Trojan.DownLoader4.27954

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SawTv' = '%PROGRAM_FILES%\SawTv\SawTvN.exe'

Вредоносные функции:

Запускает на исполнение:

<SYSTEM32>\cmd.exe /c \DelUS.bat

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\SawTv\image\play_bt_down.bmp
%PROGRAM_FILES%\SawTv\image\play_bt_over.bmp
%PROGRAM_FILES%\SawTv\image\right_dot.bmp
%PROGRAM_FILES%\SawTv\image\msg_box_left.bmp
%PROGRAM_FILES%\SawTv\image\msg_box_right.bmp
%PROGRAM_FILES%\SawTv\image\play_bt_default.bmp
%PROGRAM_FILES%\SawTv\image\soundbar_dot.bmp
%PROGRAM_FILES%\SawTv\image\soundon_default.bmp
%PROGRAM_FILES%\SawTv\image\soundon_over.bmp
%PROGRAM_FILES%\SawTv\image\stop_bt_default.bmp
%PROGRAM_FILES%\SawTv\image\soundbar_line.bmp
%PROGRAM_FILES%\SawTv\image\soundoff_default.bmp
%PROGRAM_FILES%\SawTv\image\soundoff_over.bmp
%PROGRAM_FILES%\SawTv\image\msg_box_center.bmp
%PROGRAM_FILES%\SawTv\image\listhide_default.bmp
%PROGRAM_FILES%\SawTv\image\listhide_over.bmp
%PROGRAM_FILES%\SawTv\image\listshow_default.bmp
%PROGRAM_FILES%\SawTv\image\listdown_bt_default.bmp
%PROGRAM_FILES%\SawTv\image\listdown_bt_down.bmp
%PROGRAM_FILES%\SawTv\image\listdown_bt_over.bmp
%PROGRAM_FILES%\SawTv\image\listshow_over.bmp
%PROGRAM_FILES%\SawTv\image\minimize_bt_default.bmp
%PROGRAM_FILES%\SawTv\image\minimize_bt_down.bmp
%PROGRAM_FILES%\SawTv\image\minimize_bt_over.bmp
%PROGRAM_FILES%\SawTv\image\maximize_bt_default.bmp
%PROGRAM_FILES%\SawTv\image\maximize_bt_down.bmp
%PROGRAM_FILES%\SawTv\image\maximize_bt_over.bmp
%PROGRAM_FILES%\SawTv\tvlistinfo.ini
%PROGRAM_FILES%\SawTv\uninstall.exe
%HOMEPATH%\Start Menu\Programs\SawTv\SawTv ЅЗЗа.lnk
%PROGRAM_FILES%\SawTv\radiochinfo.ini
%PROGRAM_FILES%\SawTv\radiolistinfo.ini
%PROGRAM_FILES%\SawTv\tvchinfo.ini
%HOMEPATH%\Start Menu\Programs\SawTv\Uninst.lnk
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\check_counter[1].php
%TEMP%\nsb3.tmp\SelfDelete.dll
C:\DelUS.bat
%TEMP%\nsb3.tmp\System.dll
%TEMP%\nsb3.tmp\Math.dll
%TEMP%\nsb3.tmp\DLLWebCount.dll
%PROGRAM_FILES%\SawTv\modern.exe
%PROGRAM_FILES%\SawTv\image\top_left.bmp
%PROGRAM_FILES%\SawTv\image\top_right.bmp
%PROGRAM_FILES%\SawTv\image\uccsearch_bt_default.bmp
%PROGRAM_FILES%\SawTv\image\stop_bt_down.bmp
%PROGRAM_FILES%\SawTv\image\stop_bt_over.bmp
%PROGRAM_FILES%\SawTv\image\top_dot.bmp
%PROGRAM_FILES%\SawTv\image\uccsearch_bt_down.bmp
%PROGRAM_FILES%\SawTv\SawTv.exe
%PROGRAM_FILES%\SawTv\SawTvN.exe
%PROGRAM_FILES%\SawTv\ad.ini
%PROGRAM_FILES%\SawTv\image\uccsearch_bt_over.bmp
%PROGRAM_FILES%\SawTv\image\view_logo.bmp
%PROGRAM_FILES%\SawTv\License.txt
%PROGRAM_FILES%\SawTv\image\bt_insert_over.bmp
%PROGRAM_FILES%\SawTv\image\center_dot.bmp
%PROGRAM_FILES%\SawTv\image\channel_home_default.bmp
%PROGRAM_FILES%\SawTv\image\bt_del_over.bmp
%PROGRAM_FILES%\SawTv\image\bt_insert_down.bmp
%PROGRAM_FILES%\SawTv\image\bt_insert_nomal.bmp
%PROGRAM_FILES%\SawTv\image\channel_home_default_on.bmp
%PROGRAM_FILES%\SawTv\image\channel_my_over.bmp
%PROGRAM_FILES%\SawTv\image\channel_radio_default.bmp
%PROGRAM_FILES%\SawTv\image\channel_radio_default_on.bmp
%PROGRAM_FILES%\SawTv\image\channel_home_over.bmp
%PROGRAM_FILES%\SawTv\image\channel_my_default.bmp
%PROGRAM_FILES%\SawTv\image\channel_my_default_on.bmp
%PROGRAM_FILES%\SawTv\image\bt_del_nomal.bmp
%PROGRAM_FILES%\SawTv\image\back_bt_down.bmp
%PROGRAM_FILES%\SawTv\image\back_bt_over.bmp
%PROGRAM_FILES%\SawTv\image\bg_main.bmp
%TEMP%\nsw2.tmp
%TEMP%\nsb3.tmp\KillProcDLL.dll
%PROGRAM_FILES%\SawTv\image\back_bt_default.bmp
%PROGRAM_FILES%\SawTv\image\bottom_dot.bmp
%PROGRAM_FILES%\SawTv\image\bt_change_nomal.bmp
%PROGRAM_FILES%\SawTv\image\bt_change_over.bmp
%PROGRAM_FILES%\SawTv\image\bt_del_down.bmp
%PROGRAM_FILES%\SawTv\image\bottom_left.bmp
%PROGRAM_FILES%\SawTv\image\bottom_right.bmp
%PROGRAM_FILES%\SawTv\image\bt_change_down.bmp
%PROGRAM_FILES%\SawTv\image\close_bt_down.bmp
%PROGRAM_FILES%\SawTv\image\close_bt_over.bmp
%PROGRAM_FILES%\SawTv\image\front_bt_default.bmp
%PROGRAM_FILES%\SawTv\image\channeryes_bt_down.bmp
%PROGRAM_FILES%\SawTv\image\channeryes_bt_over.bmp
%PROGRAM_FILES%\SawTv\image\close_bt_default.bmp
%PROGRAM_FILES%\SawTv\image\front_bt_down.bmp
%PROGRAM_FILES%\SawTv\image\listbg_down.bmp
%PROGRAM_FILES%\SawTv\image\listbgbottom.bmp
%PROGRAM_FILES%\SawTv\image\listdown_bg.bmp
%PROGRAM_FILES%\SawTv\image\front_bt_over.bmp
%PROGRAM_FILES%\SawTv\image\left_dot.bmp
%PROGRAM_FILES%\SawTv\image\listbg.bmp
%PROGRAM_FILES%\SawTv\image\channeryes_bt_default.bmp
%PROGRAM_FILES%\SawTv\image\channel_tv_over.bmp
%PROGRAM_FILES%\SawTv\image\channel_ucc_default.bmp
%PROGRAM_FILES%\SawTv\image\channel_ucc_default_on.bmp
%PROGRAM_FILES%\SawTv\image\channel_radio_over.bmp
%PROGRAM_FILES%\SawTv\image\channel_tv_default.bmp
%PROGRAM_FILES%\SawTv\image\channel_tv_default_on.bmp
%PROGRAM_FILES%\SawTv\image\channel_ucc_over.bmp
%PROGRAM_FILES%\SawTv\image\channerok_bt_default.bmp
%PROGRAM_FILES%\SawTv\image\channerok_bt_down.bmp
%PROGRAM_FILES%\SawTv\image\channerok_bt_over.bmp
%PROGRAM_FILES%\SawTv\image\channerno_bt_default.bmp
%PROGRAM_FILES%\SawTv\image\channerno_bt_down.bmp
%PROGRAM_FILES%\SawTv\image\channerno_bt_over.bmp

Удаляет следующие файлы:

%TEMP%\nsb3.tmp\Math.dll
%TEMP%\nsb3.tmp\SelfDelete.dll
%TEMP%\nsb3.tmp\System.dll
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\check_counter[1].php
%TEMP%\nsb3.tmp\DLLWebCount.dll
%TEMP%\nsb3.tmp\KillProcDLL.dll

Самоудаляется.

Сетевая активность:

Подключается к: