Trojan.DownLoader6.34178

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%HOMEPATH%\Windows\UpdateOffice.exe

Вредоносные функции:

Создает и запускает на исполнение:

%HOMEPATH%\PrintHood\UpdateOffice.exe
%HOMEPATH%\Windows\UpdateOffice.exe

Запускает на исполнение:

<SYSTEM32>\ping.exe 174.142.57.28
<SYSTEM32>\cmd.exe /c ""%HOMEPATH%\PrintHood\pangtip.bat" "
<SYSTEM32>\cmd.exe /c ""%HOMEPATH%\PrintHood\700.bat" "

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\PrintHood\~J0m8RlO6k5Ty9K7A7dlo.TMP
%HOMEPATH%\PrintHood\i4LsULmsMp.PRI
%HOMEPATH%\PrintHood\~aqK7ffsPXchz72xZmrbK.TMP
%HOMEPATH%\PrintHood\~AsqdHfJGRzpCgccN2A8y.TMP
%HOMEPATH%\PrintHood\Yn461C8ZSF.PRI
%HOMEPATH%\PrintHood\WI7lPzusOW.PRI
%HOMEPATH%\PrintHood\kjf8pkFpNJ.PRI
%HOMEPATH%\PrintHood\EhO25l3i6G.PRI
%HOMEPATH%\PrintHood\NbYj0Qq4qN.PRI
%HOMEPATH%\PrintHood\~dPsNrMgJcF4rB25ix4Bf.TMP
%HOMEPATH%\PrintHood\~HSiPgfbeoMOsJcmcxfMV.TMP
%HOMEPATH%\PrintHood\~vDY0kpAF51617r7XP5Ln.TMP
%HOMEPATH%\PrintHood\~7U7z81NVyPt3oBIr5XR7.TMP
%HOMEPATH%\PrintHood\~xGR3psf4gQREwTtVZELl.TMP
%HOMEPATH%\PrintHood\~FqrnTFBWjPghUTjzLxq9.TMP
%HOMEPATH%\PrintHood\~75Xb1KyOJKYbx2loUndB.TMP
%HOMEPATH%\PrintHood\~zfrG7Y865Qwja7zOwAXT.TMP
%HOMEPATH%\PrintHood\~tAXVXYKhkAXRzKJGRtlD.TMP
%HOMEPATH%\PrintHood\~gwxd3H9dqje6gRmM9VkV.TMP
%HOMEPATH%\PrintHood\OwKhuC0r8p.PRI
%HOMEPATH%\PrintHood\2exncKgkwv.PRI
%HOMEPATH%\PrintHood\z41Uh7kpEr.PRI
%HOMEPATH%\PrintHood\mi3ud45evb.PRI
%HOMEPATH%\PrintHood\RdmvxmACkh.PRI
%HOMEPATH%\PrintHood\DKM5RyBy0K.PRI
%HOMEPATH%\PrintHood\EjB2MxX1Mz.PRI
%HOMEPATH%\PrintHood\eQOQ4GfezL.PRI
%HOMEPATH%\PrintHood\BKTJsKmAi3.PRI
%HOMEPATH%\PrintHood\85mj8mPaCp.PRI
%HOMEPATH%\PrintHood\u5r5mgbTr0.PRI
%HOMEPATH%\PrintHood\VmbRC2tcWA.PRI
%HOMEPATH%\PrintHood\wdPI1jWf1q.PRI
%HOMEPATH%\PrintHood\MQNMQnAIrg.PRI
%HOMEPATH%\PrintHood\Cclr0ph8TX.PRI
%HOMEPATH%\PrintHood\xzAyrEzjH0.PRI
%HOMEPATH%\PrintHood\wqAA89Vvzk.PRI
%HOMEPATH%\PrintHood\dMPidvZiT0.PRI
%HOMEPATH%\PrintHood\83YdbJ1eGF.PRI
%HOMEPATH%\PrintHood\L8EDfl4mWe.PRI
%HOMEPATH%\PrintHood\~H2C79OiMQKCfqRs7Ibqx.TMP
%HOMEPATH%\PrintHood\~w1ggojPteSWv2QJL7Ov4.TMP
%HOMEPATH%\PrintHood\~d2ZwNEsggkJtma6Th6kW.TMP
%HOMEPATH%\PrintHood\~bgfud6X2rEZX4M0Cs6W8.TMP
%HOMEPATH%\PrintHood\~7759XG5GaXwLvkJl5vzr.TMP
%HOMEPATH%\PrintHood\~ReLsIlGVePuWzchs5HB7.TMP
%HOMEPATH%\PrintHood\~waJGQ5oFi2zgwSz73YI8.TMP
%HOMEPATH%\PrintHood\~b81qA2OHW0KBKQYahfvU.TMP
%HOMEPATH%\PrintHood\~4IjM37VJh5ARw6mJXctE.TMP
%HOMEPATH%\PrintHood\~gDlv1woeMurCHLTkmNZ1.TMP
%HOMEPATH%\PrintHood\~jsyqMPe2GqeEGmzBzbez.TMP
%HOMEPATH%\PrintHood\~8Ef5MA9vGsW1o5eFOwzj.TMP
%HOMEPATH%\PrintHood\~YuC7hrLb0AjxtVvx8T7Z.TMP
%HOMEPATH%\PrintHood\~df9hOF8hQi070tvmTczA.TMP
%HOMEPATH%\PrintHood\~APTUgZYf5QsWKqrwUl3R.TMP
%HOMEPATH%\PrintHood\~5W0kPWOB9saip28oPLWX.TMP
%HOMEPATH%\PrintHood\~djYvsZ90dYcskte212vM.TMP
%HOMEPATH%\PrintHood\~Cbw3j5d7JeSsTqMGCDyP.TMP
%HOMEPATH%\PrintHood\~2lNskWJLuT0hQyyP9gBP.TMP
%HOMEPATH%\PrintHood\~t5mgqv7rLQQ7mCh5X0by.TMP
%HOMEPATH%\PrintHood\~CxUDnFJCL3xQIFP8uIHU.TMP
%HOMEPATH%\PrintHood\~ZCCnwAMtfFmcd8YYPVxK.TMP
%HOMEPATH%\PrintHood\~Gf37kwEGiBIXe0j2N6Im.TMP
%HOMEPATH%\PrintHood\~hnx9F0IxrqX64fiuCLWc.TMP
%HOMEPATH%\PrintHood\~VvmI3OLyHiTBDaKVKZHQ.TMP
%HOMEPATH%\PrintHood\~JrJ3JzXfoXJWKcuDj3cM.TMP
%HOMEPATH%\PrintHood\~R93pHllelOW5aF4HBBeV.TMP
%HOMEPATH%\PrintHood\~6fMLYZB1A43DtOmgwP7M.TMP
%HOMEPATH%\PrintHood\~yg5qEI7ogU9PuY9R51YJ.TMP
%HOMEPATH%\PrintHood\~m6ETcsinxvNOIdKiAB4c.TMP
%HOMEPATH%\PrintHood\~JSIPVIJoZxVfcbGeD4Rf.TMP
%HOMEPATH%\PrintHood\~gZiY5nSsJamksQdkc6hh.TMP
%HOMEPATH%\PrintHood\~Qs5XWRGvuEz4DaDV0J2c.TMP
%HOMEPATH%\PrintHood\~0AW7laBLCrEn8TcOJwkA.TMP
%HOMEPATH%\PrintHood\~aXRpLJVKZO1xpao1tKzL.TMP
%HOMEPATH%\PrintHood\~QyyBMzvwLOJki0A1NGHf.TMP
%HOMEPATH%\PrintHood\~G5Ps5ft7M9u6LuLVRkSx.TMP
%HOMEPATH%\PrintHood\~6R8ACT3QIf9uqHkTXIme.TMP
%HOMEPATH%\PrintHood\~tRmkxpskDtV8qlikf1LK.TMP
%HOMEPATH%\PrintHood\~PVGk3NbDbM4dX7GG4CRG.TMP
%HOMEPATH%\PrintHood\NPceZfdR8A.dll
%HOMEPATH%\PrintHood\Ah9OMrIaYD.dll
%HOMEPATH%\PrintHood\sbHdoOkb73.dll
%HOMEPATH%\PrintHood\DuhujC0mS8.dll
%HOMEPATH%\PrintHood\IZ5dZMpBgO.dll
%HOMEPATH%\PrintHood\v8hx1S7Xoz.dll
%HOMEPATH%\PrintHood\LKrS7gDw3n.dll
%HOMEPATH%\PrintHood\i1MXhdvpbh.dll
%HOMEPATH%\PrintHood\3ECHIca33N.dll
%HOMEPATH%\PrintHood\sY0NbUUXM9.dll
%HOMEPATH%\PrintHood\jKrzeV99wx.dll
%HOMEPATH%\PrintHood\fNvSUfa8ZA.dll
%HOMEPATH%\PrintHood\xW9Zz2mKR5.dll
%HOMEPATH%\PrintHood\zUQpaKLnSU.dll
%HOMEPATH%\PrintHood\CHcOJg97Ur.dll
%HOMEPATH%\PrintHood\fqilBnP4uV.dll
%HOMEPATH%\PrintHood\XCkIWxixB3.dll
%HOMEPATH%\PrintHood\vekpWBluuE.dll
%HOMEPATH%\PrintHood\b6tFXKq3vS.dll
%HOMEPATH%\PrintHood\TBZFztCgEg.dll
%HOMEPATH%\PrintHood\nJEIUuUvqi.dll
%HOMEPATH%\PrintHood\VnSrR6TFc8.dll
%HOMEPATH%\PrintHood\pt9W9q3GLt.dll
%HOMEPATH%\PrintHood\6xObJQw4tF.dll
%HOMEPATH%\PrintHood\OQoFDgWZXv.dll
%HOMEPATH%\PrintHood\pangtip.bat
%HOMEPATH%\PrintHood\UPDATE~1.EXE.pkxm
%HOMEPATH%\PrintHood\PtKCDJKjCO.dll
%HOMEPATH%\Templates\nam.dll
%HOMEPATH%\PrintHood\ATVVQLsOqM.dll
%HOMEPATH%\PrintHood\soI5V4D6SI.dll
%HOMEPATH%\PrintHood\2xEx4S8H6Z.dll
%HOMEPATH%\PrintHood\H8wE7xm9zq.dll
%HOMEPATH%\PrintHood\Tf964Ta3Nb.dll
%HOMEPATH%\PrintHood\4dFUixARoM.dll
%HOMEPATH%\PrintHood\5spMslVUrd.dll
%HOMEPATH%\PrintHood\9CcoXA6R0M.dll
%HOMEPATH%\PrintHood\Y80NtwNpwB.dll
%HOMEPATH%\PrintHood\3z24CEOkly.dll
%HOMEPATH%\PrintHood\juF1PQzdyu.dll
%HOMEPATH%\PrintHood\eH6N458VHt.PRI
%HOMEPATH%\PrintHood\k3rkMVYqEU.PRI
%HOMEPATH%\PrintHood\GcBSWcMv0r.PRI
%HOMEPATH%\PrintHood\vUdiKnhiAe.PRI
%HOMEPATH%\PrintHood\JoOVmzgIt6.PRI
%HOMEPATH%\PrintHood\VGWiCWUPP7.PRI
%HOMEPATH%\PrintHood\72YZqSIrFt.PRI
%HOMEPATH%\PrintHood\g3IMsZK2fj.PRI
%HOMEPATH%\PrintHood\p9DHwSruHa.PRI
%HOMEPATH%\PrintHood\XyWWo2qAKo.PRI
%HOMEPATH%\PrintHood\QvMEIX67cn.PRI
%HOMEPATH%\PrintHood\2Y2rHy1yXT.PRI
%HOMEPATH%\PrintHood\IFmmGSIX0q.PRI
%HOMEPATH%\PrintHood\VULCLdAGsv.PRI
%HOMEPATH%\PrintHood\4uhBeQ6gU9.PRI
%HOMEPATH%\PrintHood\MhyXrjVhUG.PRI
%HOMEPATH%\PrintHood\oQjJvKTHK2.PRI
%HOMEPATH%\PrintHood\spNGZvmNFC.PRI
%HOMEPATH%\PrintHood\ZVJTQMOJSO.PRI
%HOMEPATH%\PrintHood\NOguvQzWkt.PRI
%HOMEPATH%\PrintHood\fjRIL74p3Y.dll
%HOMEPATH%\PrintHood\xRCMDP35mi.dll
%HOMEPATH%\PrintHood\4IyjveYCOO.dll
%HOMEPATH%\PrintHood\gUnw3w2pWF.dll
%HOMEPATH%\PrintHood\1sRCfFfdMA.dll
%HOMEPATH%\PrintHood\caDU54fxCh.dll
%HOMEPATH%\PrintHood\7xTkbA9k8S.dll
%HOMEPATH%\PrintHood\RTyboOiezd.dll
%HOMEPATH%\PrintHood\Gf5FDOZSkn.dll
%HOMEPATH%\PrintHood\68EVxLzWXn.dll
%HOMEPATH%\PrintHood\znqaZ80mPg.PRI
%HOMEPATH%\PrintHood\NCCa3uty0Q.PRI
%HOMEPATH%\PrintHood\YVP90i1Jxq.PRI
%HOMEPATH%\PrintHood\oHtZ1TH8QK.PRI
%HOMEPATH%\PrintHood\Db8Dz6R9nV.PRI
%HOMEPATH%\PrintHood\nrZLFrENqt.dll
%HOMEPATH%\PrintHood\hYyAUtcYEC.dll
%HOMEPATH%\PrintHood\KCSSyLZGrk.dll
%HOMEPATH%\PrintHood\wjnTX31xf8.dll
%HOMEPATH%\PrintHood\~EzQMd9HJqYtAHz3dTajX.TMP
%HOMEPATH%\PrintHood\~gpR5TNthkdLUbDh6CdpV.TMP
%HOMEPATH%\PrintHood\~GfobP5sO3ADjVN5RwEux.TMP
%HOMEPATH%\PrintHood\~56X5zRuoajZLLvVqx1a7.TMP
%HOMEPATH%\PrintHood\~ioRdxm0dogz6gXOWhHPy.TMP
%HOMEPATH%\PrintHood\~xXIH83XjNkb6dEgImlkQ.TMP
%HOMEPATH%\PrintHood\~tVTduOOXP6tvZVwzIiEN.TMP
%HOMEPATH%\PrintHood\~e4tsdTMNglDJ2Q7J4i5D.TMP
%HOMEPATH%\PrintHood\~uteYqQWXdxrEFk98b59y.TMP
%HOMEPATH%\PrintHood\~zR1MbhdgZfwHAmdpT13t.TMP
%HOMEPATH%\PrintHood\~UHTpKG36d5K4j3EypJIR.TMP
%HOMEPATH%\PrintHood\~LnAi7CMFbyYs75HeiO7Z.TMP
%HOMEPATH%\PrintHood\~ddQmXunHBt2TpHIVNnhg.TMP
%HOMEPATH%\PrintHood\~EQFLwpjeJE3Dl69eg5Ql.TMP
%HOMEPATH%\PrintHood\~LGdCQKn97e0nJc16xbgy.TMP
%HOMEPATH%\PrintHood\~m26LtUyxoSeIsJjUNEvK.TMP
%HOMEPATH%\PrintHood\~NFDvj0wiJNTM7hkUbIMf.TMP
%HOMEPATH%\PrintHood\~fL2mEijiPbxqgaFuZk6v.TMP
%HOMEPATH%\PrintHood\~223qooy3AzJEgOkSyosz.TMP
%HOMEPATH%\PrintHood\~Kg0s1pYLNn2gwotfnZys.TMP
%HOMEPATH%\PrintHood\~266q9aYKN6zycLPZki8h.TMP
%HOMEPATH%\PrintHood\~uwZAewgVPWEUGvSXmMyy.TMP
%HOMEPATH%\PrintHood\~lYCtin6RPhuUD6Z5FYX4.TMP
%HOMEPATH%\PrintHood\~JjFjiVtb7N0qXCXykTrW.TMP
%HOMEPATH%\PrintHood\~KI4Kx1fTqeYSCFddUTWa.TMP
%HOMEPATH%\PrintHood\~SHJ1168eBGXreUF3klX4.TMP
%HOMEPATH%\PrintHood\~lHxtTPaGMpmDh50IIDXi.TMP
%HOMEPATH%\PrintHood\~F8CEkv6Eb0xG8K4x1zIe.TMP
%HOMEPATH%\PrintHood\~WKvGNAvXqcP2dObj77fZ.TMP
%HOMEPATH%\PrintHood\~0rDA3JGVohg89eKRx4TG.TMP
%HOMEPATH%\PrintHood\~26arguqcx3znJvtf0o0S.TMP
%HOMEPATH%\PrintHood\~idWwH9UwBuHRnjTzo3ad.TMP
%HOMEPATH%\PrintHood\~FXAMCUXLoS3uT63lOZEI.TMP
%HOMEPATH%\PrintHood\~PG0v0zlN41MGVRhWGLZt.TMP
%HOMEPATH%\PrintHood\~E58qhUaPsMzA8T8LjhLp.TMP
%HOMEPATH%\PrintHood\~7rV8QBhduH4j8fp3yVuw.TMP
%HOMEPATH%\PrintHood\~A3e86s6G0sup2RHYUi2T.TMP
%HOMEPATH%\PrintHood\~UiNNc9J6licCEEiBNw3w.TMP
%HOMEPATH%\PrintHood\~OxicMj9eekwrTONexmEl.TMP
%HOMEPATH%\PrintHood\~1keyhztW15mBqd2fZe96.TMP
%HOMEPATH%\PrintHood\~JKeAkC8h9FjKQlNhzdd7.TMP
%HOMEPATH%\PrintHood\~qACbKvDJubQvcvkJDSxO.TMP
%HOMEPATH%\PrintHood\~sXpMBOIJFQJj6otd67wU.TMP
%HOMEPATH%\PrintHood\datikal.dll
%HOMEPATH%\PrintHood\~f2JwOY4vQYKc9L8sBO5G.TMP
%HOMEPATH%\PrintHood\~vQI2jDvvahPYx1HHbcLe.TMP
%HOMEPATH%\PrintHood\~Z6Co1SJAYarhIzXA283D.TMP
%HOMEPATH%\PrintHood\~slvcUxZ4kC396aOselQr.TMP
%HOMEPATH%\PrintHood\~YNVlHVaBPxo2AWfPybE8.TMP
%HOMEPATH%\PrintHood\~sZ0nLiLjYU62jDuq4UsO.TMP
%HOMEPATH%\PrintHood\700.bat
%HOMEPATH%\PrintHood\Bidikik.dll
%HOMEPATH%\PrintHood\Filikik.dll
%HOMEPATH%\PrintHood\Shenik.dll
%HOMEPATH%\PrintHood\Sitikatik.dll
%HOMEPATH%\PrintHood\Rzakik.dll
%HOMEPATH%\PrintHood\<Имя вируса>.exe.pdf
%HOMEPATH%\PrintHood\UpdateOffice.exe
%HOMEPATH%\PrintHood\Motahare.txt
%HOMEPATH%\PrintHood\<Имя вируса>.exe.txt
%HOMEPATH%\PrintHood\~2XvxHD87sx5CaX4krmof.TMP
%HOMEPATH%\PrintHood\~3QDNCfHV665fSXjmdEtL.TMP
%HOMEPATH%\PrintHood\~BEXaPWeIMQRR0GBbAyCm.TMP
%HOMEPATH%\PrintHood\~jku76ygQeQLp9NCLTkNb.TMP
%HOMEPATH%\PrintHood\~xVShEiDLnvb6b0dy7Uys.TMP
%HOMEPATH%\PrintHood\~44lBfvk6wfX4nHGhSA5M.TMP
%HOMEPATH%\PrintHood\~Hnaa7uOpEWCiDDprjcRP.TMP
%HOMEPATH%\PrintHood\~Xyi7ktSNuii6kUVtLB4k.TMP
%HOMEPATH%\PrintHood\~si8b1zycutCOtXgB9bnr.TMP
%HOMEPATH%\PrintHood\~n6keHXIGYbRNB5z1xvw6.TMP
%HOMEPATH%\PrintHood\~6akTdPXqiIaAafpBgaER.TMP
%HOMEPATH%\PrintHood\~yWSSQQu6wVL9A5woaJWT.TMP
%HOMEPATH%\PrintHood\~Rv89c1RQYTmnc7TY6NcW.TMP
%HOMEPATH%\PrintHood\~44z5XK99QqyxgmBF85iB.TMP
%HOMEPATH%\PrintHood\~9wpArD7gpgXC4YqrtmDS.TMP
%HOMEPATH%\PrintHood\~08jhnzOlh6aEzvoktCLZ.TMP
%HOMEPATH%\PrintHood\~IP2xYkJK0ZGvMTuM1l6P.TMP
%HOMEPATH%\PrintHood\~8HfoGH2H5ZInEWX8wBmJ.TMP
%HOMEPATH%\PrintHood\~KyQDWjVs6ScVX4rysszn.TMP
%HOMEPATH%\PrintHood\~ZbBdwIBWDzDcB8mnNM5P.TMP
%HOMEPATH%\PrintHood\~cb5tPbKz7Lu9xPZU5p71.TMP
%HOMEPATH%\PrintHood\~1YcI3f5f8duDtITR5DcG.TMP
%HOMEPATH%\PrintHood\~6ZSiTi4m169pchotgnGo.TMP
%HOMEPATH%\PrintHood\~crkfG9LIpAsTXmciJBGz.TMP
%HOMEPATH%\PrintHood\~Iq23VAwI9c8qDPOjRaTi.TMP
%HOMEPATH%\PrintHood\~SsX0spS4gNr5X0jj7zof.TMP
%HOMEPATH%\PrintHood\~DIObTP9SvIiKlRh6m7Sk.TMP
%HOMEPATH%\PrintHood\~xXVrV5x5mFPTMEjAOwAZ.TMP
%HOMEPATH%\PrintHood\~eaNASwMJTWhGjjJ6VWK8.TMP
%HOMEPATH%\PrintHood\~JiL77xK7EHFhI7rKkBgo.TMP
%HOMEPATH%\PrintHood\~HjFb9DgbcPB9t1U9Fx0S.TMP
%HOMEPATH%\PrintHood\~ymRPg6uZJWbxCJINDOGp.TMP
%HOMEPATH%\PrintHood\~5swUlLqPL7kx6rtTe0sB.TMP
%HOMEPATH%\PrintHood\~y63aolyPTh6TQPG8xZQS.TMP
%HOMEPATH%\PrintHood\~hWHy2JrvmPqs8dAM8qqE.TMP
%HOMEPATH%\PrintHood\~vgNmCK2gOjPrn848ZzTS.TMP
%HOMEPATH%\PrintHood\~zBmRp11r70YLuNF4FCc3.TMP
%HOMEPATH%\PrintHood\~m0VTO1HpLzoG8z1139lY.TMP
%HOMEPATH%\PrintHood\~2H24VtFMHP9LZ8MLBkgc.TMP
%HOMEPATH%\PrintHood\~FgXjcaXAsVnjipwHn2TF.TMP
%HOMEPATH%\PrintHood\~jHHdr3UVfru7MhaxHOfu.TMP
%HOMEPATH%\PrintHood\~1jqw7NUp3gk8BYgAQAQH.TMP
%HOMEPATH%\PrintHood\~fNDNDQcusl5TiA3gSri7.TMP
%HOMEPATH%\PrintHood\~7vYJAo2cfep5UmVYZQXj.TMP
%HOMEPATH%\PrintHood\~9qUcibwfchgTGv9v1QhD.TMP
%HOMEPATH%\PrintHood\~8evir55BBFNhGLsQXhBD.TMP
%HOMEPATH%\PrintHood\~eY0UvRXeejmXBbrrvbms.TMP
%HOMEPATH%\PrintHood\~gQKDN9MtLZq2TrILe1RC.TMP
%HOMEPATH%\PrintHood\~965sAwQqDwzcMuGrLL7L.TMP
%HOMEPATH%\PrintHood\~rr1Gl4HoNTsUBibr2WlO.TMP
%HOMEPATH%\PrintHood\~lCSKBrJ3OsX5sZpNYDhV.TMP
%HOMEPATH%\PrintHood\~VN9H9XvrVaPCSNbrXxHV.TMP
%HOMEPATH%\PrintHood\~iBmytv42OIyR8LxqEOr0.TMP
%HOMEPATH%\PrintHood\~ZzKx6R4y2FlFERfX2A6y.TMP
%HOMEPATH%\PrintHood\~fSMExN4xn8e4UAaticdB.TMP
%HOMEPATH%\PrintHood\~zelI8rXFBSMRHnrOWhxB.TMP
%HOMEPATH%\PrintHood\~VLS1tq9axTMq0XfT2u8Q.TMP
%HOMEPATH%\PrintHood\~g8PyH50rMZclZGEV0FE1.TMP
%HOMEPATH%\PrintHood\~kJhdsvHz3tVQB0M3WmjQ.TMP
%HOMEPATH%\PrintHood\~quvjB317lNZjX7IQ5MUP.TMP
%HOMEPATH%\PrintHood\~MfctGQenuoBeivgB7JjB.TMP
%HOMEPATH%\PrintHood\~36MpWReHgQC7ME4Kto1h.TMP
%HOMEPATH%\PrintHood\~Ia7bVphpIQeS9Ybf8rSP.TMP
%HOMEPATH%\PrintHood\~ynb3l90fz8kX9Kw4FLI4.TMP
%HOMEPATH%\PrintHood\~QPtEHhN3jaVCKfz6YTj5.TMP
%HOMEPATH%\PrintHood\~NjgSUa5kl6uqirlH51ia.TMP
%HOMEPATH%\PrintHood\~yv1oAhC3JAMzhpuuSd4S.TMP
%HOMEPATH%\PrintHood\~EdfzlkUcxDHIKAMxQyD5.TMP
%HOMEPATH%\PrintHood\~lsuVxG3NBTgQY1cuSQlp.TMP
%HOMEPATH%\PrintHood\~v2Ma9FXSyknPHi0FIAN1.TMP
%HOMEPATH%\PrintHood\~GtNiJc4dxY3KIW4XYfih.TMP
%HOMEPATH%\PrintHood\~RLqAXdodJoD9Z2sRi6bP.TMP
%HOMEPATH%\PrintHood\~TSSJQKkuePlRhxjXIx2R.TMP
%HOMEPATH%\PrintHood\~DqxRIJsZdC1yxV2w3KL5.TMP
%HOMEPATH%\PrintHood\~riT4kaDsAXPQABda0aMz.TMP
%HOMEPATH%\PrintHood\~9gbTvVau3WBreJR462W7.TMP
%HOMEPATH%\PrintHood\~SmHdRtC34yEn5cqmIfOe.TMP
%HOMEPATH%\PrintHood\~B7oXobG8kgqj69HilE49.TMP
%HOMEPATH%\PrintHood\~QTZ8j7kTL4Dde58A5AQt.TMP
%HOMEPATH%\PrintHood\~O2nwlzkuCIaFX21WajLx.TMP
%HOMEPATH%\PrintHood\~ueZlcARJxZJnjMCZgwwC.TMP
%HOMEPATH%\PrintHood\~Y0who8jZ9lS969H8rECa.TMP
%HOMEPATH%\PrintHood\~D96fgB0R6VRckuYs33tE.TMP
%HOMEPATH%\PrintHood\~HX8WjYJtZo93bcpySv9X.TMP
%HOMEPATH%\PrintHood\~Yaz08K8elzZfdx8qvyyM.TMP
%HOMEPATH%\PrintHood\~0gOx50h2LYjy5gSYueTx.TMP
%HOMEPATH%\PrintHood\~58jE502tJaZmQKHKEasT.TMP
%HOMEPATH%\PrintHood\~CSNPNPrCnSjwySGI4dFs.TMP
%HOMEPATH%\PrintHood\~Rjby82VBf4B2Av0ukYuV.TMP
%HOMEPATH%\PrintHood\~o6tnS50i2YiGjGxEeomS.TMP
%HOMEPATH%\PrintHood\~bbv7UzB8ReYlRtivWdpJ.TMP
%HOMEPATH%\PrintHood\~GRpuTaNEApvllsXPF7ba.TMP
%HOMEPATH%\PrintHood\~F6Fr7pPAFG7ZIKxQXkYA.TMP
%HOMEPATH%\PrintHood\~vHcMYm3eNMpMAiWiwJM8.TMP
%HOMEPATH%\PrintHood\~yHkeCtNOQp95tqDSJfly.TMP
%HOMEPATH%\PrintHood\~DCCJS2AA2hEyRySerl0V.TMP
%HOMEPATH%\PrintHood\~xmNiTRZXc1n3SzNjM0ru.TMP
%HOMEPATH%\PrintHood\~A4ugE4tKMYWxi1B9pCtb.TMP
%HOMEPATH%\PrintHood\~193LA4xPkU8R8WSquJuV.TMP

Удаляет следующие файлы:

%HOMEPATH%\PrintHood\pangtip.bat
%HOMEPATH%\PrintHood\<Имя вируса>.exe.txt

Сетевая активность:

Подключается к:

'localhost':1038
'localhost':1039
'localhost':1040
'localhost':1035
'localhost':1036
'localhost':1037

Другое:

Ищет следующие окна:

ClassName: '' WindowName: 'http://174.142.57.28/ - 404 - File or directory not found. - Windows Internet Explorer'
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: '' WindowName: '404 - File or directory not found. - Microsoft Internet Explorer'
ClassName: '' WindowName: 'http://174.142.57.28/ - 404 - File or directory not found. - Microsoft Internet Explorer'
ClassName: '' WindowName: '404 - File or directory not found. - Windows Internet Explorer'
ClassName: '' WindowName: 'u!u!u!u! - Microsoft Internet Explorer'
ClassName: '' WindowName: 'http://174.142.57.28/ - u!u!u!u! - Windows Internet Explorer'
ClassName: '' WindowName: 'u!u!u!u! - Windows Internet Explorer'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: ''
ClassName: '' WindowName: 'http://174.142.57.28/ - u!u!u!u! - Microsoft Internet Explorer'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней