Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Hardlock] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%CommonProgramFiles%\FTR Shared\MISC\hinstall.exe' -i
Изменения в файловой системе:
Создает следующие файлы:
- %CommonProgramFiles%\FTR Shared\SVLCMD\OLDSVLX.DLL
- %CommonProgramFiles%\FTR Shared\SVLCMD\SVPXCMD.SVP
- %CommonProgramFiles%\FTR Shared\PLOTTER\PLTOYO.DLL
- %CommonProgramFiles%\FTR Shared\SVLCMD\SVLXCMD.DLL
- %TEMP%\0pdc.txt
- %WINDIR%\aksdrvsetup.log
- %TEMP%\haspds_windows.dll
- %TEMP%\hhl01.cab
- %CommonProgramFiles%\FTR Shared\PLOTTER\PLGRAPHT.DLL
- %CommonProgramFiles%\FTR Shared\PLOTTER\PLHPGL.DLL
- %CommonProgramFiles%\FTR Shared\PLOTTER\PLSKT.DLL
- %CommonProgramFiles%\FTR Shared\PLOTTER\PLDSCAN.dll
- %CommonProgramFiles%\FTR Shared\PLOTTER\PLMUTO.DLL
- %CommonProgramFiles%\FTR Shared\PLOTTER\PLCALCMP.DLL
- %CommonProgramFiles%\FTR Shared\PLOTTER\PLHPGL2.DLL
- %CommonProgramFiles%\FTR Shared\PLOTTER\PLIWATU.DLL
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- %WINDIR%\inf\oem3.inf
- <SYSTEM32>\Setup\aladdin\hasphl\hardlock.sys
- <DRIVERS>\hardlock.sys
- %WINDIR%\inf\oem4.inf
- %WINDIR%\inf\oem4.PNF
- %WINDIR%\inf\oem3.PNF
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT
- <SYSTEM32>\Setup\aladdin\hasphl\akshasp.cat
- <SYSTEM32>\Setup\aladdin\hasphl\akshasp.inf
- <SYSTEM32>\Setup\aladdin\hasphl\aksclass.sys
- <SYSTEM32>\Setup\aladdin\hasphl\akscoinst.dll
- <SYSTEM32>\Setup\aladdin\hasphl\aksusb.inf
- <SYSTEM32>\Setup\aladdin\hasphl\aksusb.sys
- <SYSTEM32>\Setup\aladdin\hasphl\akshasp.sys
- <SYSTEM32>\Setup\aladdin\hasphl\aksusb.cat
- %CommonProgramFiles%\FTR Shared\OTHERCAD\DWG.dll
- %CommonProgramFiles%\FTR Shared\FTRENGIN\FTRBX.DLL
- %CommonProgramFiles%\FTR Shared\FTRENGIN\FTRCX.dll
- %CommonProgramFiles%\FTR Shared\MISC\hinstall.exe
- %CommonProgramFiles%\FTR Shared\FTRENGIN\SDC.DLL
- %CommonProgramFiles%\FTR Shared\FTRENGIN\PrnFTR.exe
- %CommonProgramFiles%\FTR Shared\FTRENGIN\JVEC31.DLL
- %CommonProgramFiles%\FTR Shared\FTRENGIN\SDL.DLL
- %CommonProgramFiles%\FTR Shared\FTRENGIN\JVEC12x14.DLL
- %CommonProgramFiles%\FTR Shared\OTHERCAD\common_lib.dll
- %CommonProgramFiles%\FTR Shared\OTHERCAD\DConvertCon.exe
- %CommonProgramFiles%\FTR Shared\OTHERCAD\simplex.shx
- %CommonProgramFiles%\FTR Shared\OTHERCAD\common_lib_AP202.dll
- %CommonProgramFiles%\FTR Shared\OTHERCAD\bigfont.shx
- %CommonProgramFiles%\FTR Shared\OTHERCAD\adinit.dat
- %CommonProgramFiles%\FTR Shared\OTHERCAD\txt.shx
- %CommonProgramFiles%\FTR Shared\OTHERCAD\extfont.shx
- %CommonProgramFiles%\FTR Shared\OLDCAD\READF4.DLL
- %CommonProgramFiles%\FTR Shared\OTHERCAD\JWC.dll
- %CommonProgramFiles%\FTR Shared\OLDCAD\READDOS.DLL
- %CommonProgramFiles%\FTR Shared\OLDCAD\READF3.DLL
- %CommonProgramFiles%\FTR Shared\OTHERCAD\SXF_.dll
- %CommonProgramFiles%\FTR Shared\OTHERCAD\DXF.dll
- %CommonProgramFiles%\FTR Shared\OTHERCAD\SXF.dll
- %CommonProgramFiles%\FTR Shared\OTHERCAD\JWW.dll
- %CommonProgramFiles%\FTR Shared\FTRENGIN\FUTURE.DLL
- %CommonProgramFiles%\FTR Shared\FTRENGIN\PrnFTR.tlb
- %CommonProgramFiles%\FTR Shared\FTRENGIN\FUNC.dll
- %CommonProgramFiles%\FTR Shared\FTRENGIN\FTRSX.dll
- %CommonProgramFiles%\FTR Shared\MISC\AdjustJ.dll
- %CommonProgramFiles%\FTR Shared\OLDCAD\READF2.DLL
- %CommonProgramFiles%\FTR Shared\FTRENGIN\FUNCA.dll
- %CommonProgramFiles%\FTR Shared\FTRENGIN\Cyotto.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
Удаляет следующие файлы:
- %TEMP%\hhl01.cab
- %TEMP%\0pdc.txt
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
