Trojan.MulDrop20.30131

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Classes\WinRAR\shell\open\command] '' = '"%ProgramFiles(x86)%\WinRAR\WinRAR.exe" "%1"'
[<HKLM>\Software\Classes\WinRAR.ZIP\shell\open\command] '' = '"%ProgramFiles(x86)%\WinRAR\WinRAR.exe" "%1"'
[<HKLM>\Software\Classes\WinRAR.REV\shell\open\command] '' = '"%ProgramFiles(x86)%\WinRAR\WinRAR.exe" "%1"'

Modifies file system

Creates the following files

%TEMP%\rarsfx0\lng.exe
%APPDATA%\winrar\themes\vista_ultimate_48x48\toolbar\virusscan.bmp
%APPDATA%\winrar\themes\vista rtm (48)\toolbar\virusscan.bmp
%APPDATA%\winrar\themes\token\toolbar\virusscan.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\toolbar\virusscan.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\toolbar\virusscan.bmp
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\virusscan.bmp
%APPDATA%\winrar\themes\winrar_cryo\toolbar\view.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\view.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\view.bmp
%APPDATA%\winrar\themes\windows 7 default\toolbar\view.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\toolbar\view.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\virusscan.bmp
%APPDATA%\winrar\themes\windows 7 default\toolbar\virusscan.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\toolbar\view.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\toolbar\view.bmp
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\view.bmp
%APPDATA%\winrar\themes\winrar_cryo\toolbar\test.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\test.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\test.bmp
%APPDATA%\winrar\themes\windows 7 default\toolbar\test.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\toolbar\test.bmp
%APPDATA%\winrar\themes\vista rtm (48)\toolbar\test.bmp
%APPDATA%\winrar\themes\token\toolbar\test.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\toolbar\test.bmp
%APPDATA%\winrar\themes\vista rtm (48)\toolbar\view.bmp
%APPDATA%\winrar\themes\windows 7 default\dragcopy.cur
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\virusscan.bmp
%APPDATA%\winrar\themes\token\dragcopy.cur
%APPDATA%\winrar\themes\vista rtm (48)\dragcopy.cur
%APPDATA%\winrar\themes\vista rtm (32)\dragcopy.cur
%APPDATA%\winrar\themes\winrar_vista_32x32\dragcopy.cur
%APPDATA%\winrar\themes\winrar_cryo\dragcopy.cur
%APPDATA%\winrar\themes\winrar_vista_32x32\wizardlogo.bmp
%APPDATA%\winrar\themes\winrar_cryo\wizardlogo.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\wizardlogo.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\wizardlogo.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\wizardlogo.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\wizardlogo.bmp
%APPDATA%\winrar\themes\windows 7 default\wizardlogo.bmp
%APPDATA%\winrar\themes\token\wizardlogo.bmp
%APPDATA%\winrar\themes\vista rtm (48)\wizardlogo.bmp
%APPDATA%\winrar\themes\vista rtm (32)\wizardlogo.bmp
%APPDATA%\winrar\themes\winrar_cryo\toolbar\wizard.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\wizard.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\wizard.bmp
%APPDATA%\winrar\themes\windows 7 default\toolbar\wizard.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\toolbar\wizard.bmp
%APPDATA%\winrar\themes\vista rtm (48)\toolbar\wizard.bmp
%APPDATA%\winrar\themes\token\toolbar\wizard.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\toolbar\wizard.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\toolbar\wizard.bmp
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\wizard.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\toolbar\test.bmp
%APPDATA%\winrar\themes\token\toolbar\view.bmp
%APPDATA%\winrar\themes\winrar_cryo\toolbar\virusscan.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\dragcopy.cur
%APPDATA%\winrar\themes\winrar_vista_32x32\sortup.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\report.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\sfx.bmp
%APPDATA%\winrar\themes\windows 7 default\toolbar\sfx.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\toolbar\sfx.bmp
%APPDATA%\winrar\themes\vista rtm (48)\toolbar\sfx.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\toolbar\sfx.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\toolbar\sfx.bmp
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\sfx.bmp
%APPDATA%\winrar\themes\token\toolbar\safari.bmp
%APPDATA%\winrar\themes\winrar_cryo\toolbar\report.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\report.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\sfxlogo.bmp
%APPDATA%\winrar\themes\winrar_cryo\toolbar\sfx.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\sfxlogo.bmp
%APPDATA%\winrar\themes\vista rtm (48)\toolbar\report.bmp
%APPDATA%\winrar\themes\token\toolbar\report.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\toolbar\report.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\toolbar\report.bmp
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\report.bmp
%APPDATA%\winrar\themes\winrar_cryo\toolbar\repair.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\repair.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\repair.bmp
%APPDATA%\winrar\themes\windows 7 default\toolbar\repair.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\toolbar\repair.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\toolbar\report.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\sfxlogo.bmp
%APPDATA%\winrar\themes\windows 7 default\sortup.bmp
%APPDATA%\winrar\themes\winrar_cryo\sortup.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\sfx.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\sortup.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\sortup.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\sortup.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\sortup.bmp
%APPDATA%\winrar\themes\vista rtm (48)\sortup.bmp
%APPDATA%\winrar\themes\vista rtm (32)\sortup.bmp
%APPDATA%\winrar\themes\token\sortup.bmp
%APPDATA%\winrar\themes\winrar_cryo\sortdown.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\sortdown.bmp
%APPDATA%\winrar\themes\windows 7 default\sortdown.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\sortdown.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\sortdown.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\sortdown.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\sortdown.bmp
%APPDATA%\winrar\themes\vista rtm (48)\sortdown.bmp
%APPDATA%\winrar\themes\vista rtm (32)\sortdown.bmp
%APPDATA%\winrar\themes\token\sortdown.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\sfxlogo.bmp
%APPDATA%\winrar\themes\winrar_cryo\sfxlogo.bmp
%APPDATA%\winrar\themes\windows 7 default\sfxlogo.bmp
%APPDATA%\winrar\themes\vista rtm (48)\sfxlogo.bmp
%APPDATA%\winrar\themes\vista rtm (32)\sfxlogo.bmp
%APPDATA%\winrar\themes\token\sfxlogo.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\sfxlogo.bmp
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\test.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\extract.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\dragcopy.cur
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\rev.ico
%APPDATA%\winrar\themes\winrar_cryo\rev.ico
%APPDATA%\winrar\themes\vista_ultimate_48x48\rev.ico
%APPDATA%\winrar\themes\vista rtm (48)\rev.ico
%APPDATA%\winrar\themes\vista rtm (32)\rev.ico
%APPDATA%\winrar\themes\winrar_vistav7_48x48\rar.ico
%APPDATA%\winrar\themes\winrar vistav6 48x48\rar.ico
%APPDATA%\winrar\themes\windows 7 default\rar.ico
%APPDATA%\winrar\themes\token\rar.ico
%APPDATA%\winrar\themes\winrar_cryo\rar.ico
%APPDATA%\winrar\themes\vista_ultimate_48x48\rar.ico
%APPDATA%\winrar\themes\winrar_vista_32x32\rev.ico
%APPDATA%\winrar\themes\token\rev.ico
%APPDATA%\winrar\themes\winrar_vista_32x32\rar.ico
%APPDATA%\winrar\themes\vista rtm (32)\rar.ico
%APPDATA%\winrar\themes\vista_ultimate_48x48\passwordon.ico
%APPDATA%\winrar\themes\vista rtm (48)\passwordon.ico
%APPDATA%\winrar\themes\vista rtm (32)\passwordon.ico
%APPDATA%\winrar\themes\winrar_vistav7_48x48\passwordon.ico
%APPDATA%\winrar\themes\winrar vistav6 48x48\passwordon.ico
%APPDATA%\winrar\themes\windows 7 default\passwordon.ico
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\passwordon.ico
%APPDATA%\winrar\themes\winrar_vista_32x32\passwordon.ico
%APPDATA%\winrar\themes\winrar_cryo\passwordon.ico
%APPDATA%\winrar\themes\vista rtm (48)\rar.ico
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\rar.ico
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\dragcopy.cur
%APPDATA%\winrar\themes\winrar vistav6 48x48\rev.ico
%APPDATA%\winrar\themes\winrar_cryo\tray.ico
%APPDATA%\winrar\themes\winrar_vistav7_48x48\sfx1.ico
%APPDATA%\winrar\themes\winrar vistav6 48x48\sfx1.ico
%APPDATA%\winrar\themes\vista rtm (48)\sfx1.ico
%APPDATA%\winrar\themes\vista rtm (32)\sfx1.ico
%APPDATA%\winrar\themes\windows 7 default\sfx.ico
%APPDATA%\winrar\themes\token\sfx.ico
%APPDATA%\winrar\themes\winrar_cryo\sfx.ico
%APPDATA%\winrar\themes\vista_ultimate_48x48\sfx.ico
%APPDATA%\winrar\themes\winrar_vista_32x32\sfx.ico
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\sfx.ico
%APPDATA%\winrar\themes\vista rtm (48)\sfx.ico
%APPDATA%\winrar\themes\vista rtm (32)\sfx.ico
%APPDATA%\winrar\themes\winrar_cryo\setup.ico
%APPDATA%\winrar\themes\windows 7 default\setup.ico
%APPDATA%\winrar\themes\token\setup.ico
%APPDATA%\winrar\themes\vista_ultimate_48x48\setup.ico
%APPDATA%\winrar\themes\winrar_vista_32x32\setup.ico
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\setup.ico
%APPDATA%\winrar\themes\winrar_vistav7_48x48\setup.ico
%APPDATA%\winrar\themes\winrar vistav6 48x48\setup.ico
%APPDATA%\winrar\themes\vista rtm (48)\setup.ico
%APPDATA%\winrar\themes\vista rtm (32)\setup.ico
%APPDATA%\winrar\themes\winrar_vistav7_48x48\rev.ico
%APPDATA%\winrar\themes\token\passwordon.ico
%APPDATA%\winrar\themes\vista_ultimate_48x48\passwordoff.ico
%APPDATA%\winrar\themes\windows 7 default\rev.ico
%APPDATA%\winrar\themes\vista rtm (48)\passwordoff.ico
%APPDATA%\winrar\themes\vista rtm (32)\passwordoff.ico
%APPDATA%\winrar\themes\vista rtm (48)\diskoff.ico
%APPDATA%\winrar\themes\windows 7 default\toolbar\thumbs.db
%APPDATA%\winrar\themes\winrar_vistav7_48x48\diskoff.ico
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\diskoff.ico
%APPDATA%\winrar\themes\winrar_vista_32x32\diskoff.ico
%APPDATA%\winrar\themes\winrar_cryo\diskoff.ico
%APPDATA%\winrar\themes\winrar vistav6 48x48\diskoff.ico
%APPDATA%\winrar\themes\token\diskoff.ico
%APPDATA%\winrar\themes\winrar_vistav7_48x48\cp 17.ico
%APPDATA%\winrar\themes\winrar vistav6 48x48\cp 17.ico
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\thumbs.db
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\thumbs.db
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\thumbs.db
%APPDATA%\winrar\themes\windows 7 default\thumbs.db
%APPDATA%\winrar\themes\vista rtm (48)\toolbar\repair.bmp
%APPDATA%\winrar\themes\vista rtm (32)\thumbs.db
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\dragno.cur
%APPDATA%\winrar\themes\windows 7 default\dragno.cur
%APPDATA%\winrar\themes\vista_ultimate_48x48\dragno.cur
%APPDATA%\winrar\themes\winrar_vista_32x32\dragno.cur
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\dragmove.cur
%APPDATA%\winrar\themes\windows 7 default\dragmove.cur
%APPDATA%\winrar\themes\vista_ultimate_48x48\dragmove.cur
%APPDATA%\winrar\themes\winrar_vista_32x32\dragmove.cur
%APPDATA%\winrar\themes\winrar_vistav7_48x48\dragcopy.cur
%APPDATA%\winrar\themes\vista_ultimate_48x48\diskoff.ico
%APPDATA%\winrar\themes\windows 7 default\diskoff.ico
%APPDATA%\winrar\themes\windows 7 default\toolbar\report.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\diskon.ico
%APPDATA%\winrar\themes\token\diskon.ico
