Trojan.KillProc.52836

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '{0C9C1B93-22F0-3CA3-4755-54A6B922A4DF}' = '%APPDATA%\guide.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk

Заражает следующие исполняемые файлы:

C:\Far2\Plugins\arclite\7zS2con.sfx
C:\Far2\Plugins\arclite\7zSD.sfx
C:\Far2\Plugins\arclite\7zS2.sfx
C:\Far2\Plugins\arclite\7z.sfx
C:\Far2\Plugins\arclite\7zCon.sfx

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

удаляет теневые копии разделов.

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /c wmic SHADOWCOPY DELETE
'<SYSTEM32>\cmd.exe' /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0
'<SYSTEM32>\cmd.exe' /c vssadmin Delete Shadows /All /Quiet
'<SYSTEM32>\cmd.exe' /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
'<SYSTEM32>\cmd.exe' /c bcdedit /set {default} recoveryenabled No
'<SYSTEM32>\cmd.exe' /c vssadmin Delete Shadows /for=F: /All
'<SYSTEM32>\cmd.exe' /c %TEMP%\{883EC156-0A67-756C-23AF-A64052E1A4DA}.bat
'%APPDATA%\guide.exe'
'<SYSTEM32>\cmd.exe' /c vssadmin Delete Shadows /for=C: /All
'<SYSTEM32>\cmd.exe' /c vssadmin Delete Shadows /for=E: /All
'<SYSTEM32>\cmd.exe' /c vssadmin Delete Shadows /for=D: /All

Завершает или пытается завершить

следующие системные процессы:

<SYSTEM32>\cscript.exe

Изменения в файловой системе:

Создает следующие файлы:

C:\Far2\Plugins\FarCmds\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\ExtSearch\sources\RegExp\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\ExtSearch\sources\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\FTP\lib\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\FTP\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\FileCase\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\ExtSearch\doc\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\DrawLine\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Compare\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Colorer\hrd\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\ExtSearch\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\EMenu\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\EditCase\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\HlfViewer\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\GVOnline\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\el_cli\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\cbmain\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\lin\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\l2\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\kb_cli\HOW TO RECOVER ENCRYPTED FILES.TXT
<STUBS_DIR>\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\ProcList\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Network\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\MacroView\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\PluginSDK\Headers.pas\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\PluginSDK\Headers.c\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\TmpPanel\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Colorer\hrc\auto\types\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Start Menu\Programs\Accessories\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Start Menu\Programs\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Start Menu\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\HOW TO RECOVER ENCRYPTED FILES.TXT
%TEMP%\tmp2.tmp
%HOMEPATH%\My Documents\My Pictures\HOW TO RECOVER ENCRYPTED FILES.TXT
%TEMP%\tmp1.tmp
%TEMP%\{883EC156-0A67-756C-23AF-A64052E1A4DA}.bat
%APPDATA%\guide.exe
%HOMEPATH%\My Documents\My Music\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Favorites\Links\HOW TO RECOVER ENCRYPTED FILES.TXT
%HOMEPATH%\Favorites\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Brackets\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\AutoWrap\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\arclite\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Colorer\hrc\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Colorer\bin\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Colorer\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\Align\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Documentation\eng\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Addons\Shell\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Addons\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Plugins\7-Zip\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Encyclopedia\HOW TO RECOVER ENCRYPTED FILES.TXT
C:\Far2\Documentation\rus\HOW TO RECOVER ENCRYPTED FILES.TXT