Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\PrismXL] 'ImagePath' = '%CommonProgramFiles%\New Boundary\PrismXL\PRISMXL.SYS'
- [<HKLM>\SYSTEM\ControlSet001\Services\PrismXL] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- '%CommonProgramFiles%\New Boundary\PrismXL\PRISMXL.SYS'
Изменения в файловой системе:
Создает следующие файлы:
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\WebPDF.api
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\weblink.api
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\RdrENU.xml
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\WHA.api
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\Sendmail.api
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\PPKLite.api
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\Movie\QT4.dll
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\SelfSign.prc
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\reflow.api
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\SPPlugins\ADMPlugin.apl
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\Font\AdobeFnt.lst
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\ENUtxt.pdf
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\Font\cobo____.pfb
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\Font\cob_____.pfb
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\CMap\Identity-V
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\Uninstall\Uninst.dll
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\SPPlugins\ExpressViews.apl
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\CMap\Identity-H
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\ReadMe.html
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\Annotations\Stamps\Enu\Faces.pdf
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\Annotations\Annots.api
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\Annotations\Stamps\Enu\Standard.pdf
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\Annotations\Stamps\Enu\Pointers.pdf
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\AcroFill.api
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\oleaut32.dll
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\msvcrt.dll
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\Optional\Readme.txt
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\OPP.dll
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\Annotations\Stamps\Words.pdf
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\Movie\Movie.api
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\InterTrust\DocBox.api
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\Movie\QT3.dll
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\Movie\QT2.dll
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\IA32.api
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\EScript.api
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\DigSig.api
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\hls.api
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\plug_ins\EWH32.api
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\Font\com_____.pfb
- %ProgramFiles%\Workshare\Deltaview\WsLicGen.exe
- %ProgramFiles%\Workshare\Deltaview\WSDocumentProvider.dll
- %ProgramFiles%\Workshare\Deltaview\WsLogDll.dll
- %ProgramFiles%\Workshare\Deltaview\WSLog.exe
- %ProgramFiles%\Workshare\Deltaview\WSCrypt.dll
- %ProgramFiles%\Workshare\Deltaview\WSCompose.dll
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\setup.lid
- %ProgramFiles%\Workshare\Deltaview\WSConverter.dll
- %ProgramFiles%\Workshare\Deltaview\WSContext.dll
- %ProgramFiles%\Workshare\Deltaview\WSMessage.dll
- %APPDATA%\Workshare\DeltaView\Options.xml
- %WINDIR%\Installer\{E6C0BE69-6986-4af1-8E52-BF23168BB4B7}\IconBC29B6AE2.chm
- %WINDIR%\PICTAKER.LOG
- %APPDATA%\Workshare\DeltaView\Settings.xml
- %WINDIR%\Installer\{E6C0BE69-6986-4af1-8E52-BF23168BB4B7}\IconBC29B6AE1.pdf
- %ProgramFiles%\Workshare\Deltaview\WsTer32X.dll
- %ProgramFiles%\Workshare\Deltaview\WsShared.dll
- %WINDIR%\Installer\{E6C0BE69-6986-4af1-8E52-BF23168BB4B7}\IconBC29B6AE.exe
- %WINDIR%\Installer\1013f4.msi
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\Font\Pfm\Zd______.pfm
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\Font\Pfm\Sy______.pfm
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\Font\Pfm\zx______.pfm
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\Font\Pfm\Zx______.mmm
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\Font\Pfm\Coo_____.pfm
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\Font\Pfm\Cob_____.pfm
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\Font\coo_____.pfb
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\Font\Pfm\Com_____.pfm
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\Font\Pfm\Cobo____.pfm
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\Font\Pfm\Zy______.mmm
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Setup.ini
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Setup.exe
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\setup.iss
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\setup.ins
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\Font\Zy______.pfb
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\Font\Sy______.pfb
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\Font\Pfm\zy______.pfm
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\Font\Zx______.pfb
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Resource\Font\Zd______.pfb
- %ProgramFiles%\Workshare\Deltaview\EmailSMTP.dll
- %ProgramFiles%\Workshare\Deltaview\EmailNotes.dll
- %ProgramFiles%\Workshare\Deltaview\Examples\DeltaView Original Document.doc
- %ProgramFiles%\Workshare\Deltaview\Examples\DeltaView modified Document.doc
- %ProgramFiles%\Workshare\Deltaview\EmailMapi.dll
- %ProgramFiles%\Workshare\Deltaview\DVOutExt.dll
- %ProgramFiles%\Workshare\Deltaview\DVOption.dll
- %ProgramFiles%\Workshare\Deltaview\EmailBase.dll
- %ProgramFiles%\Workshare\Deltaview\EmailAbstraction.dll
- %ProgramFiles%\Workshare\Deltaview\FileCombo.dll
- %ProgramFiles%\Workshare\Deltaview\loadfail.rtf
- %ProgramFiles%\Workshare\Deltaview\LFManager.dll
- %ProgramFiles%\Workshare\Deltaview\Lumberjack.exe
- %ProgramFiles%\Workshare\Deltaview\LocalFileStore.dll
- %ProgramFiles%\Workshare\Deltaview\InterwovenSiteExt.dll
- %ProgramFiles%\Workshare\Deltaview\IManDeskSite.dll
- %ProgramFiles%\Workshare\Deltaview\icon3.ico
- %ProgramFiles%\Workshare\Deltaview\InterwovenSiteDP.dll
- %ProgramFiles%\Workshare\Deltaview\IMANDP.dll
- C:\Documents and Settings\Default User\Application Data\Workshare\DeltaView\settings.xml
- C:\Documents and Settings\Default User\Application Data\Workshare\DeltaView\options.xml
- %ProgramFiles%\Workshare\Deltaview\Config\dvconfig.ini
- %ProgramFiles%\Workshare\Deltaview\admin.pdf
- %ALLUSERSPROFILE%\Application Data\Workshare\DeltaView\Settings.xml
- %CommonProgramFiles%\New Boundary\PrismXL\PRISMXL.SYS
- %TEMP%\PRISMXL.SYS
- %ALLUSERSPROFILE%\Application Data\Prism Pack\UNAPPLY\<Имя файла> 1.PWR
- %ALLUSERSPROFILE%\Application Data\Prism Pack\UNAPPLY\<Имя файла>.PWR
- %ProgramFiles%\Workshare\Deltaview\ConfigMgr.dll
- %ProgramFiles%\Workshare\Deltaview\dv and imanage integration guide.pdf
- %ProgramFiles%\Workshare\Deltaview\DeskSiteExt.dll
- %ProgramFiles%\Workshare\Deltaview\DVIManExt.dll
- %ProgramFiles%\Workshare\Deltaview\DvConfigAssistant.exe
- %ProgramFiles%\Workshare\Deltaview\deltavw.pdf
- %ProgramFiles%\Workshare\Deltaview\DeltaView.dot
- %ProgramFiles%\Workshare\Deltaview\DeltaView Quick Reference Guide.pdf
- %ProgramFiles%\Workshare\Deltaview\DeltaVw.exe
- %ProgramFiles%\Workshare\Deltaview\deltavw.chm
- %ProgramFiles%\Workshare\Deltaview\MsW7Aut.dll
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\Acelite.dll
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\os.dat
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\AcroRd32.exe
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\Acrofx32.dll
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\layout.bin
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Help\Enu\Acrobat.pdf
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\data1.hdr
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\lang.dat
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Help\Enu\MiniReader.pdf
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\ActiveX\AcroIEHelper.ocx
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\JavaScripts\aform.js
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\CoolType.dll
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\msvcp60.dll
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\JavaScripts\Annots.js
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\Browser\nppdf32.dll
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\ActiveX\pdf.tlb
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\ActiveX\pdf.ocx
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\Bib.dll
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Reader\Agm.dll
- %ProgramFiles%\Workshare\Deltaview\Template.rtf
- %ProgramFiles%\Workshare\Deltaview\Settings.XML
- %ProgramFiles%\Workshare\Deltaview\WININET.DLL
- %ProgramFiles%\Workshare\Deltaview\Ter32.dll
- %ProgramFiles%\Workshare\Deltaview\ReadMe\DV Release Notes.pdf
- %ProgramFiles%\Workshare\Deltaview\Options\word caret.set
- %ProgramFiles%\Workshare\Deltaview\MsW8Aut.dll
- %ProgramFiles%\Workshare\Deltaview\Options.XML
- %ProgramFiles%\Workshare\Deltaview\Options\word overstrike.set
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\_inst32i.ex_
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Abcpy.ini
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\_user1.hdr
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\data1.cab
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\Data.tag
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\_user1.cab
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\_Setup.dll
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\_ISDel.exe
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\_sys1.hdr
- %ProgramFiles%\Workshare\Deltaview\WorkShare Acrobat Reader\_sys1.cab
Удаляет следующие файлы:
- %ALLUSERSPROFILE%\Application Data\Prism Pack\UNAPPLY\<Имя файла> 1.PWR
- %ALLUSERSPROFILE%\Application Data\Prism Pack\UNAPPLY\<Имя файла>.PWR
- %TEMP%\PRISMXL.SYS
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
