Trojan.KillFiles.7761

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%WINDIR%\svdost.exe -HideWindow
%WINDIR%\svcost.exe -HideWindow

Запускает на исполнение:

<SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVerson\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
<SYSTEM32>\cmd.exe /c ""%TEMP%\2.tmp\svcost.bat" "-HideWindow" "
<SYSTEM32>\cmd.exe /c ""%TEMP%\3.tmp\svdost.bat" "-HideWindow" "
<SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVerson\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
<SYSTEM32>\cmd.exe /c ""%TEMP%\1.tmp\рабочий вариант.bat" "
<SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SVCOST.EXE /t REG_SZ /d %WINDIR%\svcost.exe -HideWindow /f
<SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SVDOST.EXE /t REG_SZ /d %WINDIR%\svdost.exe -HideWindow /f

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\avtokliker.html
%WINDIR%\svdost.exe
%TEMP%\3.tmp\svdost.bat
%TEMP%\2.tmp\svcost.bat
%WINDIR%\svcost.exe
<Текущая директория>\svcost.exe
%TEMP%\1.tmp\рабочий вариант.bat
<Текущая директория>\avtokliker.html
<Текущая директория>\svdost.exe

Удаляет следующие файлы:

%TEMP%\3.tmp\svdost.bat
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00087
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00086
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00088
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00091
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00090
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00089
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00085
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00080
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00079
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00078
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00081
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00084
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00083
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00082
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00102
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00101
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00100
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00103
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00106
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00105
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00104
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00099
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00094
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00093
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00092
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00095
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00098
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00097
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00096
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00058
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00057
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00056
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00059
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00062
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00061
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00060
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00055
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00048
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00047
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00046
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00051
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00054
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00053
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00052
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00073
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00072
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00071
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00074
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00077
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00076
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00075
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00070
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00065
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00064
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00063
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00066
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00069
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00068
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00067
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\prc.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfkd.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfkc.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\prcp.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\xjis.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfd.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bopomofo.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\big5.nlp
%WINDIR%\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\ksc.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfc.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normidna.nlp
%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
%WINDIR%\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
%WINDIR%\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
%WINDIR%\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
%WINDIR%\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
%WINDIR%\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Conversion.v3.5.dll
%WINDIR%\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
%WINDIR%\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
%WINDIR%\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
%WINDIR%\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
%WINDIR%\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
%WINDIR%\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
%WINDIR%\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
%WINDIR%\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\System.Printing.dll
%WINDIR%\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
%WINDIR%\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00116
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00115
%WINDIR%\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.inf
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.exe
%WINDIR%\$MSI31Uninstall_KB893803v2$\spuninst\updspapi.dll
%WINDIR%\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.txt
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00114
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00109
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00108
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00107
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00110
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00113
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00112
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00111
%WINDIR%\AppPatch\drvmain.sdb
%WINDIR%\AppPatch\apph_sp.sdb
%WINDIR%\AppPatch\apphelp.sdb
%WINDIR%\AppPatch\msimain.sdb
%WINDIR%\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
%WINDIR%\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
%WINDIR%\AppPatch\sysmain.sdb
%WINDIR%\AppPatch\AcXtrnal.dll
%WINDIR%\$NtUninstallWIC$\spuninst\updspapi.dll
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.txt
%WINDIR%\$NtUninstallWIC$\spuninst\spuninst.inf
%WINDIR%\AppPatch\AcGenral.dll
%WINDIR%\AppPatch\AcSpecfc.dll
%WINDIR%\AppPatch\AcLua.dll
%WINDIR%\AppPatch\AcLayers.dll
%WINDIR%\regopt.log
%WINDIR%\REGLOCS.OLD
%WINDIR%\regedit.exe
%WINDIR%\Rhododendron.bmp
%WINDIR%\SchedLgU.Txt
%WINDIR%\Santa Fe Stucco.bmp
%WINDIR%\River Sumida.bmp
%WINDIR%\Prairie Wind.bmp
%WINDIR%\ocgen.log
%WINDIR%\ntdtcsetup.log
%WINDIR%\nsreg.dat
%WINDIR%\ocmsn.log
%WINDIR%\oobeact.log
%WINDIR%\OEWABLog.txt
%WINDIR%\ODBCINST.INI
%WINDIR%\sleep.exe
%WINDIR%\sfk.exe
%WINDIR%\setuplog.txt
%WINDIR%\Soap Bubbles.bmp
%WINDIR%\svcost.exe
%WINDIR%\Sti_Trace.log
%WINDIR%\spupdsvc.log
%WINDIR%\setuperr.log
%WINDIR%\SET4.tmp
%WINDIR%\SET3.tmp
%WINDIR%\sessmgr.setup.log
%WINDIR%\SET8.tmp
%TEMP%\1.tmp\рабочий вариант.bat
%WINDIR%\setupapi.log
%WINDIR%\setupact.log
%WINDIR%\control.ini
%WINDIR%\comsetup.log
%WINDIR%\Coffee Bean.bmp
%WINDIR%\desktop.ini
%WINDIR%\explorer.scf
%WINDIR%\explorer.exe
%WINDIR%\DtcInstall.log
%WINDIR%\cmsetacl.log
<Текущая директория>\svdost.exe
<Текущая директория>\svcost.exe
<Текущая директория>\avtokliker.html
%WINDIR%\0.log
%WINDIR%\clock.avi
%WINDIR%\Blue Lace 16.bmp
%WINDIR%\avtokliker.html
%WINDIR%\msdfmap.ini
%WINDIR%\MedCtrOC.log
%WINDIR%\KB893803v2.log
%WINDIR%\msgsocm.log
%WINDIR%\NOTEPAD.EXE
%WINDIR%\netfxocm.log
%WINDIR%\msmqinst.log
%WINDIR%\imsins.log
%WINDIR%\Gone Fishing.bmp
%WINDIR%\FeatherTexture.bmp
%WINDIR%\FaxSetup.log
%WINDIR%\Greenstone.bmp
%WINDIR%\imsins.BAK
%WINDIR%\iis6.log
%WINDIR%\hh.exe
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00026
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00025
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00024
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00027
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00030
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00029
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00028
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00023
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00018
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00017
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00016
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00019
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00022
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00021
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00020
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00041
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00040
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00039
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00042
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00045
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00044
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00043
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00038
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00033
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00032
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00031
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00034
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00037
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00036
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00035
%WINDIR%\vbaddin.ini
%WINDIR%\vb.ini
%WINDIR%\twunk_32.exe
%WINDIR%\vmmreg32.dll
%WINDIR%\win.ini
%WINDIR%\wiaservc.log
%WINDIR%\wiadebug.log
%WINDIR%\twunk_16.exe
%WINDIR%\tabletoc.log
%WINDIR%\system.ini
%WINDIR%\svdost.exe
%WINDIR%\TASKMAN.EXE
%WINDIR%\twain_32.dll
%WINDIR%\twain.dll
%WINDIR%\tsoc.log
%WINDIR%\$MSI31Uninstall_KB893803v2$\msimsg.dll
%WINDIR%\$MSI31Uninstall_KB893803v2$\msihnd.dll
%WINDIR%\$MSI31Uninstall_KB893803v2$\msiexec.exe
%WINDIR%\$MSI31Uninstall_KB893803v2$\msisip.dll
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00015
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00014
%WINDIR%\$MSI31Uninstall_KB893803v2$\reg00013
%WINDIR%\$MSI31Uninstall_KB893803v2$\msi.dll
%WINDIR%\winhlp32.exe
%WINDIR%\winhelp.exe
%WINDIR%\WindowsUpdate.log
%WINDIR%\wmsetup.log
%WINDIR%\_default.pif
%WINDIR%\Zapotec.bmp
%WINDIR%\WMSysPr9.prx

Самоудаляется.

Другое:

Ищет следующие окна:

ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней