Trojan.Encoder.556

Technical Information

Malicious functions:

Creates and executes the following:

'C:\tmp\Rar.exe' /pid=3372
'C:\tmp\del.exe' /pid=2464
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\svg\svgBindings.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\svg\svgBindings.xml"
'C:\tmp\del.exe' /pid=4224
'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\tabprompts.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\tabprompts.xml"
'C:\tmp\del.exe' /pid=4100
'C:\tmp\bbs.exe' /c del.bat
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\consoleBindings.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\consoleBindings.xml"
'C:\tmp\del.exe' /pid=5124
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\wizard.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\wizard.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\printPreviewBindings.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\printPreviewBindings.xml"
'C:\tmp\del.exe' /pid=5528
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\platformHTMLBindings.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\platformHTMLBindings.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\xml\XMLPrettyPrint.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\xml\XMLPrettyPrint.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\xpinstall\xpinstallItem.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\xpinstall\xpinstallItem.xml"
'C:\tmp\del.exe' /pid=3756
'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\plugins\pluginProblem.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\plugins\pluginProblem.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\globalBindings.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\globalBindings.xml"
'C:\tmp\Rar.exe' /pid=4752
'C:\tmp\del.exe' /pid=4784
'C:\tmp\Rar.exe' /pid=3088
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\extensions\extensions.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\extensions\extensions.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\extensions\blocklist.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\extensions\blocklist.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\downloads\download.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\downloads\download.xml"
'C:\tmp\del.exe' /pid=5984
'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\handling\handler.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\handling\handler.xml"
'C:\tmp\del.exe' /pid=5936
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\videocontrols.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\videocontrols.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\radio.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\radio.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\progressmeter.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\progressmeter.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\preferences.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\preferences.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\richlistbox.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\richlistbox.xml"
'C:\tmp\Rar.exe' /pid=6024
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\resizer.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\resizer.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\popup.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\popup.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\menu.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\menu.xml"
'C:\tmp\del.exe' /pid=3492
'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\listbox.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\listbox.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\numberbox.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\numberbox.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\notification.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\notification.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\menulist.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\menulist.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\scale.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\scale.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\toolbar.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\toolbar.xml"
'C:\tmp\Rar.exe' /pid=2464
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\textbox.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\textbox.xml"
'C:\tmp\del.exe' /pid=4460
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\tree.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\tree.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\toolbarbutton.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\toolbarbutton.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\text.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\text.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\spinbuttons.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\spinbuttons.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\scrollbox.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\scrollbox.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\scrollbar.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\scrollbar.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\tabbox.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\tabbox.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\stringbundle.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\stringbundle.xml"
'C:\tmp\Rar.exe' /pid=4876
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\globalBindings.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\globalBindings.xml"
'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Windows Media Player\npdrmv2.zip.RaR" "%PROGRAM_FILES%\Windows Media Player\npdrmv2.zip"
'C:\tmp\del.exe' /pid=3684
'C:\tmp\del.exe' /pid=3288
'C:\tmp\Rar.exe' <Auxiliary element>
'C:\tmp\del.exe' /pid=5340
'C:\tmp\Rar.exe' /pid=4560
'C:\tmp\bbs.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\Client.xml.RaR" "%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\Client.xml"
'C:\tmp\Rar.exe' /pid=3076
'C:\tmp\Rar.exe' /pid=5456
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml.RaR" "%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml.RaR" "%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml.RaR" "%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml"
'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\Client.xml.RaR" "%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\Client.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.txt.RaR" "%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.txt"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\best_secure.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\best_secure.jpg"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\connected_data.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\connected_data.jpg"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\best_road_big.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\best_road_big.jpg"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\best_road.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\best_road.jpg"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt.RaR" "%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\best_robust.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\best_robust.jpg"
'C:\tmp\Rar.exe' /pid=5280
'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg.RaR" "%WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg"
'C:\tmp\del.exe' /pid=5656
'C:\tmp\Rar.exe' /pid=5588
'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\searchplugins\google.xml.RaR" "%PROGRAM_FILES%\FireFox\searchplugins\google.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\searchplugins\eBay.xml.RaR" "%PROGRAM_FILES%\FireFox\searchplugins\eBay.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Microsoft.NET\RedistList\AssemblyList_4_extended.xml.RaR" "%PROGRAM_FILES%\Microsoft.NET\RedistList\AssemblyList_4_extended.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\searchplugins\yahoo.xml.RaR" "%PROGRAM_FILES%\FireFox\searchplugins\yahoo.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\searchplugins\wikipedia.xml.RaR" "%PROGRAM_FILES%\FireFox\searchplugins\wikipedia.xml"
'C:\tmp\del.exe' /pid=4804
'C:\tmp\Rar.exe' /pid=4020
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\README.txt.RaR" "%PROGRAM_FILES%\FireFox\README.txt"
'C:\tmp\del.exe' /pid=5844
'C:\tmp\Rar.exe' /pid=4652
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\searchplugins\bing.xml.RaR" "%PROGRAM_FILES%\FireFox\searchplugins\bing.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\searchplugins\amazondotcom.xml.RaR" "%PROGRAM_FILES%\FireFox\searchplugins\amazondotcom.xml"
'C:\tmp\del.exe' /pid=5164
'C:\tmp\del.exe' /pid=6036
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Movie Maker\Shared\Sample2.jpg.RaR" "%PROGRAM_FILES%\Movie Maker\Shared\Sample2.jpg"
'C:\tmp\Rar.exe' /pid=4892
'C:\tmp\Rar.exe' /pid=4964
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Outlook Express\msoe.txt.RaR" "%PROGRAM_FILES%\Outlook Express\msoe.txt"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\xfp.xml.RaR" "%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\xfp.xml"
'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Movie Maker\Shared\Sample1.jpg.RaR" "%PROGRAM_FILES%\Movie Maker\Shared\Sample1.jpg"
'C:\tmp\del.exe' /pid=5840
'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Movie Maker\Shared\Empty.txt.RaR" "%PROGRAM_FILES%\Movie Maker\Shared\Empty.txt"
'C:\tmp\Rar.exe' /pid=5656
'C:\tmp\Rar.exe' /pid=4740
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\Movie Maker\Shared\Profiles\Blank.txt.RaR" "%PROGRAM_FILES%\Movie Maker\Shared\Profiles\Blank.txt"
'C:\tmp\Rar.exe' /pid=6012
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\rus\Bug.Report.txt.RaR" "C:\Far2\Documentation\rus\Bug.Report.txt"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\rus\Arc.Support.txt.RaR" "C:\Far2\Documentation\rus\Arc.Support.txt"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\eng\TechInfo.txt.RaR" "C:\Far2\Documentation\eng\TechInfo.txt"
'C:\tmp\Rar.exe' /pid=2952
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\rus\Plugins.Install.txt.RaR" "C:\Far2\Documentation\rus\Plugins.Install.txt"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\rus\Far.FAQ.txt.RaR" "C:\Far2\Documentation\rus\Far.FAQ.txt"
'C:\tmp\del.exe' /pid=3044
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\eng\Bug.Report.txt.RaR" "C:\Far2\Documentation\eng\Bug.Report.txt"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\eng\Arc.Support.txt.RaR" "C:\Far2\Documentation\eng\Arc.Support.txt"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Addons\README.TXT.RaR" "C:\Far2\Addons\README.TXT"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\eng\Plugins.Review.txt.RaR" "C:\Far2\Documentation\eng\Plugins.Review.txt"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\eng\Plugins.Install.txt.RaR" "C:\Far2\Documentation\eng\Plugins.Install.txt"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\eng\Far.FAQ.txt.RaR" "C:\Far2\Documentation\eng\Far.FAQ.txt"
'C:\tmp\del.exe' /pid=2944
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Plugins\Colorer\hrc\changes.txt.RaR" "C:\Far2\Plugins\Colorer\hrc\changes.txt"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Plugins\Colorer\catalog.xml.RaR" "C:\Far2\Plugins\Colorer\catalog.xml"
'C:\tmp\del.exe' /pid=3740
'C:\tmp\Rar.exe' /pid=3552
'C:\tmp\Rar.exe' /pid=3588
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Plugins\Colorer\hrd\catalog-console.xml.RaR" "C:\Far2\Plugins\Colorer\hrd\catalog-console.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Plugins\7-Zip\far7z.txt.RaR" "C:\Far2\Plugins\7-Zip\far7z.txt"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Documentation\rus\TechInfo.txt.RaR" "C:\Far2\Documentation\rus\TechInfo.txt"
'C:\tmp\del.exe' /c del.bat
'C:\tmp\Rar.exe' /pid=2812
'C:\tmp\del.exe' /pid=3468
'C:\tmp\Rar.exe'
'C:\tmp\Rar.exe' /c del.bat
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%HOMEPATH%\Templates\winword2.doc.RaR" "%HOMEPATH%\Templates\winword2.doc"
'C:\tmp\del.exe'
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.RaR" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg"
'C:\tmp\fidonet.exe'
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.RaR" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.RaR" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.RaR" "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg"
'C:\tmp\ssencrypt.exe' public.key kii.hiew
'C:\tmp\bbs.exe'
'C:\tmp\error.exe'
'C:\tmp\push.exe'
'C:\tmp\moar.exe'
'C:\tmp\ss.exe'
'C:\tmp\mouse.exe'
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.RaR" "C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%HOMEPATH%\Templates\excel.xls.RaR" "%HOMEPATH%\Templates\excel.xls"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "<LS_APPDATA>\Microsoft\Windows Media\9.0\WMSDKNS.XML.RaR" "<LS_APPDATA>\Microsoft\Windows Media\9.0\WMSDKNS.XML"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%APPDATA%\Microsoft\Internet Explorer\brndlog.txt.RaR" "%APPDATA%\Microsoft\Internet Explorer\brndlog.txt"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%HOMEPATH%\Templates\winword.doc.RaR" "%HOMEPATH%\Templates\winword.doc"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%HOMEPATH%\Templates\powerpnt.ppt.RaR" "%HOMEPATH%\Templates\powerpnt.ppt"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%HOMEPATH%\Templates\excel4.xls.RaR" "%HOMEPATH%\Templates\excel4.xls"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Templates\winword2.doc.RaR" "C:\Documents and Settings\Default User\Templates\winword2.doc"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Templates\excel4.xls.RaR" "C:\Documents and Settings\Default User\Templates\excel4.xls"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Templates\excel.xls.RaR" "C:\Documents and Settings\Default User\Templates\excel.xls"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML.RaR" "C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\WMSDKNS.XML"
'C:\tmp\ss.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Templates\winword.doc.RaR" "C:\Documents and Settings\Default User\Templates\winword.doc"
'C:\tmp\ssencrypt.exe' /pid=764
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Documents and Settings\Default User\Templates\powerpnt.ppt.RaR" "C:\Documents and Settings\Default User\Templates\powerpnt.ppt"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Plugins\Colorer\hrd\catalog-text.xml.RaR" "C:\Far2\Plugins\Colorer\hrd\catalog-text.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\search\search.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\search\search.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\preferences\handlers.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\preferences\handlers.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\tree.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\tree.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\urlbarBindings.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\urlbarBindings.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\tabbrowser.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\tabbrowser.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\syncNotification.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\syncNotification.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\menu.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\menu.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\browser-tabPreviews.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\browser-tabPreviews.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\aboutSyncTabs-bindings.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\aboutSyncTabs-bindings.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\blocklist.xml.RaR" "%PROGRAM_FILES%\FireFox\blocklist.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\pageInfo.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\feeds.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\feeds.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\subscribe.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\subscribe.xml"
'C:\tmp\del.exe' /pid=4088
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\findbar.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\findbar.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\filefield.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\filefield.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\expander.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\expander.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\groupbox.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\groupbox.xml"
'C:\tmp\Rar.exe' /pid=6008
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\general.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\general.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\editor.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\editor.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\checkbox.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\checkbox.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\button.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\button.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\browser.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\browser.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\dialog.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\dialog.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\datetimepicker.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\datetimepicker.xml"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\colorpicker.xml.RaR" "%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\colorpicker.xml"
'C:\tmp\del.exe' /pid=3516
'C:\tmp\del.exe' /pid=3960
'C:\tmp\del.exe' /pid=3672
'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.RaR" "C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT"
'C:\tmp\Rar.exe' /pid=3376
'C:\tmp\del.exe' /pid=2932
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Plugins\FTP\FtpCmds_rus.txt.RaR" "C:\Far2\Plugins\FTP\FtpCmds_rus.txt"
'C:\tmp\Rar.exe' /pid=3636
'C:\tmp\del.exe' /pid=360
'C:\tmp\del.exe' /pid=4012
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.RaR" "C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT"
'C:\tmp\del.exe' /pid=3388
'C:\tmp\ss.exe' /pid=3396
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.RaR" "C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT"
'C:\tmp\del.exe' /pid=3368
'C:\tmp\del.exe' /pid=3872
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%CommonProgramFiles%\Microsoft Shared\Stationery\Nature Bkgrd.jpg.RaR" "%CommonProgramFiles%\Microsoft Shared\Stationery\Nature Bkgrd.jpg"
'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%CommonProgramFiles%\Microsoft Shared\Stationery\Maize Bkgrd.jpg.RaR" "%CommonProgramFiles%\Microsoft Shared\Stationery\Maize Bkgrd.jpg"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%CommonProgramFiles%\Microsoft Shared\Stationery\Sunflower Bkgrd.jpg.RaR" "%CommonProgramFiles%\Microsoft Shared\Stationery\Sunflower Bkgrd.jpg"
'C:\tmp\Rar.exe' /pid=1868
'C:\tmp\del.exe' /pid=4036
'C:\tmp\del.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%CommonProgramFiles%\Microsoft Shared\Stationery\Leaves Bkgrd.jpg.RaR" "%CommonProgramFiles%\Microsoft Shared\Stationery\Leaves Bkgrd.jpg"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%CommonProgramFiles%\Microsoft Shared\Stationery\Fiesta Bkgrd.jpg.RaR" "%CommonProgramFiles%\Microsoft Shared\Stationery\Fiesta Bkgrd.jpg"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "%CommonProgramFiles%\Microsoft Shared\Stationery\Clear Day Bkgrd.jpg.RaR" "%CommonProgramFiles%\Microsoft Shared\Stationery\Clear Day Bkgrd.jpg"
'C:\tmp\Rar.exe' a -ep1 -p90012C0190012C0190012C0190012C0190012C0190012C0190012C0190012C01 "C:\Far2\Plugins\FTP\Notes_rus.txt.RaR" "C:\Far2\Plugins\FTP\Notes_rus.txt"
'C:\tmp\Rar.exe' /pid=4080
'C:\tmp\del.exe' /pid=3552
'C:\tmp\del.exe' /pid=2600

Executes the following:

'<SYSTEM32>\cmd.exe' /c del.bat
'<SYSTEM32>\cmd.exe' /c rename.bat
'<SYSTEM32>\cmd.exe' /c rocket.bat

Injects code into

the following system processes:

<SYSTEM32>\cmd.exe

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\plugins\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\update\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\update\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\plugins\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\extensions\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\handling\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\handling\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\xpinstall\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\global\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\FireFox\chrome\toolkit\skin\classic\aero\global\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\xpinstall\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\xbl-marquee\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\xbl-marquee\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\extensions\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\search\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\bindings\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\search\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\preferences\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\preferences\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\xml\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\downloads\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\mozapps\downloads\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\xml\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\svg\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\FireFox\chrome\toolkit\content\global\svg\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\Windows Media Player\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\Windows Media Player\_3pass_%USERNAME%.pwd
%WINDIR%\$NtUninstallWIC$\spuninst\_3pass_%USERNAME%.pwd
%WINDIR%\Help\Tours\htmlTour\_Фaйлы зaшифpoванны.Txt
%WINDIR%\Help\Tours\htmlTour\_3pass_%USERNAME%.pwd
%WINDIR%\$NtUninstallWIC$\spuninst\_Фaйлы зaшифpoванны.Txt
<Auxiliary element>
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\_Фaйлы зaшифpoванны.Txt
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\Movie Maker\Shared\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\Movie Maker\Shared\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\Movie Maker\Shared\Profiles\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\Microsoft.NET\RedistList\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\FireFox\searchplugins\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\FireFox\searchplugins\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\Microsoft.NET\RedistList\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\Movie Maker\Shared\Profiles\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\Outlook Express\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\Outlook Express\_Фaйлы зaшифpoванны.Txt
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\_3pass_%USERNAME%.pwd
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\_Фaйлы зaшифpoванны.Txt
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\_3pass_%USERNAME%.pwd
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\_3pass_.pwd
C:\tmp\22022
C:\wintmp\22022
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\_Фaйлы зaшифpoванны.Txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\_Фaйлы зaшифpoванны.Txt
%APPDATA%\Microsoft\Internet Explorer\_3pass_%USERNAME%.pwd
<LS_APPDATA>\Microsoft\Windows Media\9.0\_Фaйлы зaшифpoванны.Txt
<LS_APPDATA>\Microsoft\Windows Media\9.0\_3pass_%USERNAME%.pwd
%APPDATA%\Microsoft\Internet Explorer\_Фaйлы зaшифpoванны.Txt
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\_3pass_%USERNAME%.pwd
C:\Documents and Settings\Default User\Templates\_Фaйлы зaшифpoванны.Txt
C:\Documents and Settings\Default User\Templates\_3pass_%USERNAME%.pwd
C:\tmp\kii.hiew
C:\tmp\fidonet.exe
C:\tmp\moar.exe
C:\tmp\mouse.exe
C:\tmp\error.exe
C:\tmp\bbs.exe
C:\tmp\del.bat
C:\tmp\del.exe
C:\tmp\public.key
C:\tmp\ss.exe
C:\tmp\ssencrypt.exe
C:\tmp\names.hiew
C:\tmp\rocket.bat
C:\tmp\push.exe
C:\tmp\Rar.exe
C:\tmp\rename.bat
%CommonProgramFiles%\Microsoft Shared\Stationery\_Фaйлы зaшифpoванны.Txt
%CommonProgramFiles%\Microsoft Shared\Stationery\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\FireFox\_Фaйлы зaшифpoванны.Txt
C:\Far2\Plugins\FTP\_3pass_%USERNAME%.pwd
C:\Far2\Plugins\ExtSearch\doc\_Фaйлы зaшифpoванны.Txt
C:\Far2\Plugins\ExtSearch\doc\_3pass_%USERNAME%.pwd
C:\Far2\Plugins\FTP\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\FireFox\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\pageinfo\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\places\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\_Фaйлы зaшифpoванны.Txt
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\_3pass_%USERNAME%.pwd
%PROGRAM_FILES%\FireFox\chrome\browser\content\browser\feeds\_Фaйлы зaшифpoванны.Txt
C:\Far2\Plugins\Colorer\hrd\_3pass_%USERNAME%.pwd
C:\Far2\Documentation\eng\_Фaйлы зaшифpoванны.Txt
C:\Far2\Documentation\eng\_3pass_%USERNAME%.pwd
C:\Far2\Documentation\rus\_Фaйлы зaшифpoванны.Txt
C:\Far2\Addons\_3pass_%USERNAME%.pwd
%HOMEPATH%\Templates\_Фaйлы зaшифpoванны.Txt
%HOMEPATH%\Templates\_3pass_%USERNAME%.pwd
C:\Far2\Addons\_Фaйлы зaшифpoванны.Txt
C:\Far2\Documentation\rus\_3pass_%USERNAME%.pwd
C:\Far2\Plugins\Colorer\hrc\_Фaйлы зaшифpoванны.Txt
C:\Far2\Plugins\Colorer\hrc\_3pass_%USERNAME%.pwd
C:\Far2\Plugins\Colorer\hrd\_Фaйлы зaшифpoванны.Txt
C:\Far2\Plugins\Colorer\_3pass_%USERNAME%.pwd
C:\Far2\Plugins\7-Zip\_Фaйлы зaшифpoванны.Txt
C:\Far2\Plugins\7-Zip\_3pass_%USERNAME%.pwd
C:\Far2\Plugins\Colorer\_Фaйлы зaшифpoванны.Txt

Deletes the following files:

%WINDIR%\Help\Tours\htmlTour\best_secure.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust.jpg
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.txt
C:\tmp\kii.hiew
%WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\best_road_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_road.jpg

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'EDIT' WindowName: ''

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial