Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\ACDSee.png\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.ppm\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.psd\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.pgm\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.pic\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.pict\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.psp\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.tiff\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.wmf\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.xif\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.rle\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.tga\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.tif\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.emf\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.gif\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.jfif\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.bmp\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.dcx\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.dib\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.jif\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.pbm\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.pct\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.pcx\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.jpe\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.jpeg\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\ACDSee.jpg\shell\Open\command] '' = '"%PROGRAM_FILES%\ACDSee5\ACDSee5.exe" "%1"'
Вредоносные функции:
Создает и запускает на исполнение:
- '%WINDIR%\Temp\ACDSee5.exe'
- '%WINDIR%\Temp\db.exe'
Запускает на исполнение:
- '%WINDIR%\regedit.exe' /s %WINDIR%\temp\ACDSee.reg
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\ACDSee5\EITCC_Mirror.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_Pixelate.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_PixelExplosion.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_FurryEdges.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_LinearBlur.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_MedianNoiseRemoval.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_ScatteredTiles.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_SheetMetal.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_Shift.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_Posterize.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_RadialBlur.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_Ripple.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_Dauber.dll
- %PROGRAM_FILES%\ACDSee5\ACDInTouch.dll
- %PROGRAM_FILES%\ACDSee5\digitacam.dll
- %PROGRAM_FILES%\ACDSee5\EITCCBase.dll
- %PROGRAM_FILES%\ACDSee5\ACDCLClient.dll
- %PROGRAM_FILES%\ACDSee5\acdcp.dll
- %PROGRAM_FILES%\ACDSee5\ACDFullLicense.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_Bulge.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_ColoredEdges.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_Contours.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_AddNoise.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_BathroomWindow.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_Blinds.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_Solarize.dll
- %PROGRAM_FILES%\ACDSee5\ShellIntMgr.dll
- %PROGRAM_FILES%\ACDSee5\SoundLib.dll
- %PROGRAM_FILES%\ACDSee5\TransportIrCOMM.dll
- %PROGRAM_FILES%\ACDSee5\msvcp60.dll
- %PROGRAM_FILES%\ACDSee5\Roboex32.dll
- %PROGRAM_FILES%\ACDSee5\ScreenCapture.dll
- %TEMP%\aut3.tmp
- %WINDIR%\Temp\ACDSee.reg
- %TEMP%\aut4.tmp
- %PROGRAM_FILES%\ACDSee5\TransportIrDA.dll
- %PROGRAM_FILES%\ACDSee5\TransportSerial.dll
- %PROGRAM_FILES%\ACDSee5\TransportUSB.dll
- %PROGRAM_FILES%\ACDSee5\ipwssl5.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_TopographicMap.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_UnsharpMask.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_UserDefinedConvolution.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_Spread.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_Sunspot.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_Swirl.dll
- %PROGRAM_FILES%\ACDSee5\FilterDlgUI.dll
- %PROGRAM_FILES%\ACDSee5\HHActiveX.dll
- %PROGRAM_FILES%\ACDSee5\IDBSvrps.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_Wind.dll
- %PROGRAM_FILES%\ACDSee5\EITCC_ZoomBlur.dll
- %PROGRAM_FILES%\ACDSee5\ExtDB.dll
- %APPDATA%\ACD Systems\ImageDB\ExtendedDB\TIMELINE.DBT
- %APPDATA%\ACD Systems\ImageDB\ExtendedDB\IDUNIQUE.DBU
- %APPDATA%\ACD Systems\ImageDB\ImageDB.ddf
- %APPDATA%\ACD Systems\ImageDB\ExtendedDB\FILEID.DBD
- %APPDATA%\ACD Systems\ImageDB\ExtendedDB\LOCKDATA.DBL
- %APPDATA%\ACD Systems\ImageDB\ExtendedDB\PATHID.DBP
- %PROGRAM_FILES%\ACDSee5\reg.bat
- %PROGRAM_FILES%\ACDSee5\unreg.reg
- %PROGRAM_FILES%\ACDSee5\AX_RAR.apl
- %APPDATA%\ACD Systems\ImageDB\ImageDB.dtf
- %TEMP%\aut2.tmp
- %WINDIR%\Temp\ACDSee5.exe
- %APPDATA%\ACD Systems\ImageDB\ExtendedDB\CATFILE.DB3
- %APPDATA%\ACD Systems\ImageDB\ExtendedDB\CATID.CDX
- %APPDATA%\ACD Systems\ImageDB\ExtendedDB\CATPATH.CDX
- %APPDATA%\ACD Systems\ImageDB\ExtendedDB\FILEID.CDX
- %TEMP%\aut1.tmp
- %WINDIR%\Temp\db.exe
- %APPDATA%\ACD Systems\ImageDB\ExtendedDB\CATFILE.CDX
- %APPDATA%\ACD Systems\ImageDB\ExtendedDB\TIMELINE.CDX
- %APPDATA%\ACD Systems\ImageDB\ExtendedDB\CATID.DB1
- %APPDATA%\ACD Systems\ImageDB\ExtendedDB\CATPATH.DB2
- %APPDATA%\ACD Systems\ImageDB\ExtendedDB\IDUNIQUE.CDX
- %APPDATA%\ACD Systems\ImageDB\ExtendedDB\LOCKDATA.CDX
- %APPDATA%\ACD Systems\ImageDB\ExtendedDB\PATHID.CDX
- %PROGRAM_FILES%\ACDSee5\CX_Archive.apl
- %PROGRAM_FILES%\ACDSee5\reg.inf
- %PROGRAM_FILES%\ACDSee5\ACDSee.sip
- %PROGRAM_FILES%\ACDSee5\Tips.tip
- %PROGRAM_FILES%\ACDSee5\ID_PNM.apl
- %PROGRAM_FILES%\ACDSee5\ID_PS.apl
- %PROGRAM_FILES%\ACDSee5\ID_PSP.apl
- %PROGRAM_FILES%\ACDSee5\IDBSvr.exe
- %PROGRAM_FILES%\ACDSee5\uninst.exe
- %PROGRAM_FILES%\ACDSee5\ACDAppInfo.dll
- %PROGRAM_FILES%\ACDSee5\ACDSee5.exe
- %PROGRAM_FILES%\ACDSee5\DigitaCap.exe
- %PROGRAM_FILES%\ACDSee5\FotoCanvas2.exe
- %PROGRAM_FILES%\ACDSee5\ID_Pict.apl
- %PROGRAM_FILES%\ACDSee5\DC_Digita.apl
- %PROGRAM_FILES%\ACDSee5\DC_SII.apl
- %PROGRAM_FILES%\ACDSee5\DC_WIA.apl
- %PROGRAM_FILES%\ACDSee5\CX_ContactSheet.apl
- %PROGRAM_FILES%\ACDSee5\CX_DFinder.apl
- %PROGRAM_FILES%\ACDSee5\CX_HTML.apl
- %PROGRAM_FILES%\ACDSee5\ID_ICN.apl
- %PROGRAM_FILES%\ACDSee5\ID_ICO.apl
- %PROGRAM_FILES%\ACDSee5\ID_PIC.apl
- %PROGRAM_FILES%\ACDSee5\IDE_ACDStd.apl
- %PROGRAM_FILES%\ACDSee5\IDE_Adobe.apl
- %PROGRAM_FILES%\ACDSee5\IDE_PSD.apl
Удаляет следующие файлы:
- %TEMP%\aut3.tmp
- %TEMP%\aut4.tmp
- %WINDIR%\Temp\ACDSee.reg
- %TEMP%\aut1.tmp
- %WINDIR%\Temp\db.exe
- %TEMP%\aut2.tmp
Другое:
Ищет следующие окна:
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
