Trojan.DownLoader6.19678

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%HOMEPATH%\Windows\UpdateOffice.exe

Вредоносные функции:

Создает и запускает на исполнение:

%HOMEPATH%\PrintHood\UpdateOffice.exe
%HOMEPATH%\Windows\UpdateOffice.exe

Запускает на исполнение:

<SYSTEM32>\cmd.exe /c ""%HOMEPATH%\PrintHood\pangtip.bat" "
<SYSTEM32>\ping.exe 174.142.57.29
<SYSTEM32>\rundll32.exe <SYSTEM32>\shimgvw.dll,ImageView_Fullscreen %HOMEPATH%\PrintHood\<Имя вируса>.exe.jpg
<SYSTEM32>\cmd.exe /c ""%HOMEPATH%\PrintHood\700.bat" "

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\PrintHood\~Wan8Fu29nSVVJT2S5jgD.TMP
%HOMEPATH%\PrintHood\~tQ3Tfg0nPKpn7hAXF3YD.TMP
%HOMEPATH%\PrintHood\~LG9xtRvh6OgDThFdY4HC.TMP
%HOMEPATH%\PrintHood\~LLItS2qdAgsiCDxxRvAG.TMP
%HOMEPATH%\PrintHood\elq5bwGkPV.PRI
%HOMEPATH%\PrintHood\43H5sXcPuI.PRI
%HOMEPATH%\PrintHood\9toB8aUPyN.PRI
%HOMEPATH%\PrintHood\l8JbrSSk7x.PRI
%HOMEPATH%\PrintHood\TrY0b97z1l.PRI
%HOMEPATH%\PrintHood\~9priWRazg9Xt4TzDprk0.TMP
%HOMEPATH%\PrintHood\~gfsiETuI9HY4Kpj5Lbvl.TMP
%HOMEPATH%\PrintHood\~zSkosxGhADLfKBWiCs4Y.TMP
%HOMEPATH%\PrintHood\~Uyu8MqbH3Zr2cnOMpWph.TMP
%HOMEPATH%\PrintHood\~tLp8RtXZRBnKQXntFLYP.TMP
%HOMEPATH%\PrintHood\~FS14BidxYjKWultg8GW4.TMP
%HOMEPATH%\PrintHood\~xWBZzBDq85Qewu5oHfRF.TMP
%HOMEPATH%\PrintHood\~MCrj9Zxf3UbXiizrXiZJ.TMP
%HOMEPATH%\PrintHood\~1FjkS9Wed58aboWVdY6S.TMP
%HOMEPATH%\PrintHood\~XEbcnGB7MoRUdq1VFeaA.TMP
%HOMEPATH%\PrintHood\Y64hxvAj8J.PRI
%HOMEPATH%\PrintHood\lncGzZaZ5i.PRI
%HOMEPATH%\PrintHood\AmgkMQwpJ3.PRI
%HOMEPATH%\PrintHood\USOVyJUEMV.PRI
%HOMEPATH%\PrintHood\j0GUqagfPl.PRI
%HOMEPATH%\PrintHood\XnhjQM5hff.PRI
%HOMEPATH%\PrintHood\uOpvpHFiOw.PRI
%HOMEPATH%\PrintHood\gDprakYvS6.PRI
%HOMEPATH%\PrintHood\vMHWRXW54L.PRI
%HOMEPATH%\PrintHood\XtMhvHglQz.PRI
%HOMEPATH%\PrintHood\gpXFlODd1Q.PRI
%HOMEPATH%\PrintHood\QMMpK3wABt.PRI
%HOMEPATH%\PrintHood\LY0PojBfae.PRI
%HOMEPATH%\PrintHood\7cEL5ElgL0.PRI
%HOMEPATH%\PrintHood\aiTkcQr4H6.PRI
%HOMEPATH%\PrintHood\HINNzvhc6D.PRI
%HOMEPATH%\PrintHood\WgK22kzOSR.PRI
%HOMEPATH%\PrintHood\kp6N4B07VD.PRI
%HOMEPATH%\PrintHood\bdTMhtrUG5.PRI
%HOMEPATH%\PrintHood\5WC1TYNq15.PRI
%HOMEPATH%\PrintHood\~oymRNl64cfCWbhhpTJhS.TMP
%HOMEPATH%\PrintHood\~DWwxOqnO1pSMdISQPRBQ.TMP
%HOMEPATH%\PrintHood\~HR8ACqs6NeGPPI4piJtS.TMP
%HOMEPATH%\PrintHood\~p34bLmQ9yFJLKPsamBS3.TMP
%HOMEPATH%\PrintHood\~BsTiCejE8DkkVySg7v8z.TMP
%HOMEPATH%\PrintHood\~BFAUIYcEWGP4gL1Y7Hjw.TMP
%HOMEPATH%\PrintHood\~BFfjmBhSuKsIkrjAFWRh.TMP
%HOMEPATH%\PrintHood\~ZYDoHCAEl5gV8yMF7Fgh.TMP
%HOMEPATH%\PrintHood\~WDGJZ3lNa9D9hXXBp77b.TMP
%HOMEPATH%\PrintHood\~RHsW4NVHPfHewfxm8SL1.TMP
%HOMEPATH%\PrintHood\~gy6Oy0PJbEHVHF9xWSff.TMP
%HOMEPATH%\PrintHood\~jjrUv3mIer16I4axKMXU.TMP
%HOMEPATH%\PrintHood\~qYczvJD83QQtxfc57egP.TMP
%HOMEPATH%\PrintHood\~mZSg1zLWLLNKkXAf50im.TMP
%HOMEPATH%\PrintHood\~SWedDyHC2ZqnQfRw6StY.TMP
%HOMEPATH%\PrintHood\~UsHW5ghg9T3UjgdMeWDj.TMP
%HOMEPATH%\PrintHood\~LbfGOgJui1CgzAgbMuSy.TMP
%HOMEPATH%\PrintHood\~xzNutSmXCNAFIFy1kpC4.TMP
%HOMEPATH%\PrintHood\~sYXzHwqVn3e9MmstSjPh.TMP
%HOMEPATH%\PrintHood\~W23hnmCOwCttKIwwaWux.TMP
%HOMEPATH%\PrintHood\~F2w8GEstdXuNv17KDfTT.TMP
%HOMEPATH%\PrintHood\~w3XmFk9KpKiE4hrjZrNs.TMP
%HOMEPATH%\PrintHood\~iZtBnE6zDOgEgW0Nf5kX.TMP
%HOMEPATH%\PrintHood\~MdQonQQkw37Ke1FKAc0J.TMP
%HOMEPATH%\PrintHood\~qVEGsPtNFC7pTfcn77G4.TMP
%HOMEPATH%\PrintHood\~GlmUSOy0CYrmdA9omrNm.TMP
%HOMEPATH%\PrintHood\~fdbqEsCmPswwa4i9sWfa.TMP
%HOMEPATH%\PrintHood\~XG1H2X6Tq9ejN2eVIExv.TMP
%HOMEPATH%\PrintHood\~h8tR2QhUnIawqZqaWVjI.TMP
%HOMEPATH%\PrintHood\~NsNo5tMTMn9PaA1gMvIj.TMP
%HOMEPATH%\PrintHood\~t69X8qr2mai8Az7TQYaV.TMP
%HOMEPATH%\PrintHood\~eg2N3QLupaIIVbmp5ee8.TMP
%HOMEPATH%\PrintHood\~4Kkqxx3Cu7xsGBr9ZJ3t.TMP
%HOMEPATH%\PrintHood\~lqPgGCSVOMielFMPge2q.TMP
%HOMEPATH%\PrintHood\~stT2G61sbVXNwnhgkMSm.TMP
%HOMEPATH%\PrintHood\~TKXlSlFwCoCuprzOjtzq.TMP
%HOMEPATH%\PrintHood\~tUtMkCxyOjwZzsIARWJ8.TMP
%HOMEPATH%\PrintHood\~XIWIx8bb0iKm8wj0m9sv.TMP
%HOMEPATH%\PrintHood\~DzjfNC5j5fdyobdrZo0C.TMP
%HOMEPATH%\PrintHood\~bzCeJhfbJMc99WplxNuV.TMP
%HOMEPATH%\PrintHood\SpHBmtYfIP.PRI
%HOMEPATH%\PrintHood\cXgXcd34qd.dll
%HOMEPATH%\PrintHood\sGy9S6KvNo.dll
%HOMEPATH%\PrintHood\aVcrfcIZmx.dll
%HOMEPATH%\PrintHood\BJKG0iqgbr.dll
%HOMEPATH%\PrintHood\lt17bc0h8A.dll
%HOMEPATH%\PrintHood\DOnpgLW0kk.dll
%HOMEPATH%\PrintHood\AeGMlyYBjN.dll
%HOMEPATH%\PrintHood\aqnJBjyNXi.dll
%HOMEPATH%\PrintHood\Ddz3MdtoM1.dll
%HOMEPATH%\PrintHood\1VuSZ1WtgB.dll
%HOMEPATH%\PrintHood\FywS8522cG.dll
%HOMEPATH%\PrintHood\wYoUozpI72.dll
%HOMEPATH%\PrintHood\b6fMlnnCAC.dll
%HOMEPATH%\PrintHood\dvuI7qysTn.dll
%HOMEPATH%\PrintHood\BQxDtjHz2g.dll
%HOMEPATH%\PrintHood\8vE7Sw1jLJ.dll
%HOMEPATH%\PrintHood\eL2JGgj5Ii.dll
%HOMEPATH%\PrintHood\gN7neBZ4OM.dll
%HOMEPATH%\PrintHood\ZCdwF86Ivk.dll
%HOMEPATH%\PrintHood\H1ru3IkrQe.dll
%HOMEPATH%\PrintHood\uG2OOZAgvC.dll
%HOMEPATH%\PrintHood\tV74YzUhdW.dll
%HOMEPATH%\PrintHood\ITcvXc2QtX.dll
%HOMEPATH%\PrintHood\o7AjBw3GLv.dll
%HOMEPATH%\PrintHood\nFTx6j9Jf8.dll
%HOMEPATH%\PrintHood\pangtip.bat
%HOMEPATH%\PrintHood\UPDATE~1.EXE.pkxm
%HOMEPATH%\PrintHood\OvuJm7r1DS.dll
%HOMEPATH%\Templates\nam.dll
%HOMEPATH%\PrintHood\p2OlAVKsFQ.dll
%HOMEPATH%\PrintHood\ijpWU8msNi.dll
%HOMEPATH%\PrintHood\UwmoLd1W89.dll
%HOMEPATH%\PrintHood\lqBUMpjNKA.dll
%HOMEPATH%\PrintHood\yWrsnIEhug.dll
%HOMEPATH%\PrintHood\0V9MTpuYcM.dll
%HOMEPATH%\PrintHood\QJ0nkGjDSK.dll
%HOMEPATH%\PrintHood\KGs837w91u.dll
%HOMEPATH%\PrintHood\jANUFW3EAo.dll
%HOMEPATH%\PrintHood\KGAGBP7w7k.dll
%HOMEPATH%\PrintHood\1vLGql1pBH.dll
%HOMEPATH%\PrintHood\yXBTR22tPY.PRI
%HOMEPATH%\PrintHood\XYaq6wJmPK.PRI
%HOMEPATH%\PrintHood\1Uhh7EJgTp.PRI
%HOMEPATH%\PrintHood\L6HHWtSK8z.PRI
%HOMEPATH%\PrintHood\xFlo9zvi48.PRI
%HOMEPATH%\PrintHood\0FfAAkLnSm.PRI
%HOMEPATH%\PrintHood\V0t3Hj3TrY.PRI
%HOMEPATH%\PrintHood\S7diDhBQKq.PRI
%HOMEPATH%\PrintHood\TpQVqX392h.PRI
%HOMEPATH%\PrintHood\m2Z5SM6gO2.PRI
%HOMEPATH%\PrintHood\lCZIUcCmYa.PRI
%HOMEPATH%\PrintHood\nrgCGNE3DQ.PRI
%HOMEPATH%\PrintHood\VgXYmFYN23.PRI
%HOMEPATH%\PrintHood\I7kBhEvCUt.PRI
%HOMEPATH%\PrintHood\32Ay5XO5JK.PRI
%HOMEPATH%\PrintHood\OPv0Mn0Xy4.PRI
%HOMEPATH%\PrintHood\4lAjecmoOI.PRI
%HOMEPATH%\PrintHood\IswwAAAH6f.PRI
%HOMEPATH%\PrintHood\L8ck4GtXUX.PRI
%HOMEPATH%\PrintHood\D4JH4YopD9.PRI
%HOMEPATH%\PrintHood\rY8AfKCpZp.dll
%HOMEPATH%\PrintHood\TJxAA9wIGb.dll
%HOMEPATH%\PrintHood\5KhfRM6Ery.dll
%HOMEPATH%\PrintHood\hktla77Fpk.dll
%HOMEPATH%\PrintHood\ROtuNCoE4N.dll
%HOMEPATH%\PrintHood\kuChsmEKkd.dll
%HOMEPATH%\PrintHood\vFtpBv04Cd.dll
%HOMEPATH%\PrintHood\0msvsBR8M3.dll
%HOMEPATH%\PrintHood\UmhJPmdrWR.dll
%HOMEPATH%\PrintHood\yV2sMLO8VS.dll
%HOMEPATH%\PrintHood\V6EcZAHau6.PRI
%HOMEPATH%\PrintHood\A78W5nNiUg.PRI
%HOMEPATH%\PrintHood\A0eTCNTvxc.PRI
%HOMEPATH%\PrintHood\sIw2uo1Uzt.PRI
%HOMEPATH%\PrintHood\fA17UfDXkg.PRI
%HOMEPATH%\PrintHood\xFeGjya5V1.dll
%HOMEPATH%\PrintHood\dhkpvFTKbI.dll
%HOMEPATH%\PrintHood\ZQBjn4BHoy.dll
%HOMEPATH%\PrintHood\Kf6708LZgY.dll
%HOMEPATH%\PrintHood\~CJjvN4uKQ0EPFVfTzMnv.TMP
%HOMEPATH%\PrintHood\~t2lASXLg5C4R3NYwJi4s.TMP
%HOMEPATH%\PrintHood\~N2SGEULsiVjzGBhE6Pkw.TMP
%HOMEPATH%\PrintHood\~kbiovEhw8jMw38Cc3ah8.TMP
%HOMEPATH%\PrintHood\~yY0r02v8iVtafV29xgAs.TMP
%HOMEPATH%\PrintHood\~PLPBiKEd5t47vo9g1D6j.TMP
%HOMEPATH%\PrintHood\~1gacjAT70qfDr1Focgnx.TMP
%HOMEPATH%\PrintHood\~0UKKcZLmKVzg4IByWnAc.TMP
%HOMEPATH%\PrintHood\~XFf7oF4Q0nPtOuWJGk2g.TMP
%HOMEPATH%\PrintHood\~DRxMgczro4LbedAnCCY4.TMP
%HOMEPATH%\PrintHood\~V1zowKrNchXIY3zOSDAV.TMP
%HOMEPATH%\PrintHood\~MpLyr6sH4YLJkbi14LmN.TMP
%HOMEPATH%\PrintHood\~nD8luCrWt6Y8INFdEcyy.TMP
%HOMEPATH%\PrintHood\~gBlinKACdHvALIAEGg0i.TMP
%HOMEPATH%\PrintHood\~IwXCYZlCysQLzt5sbB1v.TMP
%HOMEPATH%\PrintHood\~BYv7gKS9yA4SPRxIpB7i.TMP
%HOMEPATH%\PrintHood\~2EotMArht0ul55VPfZsb.TMP
%HOMEPATH%\PrintHood\~nqFeT20A7Ao51pg9dT4h.TMP
%HOMEPATH%\PrintHood\~JRAsQC7cfKNkHw3tWRFr.TMP
%HOMEPATH%\PrintHood\~dbdO1w4hL6vr4IccvCOS.TMP
%HOMEPATH%\PrintHood\~0nuzHQRxv36XWLXnbyZL.TMP
%HOMEPATH%\PrintHood\~whms5vv1CZIRQI2p4HfR.TMP
%HOMEPATH%\PrintHood\~FfaPELyAgQUsz4KK7s4Z.TMP
%HOMEPATH%\PrintHood\~6GkCgy6FCqpWXAKjwTTU.TMP
%HOMEPATH%\PrintHood\~f5q4pFbOGgRg5WNSncih.TMP
%HOMEPATH%\PrintHood\~cExAKRfAYmjOVgFyrAkr.TMP
%HOMEPATH%\PrintHood\~4sOITrE9iT0YVCXAbb2E.TMP
%HOMEPATH%\PrintHood\~YkvHKpBwRA93qMrYShLp.TMP
%HOMEPATH%\PrintHood\~awBQx6pDVBUW2LQAmH4a.TMP
%HOMEPATH%\PrintHood\~0Gfv0fV4K5MYdZQERSWq.TMP
%HOMEPATH%\PrintHood\~E8E4LNbzMyGtnkLYWnzF.TMP
%HOMEPATH%\PrintHood\~kz1LVgkvanKJerHen7eb.TMP
%HOMEPATH%\PrintHood\~G46lcATRqgvMA7yLLJwR.TMP
%HOMEPATH%\PrintHood\~JV7UQOakfMsy3jZ1jalE.TMP
%HOMEPATH%\PrintHood\~nkSIdxVOQDX7zFPNBxEQ.TMP
%HOMEPATH%\PrintHood\~fLK5hwMOzN3ejSmOjAwc.TMP
%HOMEPATH%\PrintHood\~1bKcHCFWRCiliWmlAvUD.TMP
%HOMEPATH%\PrintHood\~qc5Xib3CHHjKeDgJMDzX.TMP
%HOMEPATH%\PrintHood\~kMC8G2nGeIzkWRDMd38N.TMP
%HOMEPATH%\PrintHood\~7JxCDwYHmen7WxB7A3gt.TMP
%HOMEPATH%\PrintHood\~xviWQ4VI8EjOk6DDvjp8.TMP
%HOMEPATH%\PrintHood\datikal.dll
%HOMEPATH%\PrintHood\~sA335Rh0YKydDKbW3HlE.TMP
%HOMEPATH%\Recent\<Имя вируса>.exe.lnk
%HOMEPATH%\Recent\PrintHood.lnk
%HOMEPATH%\PrintHood\~dtxpwTMgCo7QO6x0jBHd.TMP
%HOMEPATH%\PrintHood\~1ZBLBZnKUmubbsjdaE9W.TMP
%HOMEPATH%\PrintHood\~kzsMTgJjWs1ZOLyahrbF.TMP
%HOMEPATH%\PrintHood\~NgdPKUsF8gxFUzH2Mezf.TMP
%HOMEPATH%\PrintHood\~R21FjoBdopHaLu0bbcPR.TMP
%HOMEPATH%\PrintHood\700.bat
%HOMEPATH%\PrintHood\Bidikik.dll
%HOMEPATH%\PrintHood\Filikik.dll
%HOMEPATH%\PrintHood\Shenik.dll
%HOMEPATH%\PrintHood\Sitikatik.dll
%HOMEPATH%\PrintHood\Rzakik.dll
%HOMEPATH%\PrintHood\<Имя вируса>.exe.jpg
%HOMEPATH%\PrintHood\UpdateOffice.exe
%HOMEPATH%\PrintHood\Motahare.txt
%HOMEPATH%\PrintHood\<Имя вируса>.exe.txt
%HOMEPATH%\PrintHood\~v9WVRGDrb3SctonVlefU.TMP
%HOMEPATH%\PrintHood\~uRd45ENIuWEVfc47sHtR.TMP
%HOMEPATH%\PrintHood\~KHAcf1paBCkdCyxnBdM7.TMP
%HOMEPATH%\PrintHood\~ajg3otZXPoh1SYTm7gGl.TMP
%HOMEPATH%\PrintHood\~OxriV3bZHCHViMpV9Azt.TMP
%HOMEPATH%\PrintHood\~jwzwidKu7jmW6ZoFiRWm.TMP
%HOMEPATH%\PrintHood\~185aOTXpNdBdl600gAOq.TMP
%HOMEPATH%\PrintHood\~IKUNO1nzc0OAtzMxkYPn.TMP
%HOMEPATH%\PrintHood\~bNWiQDJh3XzEIv2Sr3Qu.TMP
%HOMEPATH%\PrintHood\~FzMJMeasi8NAU61NxNkG.TMP
%HOMEPATH%\PrintHood\~aFR27OVyzQDnBiAdikwx.TMP
%HOMEPATH%\PrintHood\~vLqLXLBi5bbfyrU07yfa.TMP
%HOMEPATH%\PrintHood\~Dm8vMCK78R3abj2v9E9C.TMP
%HOMEPATH%\PrintHood\~WdduII9uJs8mhXjAuQD7.TMP
%HOMEPATH%\PrintHood\~K7opWj5zw563LLut7Rzw.TMP
%HOMEPATH%\PrintHood\~o3pRgR9EoYAYkJtaySOS.TMP
%HOMEPATH%\PrintHood\~hiKAA27x2PjLhs6IHukV.TMP
%HOMEPATH%\PrintHood\~ksEBx1qPMV1827pDeTv3.TMP
%HOMEPATH%\PrintHood\~fHZeCQrb1MX1lNYMouDK.TMP
%HOMEPATH%\PrintHood\~W1wFdUB5YquDSwZzq56k.TMP
%HOMEPATH%\PrintHood\~QptUNUZCsOdNBwLqqduA.TMP
%HOMEPATH%\PrintHood\~WDzpHZsDLiszNyVTEb6I.TMP
%HOMEPATH%\PrintHood\~YGnWDxlivoWHCCp5IUHI.TMP
%HOMEPATH%\PrintHood\~RbEggrbtYuwbrkuKTvMV.TMP
%HOMEPATH%\PrintHood\~bGF66LvUlRnMWHJpBLYO.TMP
%HOMEPATH%\PrintHood\~Yy3lUwAoobYDDmrb7gkF.TMP
%HOMEPATH%\PrintHood\~9IfPFaLAjyVo2ET53R80.TMP
%HOMEPATH%\PrintHood\~KABlVaOcvU23ID6hiYHv.TMP
%HOMEPATH%\PrintHood\~lOEYe0Wfxe1DE4mpsPLP.TMP
%HOMEPATH%\PrintHood\~V6IeFRPFtkLqNM2Hxf5H.TMP
%HOMEPATH%\PrintHood\~Rhzca0wDdZetOfaTrKuj.TMP
%HOMEPATH%\PrintHood\~fuJGEm6eG6s6FK6fKj1j.TMP
%HOMEPATH%\PrintHood\~r5oS7sIUOJFBCVbn0bpv.TMP
%HOMEPATH%\PrintHood\~FdTzDz0QhIP6kQyiuYHD.TMP
%HOMEPATH%\PrintHood\~fXesN4FR55awEP2LlftE.TMP
%HOMEPATH%\PrintHood\~Wz6tX8FufC7BlU5MfesR.TMP
%HOMEPATH%\PrintHood\~8ffiqK7fGoW3ar7XhzaF.TMP
%HOMEPATH%\PrintHood\~J8DTIfVJMcitjBzeRcyR.TMP
%HOMEPATH%\PrintHood\~tzFsOYf8tS92cVpLELbT.TMP
%HOMEPATH%\PrintHood\~aW9vIwjPxQXa6mUYDC3o.TMP
%HOMEPATH%\PrintHood\~8i5qdF6FYXcLG2SQ43vM.TMP
%HOMEPATH%\PrintHood\~pt56Kao6jk6Q2sv3IrBu.TMP
%HOMEPATH%\PrintHood\~90LXDWkZMaayO9Ag0SxM.TMP
%HOMEPATH%\PrintHood\~Typz5V2JyMrPEeVtIaHv.TMP
%HOMEPATH%\PrintHood\~LMU2OrdkcDPyNlOcHF1P.TMP
%HOMEPATH%\PrintHood\~XiekHJbi0g2TCBeQR8VK.TMP
%HOMEPATH%\PrintHood\~NhDzgB9iv9HeCTZ2FXQ1.TMP
%HOMEPATH%\PrintHood\~h541gOAOgx9PzQhLZtaj.TMP
%HOMEPATH%\PrintHood\~YCNkaf2VIQEP5wykLvVf.TMP
%HOMEPATH%\PrintHood\~DoCLw213siJ7QB5ajErc.TMP
%HOMEPATH%\PrintHood\~M6WvlHWeLcfO6KRNgyAG.TMP
%HOMEPATH%\PrintHood\~bkHaATu29JBkQyjvo8YO.TMP
%HOMEPATH%\PrintHood\~TV8aqohwmR9vg6yRCxwo.TMP
%HOMEPATH%\PrintHood\~mpofPxKmmhGzPwQfwFWT.TMP
%HOMEPATH%\PrintHood\~pQs3hvQCdoFbJdrdKhwE.TMP
%HOMEPATH%\PrintHood\~xzNioBPsUNeYYQDOLRjE.TMP
%HOMEPATH%\PrintHood\~Mhc2LaM0gKWPi5IcEDRW.TMP
%HOMEPATH%\PrintHood\~lfXEumanR0Vm3cOJTYlI.TMP
%HOMEPATH%\PrintHood\~TaXGjzcNcAWrUabd0Qjh.TMP
%HOMEPATH%\PrintHood\~gk96gLuZ0F371xZPCzft.TMP
%HOMEPATH%\PrintHood\~IsSXYUlGzpj1AVEzILpm.TMP
%HOMEPATH%\PrintHood\~L4h0cKI6fxU3N6D0m3ZN.TMP
%HOMEPATH%\PrintHood\~QfxmauVVbqPAocSREWgk.TMP
%HOMEPATH%\PrintHood\~kLSXhBxRY7xmtd5yEwnp.TMP
%HOMEPATH%\PrintHood\~F2PiAwgdfoDd96eKbroZ.TMP
%HOMEPATH%\PrintHood\~vwtGkcpMINzBp0yzfcEc.TMP
%HOMEPATH%\PrintHood\~c150cocq5QN5RipwHDBK.TMP
%HOMEPATH%\PrintHood\~OexaASH0glX2p6RVRYCP.TMP
%HOMEPATH%\PrintHood\~8dZHP7835ZHWEbZqhR4v.TMP
%HOMEPATH%\PrintHood\~mchoh3pJ2SfSWRxeorb0.TMP
%HOMEPATH%\PrintHood\~esDrKag2HodRPRr5t50k.TMP
%HOMEPATH%\PrintHood\~7wQcpUxu82EERYBRsGlC.TMP
%HOMEPATH%\PrintHood\~Mt5IVQrnEUCuOYvjg1Ha.TMP
%HOMEPATH%\PrintHood\~8dzq8U0xB5fbU6nU3Cce.TMP
%HOMEPATH%\PrintHood\~NisclpystsIwyGK6Zqt5.TMP
%HOMEPATH%\PrintHood\~BbgqrApxKbceSpdtsU7c.TMP
%HOMEPATH%\PrintHood\~ShOVTtJdcAF5TN8tJBLp.TMP
%HOMEPATH%\PrintHood\~AUH9lIXfXc0w9u3rR9no.TMP
%HOMEPATH%\PrintHood\~Eim25ko4WfhazXtEsUW6.TMP
%HOMEPATH%\PrintHood\~UmtaKjf7LKPzuoHFWJGu.TMP
%HOMEPATH%\PrintHood\~XKMhwC2bXPA8Hvat8sny.TMP
%HOMEPATH%\PrintHood\~bKWMRGVlaBscpnODEbH9.TMP
%HOMEPATH%\PrintHood\~5O9slLbWiSkVMa2bt6LF.TMP
%HOMEPATH%\PrintHood\~xez4R2gpw9MScOmsbuhm.TMP
%HOMEPATH%\PrintHood\~JcnIQ85aOwjTmUlA3YPZ.TMP
%HOMEPATH%\PrintHood\~iezGB8qw9YCJKC82h9TY.TMP
%HOMEPATH%\PrintHood\~r5DMKhbJnXAz98to0dQQ.TMP
%HOMEPATH%\PrintHood\~vHA1NWsColb9yqwtkq6l.TMP
%HOMEPATH%\PrintHood\~8NDKxwkQIdXUMp6KKCQT.TMP
%HOMEPATH%\PrintHood\~0a0KKPbHk7lKp2uTDwRx.TMP
%HOMEPATH%\PrintHood\~a0tO6YKMdU6NhWOwseGh.TMP
%HOMEPATH%\PrintHood\~M9CgRekcNVq4wVTM3hvM.TMP
%HOMEPATH%\PrintHood\~xEL0dUx1OSKgYPZMXl84.TMP
%HOMEPATH%\PrintHood\~zm11rwRWT8Sp0f4h5jKo.TMP
%HOMEPATH%\PrintHood\~Z6X4W93iktN7la5ojxcj.TMP
%HOMEPATH%\PrintHood\~kYm2jtiWjCSWqUkaBuqN.TMP
%HOMEPATH%\PrintHood\~V4XEWSpqIvlkAHTAdqBB.TMP
%HOMEPATH%\PrintHood\~2M9jkgAOKpomF8OLQiZp.TMP
%HOMEPATH%\PrintHood\~HvFsVTvA8ZCUJ6vVVJTr.TMP
%HOMEPATH%\PrintHood\~0RUQWMJ0ktb8mEBiY6gV.TMP

Удаляет следующие файлы:

%HOMEPATH%\PrintHood\pangtip.bat
%HOMEPATH%\PrintHood\<Имя вируса>.exe.txt

Сетевая активность:

Подключается к:

'localhost':1040
'localhost':1041
'localhost':1042
'localhost':1039
'localhost':1036
'localhost':1037
'localhost':1038

Другое:

Ищет следующие окна:

ClassName: '' WindowName: 'http://174.142.57.29/ - 404 - File or directory not found. - Windows Internet Explorer'
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: '' WindowName: '404 - File or directory not found. - Microsoft Internet Explorer'
ClassName: '' WindowName: 'http://174.142.57.29/ - 404 - File or directory not found. - Microsoft Internet Explorer'
ClassName: '' WindowName: '404 - File or directory not found. - Windows Internet Explorer'
ClassName: '' WindowName: ''
ClassName: '' WindowName: 'u!u!u!u! - Windows Internet Explorer'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'ShImgVw:CPreviewWnd' WindowName: ''
ClassName: '' WindowName: 'http://174.142.57.29/ - u!u!u!u! - Microsoft Internet Explorer'
ClassName: '' WindowName: 'u!u!u!u! - Microsoft Internet Explorer'
ClassName: '' WindowName: 'http://174.142.57.29/ - u!u!u!u! - Windows Internet Explorer'

Технології

Терміни

Навчання

Міфи

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней