Trojan.Inject1.35939

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Skype' = '"%APPDATA%\Skype\Phone\Skype.exe" /nosplash /minimized'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\systeminfo.exe'

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Skype\Phone\Skype.exe
%APPDATA%\Microsoft\Sze\hqhmp

Самоудаляется.

Другое:

Ищет следующие окна:

ClassName: 'EV_MMAC_SUPPORTED' WindowName: 'STATUS_DS_INVALIVED-125[Hz]= %C '
ClassName: 'AGC Error ite RENT_NODE ' WindowName: 'EV_MMAC_OID_802TE - %d) '
ClassName: 'STATUS_PLUGPLAYED NO SIGNMENT_UND' WindowName: 'START'
ClassName: 'EV_MMAC_SUPPORTED' WindowName: 'EV_MMAC_OID_802TE - %d) '
ClassName: 'E_MANY whiled at %d ' WindowName: 'FxUsbPipe %d is Logical Quick ton'
ClassName: 'Tx_Info ' WindowName: 'STATUS_CONNECT'
ClassName: 'STATUS_PLUGPLAYED NO SIGNMENT_UND' WindowName: 'STATUS_INODE_BLOCALL_HAP_SHUTDOWN_ROAM_SISO_20M - Illegal ModuceRX'
ClassName: 'TxUP_ALID_802_3_WAIT' WindowName: 'STATUS_PLUGPLAYED NO SIGNMENT_UND'
ClassName: 'AGC Error ite RENT_NODE ' WindowName: 'RPC_NT_RAD_IWLAN_TGH_TIMER '
ClassName: 'START' WindowName: 'AGC Error ite RENT_NODE '
ClassName: 'Tx_Info ' WindowName: 'AGC Error ite RENT_NODE '
ClassName: 'STATUS_PLUGPLAYED NO SIGNMENT_UND' WindowName: 'STATUS_SBARD_PROTOCOLL_ZERO'
ClassName: 'AGC Error ite RENT_NODE ' WindowName: 'START'
ClassName: 'STATUS_INODE_BLOCALL_HAP_SHUTDOWN_ROAM_SISO_20M - Illegal ModuceRX' WindowName: 'STATUS_INODE_BLOCALL_HAP_SHUTDOWN_ROAM_SISO_20M - Illegal ModuceRX'
ClassName: 'STATUS_CONNECT' WindowName: 'STATUS_INODE_BLOCALL_HAP_SHUTDOWN_ROAM_SISO_20M - Illegal ModuceRX'
ClassName: 'RPC_NT_RAD_IWLAN_TGH_TIMER ' WindowName: 'Skipped pole'
ClassName: 'STATUS_CONNECT' WindowName: 'Fifo: PTER_TIMEOUT'
ClassName: 'STATUS_SBARD_PROTOCOLL_ZERO' WindowName: 'TxUP_ALID_802_3_WAIT'
ClassName: 'Fifo: PTER_TIMEOUT' WindowName: 'Fifo: PTER_TIMEOUT'
ClassName: 'RPC_NT_RAD_IWLAN_TGH_TIMER ' WindowName: 'START'
ClassName: 'AGC Error ite RENT_NODE ' WindowName: 'No small '
ClassName: 'Fifo: PTER_TIMEOUT' WindowName: 'AGC Error ite RENT_NODE '
ClassName: 'No small ' WindowName: 'STATUS_INODE_BLOCALL_HAP_SHUTDOWN_ROAM_SISO_20M - Illegal ModuceRX'
ClassName: 'Indicator' WindowName: '(null)'
ClassName: 'SHADOW_RAD_DOT11_QOS_DOMAIN TX' WindowName: 'No small '
ClassName: 'STATUS_PLUGPLAYED NO SIGNMENT_UND' WindowName: 'No small '
ClassName: 'Rx DelRetreams ' WindowName: 'RegPath}\UninstrolSet\Session '
ClassName: 'EV_MMAC_OID_STATUS_ADDR' WindowName: 'AGC Error ite RENT_NODE '
ClassName: 'STATUS_PLUGPLAYED NO SIGNMENT_UND' WindowName: 'STACK_INVALID_IMART'
ClassName: 'START' WindowName: 'STATUS_INODE_BLOCALL_HAP_SHUTDOWN_ROAM_SISO_20M - Illegal ModuceRX'
ClassName: 'START' WindowName: 'START'
ClassName: 'START' WindowName: 'Monit 1998'
ClassName: 'EV_MMAC_SUPPORTED' WindowName: 'AGC Error ite RENT_NODE '
ClassName: 'UNI vected ' WindowName: 'STACK_INVALID_IMART'
ClassName: 'STATUS_SBARD_PROTOCOLL_ZERO' WindowName: 'Tx_Info '
ClassName: 'AGC Error ite RENT_NODE ' WindowName: 'AGC Error ite RENT_NODE '
ClassName: 'STATUS_SBARD_PROTOCOLL_ZERO' WindowName: 'AGC Error ite RENT_NODE '
ClassName: 'RPC_NT_RAD_IWLAN_TGH_TIMER ' WindowName: 'STATUS_INODE_BLOCALL_HAP_SHUTDOWN_ROAM_SISO_20M - Illegal ModuceRX'
ClassName: 'STATUS_SBARD_PROTOCOLL_ZERO' WindowName: 'VESA DMT'
ClassName: 'UNI vected ' WindowName: 'STATUS_PLUGPLAYED NO SIGNMENT_UND'
ClassName: 'Monit 1998' WindowName: 'RegPath}\UninstrolSet\Session '
ClassName: 'STATUS_ABOR_TERS_PATH_SWITCHDOG' WindowName: 'START'
ClassName: 'PNP0C01' WindowName: 'Min_dB = %d %d Tone/Tx/Rated plex succes operation %f dB '
ClassName: 'STATUS_PLUGPLAYED NO SIGNMENT_UND' WindowName: 'SHADOW_RAD_DOT11_QOS_DOMAIN TX'
ClassName: 'RegPath}\UninstrolSet\Session ' WindowName: 'STATUS_DS_INVALIVED-125[Hz]= %C '
ClassName: 'AGC Error ite RENT_NODE ' WindowName: 'Speake Tx Descmd'
ClassName: 'CRADIO_OFF' WindowName: 'RPC_NT_ATION_FILED'
ClassName: 'CRADIO_OFF' WindowName: 'CRADIO_OFF'
ClassName: 'Rx DelRetreams ' WindowName: 'No small '
ClassName: 'Tx_Info ' WindowName: 'STATUS_ABOR_TERS_PATH_SWITCHDOG'
ClassName: 'STATUS_INODE_BLOCALL_HAP_SHUTDOWN_ROAM_SISO_20M - Illegal ModuceRX' WindowName: 'AGC Error ite RENT_NODE '
ClassName: 'Tx_Info ' WindowName: 'FxUsbPipe %d is Logical Quick ton'
ClassName: 'SHADOW_RAD_DOT11_QOS_DOMAIN TX' WindowName: 'PNP0C01'
ClassName: 'Rx: RxLevent' WindowName: 'VESA DMT'
ClassName: 'Tx_Info ' WindowName: 'START'
ClassName: 'STATUS_PLUGPLAYED NO SIGNMENT_UND' WindowName: 'RPC_NT_RAD_IWLAN_TGH_TIMER '
ClassName: 'AGC Error ite RENT_NODE ' WindowName: 'Min_dB = %d %d Tone/Tx/Rated plex succes operation %f dB '
ClassName: 'RPC_NT_RAD_IWLAN_TGH_TIMER ' WindowName: 'No small '
ClassName: 'UNI vected ' WindowName: 'AGC Error ite RENT_NODE '
ClassName: 'RegPath}\UninstrolSet\Session ' WindowName: 'STATUS_SBARD_PROTOCOLL_ZERO'
ClassName: 'SHADOW_RAD_DOT11_QOS_DOMAIN TX' WindowName: 'AGC Error ite RENT_NODE '
ClassName: 'Rx DelRetreams ' WindowName: 'Speake Tx Descmd'
ClassName: 'AGC Error ite RENT_NODE ' WindowName: 'SHADOW_RAD_DOT11_QOS_DOMAIN TX'
ClassName: 'AGC Error ite RENT_NODE ' WindowName: 'STATUS_DS_INVALIVED-125[Hz]= %C '
ClassName: 'STACK_INVALID_IMART' WindowName: 'RPC_NT_ATION_FILED'
ClassName: 'Rx DelRetreams ' WindowName: 'AGC Error ite RENT_NODE '
ClassName: 'E_MANY whiled at %d ' WindowName: 'STACK_INVALID_IMART'
ClassName: 'SHADOW_RAD_DOT11_QOS_DOMAIN TX' WindowName: 'Speake Tx Descmd'
ClassName: 'AGC Error ite RENT_NODE ' WindowName: 'Rx: RxLevent'
ClassName: 'D3 State %d %d) !!!!!!! T:%d' WindowName: 'AGC Error ite RENT_NODE '