Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscntfy.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guard.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avast.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwproxy.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravmon.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVXP.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavmonD.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvMonXP.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe] 'debugger' = 'IFEOFILE'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe] 'debugger' = 'IFEOFILE'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Prstgressep] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- <SYSTEM32>\PrstService.exe
- C:\Temp\kyxwb11.exe
- %TEMP%\SaveFile.exe
Запускает на исполнение:
- <SYSTEM32>\cmd.exe /c c:\delus.bat
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\_EVLPK.tmp
- C:\delus.bat
- %WINDIR%\Fonts\PrstService.jpg
- %PROGRAM_FILES%\Internet Explorer\dp1.fne
- %PROGRAM_FILES%\Internet Explorer\IJL105.DLL
- %PROGRAM_FILES%\Internet Explorer\krnln.fnr
- %PROGRAM_FILES%\Internet Explorer\Exmlrpc.fne
- %TEMP%\E_4\krnln.fnr
- C:\Temp\kyxwb11.exe
- %TEMP%\SaveFile.exe
- %TEMP%\E_4\dp1.fne
- <SYSTEM32>\PrstService.dll
- <SYSTEM32>\PrstService.exe
- %TEMP%\E_4\Exmlrpc.fne
Присваивает атрибут 'скрытый' для следующих файлов:
- %PROGRAM_FILES%\Internet Explorer\Exmlrpc.fne
- %PROGRAM_FILES%\Internet Explorer\krnln.fnr
- %PROGRAM_FILES%\Internet Explorer\IJL105.DLL
- <SYSTEM32>\PrstService.exe
- <SYSTEM32>\PrstService.dll
- %PROGRAM_FILES%\Internet Explorer\dp1.fne
Удаляет следующие файлы:
- C:\Temp\kyxwb11.exe
Сетевая активность:
Подключается к:
- 'rt##.3322.org':19820
UDP:
- DNS ASK rt##.3322.org
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
