Trojan.MulDrop8.20741

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\<File name>.exe
%HOMEPATH%\Start Menu\Programs\Startup\<File name>.exe

Modifies file system:

Creates the following files:

%TEMP%\1.tmp\2.tmp\3.bat
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\Speech\1033\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\DW\3082\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\DW\2052\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\DW\1042\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\DW\1041\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\DW\1040\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\DW\1036\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\DW\1033\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\DW\1031\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\DW\1028\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\DW\1025\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\Web Folders\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\VGX\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\<File name>.exe
%ProgramFiles%\FireFox\chrome\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admcgi\scripts\<File name>.exe
%CommonProgramFiles%\System\Ole DB\<File name>.exe
%CommonProgramFiles%\System\msadc\<File name>.exe
%CommonProgramFiles%\System\ado\<File name>.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\1033\<File name>.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\1033\<File name>.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\TTS\<File name>.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\Lexicon\<File name>.exe
%CommonProgramFiles%\SpeechEngines\Microsoft\<File name>.exe
%CommonProgramFiles%\ODBC\Data Sources\<File name>.exe
%CommonProgramFiles%\MSSoap\Binaries\Resources\1033\<File name>.exe
%CommonProgramFiles%\MSSoap\Binaries\Resources\<File name>.exe
%CommonProgramFiles%\MSSoap\Binaries\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_aut\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\_vti_bin\_vti_adm\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_aut\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\isapi\_vti_adm\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bots\vinavbar\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\bin\1033\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\admisapi\scripts\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\VC\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\web server extensions\40\servsupp\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\Triedit\<File name>.exe
%ProgramFiles%\microsoft frontpage\<File name>.exe
%ProgramFiles%\Internet Explorer\<File name>.exe
%ProgramFiles%\FireFox\<File name>.exe
%ProgramFiles%\ComPlus Applications\<File name>.exe
%CommonProgramFiles%\<File name>.exe
C:\Muldrop\dmp_0x8c_0x30000
C:\Muldrop\dmp_0x8c_0x20000
C:\Muldrop\dmp_0x8c_0x10000
C:\Far2\Plugins\WinSCP\putty\windows\<File name>.exe
C:\Far2\Plugins\WinSCP\putty\charset\<File name>.exe
C:\Far2\Plugins\WinSCP\packages\theme\<File name>.exe
C:\Far2\Plugins\WinSCP\packages\tbx\<File name>.exe
C:\Far2\Plugins\WinSCP\packages\tb2k\<File name>.exe
C:\Far2\Plugins\WinSCP\packages\my\<File name>.exe
C:\Far2\Plugins\WinSCP\packages\filemng\<File name>.exe
C:\Far2\Plugins\WinSCP\packages\dragndrop\<File name>.exe
C:\Far2\Plugins\WinSCP\filezilla\misc\<File name>.exe
C:\Far2\Plugins\WinSCP\windows\<File name>.exe
C:\Far2\Plugins\WinSCP\resource\<File name>.exe
C:\Far2\Plugins\WinSCP\release\<File name>.exe
%ProgramFiles%\Messenger\<File name>.exe
%ProgramFiles%\Movie Maker\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\Stationery\<File name>.exe
%ProgramFiles%\MSBuild\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\Speech\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\MSInfo\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\DW\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\DAO\<File name>.exe
%CommonProgramFiles%\System\<File name>.exe
%CommonProgramFiles%\SpeechEngines\<File name>.exe
%CommonProgramFiles%\Services\<File name>.exe
%CommonProgramFiles%\ODBC\<File name>.exe
%CommonProgramFiles%\MSSoap\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\<File name>.exe
%ProgramFiles%\xerox\<File name>.exe
%ProgramFiles%\Windows NT\<File name>.exe
%ProgramFiles%\Windows Media Player\<File name>.exe
%ProgramFiles%\Reference Assemblies\<File name>.exe
%ProgramFiles%\Outlook Express\<File name>.exe
%ProgramFiles%\Online Services\<File name>.exe
%ProgramFiles%\NetMeeting\<File name>.exe
%ProgramFiles%\MSN Gaming Zone\<File name>.exe
%ProgramFiles%\MSN\<File name>.exe
%CommonProgramFiles%\Microsoft Shared\TextConv\<File name>.exe
%ProgramFiles%\FireFox\components\<File name>.exe
%ProgramFiles%\FireFox\defaults\<File name>.exe
%ProgramFiles%\FireFox\dictionaries\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\layout\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\dom\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\services\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\places\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\pippki\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\pipnss\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\passwordmgr\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\necko\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global-region\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global-platform\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\cookie\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\autoconfig\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\alerts\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\sidebar\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\safebrowsing\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\preferences\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\places\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\feeds\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\migration\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\search\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\security\<File name>.exe
%ProgramFiles%\FireFox\chrome\toolkit\skin\<File name>.exe
%ProgramFiles%\FireFox\chrome\toolkit\res\<File name>.exe
%ProgramFiles%\FireFox\chrome\toolkit\content\<File name>.exe
%ProgramFiles%\FireFox\chrome\pippki\content\pippki\<File name>.exe
%ProgramFiles%\FireFox\chrome\pippki\content\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\xpinstall\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\update\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\profile\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\preferences\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\handling\<File name>.exe
%ProgramFiles%\FireFox\chrome\toolkit\content\cookie\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\extensions\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\downloads\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global-platform\win\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global-platform\unix\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global-platform\mac\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\xslt\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\xpinstall\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\xml\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\global\svg\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\downloads\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\feedback\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\content\browser\history\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\content\browser\feeds\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\content\browser\certerror\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\content\browser\bookmarks\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\content\browser\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\content\branding\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\skin\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\content\<File name>.exe
%ProgramFiles%\FireFox\chrome\toolkit\<File name>.exe
%ProgramFiles%\FireFox\chrome\pippki\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\<File name>.exe
%ProgramFiles%\FireFox\uninstall\<File name>.exe
%ProgramFiles%\FireFox\searchplugins\<File name>.exe
%ProgramFiles%\FireFox\res\<File name>.exe
%ProgramFiles%\FireFox\plugins\<File name>.exe
%ProgramFiles%\FireFox\modules\<File name>.exe
%ProgramFiles%\FireFox\extensions\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\content\browser\pageinfo\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\content\browser\places\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\content\browser\migration\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\content\browser\preferences\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\browser-region\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\content\browser\safebrowsing\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\browser\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\branding\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabview\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\tabbrowser\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\preferences\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\places\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\feeds\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabbrowser\<File name>.exe
C:\Far2\Plugins\WinSCP\putty\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\preferences\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\places\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\feeds\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\skin\classic\communicator\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\skin\classic\browser\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\skin\classic\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\content\browser\search\<File name>.exe
%ProgramFiles%\FireFox\chrome\browser\skin\classic\aero\browser\tabview\<File name>.exe
%ProgramFiles%\FireFox\chrome\en-US\locale\en-US\mozapps\plugins\<File name>.exe
C:\Far2\Plugins\WinSCP\packages\<File name>.exe
C:\Far2\Plugins\ExtSearch\sources\<File name>.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\<File name>.exe
C:\Documents and Settings\NetworkService\Local Settings\Temp\<File name>.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\<File name>.exe
C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\<File name>.exe
C:\Documents and Settings\NetworkService\Application Data\<File name>.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\<File name>.exe
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\<File name>.exe
C:\Documents and Settings\LocalService\Local Settings\Temp\<File name>.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\<File name>.exe
C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\<File name>.exe
C:\Documents and Settings\LocalService\Application Data\<File name>.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\<File name>.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\<File name>.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Startup\<File name>.exe
C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\<File name>.exe
C:\Documents and Settings\Default User\Start Menu\Programs\<File name>.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\<File name>.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\<File name>.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\<File name>.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\<File name>.exe
%HOMEPATH%\Favorites\<File name>.exe
<LS_APPDATA>\Microsoft\<File name>.exe
%HOMEPATH%\My Documents\<File name>.exe
<LS_APPDATA>\Identities\<File name>.exe
%TEMP%\<File name>.exe
%HOMEPATH%\Favorites\Links\<File name>.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\<File name>.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\<File name>.exe
%APPDATA%\Mozilla\Firefox\Profiles\<File name>.exe
%APPDATA%\Mozilla\Firefox\<File name>.exe
%APPDATA%\Mozilla\Extensions\<File name>.exe
%APPDATA%\Microsoft\Windows\Themes\<File name>.exe
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\<File name>.exe
%APPDATA%\Microsoft\Windows\<File name>.exe
%APPDATA%\Microsoft\MMC\<File name>.exe
%APPDATA%\Microsoft\Media Player\<File name>.exe
%APPDATA%\Microsoft\Internet Explorer\<File name>.exe
%APPDATA%\Microsoft\Address Book\<File name>.exe
%APPDATA%\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\<File name>.exe
%APPDATA%\Mozilla\<File name>.exe
%APPDATA%\Identities\<File name>.exe
%HOMEPATH%\Start Menu\<File name>.exe
C:\Documents and Settings\Default User\Local Settings\Temp\<File name>.exe
%HOMEPATH%\Desktop\<File name>.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\<File name>.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Cm\<File name>.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\<File name>.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\<File name>.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\<File name>.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Media Index\<File name>.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\HTML Help\<File name>.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\<File name>.exe
%ALLUSERSPROFILE%\Start Menu\<File name>.exe
%ALLUSERSPROFILE%\Favorites\<File name>.exe
%ALLUSERSPROFILE%\Documents\<File name>.exe
%ALLUSERSPROFILE%\Desktop\<File name>.exe
%HOMEPATH%\<File name>.exe
%ALLUSERSPROFILE%\<File name>.exe
%WINDIR%\<File name>.exe
<STUBS_DIR>\<File name>.exe
%ProgramFiles%\<File name>.exe
C:\Muldrop\<File name>.exe
C:\Far2\<File name>.exe
C:\Documents and Settings\<File name>.exe
<Current directory>\InfList_..txt
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\<File name>.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\<File name>.exe
C:\Documents and Settings\Default User\Start Menu\<File name>.exe
%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\<File name>.exe
C:\Documents and Settings\Default User\My Documents\<File name>.exe
C:\Documents and Settings\Default User\Favorites\<File name>.exe
C:\Documents and Settings\Default User\Desktop\<File name>.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\<File name>.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\<File name>.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\<File name>.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\<File name>.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Games\<File name>.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\<File name>.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Accessories\<File name>.exe
%ALLUSERSPROFILE%\Start Menu\Programs\<File name>.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\<File name>.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\<File name>.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\<File name>.exe
%ALLUSERSPROFILE%\Documents\My Music\Sample Music\<File name>.exe
%ALLUSERSPROFILE%\Documents\My Music\My Playlists\<File name>.exe
%ALLUSERSPROFILE%\Documents\My Videos\<File name>.exe
%ALLUSERSPROFILE%\Documents\My Pictures\<File name>.exe
%ALLUSERSPROFILE%\Documents\My Music\<File name>.exe
C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\<File name>.exe
<LS_APPDATA>\Mozilla\<File name>.exe
<LS_APPDATA>\VMware\<File name>.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\<File name>.exe
C:\Far2\Plugins\Network\<File name>.exe
C:\Far2\Plugins\MacroView\<File name>.exe
C:\Far2\Plugins\HlfViewer\<File name>.exe
C:\Far2\Plugins\FTP\<File name>.exe
C:\Far2\Plugins\FileCase\<File name>.exe
C:\Far2\Plugins\FarCmds\<File name>.exe
C:\Far2\Plugins\ExtSearch\<File name>.exe
C:\Far2\Plugins\EMenu\<File name>.exe
C:\Far2\Plugins\EditCase\<File name>.exe
C:\Far2\Plugins\DrawLine\<File name>.exe
C:\Far2\Plugins\Compare\<File name>.exe
C:\Far2\Plugins\Colorer\<File name>.exe
C:\Far2\Plugins\Brackets\<File name>.exe
C:\Far2\Plugins\AutoWrap\<File name>.exe
C:\Far2\Plugins\arclite\<File name>.exe
C:\Far2\Plugins\Align\<File name>.exe
C:\Far2\Plugins\7-Zip\<File name>.exe
C:\Far2\Documentation\rus\<File name>.exe
C:\Far2\Documentation\eng\<File name>.exe
C:\Far2\Addons\Colors\Default Highlighting\<File name>.exe
C:\Far2\Addons\XLat\Russian\<File name>.exe
C:\Far2\Plugins\ProcList\<File name>.exe
C:\Far2\Plugins\TmpPanel\<File name>.exe
C:\Far2\Plugins\WinSCP\filezilla\<File name>.exe
C:\Far2\Plugins\WinSCP\fari\<File name>.exe
C:\Far2\Plugins\WinSCP\far\<File name>.exe
C:\Far2\Plugins\WinSCP\dragext\<File name>.exe
C:\Far2\Plugins\WinSCP\core\<File name>.exe
C:\Far2\Plugins\WinSCP\console\<File name>.exe
C:\Far2\Plugins\WinSCP\components\<File name>.exe
C:\Far2\Plugins\FTP\lib\<File name>.exe
C:\Far2\Plugins\ExtSearch\sources\RegExp\<File name>.exe
C:\Far2\Plugins\ExtSearch\keys\<File name>.exe
C:\Far2\Plugins\WinSCP\forms\<File name>.exe
C:\Far2\Plugins\ExtSearch\doc\<File name>.exe
C:\Far2\Plugins\Colorer\hrd\console\contrib\<File name>.exe
C:\Far2\Plugins\Colorer\hrd\console\<File name>.exe
C:\Far2\Plugins\Colorer\hrc\auto\types\<File name>.exe
C:\Far2\Plugins\Colorer\hrc\auto\<File name>.exe
C:\Far2\Plugins\Colorer\hrd\<File name>.exe
C:\Far2\Plugins\Colorer\hrc\<File name>.exe
C:\Far2\Plugins\Colorer\bin\<File name>.exe
C:\Far2\Plugins\WinSCP\<File name>.exe
C:\Far2\Addons\Colors\Custom Highlighting\<File name>.exe
C:\Far2\Addons\XLat\<File name>.exe
C:\Far2\Addons\Shell\<File name>.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\7\<File name>.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\6\<File name>.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\5\<File name>.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\4\<File name>.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\3\<File name>.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\2\<File name>.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\1\<File name>.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\0\<File name>.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\<File name>.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\<File name>.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\<File name>.exe
<LS_APPDATA>\Mozilla\Firefox\<File name>.exe
<LS_APPDATA>\Microsoft\Windows Media\<File name>.exe
<LS_APPDATA>\Microsoft\Windows\<File name>.exe
<LS_APPDATA>\Microsoft\Media Player\<File name>.exe
<LS_APPDATA>\Microsoft\CD Burning\<File name>.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\<File name>.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\<File name>.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\9\<File name>.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\A\<File name>.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\8\<File name>.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\B\<File name>.exe
C:\Far2\Addons\SetUp\<File name>.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\C\<File name>.exe
C:\Far2\Addons\Macros\<File name>.exe
C:\Far2\Addons\Colors\<File name>.exe
C:\Far2\PluginSDK\<File name>.exe
C:\Far2\Plugins\<File name>.exe
C:\Far2\FExcept\<File name>.exe
C:\Far2\Encyclopedia\<File name>.exe
C:\Far2\Documentation\<File name>.exe
C:\Far2\Addons\<File name>.exe
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\<File name>.exe
C:\Far2\Plugins\WinSCP\lib\<File name>.exe
%HOMEPATH%\Start Menu\Programs\Accessories\<File name>.exe
%HOMEPATH%\Start Menu\Programs\<File name>.exe
%HOMEPATH%\My Documents\My Received Files\<File name>.exe
%HOMEPATH%\My Documents\My Pictures\<File name>.exe
%HOMEPATH%\My Documents\My Music\<File name>.exe
%HOMEPATH%\My Documents\Downloads\<File name>.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\F\<File name>.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\E\<File name>.exe
<LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\D\<File name>.exe
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\<File name>.exe
%ProgramFiles%\FireFox\chrome\toolkit\content\global\<File name>.exe

Miscellaneous:

Executes the following:

'<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\2.tmp\3.bat" <Full path to file>"
'<SYSTEM32>\cmd.exe' /S /D /c" echo Y "
'<SYSTEM32>\cmd.exe' /S /D /c" FOR /F "tokens=1,* delims=: " %j in (InfList_..txt) do copy /y <Full path to file> "%j:%k""

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial