Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'DECRYPTINFO' = '"%APPDATA%\!#_RESTORE_FILES_#!.inf"'
Создает или изменяет следующие файлы:
- %HOMEPATH%\Start Menu\Programs\Startup\desktop.ini
- %HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk
- %HOMEPATH%\Start Menu\Programs\Startup\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\desktop.ini
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
удаляет теневые копии разделов.
Запускает на исполнение:
- '<SYSTEM32>\cmd.exe' /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\cmd.exe' /c bcdedit.exe /set {default} recoveryenabled No
- '<SYSTEM32>\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Microsoft\Address Book\!#_RESTORE_FILES_#!.inf
- %APPDATA%\Microsoft\Internet Explorer\!#_RESTORE_FILES_#!.inf
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\NetworkService\!#_RESTORE_FILES_#!.inf
- %APPDATA%\Microsoft\Media Player\!#_RESTORE_FILES_#!.inf
- %APPDATA%\Mozilla\Firefox\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Cookies\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Favorites\!#_RESTORE_FILES_#!.inf
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\!#_RESTORE_FILES_#!.inf
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\!#_RESTORE_FILES_#!.inf
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\NetworkService\Local Settings\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\NetworkService\Local Settings\History\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Recent\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\SendTo\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\My Documents\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\My Documents\My Music\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\My Documents\My Pictures\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Start Menu\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Start Menu\Programs\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Templates\!#_RESTORE_FILES_#!.inf
- C:\Far2\Addons\Colors\Custom Highlighting\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Start Menu\Programs\Accessories\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Local Settings\<INETFILES>\!#_RESTORE_FILES_#!.inf
- <LS_APPDATA>\Microsoft\Media Player\!#_RESTORE_FILES_#!.inf
- <LS_APPDATA>\Microsoft\Windows Media\9.0\!#_RESTORE_FILES_#!.inf
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\Cache\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Favorites\Links\!#_RESTORE_FILES_#!.inf
- <LS_APPDATA>\!#_RESTORE_FILES_#!.inf
- <LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\!#_RESTORE_FILES_#!.inf
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\startupCache\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Local Settings\History\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Local Settings\History\History.IE5\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\!#_RESTORE_FILES_#!.inf
- <LS_APPDATA>\Mozilla\Firefox\Profiles\cwdgt0y8.default\!#_RESTORE_FILES_#!.inf
- <LS_APPDATA>\VMware\!#_RESTORE_FILES_#!.inf
- %HOMEPATH%\Local Settings\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\DRM\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Documents\My Pictures\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Documents\My Videos\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Application Data\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\S-1-5-18\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Application Data\Microsoft\Dr Watson\!#_RESTORE_FILES_#!.inf
- %APPDATA%\!#_RESTORE_FILES_#!.inf
- <Текущая директория>\!#_RESTORE_FILES_#!.inf
- C:\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Application Data\Microsoft\Media Player\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Documents\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Documents\My Music\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Application Data\Microsoft\Network\Connections\Pbk\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\!#_RESTORE_FILES_#!.inf
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\SendTo\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Start Menu\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Start Menu\Programs\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Local Settings\Application Data\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Local Settings\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Local Settings\History\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Templates\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\LocalService\Cookies\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Application Data\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Cookies\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\History\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\!#_RESTORE_FILES_#!.inf
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\!#_RESTORE_FILES_#!.inf
Перемещает следующие файлы:
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\mimeTypes.rdf в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\mimeTypes.rdf.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\localstore.rdf в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\localstore.rdf.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\permissions.sqlite.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\pluginreg.dat.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\places.sqlite.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.ini в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.ini.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\downloads.sqlite.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\key3.db.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\formhistory.sqlite.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\signons.sqlite.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.js.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\webappsstore.sqlite.[3bitcoins@protonmail.com].blocking
- %APPDATA%\winscp.rnd в %APPDATA%\winscp.rnd.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\profiles.ini в %APPDATA%\Mozilla\Firefox\profiles.ini.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.json в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.json.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\prefs.js.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\search.sqlite.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\sessionstore.bak.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\secmod.db.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\desktop.ini в %APPDATA%\Microsoft\Internet Explorer\Quick Launch\desktop.ini.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Microsoft\Internet Explorer\Desktop.htt в %APPDATA%\Microsoft\Internet Explorer\Desktop.htt.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk в %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk в %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf в %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Microsoft\Address Book\%USERNAME%.wab в %APPDATA%\Microsoft\Address Book\%USERNAME%.wab.[3bitcoins@protonmail.com].blocking
- %APPDATA%\desktop.ini в %APPDATA%\desktop.ini.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Microsoft\Address Book\%USERNAME%.wab~ в %APPDATA%\Microsoft\Address Book\%USERNAME%.wab~.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Microsoft\Internet Explorer\brndlog.txt в %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Microsoft\Internet Explorer\brndlog.bak в %APPDATA%\Microsoft\Internet Explorer\brndlog.bak.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chromeappsstore.sqlite.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userContent-example.css.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\compatibility.ini в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\compatibility.ini.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cookies.sqlite.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\content-prefs.sqlite.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarkbackups\bookmarks-2011-11-10.json.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Microsoft\Media Player\0007F0B7.wpl в %APPDATA%\Microsoft\Media Player\0007F0B7.wpl.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarks.html в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarks.html.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\chrome\userChrome-example.css.[3bitcoins@protonmail.com].blocking
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db в %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\cert8.db.[3bitcoins@protonmail.com].blocking
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
