Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Avatar3D' = '<Полный путь к вирусу>'
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\blurbs\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\$000000.tmp
- <SYSTEM32>\oobe\images\$000000.tmp
- %WINDIR%\Web\Wallpaper\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\48x48\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\16x16\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\24x24\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\32x32\$000000.tmp
- <SYSTEM32>\oobe\html\mouse\images\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\$000000.tmp
- <SYSTEM32>\$000000.tmp
- <SYSTEM32>\CatRoot2\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\$000000.tmp
- %WINDIR%\$000000.tmp
- %WINDIR%\Help\Tours\mmTour\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\DVDUpgrd\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\$000000.tmp
- <DRIVERS>\$000000.tmp
- <SYSTEM32>\Restore\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Web\Wallpaper\Ascent.jpg в %WINDIR%\Web\Wallpaper\$000000.tmp
- %WINDIR%\Web\Wallpaper\Azul.jpg в %WINDIR%\Web\Wallpaper\$000000.tmp
- %WINDIR%\Web\Wallpaper\Follow.jpg в %WINDIR%\Web\Wallpaper\$000000.tmp
- <SYSTEM32>\oobe\images\wpatop.jpg в <SYSTEM32>\oobe\images\$000000.tmp
- <SYSTEM32>\oobe\images\skipover.jpg в <SYSTEM32>\oobe\images\$000000.tmp
- <SYSTEM32>\oobe\images\wpaback.jpg в <SYSTEM32>\oobe\images\$000000.tmp
- <SYSTEM32>\oobe\images\wpaflag.jpg в <SYSTEM32>\oobe\images\$000000.tmp
- %WINDIR%\Web\Wallpaper\Home.jpg в %WINDIR%\Web\Wallpaper\$000000.tmp
- %WINDIR%\Web\Wallpaper\Vortec space.jpg в %WINDIR%\Web\Wallpaper\$000000.tmp
- %WINDIR%\Web\Wallpaper\Windows XP.jpg в %WINDIR%\Web\Wallpaper\$000000.tmp
- %WINDIR%\Blue Lace 16.bmp в %WINDIR%\$000000.tmp
- %WINDIR%\Web\Wallpaper\Stonehenge.jpg в %WINDIR%\Web\Wallpaper\$000000.tmp
- %WINDIR%\Web\Wallpaper\Peace.jpg в %WINDIR%\Web\Wallpaper\$000000.tmp
- %WINDIR%\Web\Wallpaper\Purple flower.jpg в %WINDIR%\Web\Wallpaper\$000000.tmp
- %WINDIR%\Web\Wallpaper\Red moon desert.jpg в %WINDIR%\Web\Wallpaper\$000000.tmp
- <SYSTEM32>\oobe\html\mouse\images\venice.jpg в <SYSTEM32>\oobe\html\mouse\images\$000000.tmp
- <SYSTEM32>\oobe\html\mouse\images\verona.jpg в <SYSTEM32>\oobe\html\mouse\images\$000000.tmp
- <SYSTEM32>\oobe\images\backdown.jpg в <SYSTEM32>\oobe\images\$000000.tmp
- <SYSTEM32>\oobe\html\mouse\images\tyrol.jpg в <SYSTEM32>\oobe\html\mouse\images\$000000.tmp
- <SYSTEM32>\oobe\html\mouse\images\paris.jpg в <SYSTEM32>\oobe\html\mouse\images\$000000.tmp
- <SYSTEM32>\oobe\html\mouse\images\pisa.jpg в <SYSTEM32>\oobe\html\mouse\images\$000000.tmp
- <SYSTEM32>\oobe\html\mouse\images\prague.jpg в <SYSTEM32>\oobe\html\mouse\images\$000000.tmp
- <SYSTEM32>\oobe\images\backover.jpg в <SYSTEM32>\oobe\images\$000000.tmp
- <SYSTEM32>\oobe\images\nextoff.jpg в <SYSTEM32>\oobe\images\$000000.tmp
- <SYSTEM32>\oobe\images\nextup.jpg в <SYSTEM32>\oobe\images\$000000.tmp
- <SYSTEM32>\oobe\images\skipdown.jpg в <SYSTEM32>\oobe\images\$000000.tmp
- <SYSTEM32>\oobe\images\newtop8.jpg в <SYSTEM32>\oobe\images\$000000.tmp
- <SYSTEM32>\oobe\images\mslogo.jpg в <SYSTEM32>\oobe\images\$000000.tmp
- <SYSTEM32>\oobe\images\newbtm8.jpg в <SYSTEM32>\oobe\images\$000000.tmp
- <SYSTEM32>\oobe\images\newmark8.jpg в <SYSTEM32>\oobe\images\$000000.tmp
- %WINDIR%\FeatherTexture.bmp в %WINDIR%\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_normal.bmp в %WINDIR%\pchealth\helpctr\System\images\24x24\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\32x32\logo.bmp в %WINDIR%\pchealth\helpctr\System\images\32x32\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_01.bmp в %WINDIR%\pchealth\helpctr\System\images\48x48\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\24x24\arrow_green_mousedown.bmp в %WINDIR%\pchealth\helpctr\System\images\24x24\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\16x16\compat.bmp в %WINDIR%\pchealth\helpctr\System\images\16x16\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\16x16\support.bmp в %WINDIR%\pchealth\helpctr\System\images\16x16\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\16x16\update.bmp в %WINDIR%\pchealth\helpctr\System\images\16x16\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_03.bmp в %WINDIR%\pchealth\helpctr\System\images\48x48\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendVoice.bmp в %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\StopControl.bmp в %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\up.bmp в %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Quit.bmp в %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\48x48\desktop_icon_generic.bmp в %WINDIR%\pchealth\helpctr\System\images\48x48\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\TakeControl.bmp в %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\HelpCenter.bmp в %WINDIR%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\$000000.tmp
- %WINDIR%\Zapotec.bmp в %WINDIR%\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\logo.bmp в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\header.bmp в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\$000000.tmp
- %WINDIR%\winnt.bmp в %WINDIR%\$000000.tmp
- %WINDIR%\Greenstone.bmp в %WINDIR%\$000000.tmp
- %WINDIR%\Rhododendron.bmp в %WINDIR%\$000000.tmp
- %WINDIR%\Santa Fe Stucco.bmp в %WINDIR%\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\watermark.bmp в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\icon_newwindow_12x.bmp в %WINDIR%\pchealth\helpctr\System\images\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\icon_tours_12x.bmp в %WINDIR%\pchealth\helpctr\System\images\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\16x16\arrow_blue_normal_shadow.bmp в %WINDIR%\pchealth\helpctr\System\images\16x16\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\images\icon_articles_12x.bmp в %WINDIR%\pchealth\helpctr\System\images\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\header.bmp в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\watermark.bmp в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\blurbs\watermark_300x.bmp в %WINDIR%\pchealth\helpctr\System\blurbs\$000000.tmp
- <SYSTEM32>\oobe\html\mouse\images\heidelb.jpg в <SYSTEM32>\oobe\html\mouse\images\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\best_secure.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\img004b.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\img033.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\img034.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\gradient.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\end_up.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\mmTour\segment5.txt в %WINDIR%\Help\Tours\mmTour\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\SetupENU1.txt в %WINDIR%\Microsoft.NET\Framework\v1.1.4322\1033\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\dd_dotnetfx3error.txt в %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\$000000.tmp
- %WINDIR%\Help\Tours\mmTour\segment3.txt в %WINDIR%\Help\Tours\mmTour\$000000.tmp
- %WINDIR%\OEWABLog.txt в %WINDIR%\$000000.tmp
- %WINDIR%\Help\Tours\mmTour\intro.txt в %WINDIR%\Help\Tours\mmTour\$000000.tmp
- %WINDIR%\Help\Tours\mmTour\segment1.txt в %WINDIR%\Help\Tours\mmTour\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\VSMsiLog22FD.txt в %WINDIR%\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 x86\Logs\$000000.tmp
- <SYSTEM32>\Restore\MachineGuid.txt в <SYSTEM32>\Restore\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\best_road.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- <DRIVERS>\gmreadme.txt в <DRIVERS>\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\dd_dotnetfx35error.txt в %WINDIR%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\Logs\$000000.tmp
- <SYSTEM32>\eula.txt в <SYSTEM32>\$000000.tmp
- <SYSTEM32>\CatRoot2\dberr.txt в <SYSTEM32>\CatRoot2\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\img046.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\window_up.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg в %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\ul_logo.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg в %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\DVDUpgrd\stripe.jpg в %WINDIR%\pchealth\helpctr\System\DVDUpgrd\$000000.tmp
- %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\greendot.jpg в %WINDIR%\pchealth\helpctr\System\sysinfo\graphics\$000000.tmp
- <SYSTEM32>\oobe\html\mouse\images\bulzano.jpg в <SYSTEM32>\oobe\html\mouse\images\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg в %WINDIR%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\$000000.tmp
- %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg в %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\img116.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\img123.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\img136.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\img109.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\img068.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\img074a.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\img100.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\intro_logo.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\start_up.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\pen_icon.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\read_icon.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp
- %WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg в %WINDIR%\Help\Tours\htmlTour\$000000.tmp