Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'lsass' = '<SYSTEM32>\lsass.exe'
Создает или изменяет следующие файлы:
- %WINDIR%\Tasks.exe
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\twain_32.exe
- %WINDIR%\twain.dll.exe
- %WINDIR%\twain_32.dll.exe
- %WINDIR%\twunk_32.exe.exe
- %WINDIR%\twunk_16.exe.exe
- %WINDIR%\tabletoc.log.exe
- <SYSTEM32>.exe
- %WINDIR%\TASKMAN.EXE.exe
- %WINDIR%\tsoc.log.exe
- %WINDIR%\Temp.exe
- %WINDIR%\win.ini.exe
- %WINDIR%\wiaservc.log.exe
- %WINDIR%\WINDOWS.exe.exe
- %WINDIR%\WindowsUpdate.log.exe
- %WINDIR%\WindowsShell.Manifest.exe
- %WINDIR%\vbaddin.ini.exe
- %WINDIR%\vb.ini.exe
- %WINDIR%\vmmreg32.dll.exe
- %WINDIR%\wiadebug.log.exe
- %WINDIR%\Web.exe
- %WINDIR%\system.ini.exe
- %WINDIR%\SET4.tmp.exe
- %WINDIR%\SET3.tmp.exe
- %WINDIR%\SET8.tmp.exe
- %WINDIR%\setupapi.log.exe
- %WINDIR%\setupact.log.exe
- %WINDIR%\Santa Fe Stucco.bmp.exe
- %WINDIR%\River Sumida.bmp.exe
- %WINDIR%\SchedLgU.Txt.exe
- %WINDIR%\sessmgr.setup.log.exe
- %WINDIR%\security.exe
- %WINDIR%\spupdsvc.log.exe
- %WINDIR%\SoftwareDistribution.exe
- %WINDIR%\srchasst.exe
- %WINDIR%\system.exe
- %WINDIR%\Sti_Trace.log.exe
- %WINDIR%\setuplog.txt.exe
- %WINDIR%\setuperr.log.exe
- %WINDIR%\sfk.exe.exe
- %WINDIR%\Soap Bubbles.bmp.exe
- %WINDIR%\sleep.exe.exe
- %WINDIR%\Cursors.exe.exe
- %WINDIR%\control.ini.exe.exe
- %WINDIR%\Debug.exe.exe
- %WINDIR%\Downloaded Program Files.exe.exe
- %WINDIR%\desktop.ini.exe.exe
- %WINDIR%\Coffee Bean.bmp.exe.exe
- %WINDIR%\cmsetacl.log.exe.exe
- %WINDIR%\comsetup.log.exe.exe
- %WINDIR%\Connection Wizard.exe.exe
- %WINDIR%\Config.exe.exe
- %WINDIR%\FeatherTexture.bmp.exe.exe
- %WINDIR%\FaxSetup.log.exe.exe
- %WINDIR%\Fonts.exe.exe
- %WINDIR%\Greenstone.bmp.exe.exe
- %WINDIR%\Gone Fishing.bmp.exe.exe
- %WINDIR%\DtcInstall.log.exe.exe
- %WINDIR%\Driver Cache.exe.exe
- %WINDIR%\ehome.exe.exe
- %WINDIR%\explorer.scf.exe.exe
- %WINDIR%\explorer.exe.exe.exe
- %WINDIR%\clock.avi.exe.exe
- %WINDIR%\WMSysPr9.prx.exe
- %WINDIR%\wmsetup.log.exe
- %WINDIR%\<Служебное имя>.exe
- %WINDIR%\_default.pif.exe
- %WINDIR%\Zapotec.bmp.exe
- %WINDIR%\winhlp32.exe.exe
- %WINDIR%\winhelp.exe.exe
- %WINDIR%\winnt.bmp.exe
- %WINDIR%\WinSxS.exe
- %WINDIR%\winnt256.bmp.exe
- %WINDIR%\AppPatch.exe.exe
- %WINDIR%\addins.exe.exe
- %WINDIR%\assembly.exe.exe
- %WINDIR%\bootstat.dat.exe.exe
- %WINDIR%\Blue Lace 16.bmp.exe.exe
- %WINDIR%\$NtUninstallWIC$.exe.exe
- %WINDIR%\$MSI31Uninstall_KB893803v2$.exe.exe
- %WINDIR%\...exe.exe
- %WINDIR%\0.log.exe.exe
- %WINDIR%\..exe.exe.exe
- %WINDIR%\Rhododendron.bmp.exe
- %WINDIR%\Debug.exe
- %WINDIR%\Cursors.exe
- %WINDIR%\desktop.ini.exe
- %WINDIR%\Driver Cache.exe
- %WINDIR%\Downloaded Program Files.exe
- %WINDIR%\comsetup.log.exe
- %WINDIR%\Coffee Bean.bmp.exe
- %WINDIR%\Config.exe
- %WINDIR%\control.ini.exe
- %WINDIR%\Connection Wizard.exe
- %WINDIR%\Fonts.exe
- %WINDIR%\FeatherTexture.bmp.exe
- %WINDIR%\Gone Fishing.bmp.exe
- %WINDIR%\Help.exe
- %WINDIR%\Greenstone.bmp.exe
- %WINDIR%\ehome.exe
- %WINDIR%\DtcInstall.log.exe
- %WINDIR%\explorer.exe.exe
- %WINDIR%\FaxSetup.log.exe
- %WINDIR%\explorer.scf.exe
- %WINDIR%\cmsetacl.log.exe
- <Текущая директория>\..exe
- %WINDIR%\WINDOWS.exe
- C:\...exe
- %WINDIR%\...exe
- %WINDIR%\..exe
- C:\Documents and Settings\Documents and Settings.exe
- <Текущая директория>\af32d3b0.exe
- <Служебный элемент>
- C:\RECYCLER\RECYCLER.exe
- %PROGRAM_FILES%\Program Files.exe
- %WINDIR%\assembly.exe
- %WINDIR%\AppPatch.exe
- %WINDIR%\Blue Lace 16.bmp.exe
- %WINDIR%\clock.avi.exe
- %WINDIR%\bootstat.dat.exe
- %WINDIR%\$NtUninstallWIC$.exe
- %WINDIR%\$MSI31Uninstall_KB893803v2$.exe
- %WINDIR%\..exe.exe
- %WINDIR%\addins.exe
- %WINDIR%\0.log.exe
- %WINDIR%\Offline Web Pages.exe
- %WINDIR%\OEWABLog.txt.exe
- %WINDIR%\oobeact.log.exe
- %WINDIR%\PeerNet.exe
- %WINDIR%\pchealth.exe
- %WINDIR%\ocgen.log.exe
- %WINDIR%\ntdtcsetup.log.exe
- %WINDIR%\ocmsn.log.exe
- %WINDIR%\OemDir.exe
- %WINDIR%\ODBCINST.INI.exe
- %WINDIR%\REGLOCS.OLD.exe
- %WINDIR%\Registration.exe
- %WINDIR%\regopt.log.exe
- %WINDIR%\Resources.exe
- %WINDIR%\repair.exe
- %WINDIR%\Prefetch.exe
- %WINDIR%\Prairie Wind.bmp.exe
- %WINDIR%\Provisioning.exe
- %WINDIR%\regedit.exe.exe
- %WINDIR%\pss.exe
- %WINDIR%\nsreg.dat.exe
- %WINDIR%\Installer.exe
- %WINDIR%\inf.exe
- %WINDIR%\java.exe
- %WINDIR%\MedCtrOC.log.exe
- %WINDIR%\KB893803v2.log.exe
- %WINDIR%\iis6.log.exe
- %WINDIR%\hh.exe.exe
- %WINDIR%\ime.exe
- %WINDIR%\imsins.log.exe
- %WINDIR%\imsins.BAK.exe
- %WINDIR%\msmqinst.log.exe
- %WINDIR%\msgsocm.log.exe
- %WINDIR%\mui.exe
- %WINDIR%\NOTEPAD.EXE.exe
- %WINDIR%\netfxocm.log.exe
- %WINDIR%\Microsoft.NET.exe
- %WINDIR%\Media.exe
- %WINDIR%\msagent.exe
- %WINDIR%\msdfmap.ini.exe
- %WINDIR%\msapps.exe
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'Indicator' WindowName: ''
