Защити созданное

Другие наши ресурсы

  • free.drweb.kz — бесплатные утилиты, плагины, информеры
  • av-desk.com — интернет-сервис для поставщиков услуг Dr.Web AV-Desk
  • curenet.drweb.kz — сетевая лечащая утилита Dr.Web CureNet!
Закрыть

Библиотека
Моя библиотека

Чтобы добавить ресурс в библиотеку, войдите в аккаунт.

+ Добавить в библиотеку

Ресурсов: -

Последний: -

Моя библиотека

Поиск
Поиск

Поиск

Поддержка
Круглосуточная поддержка | Правила обращения

Напишите

Запрос через форму

Позвоните

Глобальная поддержка:
+7 (495) 789-45-86

ЧаВо | Форум

Ваши запросы

  • Все: -
  • Незакрытые: -
  • Последний: -
Создать новый запрос Частые вопросы

Позвоните

Глобальная поддержка:
+7 (495) 789-45-86

Свяжитесь с нами Незакрытые запросы: 

Профиль

Профиль

KZ

RU CN DE EN ES FR IT JP KZ UZ PL BY
Закрыть
Сервисы
Сканеры
Dr.Web vxCube
Демо
Экспертиза ВКИ
Вирусная библиотека
База знаний

Технологии

Термины

Обучение и просвещение

Мифы

Новости

Trojan.Encoder.556

Добавлен в вирусную базу Dr.Web: 2014-09-17

Описание добавлено:

Техническая информация

Вредоносные функции:
Создает и запускает на исполнение:
  • 'C:\tmp\Rar.exe' /pid=3372
  • 'C:\tmp\del.exe' /pid=2464
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\svg\svgBindings.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\svg\svgBindings.xml"
  • 'C:\tmp\del.exe' /pid=4224
  • 'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\tabprompts.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\tabprompts.xml"
  • 'C:\tmp\del.exe' /pid=4100
  • 'C:\tmp\bbs.exe' /c del.bat
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\consoleBindings.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\consoleBindings.xml"
  • 'C:\tmp\del.exe' /pid=5124
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\wizard.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\wizard.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\printPreviewBindings.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\printPreviewBindings.xml"
  • 'C:\tmp\del.exe' /pid=5528
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\platformHTMLBindings.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\platformHTMLBindings.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\xml\XMLPrettyPrint.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\xml\XMLPrettyPrint.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\xpinstall\xpinstallItem.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\xpinstall\xpinstallItem.xml"
  • 'C:\tmp\del.exe' /pid=3756
  • 'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\plugins\pluginProblem.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\plugins\pluginProblem.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\globalBindings.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\globalBindings.xml"
  • 'C:\tmp\Rar.exe' /pid=4752
  • 'C:\tmp\del.exe' /pid=4784
  • 'C:\tmp\Rar.exe' /pid=3088
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\extensions\extensions.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\extensions\extensions.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\extensions\blocklist.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\extensions\blocklist.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\downloads\download.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\downloads\download.xml"
  • 'C:\tmp\del.exe' /pid=5984
  • 'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\handling\handler.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\handling\handler.xml"
  • 'C:\tmp\del.exe' /pid=5936
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\videocontrols.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\videocontrols.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\radio.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\radio.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\progressmeter.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\progressmeter.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\preferences.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\preferences.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\richlistbox.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\richlistbox.xml"
  • 'C:\tmp\Rar.exe' /pid=6024
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\resizer.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\resizer.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\popup.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\popup.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\menu.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\menu.xml"
  • 'C:\tmp\del.exe' /pid=3492
  • 'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\listbox.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\listbox.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\numberbox.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\numberbox.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\notification.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\notification.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\menulist.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\menulist.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\scale.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\scale.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\toolbar.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\toolbar.xml"
  • 'C:\tmp\Rar.exe' /pid=2464
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\textbox.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\textbox.xml"
  • 'C:\tmp\del.exe' /pid=4460
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\tree.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\tree.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\toolbarbutton.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\toolbarbutton.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\text.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\text.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\spinbuttons.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\spinbuttons.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\scrollbox.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\scrollbox.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\scrollbar.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\scrollbar.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\tabbox.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\tabbox.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\stringbundle.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\stringbundle.xml"
  • 'C:\tmp\Rar.exe' /pid=4876
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\globalBindings.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\globalBindings.xml"
  • 'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Windows Media Player\npdrmv2.zip.RaR" "%PROGRAM_FILES%\Windows Media Player\npdrmv2.zip"
  • 'C:\tmp\del.exe' /pid=3684
  • 'C:\tmp\del.exe' /pid=3288
  • 'C:\tmp\Rar.exe' <Служебный элемент>
  • 'C:\tmp\del.exe' /pid=5340
  • 'C:\tmp\Rar.exe' /pid=4560
  • 'C:\tmp\bbs.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\Client.xml.RaR" "%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\Client.xml"
  • 'C:\tmp\Rar.exe' /pid=3076
  • 'C:\tmp\Rar.exe' /pid=5456
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml.RaR" "%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml.RaR" "%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml.RaR" "%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml"
  • 'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\Client.xml.RaR" "%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\Client.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.txt.RaR" "%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.txt"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\best_secure.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\best_secure.jpg"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\connected_data.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\connected_data.jpg"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\best_road_big.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\best_road_big.jpg"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\best_road.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\best_road.jpg"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt.RaR" "%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\best_robust.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\best_robust.jpg"
  • 'C:\tmp\Rar.exe' /pid=5280
  • 'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg"
  • 'C:\tmp\del.exe' /pid=5656
  • 'C:\tmp\Rar.exe' /pid=5588
  • 'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\searchplugins\google.xml.RaR" "%PROGRAM_FILES%\FireFox\searchplugins\google.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\searchplugins\eBay.xml.RaR" "%PROGRAM_FILES%\FireFox\searchplugins\eBay.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Microsoft.NET\RedistList\AssemblyList_4_extended.xml.RaR" "%PROGRAM_FILES%\Microsoft.NET\RedistList\AssemblyList_4_extended.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\searchplugins\yahoo.xml.RaR" "%PROGRAM_FILES%\FireFox\searchplugins\yahoo.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\searchplugins\wikipedia.xml.RaR" "%PROGRAM_FILES%\FireFox\searchplugins\wikipedia.xml"
  • 'C:\tmp\del.exe' /pid=4804
  • 'C:\tmp\Rar.exe' /pid=4020
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\README.txt.RaR" "%PROGRAM_FILES%\FireFox\README.txt"
  • 'C:\tmp\del.exe' /pid=5844
  • 'C:\tmp\Rar.exe' /pid=4652
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\searchplugins\bing.xml.RaR" "%PROGRAM_FILES%\FireFox\searchplugins\bing.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\searchplugins\amazondotcom.xml.RaR" "%PROGRAM_FILES%\FireFox\searchplugins\amazondotcom.xml"
  • 'C:\tmp\del.exe' /pid=5164
  • 'C:\tmp\del.exe' /pid=6036
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Movie Maker\Shared\Sample2.jpg.RaR" "%PROGRAM_FILES%\Movie Maker\Shared\Sample2.jpg"
  • 'C:\tmp\Rar.exe' /pid=4892
  • 'C:\tmp\Rar.exe' /pid=4964
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Outlook Express\msoe.txt.RaR" "%PROGRAM_FILES%\Outlook Express\msoe.txt"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\xfp.xml.RaR" "%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\xfp.xml"
  • 'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Movie Maker\Shared\Sample1.jpg.RaR" "%PROGRAM_FILES%\Movie Maker\Shared\Sample1.jpg"
  • 'C:\tmp\del.exe' /pid=5840
  • 'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Movie Maker\Shared\Empty.txt.RaR" "%PROGRAM_FILES%\Movie Maker\Shared\Empty.txt"
  • 'C:\tmp\Rar.exe' /pid=5656
  • 'C:\tmp\Rar.exe' /pid=4740
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Movie Maker\Shared\Profiles\Blank.txt.RaR" "%PROGRAM_FILES%\Movie Maker\Shared\Profiles\Blank.txt"
  • 'C:\tmp\Rar.exe' /pid=6012
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\rus\Bug.Report.txt.RaR" "C:\Far2\Documentation\rus\Bug.Report.txt"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\rus\Arc.Support.txt.RaR" "C:\Far2\Documentation\rus\Arc.Support.txt"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\eng\TechInfo.txt.RaR" "C:\Far2\Documentation\eng\TechInfo.txt"
  • 'C:\tmp\Rar.exe' /pid=2952
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\rus\Plugins.Install.txt.RaR" "C:\Far2\Documentation\rus\Plugins.Install.txt"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\rus\Far.FAQ.txt.RaR" "C:\Far2\Documentation\rus\Far.FAQ.txt"
  • 'C:\tmp\del.exe' /pid=3044
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\eng\Bug.Report.txt.RaR" "C:\Far2\Documentation\eng\Bug.Report.txt"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\eng\Arc.Support.txt.RaR" "C:\Far2\Documentation\eng\Arc.Support.txt"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Addons\README.TXT.RaR" "C:\Far2\Addons\README.TXT"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\eng\Plugins.Review.txt.RaR" "C:\Far2\Documentation\eng\Plugins.Review.txt"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\eng\Plugins.Install.txt.RaR" "C:\Far2\Documentation\eng\Plugins.Install.txt"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\eng\Far.FAQ.txt.RaR" "C:\Far2\Documentation\eng\Far.FAQ.txt"
  • 'C:\tmp\del.exe' /pid=2944
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Plugins\Colorer\hrc\changes.txt.RaR" "C:\Far2\Plugins\Colorer\hrc\changes.txt"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Plugins\Colorer\catalog.xml.RaR" "C:\Far2\Plugins\Colorer\catalog.xml"
  • 'C:\tmp\del.exe' /pid=3740
  • 'C:\tmp\Rar.exe' /pid=3552
  • 'C:\tmp\Rar.exe' /pid=3588
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Plugins\Colorer\hrd\catalog-console.xml.RaR" "C:\Far2\Plugins\Colorer\hrd\catalog-console.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Plugins\7-Zip\far7z.txt.RaR" "C:\Far2\Plugins\7-Zip\far7z.txt"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\rus\TechInfo.txt.RaR" "C:\Far2\Documentation\rus\TechInfo.txt"
  • 'C:\tmp\del.exe' /c del.bat
  • 'C:\tmp\Rar.exe' /pid=2812
  • 'C:\tmp\del.exe' /pid=3468
  • 'C:\tmp\Rar.exe'
  • 'C:\tmp\Rar.exe' /c del.bat
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%HOMEPATH%\Templates\winword2.doc.RaR" "%HOMEPATH%\Templates\winword2.doc"
  • 'C:\tmp\del.exe'
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.RaR" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg"
  • 'C:\tmp\fidonet.exe'
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.RaR" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.RaR" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.RaR" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg"
  • 'C:\tmp\ssencrypt.exe' public.key kii.hiew
  • 'C:\tmp\bbs.exe'
  • 'C:\tmp\error.exe'
  • 'C:\tmp\push.exe'
  • 'C:\tmp\moar.exe'
  • 'C:\tmp\ss.exe'
  • 'C:\tmp\mouse.exe'
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.RaR" "C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%HOMEPATH%\Templates\excel.xls.RaR" "%HOMEPATH%\Templates\excel.xls"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "<LS_APPDATA>\Microsoft\Windows Media\9.0\WMSDKNS.XML.RaR" "<LS_APPDATA>\Microsoft\Windows Media\9.0\WMSDKNS.XML"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%APPDATA%\Microsoft\Internet Explorer\brndlog.txt.RaR" "%APPDATA%\Microsoft\Internet Explorer\brndlog.txt"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%HOMEPATH%\Templates\winword.doc.RaR" "%HOMEPATH%\Templates\winword.doc"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%HOMEPATH%\Templates\powerpnt.ppt.RaR" "%HOMEPATH%\Templates\powerpnt.ppt"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%HOMEPATH%\Templates\excel4.xls.RaR" "%HOMEPATH%\Templates\excel4.xls"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Templates\winword2.doc.RaR" "C:\Documents and Settings\Default User\Templates\winword2.doc"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Templates\excel4.xls.RaR" "C:\Documents and Settings\Default User\Templates\excel4.xls"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Templates\excel.xls.RaR" "C:\Documents and Settings\Default User\Templates\excel.xls"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML.RaR" "C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML"
  • 'C:\tmp\ss.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Templates\winword.doc.RaR" "C:\Documents and Settings\Default User\Templates\winword.doc"
  • 'C:\tmp\ssencrypt.exe' /pid=764
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Templates\powerpnt.ppt.RaR" "C:\Documents and Settings\Default User\Templates\powerpnt.ppt"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Plugins\Colorer\hrd\catalog-text.xml.RaR" "C:\Far2\Plugins\Colorer\hrd\catalog-text.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\search\search.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\search\search.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\preferences\handlers.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\preferences\handlers.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\tree.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\tree.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\urlbarBindings.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\urlbarBindings.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\tabbrowser.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\tabbrowser.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\syncNotification.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\syncNotification.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\menu.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\menu.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\browser-tabPreviews.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\browser-tabPreviews.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\aboutSyncTabs-bindings.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\aboutSyncTabs-bindings.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\blocklist.xml.RaR" "%PROGRAM_FILES%\FireFox\blocklist.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\feeds.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\feeds.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\subscribe.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\subscribe.xml"
  • 'C:\tmp\del.exe' /pid=4088
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\findbar.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\findbar.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\filefield.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\filefield.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\expander.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\expander.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\groupbox.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\groupbox.xml"
  • 'C:\tmp\Rar.exe' /pid=6008
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\general.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\general.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\editor.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\editor.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\checkbox.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\checkbox.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\button.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\button.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\browser.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\browser.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\dialog.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\dialog.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\datetimepicker.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\datetimepicker.xml"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\colorpicker.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\colorpicker.xml"
  • 'C:\tmp\del.exe' /pid=3516
  • 'C:\tmp\del.exe' /pid=3960
  • 'C:\tmp\del.exe' /pid=3672
  • 'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.RaR" "C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT"
  • 'C:\tmp\Rar.exe' /pid=3376
  • 'C:\tmp\del.exe' /pid=2932
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Plugins\FTP\FtpCmds_rus.txt.RaR" "C:\Far2\Plugins\FTP\FtpCmds_rus.txt"
  • 'C:\tmp\Rar.exe' /pid=3636
  • 'C:\tmp\del.exe' /pid=360
  • 'C:\tmp\del.exe' /pid=4012
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.RaR" "C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT"
  • 'C:\tmp\del.exe' /pid=3388
  • 'C:\tmp\ss.exe' /pid=3396
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.RaR" "C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT"
  • 'C:\tmp\del.exe' /pid=3368
  • 'C:\tmp\del.exe' /pid=3872
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%CommonProgramFiles%\Microsoft Shared\Stationery\Nature Bkgrd.jpg.RaR" "%CommonProgramFiles%\Microsoft Shared\Stationery\Nature Bkgrd.jpg"
  • 'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%CommonProgramFiles%\Microsoft Shared\Stationery\Maize Bkgrd.jpg.RaR" "%CommonProgramFiles%\Microsoft Shared\Stationery\Maize Bkgrd.jpg"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%CommonProgramFiles%\Microsoft Shared\Stationery\Sunflower Bkgrd.jpg.RaR" "%CommonProgramFiles%\Microsoft Shared\Stationery\Sunflower Bkgrd.jpg"
  • 'C:\tmp\Rar.exe' /pid=1868
  • 'C:\tmp\del.exe' /pid=4036
  • 'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%CommonProgramFiles%\Microsoft Shared\Stationery\Leaves Bkgrd.jpg.RaR" "%CommonProgramFiles%\Microsoft Shared\Stationery\Leaves Bkgrd.jpg"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%CommonProgramFiles%\Microsoft Shared\Stationery\Fiesta Bkgrd.jpg.RaR" "%CommonProgramFiles%\Microsoft Shared\Stationery\Fiesta Bkgrd.jpg"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%CommonProgramFiles%\Microsoft Shared\Stationery\Clear Day Bkgrd.jpg.RaR" "%CommonProgramFiles%\Microsoft Shared\Stationery\Clear Day Bkgrd.jpg"
  • 'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Plugins\FTP\Notes_rus.txt.RaR" "C:\Far2\Plugins\FTP\Notes_rus.txt"
  • 'C:\tmp\Rar.exe' /pid=4080
  • 'C:\tmp\del.exe' /pid=3552
  • 'C:\tmp\del.exe' /pid=2600
Запускает на исполнение:
  • '<SYSTEM32>\cmd.exe' /c del.bat
  • '<SYSTEM32>\cmd.exe' /c rename.bat
  • '<SYSTEM32>\cmd.exe' /c rocket.bat
Внедряет код в
следующие системные процессы:
  • <SYSTEM32>\cmd.exe
Изменения в файловой системе:
Создает следующие файлы:
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\plugins\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\update\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\update\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\plugins\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\extensions\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\handling\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\handling\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\xpinstall\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\xpinstall\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\xbl-marquee\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\xbl-marquee\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\extensions\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\search\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\search\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\preferences\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\preferences\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\xml\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\downloads\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\downloads\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\xml\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\svg\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\svg\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\Windows Media Player\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\Windows Media Player\_3pass_%USERNAME%.pwd
  • %WINDIR%\$NtUninstallWIC$\spuninst\_3pass_%USERNAME%.pwd
  • %WINDIR%\Help\Tours\htmlTour\_Фaйлы зaшифpoванны.Txt
  • %WINDIR%\Help\Tours\htmlTour\_3pass_%USERNAME%.pwd
  • %WINDIR%\$NtUninstallWIC$\spuninst\_Фaйлы зaшифpoванны.Txt
  • <Служебный элемент>
  • %WINDIR%\$NtUninstallKB942288-v3$\spuninst\_Фaйлы зaшифpoванны.Txt
  • %WINDIR%\$NtUninstallKB942288-v3$\spuninst\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\Movie Maker\Shared\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\Movie Maker\Shared\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\Movie Maker\Shared\Profiles\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\Microsoft.NET\RedistList\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\FireFox\searchplugins\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\FireFox\searchplugins\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\Microsoft.NET\RedistList\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\Movie Maker\Shared\Profiles\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\Outlook Express\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\MSN\MSNCoreFiles\Install\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\Outlook Express\_Фaйлы зaшифpoванны.Txt
  • %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\_3pass_%USERNAME%.pwd
  • C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\_Фaйлы зaшифpoванны.Txt
  • C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\_3pass_%USERNAME%.pwd
  • %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\_3pass_.pwd
  • C:\tmp\22022
  • C:\wintmp\22022
  • %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\_Фaйлы зaшифpoванны.Txt
  • C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\_Фaйлы зaшифpoванны.Txt
  • %APPDATA%\Microsoft\Internet Explorer\_3pass_%USERNAME%.pwd
  • <LS_APPDATA>\Microsoft\Windows Media\9.0\_Фaйлы зaшифpoванны.Txt
  • <LS_APPDATA>\Microsoft\Windows Media\9.0\_3pass_%USERNAME%.pwd
  • %APPDATA%\Microsoft\Internet Explorer\_Фaйлы зaшифpoванны.Txt
  • C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\_3pass_%USERNAME%.pwd
  • C:\Documents and Settings\Default User\Templates\_Фaйлы зaшифpoванны.Txt
  • C:\Documents and Settings\Default User\Templates\_3pass_%USERNAME%.pwd
  • C:\tmp\kii.hiew
  • C:\tmp\fidonet.exe
  • C:\tmp\moar.exe
  • C:\tmp\mouse.exe
  • C:\tmp\error.exe
  • C:\tmp\bbs.exe
  • C:\tmp\del.bat
  • C:\tmp\del.exe
  • C:\tmp\public.key
  • C:\tmp\ss.exe
  • C:\tmp\ssencrypt.exe
  • C:\tmp\names.hiew
  • C:\tmp\rocket.bat
  • C:\tmp\push.exe
  • C:\tmp\Rar.exe
  • C:\tmp\rename.bat
  • %CommonProgramFiles%\Microsoft Shared\Stationery\_Фaйлы зaшифpoванны.Txt
  • %CommonProgramFiles%\Microsoft Shared\Stationery\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\FireFox\_Фaйлы зaшифpoванны.Txt
  • C:\Far2\Plugins\FTP\_3pass_%USERNAME%.pwd
  • C:\Far2\Plugins\ExtSearch\doc\_Фaйлы зaшифpoванны.Txt
  • C:\Far2\Plugins\ExtSearch\doc\_3pass_%USERNAME%.pwd
  • C:\Far2\Plugins\FTP\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\FireFox\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\_Фaйлы зaшифpoванны.Txt
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\_3pass_%USERNAME%.pwd
  • %PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\_Фaйлы зaшифpoванны.Txt
  • C:\Far2\Plugins\Colorer\hrd\_3pass_%USERNAME%.pwd
  • C:\Far2\Documentation\eng\_Фaйлы зaшифpoванны.Txt
  • C:\Far2\Documentation\eng\_3pass_%USERNAME%.pwd
  • C:\Far2\Documentation\rus\_Фaйлы зaшифpoванны.Txt
  • C:\Far2\Addons\_3pass_%USERNAME%.pwd
  • %HOMEPATH%\Templates\_Фaйлы зaшифpoванны.Txt
  • %HOMEPATH%\Templates\_3pass_%USERNAME%.pwd
  • C:\Far2\Addons\_Фaйлы зaшифpoванны.Txt
  • C:\Far2\Documentation\rus\_3pass_%USERNAME%.pwd
  • C:\Far2\Plugins\Colorer\hrc\_Фaйлы зaшифpoванны.Txt
  • C:\Far2\Plugins\Colorer\hrc\_3pass_%USERNAME%.pwd
  • C:\Far2\Plugins\Colorer\hrd\_Фaйлы зaшифpoванны.Txt
  • C:\Far2\Plugins\Colorer\_3pass_%USERNAME%.pwd
  • C:\Far2\Plugins\7-Zip\_Фaйлы зaшифpoванны.Txt
  • C:\Far2\Plugins\7-Zip\_3pass_%USERNAME%.pwd
  • C:\Far2\Plugins\Colorer\_Фaйлы зaшифpoванны.Txt
Удаляет следующие файлы:
  • %WINDIR%\Help\Tours\htmlTour\best_secure.jpg
  • %WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg
  • %WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg
  • %WINDIR%\Help\Tours\htmlTour\connected_data.jpg
  • %WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg
  • %WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg
  • %WINDIR%\Help\Tours\htmlTour\best_robust.jpg
  • %WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt
  • %WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.txt
  • C:\tmp\kii.hiew
  • %WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg
  • %WINDIR%\Help\Tours\htmlTour\best_road_big.jpg
  • %WINDIR%\Help\Tours\htmlTour\best_road.jpg
Другое:
Ищет следующие окна:
  • ClassName: 'Shell_TrayWnd' WindowName: ''
  • ClassName: 'EDIT' WindowName: ''

Рекомендации по лечению

  1. В случае если операционная система способна загрузиться (в штатном режиме или режиме защиты от сбоев), скачайте лечащую утилиту Dr.Web CureIt! и выполните с ее помощью полную проверку вашего компьютера, а также используемых вами переносных носителей информации.
  2. Если загрузка операционной системы невозможна, измените настройки BIOS вашего компьютера, чтобы обеспечить возможность загрузки ПК с компакт-диска или USB-накопителя. Скачайте образ аварийного диска восстановления системы Dr.Web® LiveDisk или утилиту записи Dr.Web® LiveDisk на USB-накопитель, подготовьте соответствующий носитель. Загрузив компьютер с использованием данного носителя, выполните его полную проверку и лечение обнаруженных угроз.
Демо бесплатно

 

Скачать Dr.Web

По серийному номеру

Выполните полную проверку системы с использованием Антивируса Dr.Web Light для macOS. Данный продукт можно загрузить с официального сайта Apple App Store.

Демо бесплатно

 

Скачать Dr.Web

По серийному номеру

Скачать Dr.Web с Apple Store

На загруженной ОС выполните полную проверку всех дисковых разделов с использованием продукта Антивирус Dr.Web для Linux.

Демо бесплатно

 

Скачать Dr.Web

По серийному номеру

  1. Если мобильное устройство функционирует в штатном режиме, загрузите и установите на него бесплатный антивирусный продукт Dr.Web для Android Light. Выполните полную проверку системы и используйте рекомендации по нейтрализации обнаруженных угроз.
  2. Если мобильное устройство заблокировано троянцем-вымогателем семейства Android.Locker (на экране отображается обвинение в нарушении закона, требование выплаты определенной денежной суммы или иное сообщение, мешающее нормальной работе с устройством), выполните следующие действия:
    • загрузите свой смартфон или планшет в безопасном режиме (в зависимости от версии операционной системы и особенностей конкретного мобильного устройства эта процедура может быть выполнена различными способами; обратитесь за уточнением к инструкции, поставляемой вместе с приобретенным аппаратом, или напрямую к его производителю);
    • после активации безопасного режима установите на зараженное устройство бесплатный антивирусный продукт Dr.Web для Android Light и произведите полную проверку системы, выполнив рекомендации по нейтрализации обнаруженных угроз;
    • выключите устройство и включите его в обычном режиме.

Подробнее о Dr.Web для Android

Демо бесплатно на 14 дней

Выдаётся при установке

Скачать с сайта
Скачать с Google Play