Trojan.AVKill.24504

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\.exe] '' = 'exefile'
[<HKLM>\SOFTWARE\Classes\.exe] '' = 'jpegfile'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Explore.exe' = '<SYSTEM32>\0.vbs'

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files

blocks execution of the following system utilities:

Registry Editor (RegEdit)

Executes the following:

<SYSTEM32>\taskkill.exe /f /im 360tray.exe
<SYSTEM32>\taskkill.exe /f /im VsTskMgr.exe
%WINDIR%\regedit.exe /s reg.reg
<SYSTEM32>\cmd.exe /c <SYSTEM32>\reg.bat
<SYSTEM32>\taskkill.exe /f /im Mcshield.exe
<SYSTEM32>\taskkill.exe /f /im KVXP.kxp
<SYSTEM32>\taskkill.exe /f /im kavsvc.exe
<SYSTEM32>\taskkill.exe /f /im Ravmon.exe
<SYSTEM32>\taskkill.exe /f /im Rav.exe

Terminates or attempts to terminate

the following user processes:

360tray.exe

Modifies settings of Windows Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoLogOff' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFileMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetFolders' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewContextMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRecentDocsMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDrives' = 'FFFFFFFF'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewOnDrive' = 'FFFFFFFF'

Hides the following processes:

Modifies file system :

Creates the following files:

<SYSTEM32>\reg.bat
<SYSTEM32>\wscript.ico
<SYSTEM32>\9.bat

Sets the 'hidden' attribute to the following files:

<SYSTEM32>\9.bat

Deletes the following files:

%WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure.jpg
%WINDIR%\Help\Tours\htmlTour\bluearrow.gif
%WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure.htm
%WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\bot_bar.gif
%WINDIR%\Help\Tours\htmlTour\connected_multiple.htm
%WINDIR%\Help\Tours\htmlTour\connected_fr.htm
%WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data.htm
%WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg
%WINDIR%\Help\taskmgr.hlp
%WINDIR%\Help\taskmgr.chm
%WINDIR%\Help\tcpmon.hlp
%WINDIR%\Help\tcpip.chm
%WINDIR%\Help\tapi.chm
%WINDIR%\Help\sys_srv.chm
%WINDIR%\Help\taskbar.chm
%WINDIR%\Help\tapi.hlp
%WINDIR%\Help\telnet.chm
%WINDIR%\Help\Tours\htmlTour\best_road_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_road.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust.htm
%WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg
%WINDIR%\Help\timesrv.chm
%WINDIR%\Help\telnet.hlp
%WINDIR%\Help\Tours\htmlTour\best_road.htm
%WINDIR%\Help\Tours\htmlTour\best_fr.htm
%WINDIR%\Help\Tours\htmlTour\img034.jpg
%WINDIR%\Help\Tours\htmlTour\img033a.jpg
%WINDIR%\Help\Tours\htmlTour\img046.jpg
%WINDIR%\Help\Tours\htmlTour\img040.jpg
%WINDIR%\Help\Tours\htmlTour\img004b.jpg
%WINDIR%\Help\Tours\htmlTour\icon_up.jpg
%WINDIR%\Help\Tours\htmlTour\img033.jpg
%WINDIR%\Help\Tours\htmlTour\img014.jpg
%WINDIR%\Help\Tours\htmlTour\img060.jpg
%WINDIR%\Help\Tours\htmlTour\img103.jpg
%WINDIR%\Help\Tours\htmlTour\img100.jpg
%WINDIR%\Help\Tours\htmlTour\img110.jpg
%WINDIR%\Help\Tours\htmlTour\img109.jpg
%WINDIR%\Help\Tours\htmlTour\img072.jpg
%WINDIR%\Help\Tours\htmlTour\img068.jpg
%WINDIR%\Help\Tours\htmlTour\img089.jpg
%WINDIR%\Help\Tours\htmlTour\img074a.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard.htm
%WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg
%WINDIR%\Help\Tours\htmlTour\connected_networks.htm
%WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_networks.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\folder_up.jpg
%WINDIR%\Help\Tours\htmlTour\end_up.jpg
%WINDIR%\Help\Tours\htmlTour\gradient.jpg
%WINDIR%\Help\Tours\htmlTour\footer.htm
%WINDIR%\Help\Tours\htmlTour\default.htm
%WINDIR%\Help\Tours\htmlTour\control_up.jpg
%WINDIR%\Help\Tours\htmlTour\desktop_up.jpg
%WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg
%WINDIR%\Help\scarddlg.hlp
%WINDIR%\Help\sc.chm
%WINDIR%\Help\sceconcepts.chm
%WINDIR%\Help\sce.chm
%WINDIR%\Help\safer.chm
%WINDIR%\Help\rvse.chm
%WINDIR%\Help\sapicpl.hlp
%WINDIR%\Help\saferconcepts.chm
%WINDIR%\Help\scm.chm
%WINDIR%\Help\sendcmsg.chm
%WINDIR%\Help\secsettings.chm
%WINDIR%\Help\sfmmgr.hlp
%WINDIR%\Help\sendcmsg.hlp
%WINDIR%\Help\secauth.hlp
%WINDIR%\Help\scmconcepts.chm
%WINDIR%\Help\secsetconcepts.chm
%WINDIR%\Help\secedit.chm
%WINDIR%\Help\regedit.chm
%WINDIR%\Help\recycle.chm
%WINDIR%\Help\regopt.chm
%WINDIR%\Help\regedit.hlp
%WINDIR%\Help\rdesktop.chm
%WINDIR%\Help\ratings.hlp
%WINDIR%\Help\reader.hlp
%WINDIR%\Help\reader.chm
%WINDIR%\Help\remasst.chm
%WINDIR%\Help\rsmconcepts.chm
%WINDIR%\Help\rsm.hlp
%WINDIR%\Help\rsopsnp.chm
%WINDIR%\Help\rsop.chm
%WINDIR%\Help\rktools.chm
%WINDIR%\Help\reskit.chm
%WINDIR%\Help\rsm.chm
%WINDIR%\Help\rrc.chm
%WINDIR%\Help\sr_ui.chm
%WINDIR%\Help\spolsconcepts.chm
%WINDIR%\Help\supp_ed.chm
%WINDIR%\Help\sstub.dll
%WINDIR%\Help\spider.chm
%WINDIR%\Help\speech.chm
%WINDIR%\Help\splash.chm
%WINDIR%\Help\spider.hlp
%WINDIR%\Help\suptools.chm
%WINDIR%\Help\sysrestore.chm
%WINDIR%\Help\sysprop.chm
%WINDIR%\Help\system.chm
%WINDIR%\Help\sysrestore.hlp
%WINDIR%\Help\sysdm.hlp
%WINDIR%\Help\sysdm.chm
%WINDIR%\Help\sysmon.hlp
%WINDIR%\Help\sysmon.chm
%WINDIR%\Help\sndvol32.chm
%WINDIR%\Help\smlogcfg.chm
%WINDIR%\Help\sniffpol.dll
%WINDIR%\Help\sndvol32.hlp
%WINDIR%\Help\shvl.chm
%WINDIR%\Help\shell.hlp
%WINDIR%\Help\sigverif.hlp
%WINDIR%\Help\signin.hlp
%WINDIR%\Help\snmpconcepts.chm
%WINDIR%\Help\sounds.chm
%WINDIR%\Help\soundrec.hlp
%WINDIR%\Help\spconcepts.chm
%WINDIR%\Help\spad.chm
%WINDIR%\Help\sol.chm
%WINDIR%\Help\snmpsnap.hlp
%WINDIR%\Help\soundrec.chm
%WINDIR%\Help\sol.hlp
%WINDIR%\Help\Tours\htmlTour\img116.jpg
%WINDIR%\Help\Tours\WindowsMediaPlayer\Cnt\wmploc.js
%WINDIR%\Help\Tours\WindowsMediaPlayer\Cnt\contents.htm
%WINDIR%\Help\Tours\WindowsMediaPlayer\Css\wmptour.css
%WINDIR%\Help\Tours\WindowsMediaPlayer\Css\controls.css
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud7.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud6.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud9.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud8.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\bktr.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\cnth.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\cntd.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\taoffh.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\taoff.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\cloapp.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\bktrh.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\cnt.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\cloapph.gif
%WINDIR%\Help\Tours\mmTour\segment3.txt
%WINDIR%\Help\Tours\mmTour\segment3.swf
%WINDIR%\Help\Tours\mmTour\segment4.txt
%WINDIR%\Help\Tours\mmTour\segment4.swf
%WINDIR%\Help\Tours\mmTour\segment1.txt
%WINDIR%\Help\Tours\mmTour\segment1.swf
%WINDIR%\Help\Tours\mmTour\segment2.txt
%WINDIR%\Help\Tours\mmTour\segment2.swf
%WINDIR%\Help\Tours\mmTour\segment5.swf
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud3.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud2.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud5.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud4.wav
%WINDIR%\Help\Tours\mmTour\tour.exe
%WINDIR%\Help\Tours\mmTour\segment5.txt
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\Wav\wmpaud1.wav
%WINDIR%\Help\Tours\WindowsMediaPlayer\Audio\snd.htm
%WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\tour.js
%WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\events.js
%WINDIR%\Help\Tours\WindowsMediaPlayer\Video\mdlib.wmv
%WINDIR%\Help\Tours\WindowsMediaPlayer\Video\copycd.wmv
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm8.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm7.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Scr\controls.js
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm9.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Video\nuskin.wmv
%WINDIR%\Help\twclient.chm
%WINDIR%\Help\tshoot.dll
%WINDIR%\Help\update.cnt
%WINDIR%\Help\twclient.hlp
%WINDIR%\Help\Tours\WindowsMediaPlayer\Video\viz.wmv
%WINDIR%\Help\Tours\WindowsMediaPlayer\Video\rtuner.wmv
%WINDIR%\Help\tshoot.chm
%WINDIR%\Help\Tours\WindowsMediaPlayer\wmptour.hta
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\tplayh.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\tplay.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\mplogoh.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\mplogo.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\taonh.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\taon.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\tpauseh.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\Btn\tpause.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\tourbg.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm4.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm3.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm6.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm5.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\vidsamp.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\videobg.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm2.gif
%WINDIR%\Help\Tours\WindowsMediaPlayer\Img\WMarks\wm1.gif
%WINDIR%\Help\Tours\htmlTour\safe_better.htm
%WINDIR%\Help\Tours\htmlTour\read_icon.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_better.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easier.htm
%WINDIR%\Help\Tours\htmlTour\nav_unlock_down.gif
%WINDIR%\Help\Tours\htmlTour\nav_unlock.gif
%WINDIR%\Help\Tours\htmlTour\question_icon.jpg
%WINDIR%\Help\Tours\htmlTour\pen_icon.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_better_big.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster_big.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster.jpg
%WINDIR%\Help\Tours\htmlTour\safe_faster.htm
%WINDIR%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\safe_easy_easier_big.jpg
%WINDIR%\Help\Tours\htmlTour\intro_logo.jpg
%WINDIR%\Help\Tours\htmlTour\img149.jpg
%WINDIR%\Help\Tours\htmlTour\nav_best.gif
%WINDIR%\Help\Tours\htmlTour\logo.jpg
%WINDIR%\Help\Tours\htmlTour\img123.jpg
%WINDIR%\Help\Tours\htmlTour\img121.jpg
%WINDIR%\Help\Tours\htmlTour\img136.jpg
%WINDIR%\Help\Tours\htmlTour\img126.jpg
%WINDIR%\Help\Tours\htmlTour\nav_best_down.gif
%WINDIR%\Help\Tours\htmlTour\nav_safe_easy_down.gif
%WINDIR%\Help\Tours\htmlTour\nav_safe_easy.gif
%WINDIR%\Help\Tours\htmlTour\nav_start_here_down.gif
%WINDIR%\Help\Tours\htmlTour\nav_start_here.gif
%WINDIR%\Help\Tours\htmlTour\nav_connected.gif
%WINDIR%\Help\Tours\htmlTour\nav_blank.gif
%WINDIR%\Help\Tours\htmlTour\nav_gray.gif
%WINDIR%\Help\Tours\htmlTour\nav_connected_down.gif
%WINDIR%\Help\Tours\htmlTour\unlock_optimized.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_optimized.htm
%WINDIR%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_optimized_big.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_built_big.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_built.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_fr.htm
%WINDIR%\Help\Tours\htmlTour\unlock_built_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_playing.htm
%WINDIR%\Help\Tours\mmTour\intro.txt
%WINDIR%\Help\Tours\mmTour\intro.swf
%WINDIR%\Help\Tours\mmTour\nav.txt
%WINDIR%\Help\Tours\mmTour\nav.swf
%WINDIR%\Help\Tours\htmlTour\unlock_playing_big.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_playing.jpg
%WINDIR%\Help\Tours\htmlTour\window_up.jpg
%WINDIR%\Help\Tours\htmlTour\unlock_playing_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\start_ending.htm
%WINDIR%\Help\Tours\htmlTour\start_desktop.htm
%WINDIR%\Help\Tours\htmlTour\start_fr.htm
%WINDIR%\Help\Tours\htmlTour\start_files.htm
%WINDIR%\Help\Tours\htmlTour\scripts.js
%WINDIR%\Help\Tours\htmlTour\safe_fr.htm
%WINDIR%\Help\Tours\htmlTour\start_control.htm
%WINDIR%\Help\Tours\htmlTour\spacer.gif
%WINDIR%\Help\Tours\htmlTour\start_icons.htm
%WINDIR%\Help\Tours\htmlTour\taskbar_up.jpg
%WINDIR%\Help\Tours\htmlTour\style.css
%WINDIR%\Help\Tours\htmlTour\unlock_built.htm
%WINDIR%\Help\Tours\htmlTour\ul_logo.jpg
%WINDIR%\Help\Tours\htmlTour\start_taskbar.htm
%WINDIR%\Help\Tours\htmlTour\start_menu.htm
%WINDIR%\Help\Tours\htmlTour\start_windows.htm
%WINDIR%\Help\Tours\htmlTour\start_up.jpg
%WINDIR%\Help\dialer.hlp
%WINDIR%\Help\dialer.chm
%WINDIR%\Help\dijoy.hlp
%WINDIR%\Help\digiras.chm
%WINDIR%\Help\devmgr.hlp
%WINDIR%\Help\devmgr.chm
%WINDIR%\Help\diagboot.chm
%WINDIR%\Help\dfs.hlp
%WINDIR%\Help\diskmgmt.chm
%WINDIR%\Help\drwtsn32.chm
%WINDIR%\Help\drvvfp.chm
%WINDIR%\Help\dsclient.hlp
%WINDIR%\Help\drwtsn32.hlp
%WINDIR%\Help\display.chm
%WINDIR%\Help\diskmgmt.hlp
%WINDIR%\Help\dkconcepts.chm
%WINDIR%\Help\display.hlp
%WINDIR%\Help\connect.cnt
%WINDIR%\Help\conf1.chm
%WINDIR%\Help\cpanel.chm
%WINDIR%\Help\connect.hlp
%WINDIR%\Help\conf.chm
%WINDIR%\Help\compstui.hlp
%WINDIR%\Help\conf.hlp
%WINDIR%\Help\conf.cnt
%WINDIR%\Help\cpanel.chq
%WINDIR%\Help\ddeshare.hlp
%WINDIR%\Help\ddeshare.chm
%WINDIR%\Help\defrag.hlp
%WINDIR%\Help\defrag.chm
%WINDIR%\Help\cyycoins.chm
%WINDIR%\Help\cscui.hlp
%WINDIR%\Help\datetime.chm
%WINDIR%\Help\cyzcoins.chm
%WINDIR%\Help\fxsclnt.hlp
%WINDIR%\Help\fxsclnt.chm
%WINDIR%\Help\fxsshare.chm
%WINDIR%\Help\fxscover.chm
%WINDIR%\Help\fonts.hlp
%WINDIR%\Help\fonts.chm
%WINDIR%\Help\freecell.hlp
%WINDIR%\Help\freecell.chm
%WINDIR%\Help\gen.chm
%WINDIR%\Help\hardware.chm
%WINDIR%\Help\halftone.hlp
%WINDIR%\Help\howto.chm
%WINDIR%\Help\hardware.hlp
%WINDIR%\Help\gpedit.chm
%WINDIR%\Help\Glossary.chm
%WINDIR%\Help\gptext.hlp
%WINDIR%\Help\gpedit.hlp
%WINDIR%\Help\encrypt.chm
%WINDIR%\Help\els.hlp
%WINDIR%\Help\eudcedit.hlp
%WINDIR%\Help\eudcedit.chm
%WINDIR%\Help\dskquoui.hlp
%WINDIR%\Help\dskquoui.chm
%WINDIR%\Help\els.chm
%WINDIR%\Help\dxdiag.chm
%WINDIR%\Help\evconcepts.chm
%WINDIR%\Help\file_srv.chm
%WINDIR%\Help\filemgmt.hlp
%WINDIR%\Help\folderop.chm
%WINDIR%\Help\find.chm
%WINDIR%\Help\fde.hlp
%WINDIR%\Help\evntwin.hlp
%WINDIR%\Help\filefold.hlp
%WINDIR%\Help\filefold.chm
%WINDIR%\Help\agt0410.hlp
%WINDIR%\Help\agt040e.hlp
%WINDIR%\Help\agt0414.hlp
%WINDIR%\Help\agt0413.hlp
%WINDIR%\Help\agt0409.hlp
%WINDIR%\Help\agt0408.hlp
%WINDIR%\Help\agt040c.hlp
%WINDIR%\Help\agt040b.hlp
%WINDIR%\Help\agt0415.hlp
%WINDIR%\Help\agt0c0a.hlp
%WINDIR%\Help\agt0816.hlp
%WINDIR%\Help\apps_sp.chm
%WINDIR%\Help\apps.chm
%WINDIR%\Help\agt0419.hlp
%WINDIR%\Help\agt0416.hlp
%WINDIR%\Help\agt041f.hlp
%WINDIR%\Help\agt041d.hlp
%WINDIR%\Help\access.hlp
%WINDIR%\Help\access.chm
%WINDIR%\Help\acc_dis.chm
%WINDIR%\Help\accessib.chm
%WINDIR%\ime\SOFTKBD.DLL
%WINDIR%\ime\mscandui.dll
%WINDIR%\ime\SPTIP.dll
%WINDIR%\ime\SPGRMR.dll
%WINDIR%\Help\aclui.chm
%WINDIR%\Help\agt0405.hlp
%WINDIR%\Help\adprop.hlp
%WINDIR%\Help\agt0407.hlp
%WINDIR%\Help\agt0406.hlp
%WINDIR%\Help\addremov.chm
%WINDIR%\Help\aclui.hlp
%WINDIR%\Help\admtools.chm
%WINDIR%\Help\ade.hlp
%WINDIR%\Help\chooser.hlp
%WINDIR%\Help\chnscsvr.hlp
%WINDIR%\Help\ciquery.htm
%WINDIR%\Help\ciadmin.htm
%WINDIR%\Help\charmap.chm
%WINDIR%\Help\certmgr.hlp
%WINDIR%\Help\chkr.chm
%WINDIR%\Help\charmap.hlp
%WINDIR%\Help\clipbrd.chm
%WINDIR%\Help\common.chm
%WINDIR%\Help\comexp.hlp
%WINDIR%\Help\compmgmt.chm
%WINDIR%\Help\compfldr.chm
%WINDIR%\Help\cmconcepts.chm
%WINDIR%\Help\clipbrd.hlp
%WINDIR%\Help\comexp.chm
%WINDIR%\Help\colormgt.chm
%WINDIR%\Help\blurbs.chm
%WINDIR%\Help\bckg.chm
%WINDIR%\Help\bnts.dll
%WINDIR%\Help\blutooth.chm
%WINDIR%\Help\atm.chm
%WINDIR%\Help\article.chm
%WINDIR%\Help\audit.chm
%WINDIR%\Help\audiocdc.hlp
%WINDIR%\Help\bootcons.chm
%WINDIR%\Help\cdmedia.chm
%WINDIR%\Help\camera.hlp
%WINDIR%\Help\certmgr.chm
%WINDIR%\Help\cdmedia.hlp
%WINDIR%\Help\calc.chm
%WINDIR%\Help\brief.chm
%WINDIR%\Help\camera.chm
%WINDIR%\Help\calc.hlp
%WINDIR%\Help\hrtz.chm
%WINDIR%\Help\newfeat3.hlp
%WINDIR%\Help\newfeat3.chm
%WINDIR%\Help\newfeat4.hlp
%WINDIR%\Help\newfeat4.chm
%WINDIR%\Help\newfeat1.hlp
%WINDIR%\Help\newfeat1.chm
%WINDIR%\Help\newfeat2.hlp
%WINDIR%\Help\newfeat2.chm
%WINDIR%\Help\newfeat5.chm
%WINDIR%\Help\notepad.chm
%WINDIR%\Help\nofts.chm
%WINDIR%\Help\ntart.chm
%WINDIR%\Help\notepad.hlp
%WINDIR%\Help\nmchat.chm
%WINDIR%\Help\newfeat5.hlp
%WINDIR%\Help\nocontnt.cnt
%WINDIR%\Help\nmwhiteb.chm
%WINDIR%\Help\msoe.chm
%WINDIR%\Help\msnauth.hlp
%WINDIR%\Help\msoeacct.hlp
%WINDIR%\Help\msoe.hlp
%WINDIR%\Help\msmq.chm
%WINDIR%\Help\msinfo32.chm
%WINDIR%\Help\msnauth.cnt
%WINDIR%\Help\msmqconcepts.chm
%WINDIR%\Help\msorcl32.chm
%WINDIR%\Help\netcfg.chm
%WINDIR%\Help\mstsc.chm
%WINDIR%\Help\network.chm
%WINDIR%\Help\netcfg.hlp
%WINDIR%\Help\mspaint.hlp
%WINDIR%\Help\mspaint.chm
%WINDIR%\Help\mstask.hlp
%WINDIR%\Help\mstask.chm
%WINDIR%\Help\pinball.chm
%WINDIR%\Help\phowto.chm
%WINDIR%\Help\plyr_err.chm
%WINDIR%\Help\pinball.hlp
%WINDIR%\Help\osk.hlp
%WINDIR%\Help\osk.chm
%WINDIR%\Help\password.chm
%WINDIR%\Help\packager.chm
%WINDIR%\Help\printfnd.chm
%WINDIR%\Help\qosconcepts.chm
%WINDIR%\Help\pwrmn.hlp
%WINDIR%\Help\ratings.cnt
%WINDIR%\Help\ratings.chm
%WINDIR%\Help\progman.cnt
%WINDIR%\Help\printing.chm
%WINDIR%\Help\pwrmn.chm
%WINDIR%\Help\progman.hlp
%WINDIR%\Help\nthelp.chm
%WINDIR%\Help\ntdef.chm
%WINDIR%\Help\ntshrui.hlp
%WINDIR%\Help\ntshared.chm
%WINDIR%\Help\ntbackup.hlp
%WINDIR%\Help\ntbackup.chm
%WINDIR%\Help\ntcmds.chm
%WINDIR%\Help\ntchowto.chm
%WINDIR%\Help\nusrmgr.chm
%WINDIR%\Help\oe_msgr.chm
%WINDIR%\Help\odbcjet.chm
%WINDIR%\Help\omc.chm
%WINDIR%\Help\offlinefolders.chm
%WINDIR%\Help\nwdoc.hlp
%WINDIR%\Help\nwdoc.chm
%WINDIR%\Help\odbcinst.chm
%WINDIR%\Help\objsel.hlp
%WINDIR%\Help\intellimirror.chm
%WINDIR%\Help\input.hlp
%WINDIR%\Help\ipsecsnp.chm
%WINDIR%\Help\ipsecconcepts.chm
%WINDIR%\Help\infrared.chm
%WINDIR%\Help\inetres.chm
%WINDIR%\Help\input.chm
%WINDIR%\Help\infrared.hlp
%WINDIR%\Help\ipsecsnp.hlp
%WINDIR%\Help\joy.chm
%WINDIR%\Help\ixqlang.htm
%WINDIR%\Help\keyb.chm
%WINDIR%\Help\key.chm
%WINDIR%\Help\is.chm
%WINDIR%\Help\Ipv6.chm
%WINDIR%\Help\ixhelp.hlp
%WINDIR%\Help\isconcepts.chm
%WINDIR%\Help\ident.hlp
%WINDIR%\Help\icwdial.chm
%WINDIR%\Help\ieeula.chm
%WINDIR%\Help\ieakmmc.chm
%WINDIR%\Help\hschelp.chm
%WINDIR%\Help\hs.chm
%WINDIR%\Help\hypertrm.hlp
%WINDIR%\Help\hypertrm.chm
%WINDIR%\Help\ieos.chm
%WINDIR%\Help\iis.chm
%WINDIR%\Help\iexplore.hlp
%WINDIR%\Help\imgprev.chm
%WINDIR%\Help\iismmc.chm
%WINDIR%\Help\iesupp.chm
%WINDIR%\Help\ieshared.chm
%WINDIR%\Help\iexplore.chm
%WINDIR%\Help\iewebhlp.chm
%WINDIR%\Help\mouse.chm
%WINDIR%\Help\modem.hlp
%WINDIR%\Help\mpconcepts.chm
%WINDIR%\Help\mouse.hlp
%WINDIR%\Help\mobsync.chm
%WINDIR%\Help\mmc_dlg.hlp
%WINDIR%\Help\mode.chm
%WINDIR%\Help\mobsync.hlp
%WINDIR%\Help\mplayer2.cnt
%WINDIR%\Help\mshearts.chm
%WINDIR%\Help\msdasc.chm
%WINDIR%\Help\mshearts.hlp
%WINDIR%\Help\mshearts.cnt
%WINDIR%\Help\mpnetwrk.hlp
%WINDIR%\Help\mplayer2.hlp
%WINDIR%\Help\msconfig.chm
%WINDIR%\Help\mqsnap.hlp
%WINDIR%\Help\localsec.hlp
%WINDIR%\Help\localsec.chm
%WINDIR%\Help\lpeconcepts.chm
%WINDIR%\Help\lpe.chm
%WINDIR%\Help\lang.chm
%WINDIR%\Help\keyshort.chm
%WINDIR%\Help\license.chm
%WINDIR%\Help\langbar.chm
%WINDIR%\Help\magnify.chm
%WINDIR%\Help\misc.chm
%WINDIR%\Help\migwiz2.htm
%WINDIR%\Help\mmc.chm
%WINDIR%\Help\mls_trb.chm
%WINDIR%\Help\mail.chm
%WINDIR%\Help\magnify.hlp
%WINDIR%\Help\migwiz.htm
%WINDIR%\Help\mfcuix.hlp

Network activity:

Connects to:

'www.ha###iaozu.tk':80
'www.xx###ckxxx.com':80
'localhost':1037

TCP:

HTTP GET requests:

www.ha###iaozu.tk/
www.xx###ckxxx.com/

UDP:

DNS ASK www.ha###iaozu.tk
DNS ASK www.xx###ckxxx.com

Miscellaneous:

Searches for the following windows:

ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: '' WindowName: ''

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial