Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\DeskAlerts.lnk
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\DeskAlerts_Service] 'ImagePath' = '%ProgramFiles%\DeskAlerts\DeskAlertsService.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\DeskAlerts_Service] 'Start' = '00000002'
Вредоносные функции:
Запускает на исполнение:
- '%ProgramFiles%\DeskAlerts\DeskAlertsService.exe' -i
- '%TEMP%\nse4.tmp\ns7.tmp' %ProgramFiles%\DeskAlerts\DeskAlertsService.exe -i
- '%TEMP%\nse4.tmp\ns8.tmp' %ProgramFiles%\DeskAlerts\DeskAlertsService.exe -s
- '%ProgramFiles%\DeskAlerts\DeskAlertsService.exe'
- '%ProgramFiles%\DeskAlerts\DeskAlertsService.exe' -s
- '%TEMP%\nse4.tmp\ns5.tmp' sc stop DeskAlerts_Service
- 'C:\temp\deskalerts\deskalerts_setup_silent.exe'
- '<SYSTEM32>\sc.exe' stop DeskAlerts_Service
- '<SYSTEM32>\sc.exe' delete DeskAlerts_Service
- '%TEMP%\nse4.tmp\ns6.tmp' sc delete DeskAlerts_Service
Изменения в файловой системе:
Создает следующие файлы:
- %ProgramFiles%\DeskAlerts\next_button.gif
- %ProgramFiles%\DeskAlerts\notify.wav
- %ProgramFiles%\DeskAlerts\logo.png
- %ProgramFiles%\DeskAlerts\minibrowsercaption.html
- %ProgramFiles%\DeskAlerts\options.html
- %ProgramFiles%\DeskAlerts\previous_button.gif
- %ProgramFiles%\DeskAlerts\print_button.gif
- %ProgramFiles%\DeskAlerts\optionscaption.html
- %ProgramFiles%\DeskAlerts\postpone_button.gif
- %ProgramFiles%\DeskAlerts\loader.gif
- %ProgramFiles%\DeskAlerts\img_11.gif
- %ProgramFiles%\DeskAlerts\img_11f.gif
- %ProgramFiles%\DeskAlerts\img_09.gif
- %ProgramFiles%\DeskAlerts\img_10.gif
- %ProgramFiles%\DeskAlerts\img_11s.gif
- %ProgramFiles%\DeskAlerts\jquery.min.js
- %ProgramFiles%\DeskAlerts\left.gif
- %ProgramFiles%\DeskAlerts\img_12.gif
- %ProgramFiles%\DeskAlerts\img_13.gif
- %ProgramFiles%\DeskAlerts\tickercaption.html
- %ProgramFiles%\DeskAlerts\version.txt
- %ProgramFiles%\DeskAlerts\submit_button.gif
- %ProgramFiles%\DeskAlerts\ticker.js
- %ProgramFiles%\DeskAlerts\xcpy.exe
- %ALLUSERSPROFILE%\Application Data\DeskAlerts\ALERTS00001\conf.xml
- %ProgramFiles%\DeskAlerts\DeskAlertsService.log
- %ALLUSERSPROFILE%\Start Menu\Programs\DeskAlerts\DeskAlerts.lnk
- %ALLUSERSPROFILE%\Desktop\DeskAlerts.lnk
- %ProgramFiles%\DeskAlerts\spacer.gif
- %ProgramFiles%\DeskAlerts\resize_icon.gif
- %ProgramFiles%\DeskAlerts\right.gif
- %ProgramFiles%\DeskAlerts\read_it.gif
- %ProgramFiles%\DeskAlerts\reg.js
- %ProgramFiles%\DeskAlerts\save_button.gif
- %ProgramFiles%\DeskAlerts\separator.gif
- %ProgramFiles%\DeskAlerts\skin.css
- %ProgramFiles%\DeskAlerts\search.gif
- %ProgramFiles%\DeskAlerts\search_input_bg.gif
- %ProgramFiles%\DeskAlerts\close_button.gif
- %ProgramFiles%\DeskAlerts\close_ticker.gif
- %ProgramFiles%\DeskAlerts\clear_history.gif
- %ProgramFiles%\DeskAlerts\close.gif
- %ProgramFiles%\DeskAlerts\conf.xml
- %ProgramFiles%\DeskAlerts\delete_h.gif
- %ProgramFiles%\DeskAlerts\deskalerts.dll
- %ProgramFiles%\DeskAlerts\date.js
- %ProgramFiles%\DeskAlerts\delete.gif
- %ProgramFiles%\DeskAlerts\cancel_button.gif
- %TEMP%\aut2.tmp
- C:\temp\deskalerts\deskalerts_setup.msi
- %TEMP%\aut1.tmp
- C:\temp\deskalerts\deskalerts_setup_silent.exe
- %ProgramFiles%\DeskAlerts\DeskAlertsScreenSaver.scr
- %ProgramFiles%\DeskAlerts\alertcaption.html
- %ProgramFiles%\DeskAlerts\buble.png
- %ProgramFiles%\DeskAlerts\DeskAlertsService.exe
- %ProgramFiles%\DeskAlerts\alert.js
- %ProgramFiles%\DeskAlerts\img_03s.gif
- %ProgramFiles%\DeskAlerts\img_04.gif
- %ProgramFiles%\DeskAlerts\img_03.gif
- %ProgramFiles%\DeskAlerts\img_03f.gif
- %ProgramFiles%\DeskAlerts\img_05.gif
- %ProgramFiles%\DeskAlerts\img_08.gif
- %ProgramFiles%\DeskAlerts\img_08s.gif
- %ProgramFiles%\DeskAlerts\img_06.gif
- %ProgramFiles%\DeskAlerts\img_06s.gif
- %ProgramFiles%\DeskAlerts\img_02.gif
- %ProgramFiles%\DeskAlerts\feedbackcaption.html
- %ProgramFiles%\DeskAlerts\hg29fhh847c03nu08f.key
- %ProgramFiles%\DeskAlerts\deskalerts.exe
- %ProgramFiles%\DeskAlerts\feedback.html
- %ProgramFiles%\DeskAlerts\hist.html
- %ProgramFiles%\DeskAlerts\icons.bmp
- %ProgramFiles%\DeskAlerts\img_01.gif
- %ProgramFiles%\DeskAlerts\history_icons.gif
- %ProgramFiles%\DeskAlerts\historycaption.html
Удаляет следующие файлы:
- %TEMP%\nse4.tmp\ns6.tmp
- %TEMP%\nse4.tmp\ns7.tmp
- %TEMP%\nse4.tmp\ns5.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