%APPDATA%\winrar\themes\vista rtm (32)\diskoff.ico
%APPDATA%\winrar\themes\winrar vistav6 48x48\passwordoff.ico
%APPDATA%\winrar\themes\windows 7 default\passwordoff.ico
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\passwordoff.ico
%APPDATA%\winrar\themes\winrar_vista_32x32\passwordoff.ico
%APPDATA%\winrar\themes\winrar_cryo\passwordoff.ico
%APPDATA%\winrar\themes\token\passwordoff.ico
%APPDATA%\winrar\themes\windows 7 default\file.ico
%APPDATA%\winrar\themes\vista_ultimate_48x48\file.ico
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\file.ico
%APPDATA%\winrar\themes\winrar_vistav7_48x48\file.ico
%APPDATA%\winrar\themes\winrar vistav6 48x48\file.ico
%APPDATA%\winrar\themes\token\file.ico
%APPDATA%\winrar\themes\vista rtm (48)\file.ico
%APPDATA%\winrar\themes\vista rtm (32)\file.ico
%APPDATA%\winrar\themes\winrar_vista_32x32\file.ico
%APPDATA%\winrar\themes\winrar_cryo\file.ico
%APPDATA%\winrar\themes\windows 7 default\diskon.ico
%APPDATA%\winrar\themes\vista_ultimate_48x48\diskon.ico
%APPDATA%\winrar\themes\vista rtm (48)\diskon.ico
%APPDATA%\winrar\themes\vista rtm (32)\diskon.ico
%APPDATA%\winrar\themes\winrar_vistav7_48x48\diskon.ico
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\diskon.ico
%APPDATA%\winrar\themes\winrar_vista_32x32\diskon.ico
%APPDATA%\winrar\themes\winrar_cryo\diskon.ico
%APPDATA%\winrar\themes\winrar_vistav7_48x48\passwordoff.ico
%APPDATA%\winrar\themes\token\toolbar\repair.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\toolbar\repair.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\toolbar\repair.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\toolbar\add.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\toolbar\benchmark.bmp
%APPDATA%\winrar\themes\vista rtm (48)\toolbar\benchmark.bmp
%APPDATA%\winrar\themes\token\toolbar\benchmark.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\toolbar\benchmark.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\toolbar\benchmark.bmp
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\benchmark.bmp
%APPDATA%\winrar\themes\winrar_cryo\toolbar\add.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\add.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\add.bmp
%APPDATA%\winrar\themes\windows 7 default\toolbar\add.bmp
%APPDATA%\winrar\themes\winrar_cryo\toolbar\benchmrk.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\benchmark.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\benchmark.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\toolbar\add.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\toolbar\add.bmp
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\add.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\aboutlogo.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\aboutlogo.bmp
%APPDATA%\winrar\themes\winrar_cryo\aboutlogo.bmp
%APPDATA%\winrar\themes\token\aboutlogo.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\aboutlogo.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\aboutlogo.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\aboutlogo.bmp
%APPDATA%\winrar\themes\token\toolbar\add.bmp
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\comment.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\toolbar\delete.bmp
%APPDATA%\winrar\themes\windows 7 default\aboutlogo.bmp
%APPDATA%\winrar\themes\vista rtm (32)\aboutlogo.bmp
%APPDATA%\winrar\themes\vista rtm (48)\toolbar\delete.bmp
%APPDATA%\winrar\themes\token\toolbar\delete.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\toolbar\delete.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\toolbar\delete.bmp
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\delete.bmp
%APPDATA%\winrar\themes\winrar_cryo\toolbar\convert.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\convert.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\convert.bmp
%APPDATA%\winrar\themes\windows 7 default\toolbar\convert.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\toolbar\convert.bmp
%APPDATA%\winrar\themes\vista rtm (48)\toolbar\convert.bmp
%APPDATA%\winrar\themes\token\toolbar\convert.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\toolbar\convert.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\toolbar\convert.bmp
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\convert.bmp
%APPDATA%\winrar\themes\winrar_cryo\toolbar\comment.bmp
%APPDATA%\winrar\themes\windows 7 default\toolbar\comment.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\comment.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\comment.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\toolbar\comment.bmp
%APPDATA%\winrar\themes\vista rtm (48)\toolbar\comment.bmp
%APPDATA%\winrar\themes\token\toolbar\comment.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\toolbar\comment.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\toolbar\comment.bmp
%APPDATA%\winrar\themes\vista rtm (48)\toolbar\add.bmp
%APPDATA%\winrar\themes\vista rtm (48)\aboutlogo.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\winrar_theme_description.txt
%ProgramFiles(x86)%\winrar\formats\gz.fmt
%ProgramFiles(x86)%\winrar\uninstall.lst
%ProgramFiles(x86)%\winrar\formats\ace.fmt
%ProgramFiles(x86)%\winrar\formats\7z.fmt
%ProgramFiles(x86)%\winrar\winrar.chm
%ProgramFiles(x86)%\winrar\formats\unacev2.dll
%ProgramFiles(x86)%\winrar\rarext64.dll
%ProgramFiles(x86)%\winrar\rarext.dll
%ProgramFiles(x86)%\winrar\formats\7zxa.dll
%ProgramFiles(x86)%\winrar\winrar.exe
%ProgramFiles(x86)%\winrar\unrar.exe
%ProgramFiles(x86)%\winrar\uninstall.exe
%ProgramFiles(x86)%\winrar\rar.exe
%ProgramFiles(x86)%\winrar\rarfiles.lst
%ProgramFiles(x86)%\winrar\formats\bz2.fmt
%ProgramFiles(x86)%\winrar\order.htm
%ProgramFiles(x86)%\winrar\whatsnew.txt
%ProgramFiles(x86)%\winrar\unrarsrc.txt
%ProgramFiles(x86)%\winrar\technote.txt
%ProgramFiles(x86)%\winrar\readme.txt
%ProgramFiles(x86)%\winrar\rar.txt
%ProgramFiles(x86)%\winrar\license.txt
%ProgramFiles(x86)%\winrar\descript.ion
%ProgramFiles(x86)%\winrar\file_id.diz
%TEMP%\rarsfx0\wrar401b1.exe
%TEMP%\rarsfx0\themes.exe
%APPDATA%\winrar\themes\windows 7 default\toolbar\delete.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\extra\-.-.-.+.+.pkuwyc's.homepage.+.+.-.-.-.url
%ProgramFiles(x86)%\winrar\formats\cab.fmt
%ProgramFiles(x86)%\winrar\formats\lzh.fmt
%ProgramFiles(x86)%\winrar\formats\arj.fmt
%APPDATA%\winrar\themes\winrar_cryo\winrar_theme_description.txt
%APPDATA%\winrar\themes\winrar_vista_32x32\winrar_theme_description.txt
%APPDATA%\winrar\themes\vista rtm (48)\winrar_theme_description.txt
%APPDATA%\winrar\themes\vista rtm (32)\winrar_theme_description.txt
%APPDATA%\winrar\themes\windows 7 default\winrar_theme_description.txt
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\winrar_theme_description.txt
%APPDATA%\winrar\themes\winrar_vistav7_48x48\winrar_theme_description.txt
%APPDATA%\winrar\themes\winrar vistav6 48x48\winrar_theme_description.txt
%APPDATA%\winrar\themes\token\winrar_theme_description.txt
%APPDATA%\winrar\themes\winrar_vista_32x32\readme_english_by_pkuwyc.txt
%APPDATA%\winrar\themes\winrar_vista_32x32\readme_简体中文_by_pkuwyc.txt
%ProgramFiles(x86)%\winrar\rarreg.key
%ProgramFiles(x86)%\winrar\winrar.lng
%ProgramFiles(x86)%\winrar\uninstall.lng
%ProgramFiles(x86)%\winrar\rarext.lng
%ProgramFiles(x86)%\winrar\rar.lng
%ProgramFiles(x86)%\winrar\zipnew.dat
%ProgramFiles(x86)%\winrar\rarnew.dat
%ProgramFiles(x86)%\winrar\zip.sfx
%ProgramFiles(x86)%\winrar\wincon.sfx
%ProgramFiles(x86)%\winrar\default.sfx
%ProgramFiles(x86)%\winrar\formats\z.fmt
%ProgramFiles(x86)%\winrar\formats\uue.fmt
%ProgramFiles(x86)%\winrar\formats\tar.fmt
%ProgramFiles(x86)%\winrar\formats\iso.fmt
%APPDATA%\winrar\themes\winrar_vista_32x32\tray.ico
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\delete.bmp
%APPDATA%\winrar\themes\token\estimate.bmp
%APPDATA%\winrar\themes\token\toolbar\print.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\toolbar\print.bmp
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\print.bmp
%APPDATA%\winrar\themes\winrar_cryo\toolbar\lock.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\lock.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\lock.bmp
%APPDATA%\winrar\themes\windows 7 default\toolbar\lock.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\toolbar\lock.bmp
%APPDATA%\winrar\themes\vista rtm (48)\toolbar\lock.bmp
%APPDATA%\winrar\themes\token\toolbar\lock.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\toolbar\lock.bmp
%APPDATA%\winrar\themes\windows 7 default\toolbar\benchmark.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\toolbar\lock.bmp
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\lock.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\info.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\info.bmp
%APPDATA%\winrar\themes\windows 7 default\toolbar\info.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\toolbar\info.bmp
%APPDATA%\winrar\themes\vista rtm (48)\toolbar\info.bmp
%APPDATA%\winrar\themes\token\toolbar\info.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\toolbar\info.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\toolbar\info.bmp
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\info.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\folderup.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\toolbar\print.bmp
%APPDATA%\winrar\themes\vista rtm (48)\toolbar\print.bmp
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\repair.bmp
%APPDATA%\winrar\themes\windows 7 default\folderup.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\toolbar\print.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\rarsmall.bmp
%APPDATA%\winrar\themes\winrar_cryo\rarsmall.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\rarsmall.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\rarsmall.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\rarsmall.bmp
%APPDATA%\winrar\themes\vista rtm (48)\rarsmall.bmp
%APPDATA%\winrar\themes\vista rtm (32)\rarsmall.bmp
%APPDATA%\winrar\themes\windows 7 default\rarsmall.bmp
%APPDATA%\winrar\themes\token\rarsmall.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\rarsmall.bmp
%APPDATA%\winrar\themes\winrar_cryo\toolbar\protect.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\protect.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\protect.bmp
%APPDATA%\winrar\themes\windows 7 default\toolbar\protect.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\toolbar\protect.bmp
%APPDATA%\winrar\themes\vista rtm (48)\toolbar\protect.bmp
%APPDATA%\winrar\themes\token\toolbar\protect.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\toolbar\protect.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\toolbar\protect.bmp
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\protect.bmp
%APPDATA%\winrar\themes\winrar_cryo\toolbar\print.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\print.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\print.bmp
%APPDATA%\winrar\themes\windows 7 default\toolbar\print.bmp
%APPDATA%\winrar\themes\winrar_cryo\folderup.bmp
%APPDATA%\winrar\themes\winrar_cryo\toolbar\info.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\folderup.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\folderup.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\delete.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\toolbar\exit.bmp
%APPDATA%\winrar\themes\token\toolbar\extract.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\toolbar\extract.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\toolbar\extract.bmp
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\extract.bmp
%APPDATA%\winrar\themes\winrar_cryo\toolbar\exit.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\exit.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\exit.bmp
%APPDATA%\winrar\themes\windows 7 default\toolbar\exit.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\toolbar\exit.bmp
%APPDATA%\winrar\themes\vista rtm (48)\toolbar\exit.bmp
%APPDATA%\winrar\themes\token\toolbar\exit.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\toolbar\exit.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\toolbar\extract.bmp
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\exit.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\estimate.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\estimate.bmp
%APPDATA%\winrar\themes\winrar_cryo\estimate.bmp
%APPDATA%\winrar\themes\vista rtm (48)\estimate.bmp
%APPDATA%\winrar\themes\vista rtm (32)\estimate.bmp
%APPDATA%\winrar\themes\windows 7 default\estimate.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\estimate.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\estimate.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\estimate.bmp
%APPDATA%\winrar\themes\windows 7 default\toolbar\extract.bmp
%APPDATA%\winrar\themes\winrar_cryo\toolbar\delete.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\extract.bmp
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\extractto.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\folderup.bmp
%APPDATA%\winrar\themes\vista rtm (48)\toolbar\extract.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\folderup.bmp
%APPDATA%\winrar\themes\vista rtm (48)\folderup.bmp
%APPDATA%\winrar\themes\vista rtm (32)\folderup.bmp
%APPDATA%\winrar\themes\token\folderup.bmp
%APPDATA%\winrar\themes\winrar_cryo\toolbar\find.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\find.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\find.bmp
%APPDATA%\winrar\themes\windows 7 default\toolbar\find.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\toolbar\find.bmp
%APPDATA%\winrar\themes\vista rtm (48)\toolbar\find.bmp
%APPDATA%\winrar\themes\token\toolbar\find.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\toolbar\find.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\toolbar\find.bmp
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\find.bmp
%APPDATA%\winrar\themes\winrar_cryo\toolbar\extractto.bmp
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\extractto.bmp
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\extractto.bmp
%APPDATA%\winrar\themes\windows 7 default\toolbar\extractto.bmp
%APPDATA%\winrar\themes\vista_ultimate_48x48\toolbar\extractto.bmp
%APPDATA%\winrar\themes\vista rtm (48)\toolbar\extractto.bmp
%APPDATA%\winrar\themes\token\toolbar\extractto.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\toolbar\extractto.bmp
%APPDATA%\winrar\themes\winrar_vista_mx_32x32\toolbar\extractto.bmp
%APPDATA%\winrar\themes\winrar_cryo\toolbar\extract.bmp
%APPDATA%\winrar\themes\winrar_vista_32x32\extra\-.-.-.+.+.pkuwyc.@.deviantart.+.+.-.-.-.url

Sets the 'hidden' attribute to the following files

%APPDATA%\winrar\themes\winrar_vista_mx_32x32\winrar_theme_description.txt
%APPDATA%\winrar\themes\vista rtm (32)\thumbs.db
%APPDATA%\winrar\themes\windows 7 default\thumbs.db
%APPDATA%\winrar\themes\windows 7 default\toolbar\thumbs.db
%APPDATA%\winrar\themes\vista rtm (32)\toolbar\thumbs.db
%APPDATA%\winrar\themes\winrar vistav6 48x48\toolbar\thumbs.db
%APPDATA%\winrar\themes\winrar_vistav7_48x48\toolbar\thumbs.db

Deletes the following files

%TEMP%\rarsfx0\lng.exe
%TEMP%\rarsfx0\themes.exe
%TEMP%\rarsfx0\wrar401b1.exe

Substitutes the following files

%APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk
%APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk
%APPDATA%\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk
%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'%TEMP%\rarsfx0\wrar401b1.exe' /s
'%ProgramFiles(x86)%\winrar\uninstall.exe' /setup
'%TEMP%\rarsfx0\lng.exe'
'%TEMP%\rarsfx0\themes.exe'

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial