Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'TSMSActivator' = '<Имя вируса>.exe /min'
Вредоносные функции:
Запускает на исполнение:
- <SYSTEM32>\taskkill.exe /F /FI "MODULES eq termsrv.dll"
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\svchost.exe
Изменения в файловой системе:
Создает следующие файлы:
- %WINDIR%\<Имя вируса>.exe
Удаляет следующие файлы:
- <SYSTEM32>\dllcache\filterpipelineprintproc.dll
- <SYSTEM32>\dllcache\FP4.CAT
- %WINDIR%\Prefetch\WMIPRVSE.EXE-28F301A9.pf
- %WINDIR%\Prefetch\WUAUCLT.EXE-399A8E72.pf
- <SYSTEM32>\dllcache\HPCRDP.CAT
- <SYSTEM32>\dllcache\IMS.CAT
- <SYSTEM32>\dllcache\MAPIMIG.CAT
- <SYSTEM32>\dllcache\i8042prt.sys
- <SYSTEM32>\dllcache\IASNT4.CAT
- %WINDIR%\Prefetch\WMIADAP.EXE-2DF425B2.pf
- %WINDIR%\Prefetch\TOURSTART.EXE-0D0140ED.pf
- %WINDIR%\Prefetch\TPAUTOCONNSVC.EXE-19F171C6.pf
- %WINDIR%\Prefetch\TASKLIST.EXE-10D94B23.pf
- %WINDIR%\Prefetch\TASKMGR.EXE-20256C55.pf
- %WINDIR%\Prefetch\TRACERT.EXE-0E419688.pf
- %WINDIR%\Prefetch\UNREGMP2.EXE-07CACB61.pf
- %WINDIR%\Prefetch\UPDATE.EXE-0C442665.pf
- %WINDIR%\Prefetch\UNINSTALL.EXE-0700A35E.pf
- %WINDIR%\Prefetch\UNINSTALL.EXE-0D9C8DD2.pf
- <SYSTEM32>\dllcache\mediactr.cat
- <SYSTEM32>\dllcache\printfilterpipelinesvc.exe
- <SYSTEM32>\dllcache\SP2.CAT
- <SYSTEM32>\dllcache\NTPRINT.CAT
- <SYSTEM32>\dllcache\OEMBIOS.CAT
- <SYSTEM32>\dllcache\tabletpc.cat
- <SYSTEM32>\dllcache\xpssvcs.dll
- <SYSTEM32>\termsrv.dll
- <SYSTEM32>\dllcache\wmerrenu.cat
- <SYSTEM32>\dllcache\xpsshhdr.dll
- <SYSTEM32>\dllcache\NT5INF.CAT
- <SYSTEM32>\dllcache\msn7.cat
- <SYSTEM32>\dllcache\msn9.cat
- <SYSTEM32>\dllcache\mouclass.sys
- <SYSTEM32>\dllcache\MSMSGS.CAT
- <SYSTEM32>\dllcache\MSTSWEB.CAT
- <SYSTEM32>\dllcache\NT5.CAT
- <SYSTEM32>\dllcache\NT5IIS.CAT
- <SYSTEM32>\dllcache\MW770.CAT
- <SYSTEM32>\dllcache\netfx.cat
- %WINDIR%\Prefetch\SVCHOST.EXE-3530F672.pf
- %WINDIR%\Driver Cache\i386\stdschem.gdl
- %WINDIR%\Driver Cache\i386\stdschmx.gdl
- %WINDIR%\Driver Cache\i386\stddtype.gdl
- %WINDIR%\Driver Cache\i386\stdnames.gpd
- %WINDIR%\Driver Cache\i386\unidrv.dll
- %WINDIR%\Driver Cache\i386\unires.dll
- %WINDIR%\Prefetch\ALG.EXE-0F138680.pf
- %WINDIR%\Driver Cache\i386\unidrv.hlp
- %WINDIR%\Driver Cache\i386\unidrvui.dll
- %WINDIR%\Driver Cache\i386\sp2.cab
- %WINDIR%\Driver Cache\i386\msxpsdrv.inf
- %WINDIR%\Driver Cache\i386\msxpsinc.gpd
- %WINDIR%\Driver Cache\i386\driver.cab
- %WINDIR%\Driver Cache\i386\filterpipelineprintproc.dll
- %WINDIR%\Driver Cache\i386\msxpsinc.ppd
- %WINDIR%\Driver Cache\i386\mxdwdui.gpd
- %WINDIR%\Driver Cache\i386\mxdwdui.ini
- %WINDIR%\Driver Cache\i386\mxdwdrv.dll
- %WINDIR%\Driver Cache\i386\mxdwdui.dll
- %WINDIR%\Prefetch\CMD.EXE-087B4001.pf
- %WINDIR%\Prefetch\NTOSBOOT-B00DFAAD.pf
- %WINDIR%\Prefetch\RUNDLL32.EXE-451FC2C0.pf
- %WINDIR%\Prefetch\MSCORSVW.EXE-1BF30400.pf
- %WINDIR%\Prefetch\MSIEXEC.EXE-2F8A8CAE.pf
- %WINDIR%\Prefetch\RUNONCE.EXE-2803F297.pf
- %WINDIR%\Prefetch\SETUPUTILITY.EXE-225075A7.pf
- %WINDIR%\Prefetch\SPUPDSVC.EXE-21B36524.pf
- %WINDIR%\Prefetch\SETUP.EXE-0E44220E.pf
- %WINDIR%\Prefetch\SETUP.EXE-285178BD.pf
- %WINDIR%\Prefetch\MOFCOMP.EXE-01718E95.pf
- %WINDIR%\Prefetch\DOTNETFX40_FULL_X86_X64.EXE-1BF5490D.pf
- %WINDIR%\Prefetch\FAR.EXE-02435F54.pf
- %WINDIR%\Prefetch\DEFRAG.EXE-273F131E.pf
- %WINDIR%\Prefetch\DFRGNTFS.EXE-269967DF.pf
- %WINDIR%\Prefetch\IEXPLORE.EXE-27122324.pf
- %WINDIR%\Prefetch\LOGONUI.EXE-0AF22957.pf
- %WINDIR%\Prefetch\MMC.EXE-0B0171A2.pf
- %WINDIR%\Prefetch\Layout.ini
- %WINDIR%\Prefetch\LODCTR.EXE-1009C3B4.pf
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
