Trojan.AVKill.22394

Техническая информация

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует отображение:

скрытых файлов

блокирует запуск следующих системных утилит:

Редактора реестра (RegEdit)

Запускает на исполнение:

<SYSTEM32>\ntvdm.exe -f -i2
<SYSTEM32>\net1.exe localgroup %USERNAME%sbd /ADD
<SYSTEM32>\ntvdm.exe -f -i1
<SYSTEM32>\net1.exe user 110120119 bd /add

Завершает или пытается завершить

следующие пользовательские процессы:

AVP32.EXE
AVPCC.EXE
AVGCTRL.EXE
AVP.EXE
AVPM.EXE
smc.exe
ZONEALARM.EXE
mpftray.exe
NAVAPW32.EXE

Изменяет следующие настройки проводника Windows (Windows Explorer):

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoLogOff' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFileMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetFolders' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewContextMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRecentDocsMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDrives' = 'FFFFFFFF'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewOnDrive' = 'FFFFFFFF'

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\Temp\scs3.tmp
%WINDIR%\Temp\scs4.tmp
%WINDIR%\Temp\scs1.tmp
%WINDIR%\Temp\scs2.tmp

Удаляет следующие файлы:

%WINDIR%\Temp\scs3.tmp
%WINDIR%\Temp\scs4.tmp
%WINDIR%\Temp\scs1.tmp
%WINDIR%\Temp\scs2.tmp

Другое:

Ищет следующие окна:

ClassName: '' WindowName: 'FP-WIN.EXE'
ClassName: '' WindowName: 'FPROT.EXE'
ClassName: '' WindowName: 'F-STOPW.EXE'
ClassName: '' WindowName: 'FINDVIRU.EXE'
ClassName: '' WindowName: 'IAMSERV.EXE'
ClassName: '' WindowName: 'IBMASN.EXE'
ClassName: '' WindowName: 'FRW.EXE'
ClassName: '' WindowName: 'IAMAPP.EXE'
ClassName: '' WindowName: 'ECENGINE.EXE'
ClassName: '' WindowName: 'ESAFE.EXE'
ClassName: '' WindowName: 'DVP95.EXE'
ClassName: '' WindowName: 'DVP95_0.EXE'
ClassName: '' WindowName: 'F-PROT.EXE'
ClassName: '' WindowName: 'F-PROT95.EXE'
ClassName: '' WindowName: 'EXPWATCH.EXE'
ClassName: '' WindowName: 'F-AGNT95.EXE'
ClassName: '' WindowName: 'IBMAVSP.EXE'
ClassName: '' WindowName: 'LUALL.EXE'
ClassName: '' WindowName: 'MOOLIVE.EXE'
ClassName: '' WindowName: 'LOCKDOWN2000.EXE'
ClassName: '' WindowName: 'LOOKOUT.EXE'
ClassName: '' WindowName: 'NAVAPW32.EXE'
ClassName: '' WindowName: 'NAVLU32.EXE'
ClassName: '' WindowName: 'MPFTRAY.EXE'
ClassName: '' WindowName: 'N32SCANW.EXE'
ClassName: '' WindowName: 'ICMON.EXE'
ClassName: '' WindowName: 'ICSUPP95.EXE'
ClassName: '' WindowName: 'ICLOAD95.EXE'
ClassName: '' WindowName: 'ICLOADNT.EXE'
ClassName: '' WindowName: 'IOMON98.EXE'
ClassName: '' WindowName: 'JEDI.EXE'
ClassName: '' WindowName: 'ICSUPPNT.EXE'
ClassName: '' WindowName: 'IFACE.EXE'
ClassName: '' WindowName: 'CLEANER3.EXE'
ClassName: '' WindowName: 'AVE32.EXE'
ClassName: '' WindowName: 'AVGCTRL.EXE'
ClassName: '' WindowName: 'AUTODOWN.EXE'
ClassName: '' WindowName: 'AVCONSOL.EXE'
ClassName: '' WindowName: 'AVP.EXE'
ClassName: '' WindowName: 'AVP32.EXE'
ClassName: '' WindowName: 'AVKSERV.EXE'
ClassName: '' WindowName: 'AVNT.EXE'
ClassName: '' WindowName: '_AVP32.EXE'
ClassName: '' WindowName: '_AVPCC.EXE'
ClassName: '' WindowName: 'regedit.exe'
ClassName: '' WindowName: 'tackmgr.exe'
ClassName: '' WindowName: 'ANTI-TROJAN.EXE'
ClassName: '' WindowName: 'APVXDWIN.EXE'
ClassName: '' WindowName: '_AVPM.EXE'
ClassName: '' WindowName: 'ACKWIN32.EXE'
ClassName: '' WindowName: 'AVPCC.EXE'
ClassName: '' WindowName: 'CFIAUDIT.EXE'
ClassName: '' WindowName: 'CFINET.EXE'
ClassName: '' WindowName: 'BLACKICE.EXE'
ClassName: '' WindowName: 'CFIADMIN.EXE'
ClassName: '' WindowName: 'CLAW95CF.EXE'
ClassName: '' WindowName: 'CLEANER.EXE'
ClassName: '' WindowName: 'CFINET32.EXE'
ClassName: '' WindowName: 'CLAW95.EXE'
ClassName: '' WindowName: 'AVPTC32.EXE'
ClassName: '' WindowName: 'AVPUPD.EXE'
ClassName: '' WindowName: 'AVPDOS32.EXE'
ClassName: '' WindowName: 'AVPM.EXE'
ClassName: '' WindowName: 'AVWUPD32.EXE'
ClassName: '' WindowName: 'BLACKD.EXE'
ClassName: '' WindowName: 'AVSCHED32.EXE'
ClassName: '' WindowName: 'AVWIN95.EXE'
ClassName: '' WindowName: 'NAVNT.EXE'
ClassName: '' WindowName: 'NMAIN'
ClassName: '' WindowName: 'F-PROT'
ClassName: '' WindowName: 'TASKM'
ClassName: '' WindowName: 'SCAN'
ClassName: '' WindowName: 'Norton AntiVirus Server'
ClassName: '' WindowName: 'navapsvc'
ClassName: '' WindowName: 'AVP'
ClassName: '' WindowName: 'ANTIV'
ClassName: '' WindowName: 'WEBSCANX.EXE'
ClassName: '' WindowName: 'WFINDV32.EXE'
ClassName: '' WindowName: 'VSHWIN32.EXE'
ClassName: '' WindowName: 'VSSTAT,EXE'
ClassName: '' WindowName: 'VSHW'
ClassName: '' WindowName: 'VIRUS'
ClassName: '' WindowName: 'ZONEALARM.EXE'
ClassName: '' WindowName: 'VSS'
ClassName: '' WindowName: 'rsccenter'
ClassName: '' WindowName: 'KVSrvXP.exe'
ClassName: '' WindowName: 'KVMonxp.kxp'
ClassName: '' WindowName: 'kvfw.exe'
ClassName: '' WindowName: 'KVWSC.exe'
ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b78.b7c.380001'
ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-b3c.b40.370001'
ClassName: '' WindowName: 'KRegEx.exe'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: 'OfficeScanNT'
ClassName: '' WindowName: 'OfcPfwSvc.exe'
ClassName: '' WindowName: 'rsravmon'
ClassName: '' WindowName: 'OfficeScanNT Personal Firewall'
ClassName: '' WindowName: 'KMDEVMONSRV.exe'
ClassName: '' WindowName: 'KMdevmonx.exe'
ClassName: '' WindowName: 'KPfwsvc.exe'
ClassName: '' WindowName: 'KAVStart.exe'
ClassName: '' WindowName: 'VSECOMR.EXE'
ClassName: '' WindowName: 'PAVW.EXE'
ClassName: '' WindowName: 'PCCWIN98.EXE'
ClassName: '' WindowName: 'PAVCL..EXE'
ClassName: '' WindowName: 'PAVSCHED.EXE'
ClassName: '' WindowName: 'RAV7.EXE'
ClassName: '' WindowName: 'RAV7WIN.EXE'
ClassName: '' WindowName: 'PCFWALLICON.EXE'
ClassName: '' WindowName: 'PERSFW.EXE'
ClassName: '' WindowName: 'NISUM.EXE'
ClassName: '' WindowName: 'NMAIN.EXE'
ClassName: '' WindowName: 'NAVW32.EXE'
ClassName: '' WindowName: 'NAVWNT.EXE'
ClassName: '' WindowName: 'NVC95.EXE'
ClassName: '' WindowName: 'PADMIN.EOUTPOST.EXE'
ClassName: '' WindowName: 'NORMIST.EXE'
ClassName: '' WindowName: 'NUPGRADE.EXE'
ClassName: '' WindowName: 'FESCUE.EXE'
ClassName: '' WindowName: 'TCA.EXE'
ClassName: '' WindowName: 'TDS2-98.EXE'
ClassName: '' WindowName: 'SWEEP95.EXE'
ClassName: '' WindowName: 'TBSCAN.EXE'
ClassName: '' WindowName: 'VETTRAY.EXE'
ClassName: '' WindowName: 'VSCAN40.EXE'
ClassName: '' WindowName: 'TDS2-NT.EXE'
ClassName: '' WindowName: 'VET95.EXE'
ClassName: '' WindowName: 'SCAN95.EXE'
ClassName: '' WindowName: 'SCANPM.EXE'
ClassName: '' WindowName: 'SAFEWEB.EXE'
ClassName: '' WindowName: 'SCAN32.EXE'
ClassName: '' WindowName: 'SMC.EXE'
ClassName: '' WindowName: 'SPHINX.EXE'
ClassName: '' WindowName: 'SCRSCAN.EXE'
ClassName: '' WindowName: 'SERV95.EXE'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней