Win32.HLLW.Autoruner1.52765

Technical Information

To ensure autorun and distribution:

Infects the following executable system files:

%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.exe
%WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
%WINDIR%\$NtUninstallKB942288-v3$\msiexec.exe
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.exe

Substitutes the following executable system files:

<SYSTEM32>\dllcache\oemig50.exe with <SYSTEM32>\dllcache\oemig50.exe.new
<SYSTEM32>\dllcache\msimn.exe with <SYSTEM32>\dllcache\msimn.exe.new
<SYSTEM32>\dllcache\wab.exe with <SYSTEM32>\dllcache\wab.exe.new
<SYSTEM32>\dllcache\setup50.exe with <SYSTEM32>\dllcache\setup50.exe.new
<SYSTEM32>\dllcache\cb32.exe with <SYSTEM32>\dllcache\cb32.exe.new
<SYSTEM32>\dllcache\zclientm.exe with <SYSTEM32>\dllcache\zclientm.exe.new
<SYSTEM32>\dllcache\wb32.exe with <SYSTEM32>\dllcache\wb32.exe.new
<SYSTEM32>\dllcache\conf.exe with <SYSTEM32>\dllcache\conf.exe.new
<SYSTEM32>\dllcache\wordpad.exe with <SYSTEM32>\dllcache\wordpad.exe.new
<SYSTEM32>\dllcache\wmplayer.exe with <SYSTEM32>\dllcache\wmplayer.exe.new
<SYSTEM32>\dllcache\pinball.exe with <SYSTEM32>\dllcache\pinball.exe.new
<SYSTEM32>\dllcache\dialer.exe with <SYSTEM32>\dllcache\dialer.exe.new
<SYSTEM32>\dllcache\migrate.exe with <SYSTEM32>\dllcache\migrate.exe.new
<SYSTEM32>\dllcache\wabmig.exe with <SYSTEM32>\dllcache\wabmig.exe.new
<SYSTEM32>\dllcache\setup_wm.exe with <SYSTEM32>\dllcache\setup_wm.exe.new
<SYSTEM32>\dllcache\mplayer2.exe with <SYSTEM32>\dllcache\mplayer2.exe.new
<SYSTEM32>\dllcache\icwtutor.exe with <SYSTEM32>\dllcache\icwtutor.exe.new
<SYSTEM32>\dllcache\icwrmind.exe with <SYSTEM32>\dllcache\icwrmind.exe.new
<SYSTEM32>\dllcache\isignup.exe with <SYSTEM32>\dllcache\isignup.exe.new
<SYSTEM32>\dllcache\inetwiz.exe with <SYSTEM32>\dllcache\inetwiz.exe.new
<SYSTEM32>\dllcache\sapisvr.exe with <SYSTEM32>\dllcache\sapisvr.exe.new
<SYSTEM32>\dllcache\msinfo32.exe with <SYSTEM32>\dllcache\msinfo32.exe.new
<SYSTEM32>\dllcache\icwconn2.exe with <SYSTEM32>\dllcache\icwconn2.exe.new
<SYSTEM32>\dllcache\icwconn1.exe with <SYSTEM32>\dllcache\icwconn1.exe.new
<SYSTEM32>\dllcache\hrtzzm.exe with <SYSTEM32>\dllcache\hrtzzm.exe.new
<SYSTEM32>\dllcache\chkrzm.exe with <SYSTEM32>\dllcache\chkrzm.exe.new
<SYSTEM32>\dllcache\shvlzm.exe with <SYSTEM32>\dllcache\shvlzm.exe.new
<SYSTEM32>\dllcache\rvsezm.exe with <SYSTEM32>\dllcache\rvsezm.exe.new
<SYSTEM32>\dllcache\iexplore.exe with <SYSTEM32>\dllcache\iexplore.exe.new
<SYSTEM32>\dllcache\iedw.exe with <SYSTEM32>\dllcache\iedw.exe.new
<SYSTEM32>\dllcache\bckgzm.exe with <SYSTEM32>\dllcache\bckgzm.exe.new
<SYSTEM32>\dllcache\moviemk.exe with <SYSTEM32>\dllcache\moviemk.exe.new

Creates the following files on removable media:

<Drive name for removable media>:\AutoRun.inf
<Drive name for removable media>:\WinNT.com

Malicious functions:

Creates and executes the following:

'<SYSTEM32>\ntldr.exe'

Modifies file system :

Creates the following files:

%TEMP%\RCX4D.tmp
%TEMP%\_+_leuia.tmp
%PROGRAM_FILES%\NetMeeting\cb32.exe:Flinched
%TEMP%\RCX4E.tmp
%TEMP%\RCX4F.tmp
%TEMP%\_+_vvuvj.tmp
%PROGRAM_FILES%\NetMeeting\conf.exe:Flinched
%TEMP%\RCX4A.tmp
%TEMP%\RCX49.tmp
%TEMP%\_+_qyzyv.tmp
%PROGRAM_FILES%\MSN Gaming Zone\Windows\zClientm.exe:Flinched
%TEMP%\RCX4C.tmp
%TEMP%\RCX4B.tmp
%TEMP%\_+_zqrce.tmp
%TEMP%\RCX50.tmp
%TEMP%\_+_wztpi.tmp
%PROGRAM_FILES%\Outlook Express\oemig50.exe:Flinched
%TEMP%\RCX54.tmp
%TEMP%\RCX55.tmp
%TEMP%\_+_twmnv.tmp
%PROGRAM_FILES%\Outlook Express\setup50.exe:Flinched
%TEMP%\RCX56.tmp
%TEMP%\RCX51.tmp
%TEMP%\_+_moqkj.tmp
%PROGRAM_FILES%\NetMeeting\wb32.exe:Flinched
%TEMP%\RCX52.tmp
%TEMP%\RCX53.tmp
%TEMP%\_+_wusqo.tmp
%PROGRAM_FILES%\Outlook Express\msimn.exe:Flinched
%TEMP%\_+_enrco.tmp
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\msnsusii.exe:Flinched
%TEMP%\RCX3E.tmp
%TEMP%\RCX3F.tmp
%TEMP%\_+_fhiia.tmp
%PROGRAM_FILES%\MSN Gaming Zone\Windows\bckgzm.exe:Flinched
%TEMP%\RCX40.tmp
%TEMP%\RCX3B.tmp
%TEMP%\_+_igdxm.tmp
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\Digcore.exe:Flinched
%TEMP%\RCX3C.tmp
%TEMP%\RCX3D.tmp
%TEMP%\_+_uqmun.tmp
%PROGRAM_FILES%\MSN\MSNCoreFiles\Install\MSN9Components\Msncli.exe:Flinched
%TEMP%\RCX41.tmp
%PROGRAM_FILES%\MSN Gaming Zone\Windows\Rvsezm.exe:Flinched
%TEMP%\RCX46.tmp
%TEMP%\RCX45.tmp
%TEMP%\_+_qxojy.tmp
%PROGRAM_FILES%\MSN Gaming Zone\Windows\shvlzm.exe:Flinched
%TEMP%\RCX48.tmp
%TEMP%\RCX47.tmp
%TEMP%\_+_vmirz.tmp
%PROGRAM_FILES%\MSN Gaming Zone\Windows\chkrzm.exe:Flinched
%TEMP%\RCX42.tmp
%TEMP%\RCX43.tmp
%TEMP%\_+_pahwe.tmp
%PROGRAM_FILES%\MSN Gaming Zone\Windows\hrtzzm.exe:Flinched
%TEMP%\RCX44.tmp
%TEMP%\RCX57.tmp
%TEMP%\_+_wvfuy.tmp
%PROGRAM_FILES%\Windows NT\Pinball\PINBALL.EXE:Flinched
%TEMP%\RCX6A.tmp
%TEMP%\RCX6B.tmp
%TEMP%\_+_etvzq.tmp
<Auxiliary element>
%TEMP%\RCX6C.tmp
%TEMP%\RCX67.tmp
%TEMP%\_+_xknek.tmp
%PROGRAM_FILES%\Windows NT\dialer.exe:Flinched
%TEMP%\RCX68.tmp
%TEMP%\RCX69.tmp
%TEMP%\_+_vtqdm.tmp
%PROGRAM_FILES%\Windows NT\hypertrm.exe:Flinched
%TEMP%\RCX6D.tmp
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.exe:Flinched
%TEMP%\RCX72.tmp
%TEMP%\RCX71.tmp
%TEMP%\_+_ewrnu.tmp
%WINDIR%\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe:Flinched
%TEMP%\RCX74.tmp
%TEMP%\RCX73.tmp
%TEMP%\_+_vynum.tmp
%WINDIR%\$NtUninstallKB942288-v3$\msiexec.exe:Flinched
%TEMP%\RCX6E.tmp
%TEMP%\RCX6F.tmp
%TEMP%\_+_ytrde.tmp
%WINDIR%\$NtUninstallKB942288-v3$\spuninst\spuninst.exe:Flinched
%TEMP%\RCX70.tmp
%PROGRAM_FILES%\Windows Media Player\migrate.exe:Flinched
%TEMP%\RCX5C.tmp
%TEMP%\RCX5B.tmp
%TEMP%\_+_ewgtl.tmp
%PROGRAM_FILES%\Windows Media Player\mplayer2.exe:Flinched
%TEMP%\RCX5E.tmp
%TEMP%\RCX5D.tmp
%TEMP%\_+_nqshq.tmp
%PROGRAM_FILES%\Outlook Express\wab.exe:Flinched
%TEMP%\RCX58.tmp
%TEMP%\RCX59.tmp
%TEMP%\_+_hzxry.tmp
%PROGRAM_FILES%\Outlook Express\wabmig.exe:Flinched
%TEMP%\RCX5A.tmp
%TEMP%\_+_esllc.tmp
%TEMP%\RCX64.tmp
%TEMP%\RCX63.tmp
%TEMP%\_+_hxvxh.tmp
%PROGRAM_FILES%\Windows NT\Accessories\wordpad.exe:Flinched
%TEMP%\RCX66.tmp
%TEMP%\RCX65.tmp
%TEMP%\_+_yvtze.tmp
%PROGRAM_FILES%\Windows Media Player\setup_wm.exe:Flinched
%TEMP%\RCX60.tmp
%TEMP%\RCX5F.tmp
%TEMP%\_+_ttwej.tmp
%PROGRAM_FILES%\Windows Media Player\wmplayer.exe:Flinched
%TEMP%\RCX62.tmp
%TEMP%\RCX61.tmp
%TEMP%\RCX3A.tmp
%PROGRAM_FILES%\FireFox\mangle.exe:Flinched
%TEMP%\RCX12.tmp
%TEMP%\RCX11.tmp
%TEMP%\_+_gbrym.tmp
%PROGRAM_FILES%\FireFox\nsinstall.exe:Flinched
%TEMP%\RCX14.tmp
%TEMP%\RCX13.tmp
%TEMP%\_+_nafku.tmp
%PROGRAM_FILES%\FireFox\firefox.exe:Flinched
%TEMP%\RCXE.tmp
%TEMP%\RCXF.tmp
%TEMP%\_+_qmrtz.tmp
%PROGRAM_FILES%\FireFox\js.exe:Flinched
%TEMP%\RCX10.tmp
%TEMP%\_+_qiyfk.tmp
%TEMP%\RCX1A.tmp
%TEMP%\RCX19.tmp
%TEMP%\_+_hqoub.tmp
%PROGRAM_FILES%\FireFox\uninstall\helper.exe:Flinched
%TEMP%\RCX1C.tmp
%TEMP%\RCX1B.tmp
%TEMP%\_+_lfegn.tmp
%PROGRAM_FILES%\FireFox\plugin-container.exe:Flinched
%TEMP%\RCX16.tmp
%TEMP%\RCX15.tmp
%TEMP%\_+_idbvp.tmp
%PROGRAM_FILES%\FireFox\shlibsign.exe:Flinched
%TEMP%\RCX18.tmp
%TEMP%\RCX17.tmp
%TEMP%\RCX4.tmp
%TEMP%\RCX3.tmp
%TEMP%\_+_oigep.tmp
%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE:Flinched
%TEMP%\RCX6.tmp
%TEMP%\RCX5.tmp
%TEMP%\_+_rtcin.tmp
C:\AutoRun.inf
C:\WinNT.com
<SYSTEM32>\ntldr.exe
%TEMP%\_+_qrpvf.tmp
C:\Far2\Far.exe:Flinched
%TEMP%\RCX2.tmp
%TEMP%\RCX1.tmp
%CommonProgramFiles%\Microsoft Shared\DW\DWTRIG20.EXE:Flinched
%TEMP%\RCXB.tmp
%TEMP%\_+_detvn.tmp
%CommonProgramFiles%\Microsoft Shared\Speech\sapisvr.exe:Flinched
%TEMP%\RCXC.tmp
%TEMP%\RCXD.tmp
%TEMP%\_+_shxpx.tmp
%PROGRAM_FILES%\FireFox\crashreporter.exe:Flinched
%TEMP%\RCX8.tmp
%TEMP%\RCX7.tmp
%TEMP%\_+_hrwvs.tmp
%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe:Flinched
%TEMP%\RCXA.tmp
%TEMP%\RCX9.tmp
%TEMP%\_+_lopvo.tmp
%PROGRAM_FILES%\FireFox\updater.exe:Flinched
%TEMP%\RCX30.tmp
%TEMP%\RCX2F.tmp
%TEMP%\_+_srlxy.tmp
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\isignup.exe:Flinched
%TEMP%\RCX32.tmp
%TEMP%\RCX31.tmp
%TEMP%\_+_iczke.tmp
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwtutor.exe:Flinched
%TEMP%\RCX2C.tmp
%TEMP%\RCX2B.tmp
%TEMP%\_+_byoyz.tmp
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\inetwiz.exe:Flinched
%TEMP%\RCX2E.tmp
%TEMP%\RCX2D.tmp
%PROGRAM_FILES%\Internet Explorer\iedw.exe:Flinched
%TEMP%\RCX37.tmp
%TEMP%\_+_ftihr.tmp
%PROGRAM_FILES%\Messenger\msmsgs.exe:Flinched
%TEMP%\RCX38.tmp
%TEMP%\RCX39.tmp
%TEMP%\_+_fyrwz.tmp
%PROGRAM_FILES%\Movie Maker\moviemk.exe:Flinched
%TEMP%\RCX34.tmp
%TEMP%\RCX33.tmp
%TEMP%\_+_puamd.tmp
%PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE:Flinched
%TEMP%\RCX36.tmp
%TEMP%\RCX35.tmp
%TEMP%\_+_ilmlz.tmp
%TEMP%\RCX21.tmp
%TEMP%\_+_grxoa.tmp
%PROGRAM_FILES%\FireFox\xpidl.exe:Flinched
%TEMP%\RCX22.tmp
%TEMP%\RCX23.tmp
%TEMP%\_+_sminp.tmp
%PROGRAM_FILES%\FireFox\xpt_dump.exe:Flinched
%TEMP%\RCX1E.tmp
%TEMP%\RCX1D.tmp
%TEMP%\_+_izmpo.tmp
%PROGRAM_FILES%\FireFox\xpcshell.exe:Flinched
%TEMP%\RCX20.tmp
%TEMP%\RCX1F.tmp
%TEMP%\_+_rzvik.tmp
%TEMP%\RCX24.tmp
%TEMP%\_+_gqwuf.tmp
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn2.exe:Flinched
%TEMP%\RCX28.tmp
%TEMP%\RCX29.tmp
%TEMP%\_+_lqija.tmp
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwrmind.exe:Flinched
%TEMP%\RCX2A.tmp
%TEMP%\RCX25.tmp
%TEMP%\_+_tqsdk.tmp
%PROGRAM_FILES%\FireFox\xpt_link.exe:Flinched
%TEMP%\RCX26.tmp
%TEMP%\RCX27.tmp
%TEMP%\_+_uwvjb.tmp
%PROGRAM_FILES%\Internet Explorer\Connection Wizard\icwconn1.exe:Flinched

Sets the 'hidden' attribute to the following files:

<Drive name for removable media>:\AutoRun.inf
C:\AutoRun.inf
C:\WinNT.com
<SYSTEM32>\ntldr.exe
<Drive name for removable media>:\WinNT.com

Deletes the following files:

%TEMP%\_+_leuia.tmp
%TEMP%\_+_zqrce.tmp
%TEMP%\_+_qyzyv.tmp
%TEMP%\_+_vvuvj.tmp
%TEMP%\_+_wztpi.tmp
%TEMP%\_+_wusqo.tmp
%TEMP%\_+_moqkj.tmp
%TEMP%\_+_enrco.tmp
%TEMP%\_+_uqmun.tmp
%TEMP%\_+_igdxm.tmp
%TEMP%\_+_fhiia.tmp
%TEMP%\_+_qxojy.tmp
%TEMP%\_+_pahwe.tmp
%TEMP%\_+_vmirz.tmp
%TEMP%\_+_twmnv.tmp
%TEMP%\_+_wvfuy.tmp
%TEMP%\_+_vtqdm.tmp
%TEMP%\_+_xknek.tmp
%TEMP%\_+_etvzq.tmp
%TEMP%\_+_ewrnu.tmp
%TEMP%\_+_ytrde.tmp
%TEMP%\_+_vynum.tmp
%TEMP%\_+_ewgtl.tmp
%TEMP%\_+_hzxry.tmp
%TEMP%\_+_nqshq.tmp
%TEMP%\_+_esllc.tmp
%TEMP%\_+_yvtze.tmp
%TEMP%\_+_hxvxh.tmp
%TEMP%\_+_ttwej.tmp
%TEMP%\_+_gbrym.tmp
%TEMP%\_+_qmrtz.tmp
%TEMP%\_+_nafku.tmp
%TEMP%\_+_qiyfk.tmp
%TEMP%\_+_lfegn.tmp
%TEMP%\_+_hqoub.tmp
%TEMP%\_+_idbvp.tmp
%TEMP%\_+_rtcin.tmp
%TEMP%\_+_oigep.tmp
%TEMP%\_+_qrpvf.tmp
%TEMP%\_+_hrwvs.tmp
%TEMP%\_+_shxpx.tmp
%TEMP%\_+_detvn.tmp
%TEMP%\_+_lopvo.tmp
%TEMP%\_+_izmpo.tmp
%TEMP%\_+_iczke.tmp
%TEMP%\_+_srlxy.tmp
%TEMP%\_+_byoyz.tmp
%TEMP%\_+_puamd.tmp
%TEMP%\_+_fyrwz.tmp
%TEMP%\_+_ftihr.tmp
%TEMP%\_+_ilmlz.tmp
%TEMP%\_+_sminp.tmp
%TEMP%\_+_grxoa.tmp
%TEMP%\_+_rzvik.tmp
%TEMP%\_+_tqsdk.tmp
%TEMP%\_+_lqija.tmp
%TEMP%\_+_gqwuf.tmp
%TEMP%\_+_uwvjb.tmp

Moves the following files:

from %TEMP%\RCX4F.tmp to %TEMP%\_+_vvuvj.tmp
from %TEMP%\RCX50.tmp to %TEMP%\_+_vvuvj.tmp
from %TEMP%\RCX51.tmp to %TEMP%\_+_moqkj.tmp
from %TEMP%\RCX4E.tmp to %TEMP%\_+_leuia.tmp
from %TEMP%\RCX4B.tmp to %TEMP%\_+_zqrce.tmp
from %TEMP%\RCX4C.tmp to %TEMP%\_+_zqrce.tmp
from %TEMP%\RCX4D.tmp to %TEMP%\_+_leuia.tmp
from %TEMP%\RCX52.tmp to %TEMP%\_+_moqkj.tmp
from %TEMP%\RCX57.tmp to %TEMP%\_+_twmnv.tmp
from %TEMP%\RCX58.tmp to %TEMP%\_+_twmnv.tmp
from %TEMP%\RCX59.tmp to %TEMP%\_+_nqshq.tmp
from %TEMP%\RCX56.tmp to %TEMP%\_+_wztpi.tmp
from %TEMP%\RCX53.tmp to %TEMP%\_+_wusqo.tmp
from %TEMP%\RCX54.tmp to %TEMP%\_+_wusqo.tmp
from %TEMP%\RCX55.tmp to %TEMP%\_+_wztpi.tmp
from %TEMP%\RCX41.tmp to %TEMP%\_+_fhiia.tmp
from %TEMP%\RCX42.tmp to %TEMP%\_+_fhiia.tmp
from %TEMP%\RCX43.tmp to %TEMP%\_+_vmirz.tmp
from %TEMP%\RCX40.tmp to %TEMP%\_+_enrco.tmp
from %TEMP%\RCX3D.tmp to %TEMP%\_+_uqmun.tmp
from %TEMP%\RCX3E.tmp to %TEMP%\_+_uqmun.tmp
from %TEMP%\RCX3F.tmp to %TEMP%\_+_enrco.tmp
from %TEMP%\RCX44.tmp to %TEMP%\_+_vmirz.tmp
from %TEMP%\RCX48.tmp to %TEMP%\_+_qxojy.tmp
from %TEMP%\RCX49.tmp to %TEMP%\_+_qyzyv.tmp
from %TEMP%\RCX4A.tmp to %TEMP%\_+_qyzyv.tmp
from %TEMP%\RCX47.tmp to %TEMP%\_+_qxojy.tmp
from %TEMP%\RCX45.tmp to %TEMP%\_+_pahwe.tmp
from %TEMP%\RCX46.tmp to %TEMP%\_+_pahwe.tmp
from <SYSTEM32>\dllcache\iexplore.exe.new to <SYSTEM32>\dllcache\iexplore.exe
from <SYSTEM32>\dllcache\pinball.exe.new to <SYSTEM32>\dllcache\pinball.exe
from %TEMP%\RCX6B.tmp to %TEMP%\_+_wvfuy.tmp
from %TEMP%\RCX6C.tmp to %TEMP%\_+_wvfuy.tmp
from %TEMP%\RCX6A.tmp to %TEMP%\_+_vtqdm.tmp
from %TEMP%\RCX67.tmp to %TEMP%\_+_xknek.tmp
from %TEMP%\RCX68.tmp to %TEMP%\_+_xknek.tmp
from %TEMP%\RCX69.tmp to %TEMP%\_+_vtqdm.tmp
from %TEMP%\RCX6D.tmp to %TEMP%\_+_etvzq.tmp
from %TEMP%\RCX72.tmp to %TEMP%\_+_ytrde.tmp
from %TEMP%\RCX73.tmp to %TEMP%\_+_ewrnu.tmp
from %TEMP%\RCX74.tmp to %TEMP%\_+_ewrnu.tmp
from %TEMP%\RCX71.tmp to %TEMP%\_+_ytrde.tmp
from %TEMP%\RCX6E.tmp to %TEMP%\_+_etvzq.tmp
from %TEMP%\RCX6F.tmp to %TEMP%\_+_vynum.tmp
from %TEMP%\RCX70.tmp to %TEMP%\_+_vynum.tmp
from %TEMP%\RCX5E.tmp to %TEMP%\_+_ewgtl.tmp
from %TEMP%\RCX5F.tmp to %TEMP%\_+_esllc.tmp
from %TEMP%\RCX60.tmp to %TEMP%\_+_esllc.tmp
from %TEMP%\RCX5D.tmp to %TEMP%\_+_ewgtl.tmp
from %TEMP%\RCX5A.tmp to %TEMP%\_+_nqshq.tmp
from %TEMP%\RCX5B.tmp to %TEMP%\_+_hzxry.tmp
from %TEMP%\RCX5C.tmp to %TEMP%\_+_hzxry.tmp
from %TEMP%\RCX61.tmp to %TEMP%\_+_ttwej.tmp
from %TEMP%\RCX64.tmp to %TEMP%\_+_hxvxh.tmp
from %TEMP%\RCX65.tmp to %TEMP%\_+_yvtze.tmp
from %TEMP%\RCX66.tmp to %TEMP%\_+_yvtze.tmp
from <SYSTEM32>\dllcache\zclientm.exe.new to <SYSTEM32>\dllcache\zclientm.exe
from %TEMP%\RCX62.tmp to %TEMP%\_+_ttwej.tmp
from <SYSTEM32>\dllcache\rvsezm.exe.new to <SYSTEM32>\dllcache\rvsezm.exe
from %TEMP%\RCX63.tmp to %TEMP%\_+_hxvxh.tmp
from %TEMP%\RCX14.tmp to %TEMP%\_+_gbrym.tmp
from %TEMP%\RCX15.tmp to %TEMP%\_+_qiyfk.tmp
from %TEMP%\RCX16.tmp to %TEMP%\_+_qiyfk.tmp
from %TEMP%\RCX13.tmp to %TEMP%\_+_gbrym.tmp
from %TEMP%\RCX10.tmp to %TEMP%\_+_nafku.tmp
from %TEMP%\RCX11.tmp to %TEMP%\_+_qmrtz.tmp
from %TEMP%\RCX12.tmp to %TEMP%\_+_qmrtz.tmp
from %TEMP%\RCX17.tmp to %TEMP%\_+_idbvp.tmp
from %TEMP%\RCX1C.tmp to %TEMP%\_+_lfegn.tmp
from %TEMP%\RCX1D.tmp to %TEMP%\_+_izmpo.tmp
from %TEMP%\RCX1E.tmp to %TEMP%\_+_izmpo.tmp
from %TEMP%\RCX1B.tmp to %TEMP%\_+_lfegn.tmp
from %TEMP%\RCX18.tmp to %TEMP%\_+_idbvp.tmp
from %TEMP%\RCX19.tmp to %TEMP%\_+_hqoub.tmp
from %TEMP%\RCX1A.tmp to %TEMP%\_+_hqoub.tmp
from %TEMP%\RCX5.tmp to %TEMP%\_+_rtcin.tmp
from %TEMP%\RCX6.tmp to %TEMP%\_+_rtcin.tmp
from %TEMP%\RCX7.tmp to %TEMP%\_+_hrwvs.tmp
from %TEMP%\RCX4.tmp to %TEMP%\_+_oigep.tmp
from %TEMP%\RCX1.tmp to %TEMP%\_+_qrpvf.tmp
from %TEMP%\RCX2.tmp to %TEMP%\_+_qrpvf.tmp
from %TEMP%\RCX3.tmp to %TEMP%\_+_oigep.tmp
from %TEMP%\RCX8.tmp to %TEMP%\_+_hrwvs.tmp
from %TEMP%\RCXD.tmp to %TEMP%\_+_shxpx.tmp
from %TEMP%\RCXE.tmp to %TEMP%\_+_shxpx.tmp
from %TEMP%\RCXF.tmp to %TEMP%\_+_nafku.tmp
from %TEMP%\RCXC.tmp to %TEMP%\_+_detvn.tmp
from %TEMP%\RCX9.tmp to %TEMP%\_+_lopvo.tmp
from %TEMP%\RCXA.tmp to %TEMP%\_+_lopvo.tmp
from %TEMP%\RCXB.tmp to %TEMP%\_+_detvn.tmp
from %TEMP%\RCX32.tmp to %TEMP%\_+_iczke.tmp
from %TEMP%\RCX33.tmp to %TEMP%\_+_puamd.tmp
from %TEMP%\RCX34.tmp to %TEMP%\_+_puamd.tmp
from %TEMP%\RCX31.tmp to %TEMP%\_+_iczke.tmp
from %TEMP%\RCX2E.tmp to %TEMP%\_+_byoyz.tmp
from %TEMP%\RCX2F.tmp to %TEMP%\_+_srlxy.tmp
from %TEMP%\RCX30.tmp to %TEMP%\_+_srlxy.tmp
from %TEMP%\RCX35.tmp to %TEMP%\_+_ilmlz.tmp
from %TEMP%\RCX3A.tmp to %TEMP%\_+_fyrwz.tmp
from %TEMP%\RCX3B.tmp to %TEMP%\_+_igdxm.tmp
from %TEMP%\RCX3C.tmp to %TEMP%\_+_igdxm.tmp
from %TEMP%\RCX39.tmp to %TEMP%\_+_fyrwz.tmp
from %TEMP%\RCX36.tmp to %TEMP%\_+_ilmlz.tmp
from %TEMP%\RCX37.tmp to %TEMP%\_+_ftihr.tmp
from %TEMP%\RCX38.tmp to %TEMP%\_+_ftihr.tmp
from %TEMP%\RCX23.tmp to %TEMP%\_+_sminp.tmp
from %TEMP%\RCX24.tmp to %TEMP%\_+_sminp.tmp
from %TEMP%\RCX25.tmp to %TEMP%\_+_tqsdk.tmp
from %TEMP%\RCX22.tmp to %TEMP%\_+_grxoa.tmp
from %TEMP%\RCX1F.tmp to %TEMP%\_+_rzvik.tmp
from %TEMP%\RCX20.tmp to %TEMP%\_+_rzvik.tmp
from %TEMP%\RCX21.tmp to %TEMP%\_+_grxoa.tmp
from %TEMP%\RCX26.tmp to %TEMP%\_+_tqsdk.tmp
from %TEMP%\RCX2B.tmp to %TEMP%\_+_lqija.tmp
from %TEMP%\RCX2C.tmp to %TEMP%\_+_lqija.tmp
from %TEMP%\RCX2D.tmp to %TEMP%\_+_byoyz.tmp
from %TEMP%\RCX2A.tmp to %TEMP%\_+_gqwuf.tmp
from %TEMP%\RCX27.tmp to %TEMP%\_+_uwvjb.tmp
from %TEMP%\RCX28.tmp to %TEMP%\_+_uwvjb.tmp
from %TEMP%\RCX29.tmp to %TEMP%\_+_gqwuf.tmp

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information