Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\МЪС¶_QQ.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\МЪС¶_QQ.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\eblllj.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\pvyedbapk.lnk
Вредоносные функции:
Создает и запускает на исполнение:
- %WINDIR%\viwavfepymb.exe <Полный путь к вирусу> rb
Изменения в файловой системе:
Создает следующие файлы:
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\Services.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\Freecell.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\Performance.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\Event Viewer.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\Local Security Policy.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\Hearts.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\Internet Reversi.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\Internet Spades.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\Internet Hearts.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\Internet Backgammon.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\Internet Checkers.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Scheduled Tasks.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Security Center.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Disk Cleanup.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Disk Defragmenter.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\System Information.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\Computer Management.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\Data Sources (ODBC).lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\Component Services.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\System Restore.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\WordPad.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\Minesweeper.lnk
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\Windows Media Player.lnk
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Notepad.lnk
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Command Prompt.lnk
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\Utility Manager.lnk
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Program Compatibility Wizard.lnk
- C:\Documents and Settings\Default User\Start Menu\Programs\Remote Assistance.lnk
- C:\Documents and Settings\Default User\Start Menu\Programs\Windows Media Player.lnk
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Windows Explorer.lnk
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Synchronize.lnk
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Tour Windows XP.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\MSN.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Windows Messenger.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\Spider Solitaire.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\Pinball.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\Solitaire.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Windows Movie Maker.lnk
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\Magnifier.lnk
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk
- %ALLUSERSPROFILE%\Start Menu\Windows Update.lnk
- %ALLUSERSPROFILE%\Start Menu\Set Program Access and Defaults.lnk
- %ALLUSERSPROFILE%\Start Menu\Windows Catalog.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Character Map.lnk
- %HOMEPATH%\Recent\<Служебное имя>.lnk
- %HOMEPATH%\Recent\xxmouse.lnk
- %HOMEPATH%\Recent\<Служебное имя> (2).lnk
- %HOMEPATH%\Recent\vmscsi.lnk
- %HOMEPATH%\Recent\vmx_svga.lnk
- %HOMEPATH%\Start Menu\Far.lnk
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\Utility Manager.lnk
- %HOMEPATH%\Start Menu\Programs\Accessories\Address Book.lnk
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\Magnifier.lnk
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk
- %WINDIR%\SNON4TQSONA3.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
- %WINDIR%\cqauaapc.exe
- %WINDIR%\viwavfepymb.exe
- %WINDIR%\SNON4TQSONA3.exe
- %HOMEPATH%\Favorites\Links\Windows Marketplace.lnk
- %HOMEPATH%\Recent\scsi.lnk
- %HOMEPATH%\Recent\video.lnk
- %HOMEPATH%\Recent\mouse.lnk
- %HOMEPATH%\My Documents\My Music\Sample Music.lnk
- %HOMEPATH%\My Documents\My Pictures\Sample Pictures.lnk
- %HOMEPATH%\Start Menu\Programs\Accessories\Command Prompt.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\Network Setup Wizard.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\New Connection Wizard.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\Network Connections.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Calculator.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\HyperTerminal.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\Remote Desktop Connection.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Paint.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\Backup.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\Volume Control.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\Wireless Network Setup Wizard.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\Sound Recorder.lnk
- %HOMEPATH%\Start Menu\Programs\Accessories\Synchronize.lnk
- %HOMEPATH%\Start Menu\Programs\Accessories\Tour Windows XP.lnk
- %HOMEPATH%\Start Menu\Programs\Accessories\Program Compatibility Wizard.lnk
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\Windows Media Player.lnk
- %HOMEPATH%\Start Menu\Programs\Accessories\Notepad.lnk
- %HOMEPATH%\Start Menu\Programs\Accessories\Windows Explorer.lnk
- %HOMEPATH%\Start Menu\Programs\Windows Media Player.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\Accessibility Wizard.lnk
- %HOMEPATH%\Start Menu\Programs\Remote Assistance.lnk
- %HOMEPATH%\Start Menu\Programs\Internet Explorer.lnk
- %HOMEPATH%\Start Menu\Programs\Outlook Express.lnk
Присваивает атрибут 'скрытый' для следующих файлов:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\МЪС¶_QQ.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\МЪС¶_QQ.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\pvyedbapk.lnk
- <Полный путь к вирусу>
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\eblllj.lnk
Удаляет следующие файлы:
- %WINDIR%\Media\Windows XP Menu Command.wav
- %WINDIR%\Media\Windows XP Logon Sound.wav
- %WINDIR%\Media\Windows XP Minimize.wav
- %WINDIR%\Media\Windows XP Pop-up Blocked.wav
- %WINDIR%\Media\Windows XP Notify.wav
- %WINDIR%\Media\Windows XP Hardware Insert.wav
- %WINDIR%\Media\Windows XP Hardware Fail.wav
- %WINDIR%\Media\Windows XP Hardware Remove.wav
- %WINDIR%\Media\Windows XP Logoff Sound.wav
- %WINDIR%\Media\Windows XP Information Bar.wav
- %WINDIR%\Media\Windows XP Start.wav
- %WINDIR%\Media\Windows XP Shutdown.wav
- %WINDIR%\Media\Windows XP Startup.wav
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\eblllj.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\pvyedbapk.lnk
- %WINDIR%\Media\Windows XP Recycle.wav
- %WINDIR%\Media\Windows XP Print complete.wav
- %WINDIR%\Media\Windows XP Restore.wav
- %WINDIR%\Media\Windows XP Ringout.wav
- %WINDIR%\Media\Windows XP Ringin.wav
- %WINDIR%\Media\recycle.wav
- %WINDIR%\Media\onestop.mid
- %WINDIR%\Media\ringin.wav
- %WINDIR%\Media\start.wav
- %WINDIR%\Media\ringout.wav
- %WINDIR%\Media\chord.wav
- %WINDIR%\Media\chimes.wav
- %WINDIR%\Media\ding.wav
- %WINDIR%\Media\notify.wav
- %WINDIR%\Media\flourish.mid
- %WINDIR%\Media\Windows XP Default.wav
- %WINDIR%\Media\Windows XP Critical Stop.wav
- %WINDIR%\Media\Windows XP Ding.wav
- %WINDIR%\Media\Windows XP Exclamation.wav
- %WINDIR%\Media\Windows XP Error.wav
- %WINDIR%\Media\town.mid
- %WINDIR%\Media\tada.wav
- %WINDIR%\Media\Windows XP Balloon.wav
- %WINDIR%\Media\Windows XP Battery Low.wav
- %WINDIR%\Media\Windows XP Battery Critical.wav
Сетевая активность:
Подключается к:
- '58.#9.58.27':443
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'TNPSKCWQXRGGYZR' WindowName: 'ebvswehahqwjzjj'
