gif
<Current directory>\config\template\htmledit\emot_files\general\53.gif
<Current directory>\config\template\htmledit\emot_files\general\52.gif
<Current directory>\config\template\htmledit\emot_files\general\51.gif
<Current directory>\config\template\htmledit\emot_files\general\50.gif
<Current directory>\config\template\htmledit\emot_files\general\49.gif
<Current directory>\config\template\htmledit\emot_files\general\48.gif
<Current directory>\config\template\htmledit\emot_files\general\47.gif
<Current directory>\config\template\htmledit\emot_files\general\45.gif
<Current directory>\config\template\htmledit\emot_files\general\46.gif
<Current directory>\config\template\htmledit\emot_files\general\68.gif
<Current directory>\config\template\htmledit\emot_files\general\69.gif
<Current directory>\config\template\htmledit\emot_files\hsplit\15.gif
<Current directory>\config\template\htmledit\emot_files\hsplit\14.gif
<Current directory>\config\template\htmledit\emot_files\hsplit\13.gif
<Current directory>\config\template\htmledit\emot_files\hsplit\12.gif
<Current directory>\config\template\htmledit\emot_files\hsplit\11.gif
<Current directory>\config\template\htmledit\emot_files\hsplit\10.gif
<Current directory>\config\template\htmledit\emot_files\hsplit\1.png
<Current directory>\config\template\htmledit\emot_files\general\84.gif
<Current directory>\config\template\htmledit\emot_files\general\83.gif
<Current directory>\config\template\htmledit\emot_files\general\82.gif
<Current directory>\config\template\htmledit\emot_files\general\80.gif
<Current directory>\config\template\htmledit\emot_files\hsplit\16.gif
<Current directory>\config\template\htmledit\emot_files\general\79.gif
<Current directory>\config\template\htmledit\emot_files\general\78.gif
<Current directory>\config\template\htmledit\emot_files\general\77.gif
<Current directory>\config\template\htmledit\emot_files\general\76.gif
<Current directory>\config\template\htmledit\emot_files\general\75.gif
<Current directory>\config\template\htmledit\emot_files\general\74.gif
<Current directory>\config\template\htmledit\emot_files\general\73.gif
<Current directory>\config\template\htmledit\emot_files\general\72.gif
<Current directory>\config\template\htmledit\emot_files\general\71.gif
<Current directory>\config\template\htmledit\emot_files\general\70.gif
<Current directory>\config\template\htmledit\emot_files\general\44.gif
<Current directory>\config\template\htmledit\emot_files\general\43.gif
<Current directory>\config\template\htmledit\emot_files\general\42.gif
<Current directory>\config\template\htmledit\emot_files\general\14.gif
<Current directory>\config\template\htmledit\emot_files\general\13.gif
<Current directory>\config\template\htmledit\emot_files\general\12.gif
<Current directory>\config\template\htmledit\emot_files\general\11.gif
<Current directory>\config\template\htmledit\emot_files\general\10.gif
<Current directory>\config\template\htmledit\emot_files\general\09.gif
<Current directory>\config\template\htmledit\emot_files\general\08.gif
<Current directory>\config\template\htmledit\emot_files\general\07.gif
<Current directory>\config\template\htmledit\emot_files\general\06.gif
<Current directory>\config\template\htmledit\emot_files\general\05.gif
<Current directory>\config\template\htmledit\emot_files\general\04.gif
<Current directory>\config\template\htmledit\emot_files\general\03.gif
<Current directory>\config\template\htmledit\emot_files\general\02.gif
<Current directory>\config\template\htmledit\emot_files\general\01.gif
<Current directory>\config\template\htmledit\emot_files\bg2.gif
<Current directory>\config\template\htmledit\emot_files\bg1.gif
<Current directory>\config\template\htmledit\emot_files\bg.gif
<Current directory>\config\template\htmledit\emot.htm
<Current directory>\config\template\htmledit\dialog.js
<Current directory>\config\template\htmledit\dialog.css
<Current directory>\config\template\htmledit\emot_files\general\16.gif
<Current directory>\config\template\htmledit\emot_files\general\17.gif
<Current directory>\config\template\htmledit\emot_files\general\15.gif
<Current directory>\config\template\htmledit\emot_files\general\18.gif
<Current directory>\config\template\htmledit\emot_files\general\41.gif
<Current directory>\config\template\htmledit\emot_files\general\19.gif
<Current directory>\config\template\htmledit\emot_files\general\40.gif
<Current directory>\config\template\htmledit\emot_files\general\39.gif
<Current directory>\config\template\htmledit\emot_files\general\38.gif
<Current directory>\config\template\htmledit\emot_files\general\37.gif
<Current directory>\config\template\htmledit\emot_files\general\36.gif
<Current directory>\config\template\htmledit\emot_files\general\35.gif
<Current directory>\config\template\htmledit\emot_files\general\34.gif
<Current directory>\config\template\htmledit\emot_files\general\33.gif
<Current directory>\config\template\htmledit\emot_files\general\32.gif
<Current directory>\config\template\htmledit\emot_files\general\30.gif
<Current directory>\config\template\htmledit\emot_files\hsplit\17.gif
<Current directory>\config\template\htmledit\emot_files\general\29.gif
<Current directory>\config\template\htmledit\emot_files\general\28.gif
<Current directory>\config\template\htmledit\emot_files\general\27.gif
<Current directory>\config\template\htmledit\emot_files\general\26.gif
<Current directory>\config\template\htmledit\emot_files\general\25.gif
<Current directory>\config\template\htmledit\emot_files\general\24.gif
<Current directory>\config\template\htmledit\emot_files\general\23.gif
<Current directory>\config\template\htmledit\emot_files\general\22.gif
<Current directory>\config\template\htmledit\emot_files\general\21.gif
<Current directory>\config\template\htmledit\emot_files\general\20.gif
<Current directory>\config\template\htmledit\emot_files\general\31.gif
<LS_APPDATA>\microsoft\windows\<INETFILES>\content.ie5\caasbycl\down[1]

Deletes the following files

<Current directory>\config\labels.wsb-journal

Substitutes the following files

<Current directory>\config\labels.wsb-journal

Network activity

Connects to

'ci##m.com':80

UDP

DNS ASK ci##m.com

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Creates and executes the following

'%WINDIR%\syswow64\regsvr32.exe' /s "<Current directory>\DMIEExt.DLL"' (with hidden window)
'%WINDIR%\syswow64\regsvr32.exe' /s "<Current directory>\DMOffice.DLL"' (with hidden window)
'%WINDIR%\syswow64\regsvr32.exe' /s "<Current directory>\SendToWebSaver.dll"' (with hidden window)
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\itcc.dll"' (with hidden window)
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\itss.dll"' (with hidden window)
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\itircl.dll"' (with hidden window)
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\pflt.dll"' (with hidden window)
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\offfilt.dll"' (with hidden window)
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\rtffilt.dll"' (with hidden window)
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\XMLFilter.dll"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\regsvr32.exe' /s "<Current directory>\DMIEExt.DLL"
'%WINDIR%\syswow64\regsvr32.exe' /s "<Current directory>\DMOffice.DLL"
'%WINDIR%\syswow64\regsvr32.exe' /s "<Current directory>\SendToWebSaver.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\itcc.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\itss.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\itircl.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\pflt.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\offfilt.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\rtffilt.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "<SYSTEM32>\XMLFilter.dll"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней