Trojan.PWS.Siggen2.419

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\RegAsm.exe

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\iepv.exe' /stext %TEMP%\ie.txt
'%TEMP%\mailpv.exe' /stext %TEMP%\mail.txt
'%APPDATA%\RegAsm.exe'
'%TEMP%\passwordfox.exe' /stext %TEMP%\firefox.txt

Запускает на исполнение:

'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\ilasm.exe' "%APPDATA%\RegAsm.il"
'%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe'

Внедряет код в

следующие системные процессы:

%WINDIR%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:

[<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Pets]
[<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Seasons]
[<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Nightlife]
[<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Open For Business]
[<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Glamour Life Stuff]
[<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Family Fun Stuff]
[<HKLM>\SOFTWARE\DVD Audio Extractor\Settings]
[<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Celebration Stuff]
[<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 H M Fashion Stuff]
[<HKLM>\SOFTWARE\Cyberlink\PowerDVD]
[<HKLM>\SOFTWARE\Cyberlink\PowerBar]
[<HKLM>\SOFTWARE\Valve\Counter-Strike\Settings]
[<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\Crysis]
[<HKLM>\SOFTWARE\CyberLink\PowerProducer\3.0\UserReg]
[<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2]
[<HKLM>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 University]
[<HKLM>\SOFTWARE\Valve\Day of Defeat\Settings]
[<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\The Battle for Middle-earth II]
[<HKLM>\SOFTWARE\Sierra\Empire Earth II]
[<HKLM>\SOFTWARE\THQ\Frontlines: Fuel of War]
[<HKLM>\SOFTWARE\Headlight\GetRight]
[<HKLM>\SOFTWARE\Electronic Arts\EA Distribution\Freedom Force]
[<HKLM>\SOFTWARE\THQ\Frontlines: Fuel of War Beta]
[<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Global Operations]
[<HKLM>\SOFTWARE\Electronic Arts\EA Games\Hellgate: London]
[<HKLM>\SOFTWARE\Illusion Softworks\Hidden & Dangerous 2]
[<HKLM>\SOFTWARE\Valve\Gunman]
[<HKLM>\SOFTWARE\Valve\Half-Life\Setting]
[<HKLM>\SOFTWARE\CRYTEK\FARCRY\UBI.COM]
[<HKLM>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2002]
[<HKLM>\SOFTWARE\Sierra\CDKey]
[<HKLM>\SOFTWARE\F-Secure\BackWeb\iLauncher]
[<HKLM>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2003]
[<HKLM>\SOFTWARE\Electronic Arts\EA Sports\FIFA 07]
[<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\FIFA 08]
[<HKLM>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2004]
[<HKLM>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2005]
[<HKLM>\SOFTWARE\THQ\Company of Heroes]
[<HKLM>\SOFTWARE\Elcom\Advanced PDF Password Recovery\Registration]
[<HKLM>\SOFTWARE\Elcom\Advanced PDF Password Recovery\Registration Pro]
[<HKLM>\SOFTWARE\Eugen Systems\ActOfWar]
[<HKLM>\SOFTWARE\Adobe\Photoshop\7.0\Registration]
[<HKLM>\SOFTWARE\Elcom\Advanced ZIP Password Recovery\Registration]
[<HKLM>\SOFTWARE\@stake\LC5\Registration]
[<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 1942]
[<HKLM>\SOFTWARE\Sunflowers\Anno 1701]
[<HKLM>\SOFTWARE\ashampoo\Ashampoo WinOptimizer Platinum 3]
[<HKLM>\SOFTWARE\Activision\Call of Duty WAW]
[<HKLM>\SOFTWARE\THQ\Dawn of War]
[<HKLM>\SOFTWARE\Activision\Call of Duty 2]
[<HKLM>\SOFTWARE\Activision\Call of Duty 4]
[<HKLM>\SOFTWARE\THQ\Dawn of War - Dark Crusade]
[<HKLM>\SOFTWARE\ahead\Installation\BAK\Nero 7\Info]
[<HKLM>\SOFTWARE\ACD Systems\PicaView]
[<HKLM>\SOFTWARE\SEGA\Medieval II Total War]
[<HKLM>\SOFTWARE\Adobe\Golive\5.0\Registration]
[<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 1942 Secret Weapons of WWII]
[<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Generals]
[<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Command and Conquer Generals Zero Hour]
[<HKLM>\SOFTWARE\Techland\Chrome]
[<HKLM>\SOFTWARE\Codec Tweak Tool]
[<HKLM>\SOFTWARE\Westwood\Red Alert 2]
[<HKLM>\SOFTWARE\Electronic Arts\Command and Conquer 3]
[<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\Command and Conquer 3]
[<HKLM>\SOFTWARE\Westwood\Red Alert]
[<HKLM>\SOFTWARE\Westwood\Tiberian Sun]
[<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 2142]
[<HKLM>\Software\Electronic Arts\EA GAMES\Battlefield Vietnam]
[<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 1942 The Road to Rome]
[<HKLM>\SOFTWARE\Electronic Arts\EA Games\Battlefield 2]
[<HKLM>\Software\Electronic Arts\EA GAMES\Black and White]
[<HKLM>\SOFTWARE\Electronic Arts\EA Games\Burnout Paradise]
[<HKLM>\SOFTWARE\TechSmith\Camtasia Studio\4.0]
[<HKLM>\Software\Electronic Arts\Black and White 2]
[<HKLM>\SOFTWARE\Electronic Arts\EA Games\Boulder Dash Rocks]
[<HKLM>\Software\Electronic Arts\Maxis\ Sim City 4 Deluxe]
[<HKLM>\Software\Network Associates, Inc.\Sniffer Pro\4.5\USER]
[<HKLM>\Software\Atari\Sid Meier's Pirates!]
[<HKLM>\Software\Ubisoft\SILENT HUNTER III\Keys]
[<HKLM>\Software\Silver Style Entertainment\Soldiers Of Anarchy]
[<HKLM>\Software\LucasArts\Star Wars Battlefront II\1.1]
[<HKLM>\Software\Steganos\SIAVPN]
[<HKLM>\Software\GSC Game World\STALKER-SHOC]
[<HKLM>\Software\LucasArts\Star Wars Battlefront II\1.0]
[<HKLM>\Software\PowerQuest\PartitionMagic\8.0\UserInfo]
[<HKLM>\Software\Passware\Encryption Analyzer\1\Registration,License]
[<HKLM>\Software\OnlineTVPlayer\RegInfo]
[<HKLM>\Software\O&O\O&O Defrag\8.0\Pro\licenses]
[<HKLM>\Software\Passware\Windows Key\7\Registration]
[<HKLM>\Software\Red Storm Entertainment\RAVENSHIELD]
[<HKLM>\Software\Electronic Arts\EA GAMES\Shogun Total War - Warlord Edition]
[<HKLM>\Software\EnTech\PowerStrip]
[<HKLM>\Software\KONAMI\PES2008]
[<HKLM>\Software\THQ\Gas Powered Games\Supreme Commander]
[<HKCU>\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
[<HKCU>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Software\Microsoft\Internet Account Manager\Accounts]
[<HKCU>\Software\Google\Google Talk\Accounts]
[<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
[<HKCU>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
[<HKCU>\Software\Microsoft\IdentityCRL]
[<HKCU>\Software\Microsoft\Windows Live Mail]
[<HKCU>\Software\Microsoft\MSNMessenger]
[<HKCU>\Software\Yahoo\Pager]
[<HKLM>\Software\Electronic Arts\EA Games\The Battle for Middle-earth]
[<HKLM>\Software\Electronic Arts\EA Games\The Orange Box]
[<HKLM>\Software\TechSmith\SnagIt\8]
[<HKLM>\Software\TexasCalc\License]
[<HKLM>\Software\Pegasys Inc.\TMPGEnc DVD Author\1.0]
[<HKLM>\Software\TuneUp\Utilities\8.0]
[<HKLM>\Software\Nullsoft\Winamp]
[<HKLM>\Software\TuneUp\Utilities\6.0]
[<HKLM>\Software\TuneUp\Utilities\7.0]
[<HKLM>\Software\NuMega\SmartCheck]
[<HKLM>\SOFTWARE\Electronic Arts\Medal of Honor Airborne]
[<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Medal of Honor Allied Assault]
[<HKLM>\SOFTWARE\Electronic Arts\EA Sports\Madden NFL 07]
[<HKLM>\SOFTWARE\JSG\Matrix Saver V2]
[<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Medal of Honor Allied Assault Breakthrough]
[<HKLM>\SOFTWARE\mIRC]
[<HKLM>\SOFTWARE\Electronic Arts\EA Sports\Nascar Racing 2002]
[<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Medal of Honor Allied Assault Spearhead]
[<HKLM>\SOFTWARE\Electronic Arts\EA Games\Medal of Honor: Heroes 2]
[<HKLM>\SOFTWARE\JoWooD\InstalledGames\IG2]
[<HKLM>\SOFTWARE\AVConverter\iPod Converter]
[<HKLM>\SOFTWARE\IGI 2 Retail\CDKey]
[<HKLM>\SOFTWARE\Ahead\InCD]
[<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\James Bond 007 Nightfire]
[<HKLM>\SOFTWARE\Macromedia\Fireworks\7\Registration]
[<HKLM>\SOFTWARE\Macromedia\Dreamweaver\7\Registration]
[<HKLM>\SOFTWARE\3d0\Status Legends of Might and Magic]
[<HKLM>\SOFTWARE\Macromedia\Flash\7\Registration]
[<HKLM>\SOFTWARE\Electronic Arts\EA Sports\Nascar Racing 2003]
[<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\Need for Speed ProStreet]
[<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Need For Speed Underground]
[<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Need For Speed Hot Pursuit 2]
[<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Need for Speed Most Wanted]
[<HKLM>\SOFTWARE\Electronic Arts\EA GAMES\Need For Speed Underground 2]
[<HKLM>\SOFTWARE\Nero\Installation\Families\Nero 8\Info]
[<HKLM>\Software\Westwood\Nox]
[<HKLM>\SOFTWARE\Ahead\Nero - Burning Rom\Info]
[<HKLM>\Software\Nero\Installation\Families\Nero 7\Info]
[<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NHL 2004]
[<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NHL 2005]
[<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NHL 2002]
[<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NHL 2003]
[<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NBA LIVE 2003]
[<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NBA Live 08]
[<HKLM>\SOFTWARE\Electronic Arts\Electronic Arts\Need for Speed Carbon]
[<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NBA LIVE 2004]
[<HKLM>\SOFTWARE\Electronic Arts\EA Sports\NBA LIVE 07]
[<HKCU>\SOFTWARE\Electronic Arts\Electronic Arts\The Battle for Middle-earth II]
[<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2]
[<HKCU>\SOFTWARE\CyberLink\PowerProducer\3.0\UserReg]
[<HKCU>\SOFTWARE\Valve\Day of Defeat\Settings]
[<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 University]
[<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Pets]
[<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Seasons]
[<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Nightlife]
[<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Open For Business]
[<HKCU>\SOFTWARE\Electronic Arts\Command and Conquer 3]
[<HKCU>\SOFTWARE\Electronic Arts\Electronic Arts\Command and Conquer 3]
[<HKCU>\SOFTWARE\Westwood\Red Alert]
[<HKCU>\SOFTWARE\Westwood\Tiberian Sun]
[<HKCU>\SOFTWARE\THQ\Company of Heroes]
[<HKCU>\SOFTWARE\Cyberlink\PowerDVD]
[<HKCU>\SOFTWARE\Cyberlink\PowerBar]
[<HKCU>\SOFTWARE\Valve\Counter-Strike\Settings]
[<HKCU>\SOFTWARE\Electronic Arts\Electronic Arts\Crysis]
[<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Glamour Life Stuff]
[<HKCU>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2005]
[<HKCU>\SOFTWARE\Electronic Arts\EA Sports\FIFA 07]
[<HKCU>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2003]
[<HKCU>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2004]
[<HKCU>\SOFTWARE\Electronic Arts\Electronic Arts\FIFA 08]
[<HKCU>\SOFTWARE\THQ\Frontlines: Fuel of War]
[<HKCU>\SOFTWARE\Headlight\GetRight]
[<HKCU>\SOFTWARE\Electronic Arts\EA Distribution\Freedom Force]
[<HKCU>\SOFTWARE\THQ\Frontlines: Fuel of War Beta]
[<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Family Fun Stuff]
[<HKCU>\SOFTWARE\DVD Audio Extractor\Settings]
[<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 Celebration Stuff]
[<HKCU>\SOFTWARE\Electronic Arts\EA Games\The Sims 2 H M Fashion Stuff]
[<HKCU>\SOFTWARE\Sierra\Empire Earth II]
[<HKCU>\SOFTWARE\CRYTEK\FARCRY\UBI.COM]
[<HKCU>\SOFTWARE\Electronic Arts\EA Sports\FIFA 2002]
[<HKCU>\SOFTWARE\Sierra\CDKey]
[<HKCU>\SOFTWARE\F-Secure\BackWeb\iLauncher]
[<HKCU>\SOFTWARE\Westwood\Red Alert 2]
[<HKCU>\SOFTWARE\Adobe\Golive\5.0\Registration]
[<HKCU>\SOFTWARE\ahead\Installation\BAK\Nero 7\Info]
[<HKCU>\SOFTWARE\THQ\Dawn of War - Dark Crusade]
[<HKCU>\SOFTWARE\SEGA\Medieval II Total War]
[<HKCU>\SOFTWARE\ACD Systems\PicaView]
[<HKCU>\SOFTWARE\Elcom\Advanced PDF Password Recovery\Registration]
[<HKCU>\SOFTWARE\Elcom\Advanced PDF Password Recovery\Registration Pro]
[<HKCU>\SOFTWARE\Eugen Systems\ActOfWar]
[<HKCU>\SOFTWARE\Adobe\Photoshop\7.0\Registration]
[<HKCU>\SOFTWARE\Ubisoft\Splinter Cell Chaos Theory\Keys]
[<HKCU>\SOFTWARE\Activision\Call of Duty]
[<HKCU>\Software\Paltalk]
[<HKCU>\SOFTWARE\Ubisoft\Splinter Cell Pandora Tomorrow]
[<HKCU>\SOFTWARE\Activision\Call of Duty United Offensive]
[<HKCU>\SOFTWARE\Activision\Call of Duty WAW]
[<HKCU>\SOFTWARE\THQ\Dawn of War]
[<HKCU>\SOFTWARE\Activision\Call of Duty 2]
[<HKCU>\SOFTWARE\Activision\Call of Duty 4]
[<HKCU>\SOFTWARE\Elcom\Advanced ZIP Password Recovery\Registration]
[<HKCU>\SOFTWARE\Electronic Arts\EA Games\Boulder Dash Rocks]
[<HKCU>\SOFTWARE\Electronic Arts\EA Games\Burnout Paradise]
[<HKCU>\Software\Electronic Arts\EA GAMES\Black and White]
[<HKCU>\Software\Electronic Arts\Black and White 2]
[<HKCU>\SOFTWARE\TechSmith\Camtasia Studio\4.0]
[<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Generals]
[<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Command and Conquer Generals Zero Hour]
[<HKCU>\SOFTWARE\Techland\Chrome]
[<HKCU>\SOFTWARE\Codec Tweak Tool]
[<HKCU>\SOFTWARE\@stake\LC5\Registration]
[<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 1942]
[<HKCU>\SOFTWARE\Sunflowers\Anno 1701]
[<HKCU>\SOFTWARE\ashampoo\Ashampoo WinOptimizer Platinum 3]
[<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 1942 Secret Weapons of WWII]
[<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 2142]
[<HKCU>\Software\Electronic Arts\EA GAMES\Battlefield Vietnam]
[<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Battlefield 1942 The Road to Rome]
[<HKCU>\SOFTWARE\Electronic Arts\EA Games\Battlefield 2]
[<HKCU>\Software\KONAMI\PES2008]
[<HKCU>\Software\Red Storm Entertainment\RAVENSHIELD]
[<HKCU>\Software\Passware\Windows Key\7\Registration]
[<HKCU>\Software\EnTech\PowerStrip]
[<HKCU>\Software\Electronic Arts\EA GAMES\Shogun Total War - Warlord Edition]
[<HKCU>\Software\Electronic Arts\Maxis\ Sim City 4 Deluxe]
[<HKCU>\Software\Network Associates, Inc.\Sniffer Pro\4.5\USER]
[<HKCU>\Software\Atari\Sid Meier's Pirates!]
[<HKCU>\Software\Ubisoft\SILENT HUNTER III\Keys]
[<HKCU>\SOFTWARE\Nero\Installation\Families\Nero 8\Info]
[<HKCU>\Software\Westwood\Nox]
[<HKCU>\SOFTWARE\Ahead\Nero - Burning Rom\Info]
[<HKCU>\Software\Nero\Installation\Families\Nero 7\Info]
[<HKCU>\Software\NuMega\SmartCheck]
[<HKCU>\Software\PowerQuest\PartitionMagic\8.0\UserInfo]
[<HKCU>\Software\Passware\Encryption Analyzer\1\Registration,License]
[<HKCU>\Software\OnlineTVPlayer\RegInfo]
[<HKCU>\Software\O&O\O&O Defrag\8.0\Pro\licenses]
[<HKCU>\Software\Silver Style Entertainment\Soldiers Of Anarchy]
[<HKCU>\Software\TuneUp\Utilities\7.0]
[<HKCU>\Software\TuneUp\Utilities\8.0]
[<HKCU>\Software\Pegasys Inc.\TMPGEnc DVD Author\1.0]
[<HKCU>\Software\TuneUp\Utilities\6.0]
[<HKCU>\Software\Nullsoft\Winamp]
[<HKLM>\SOFTWARE\Activision\Call of Duty]
[<HKLM>\SOFTWARE\Activision\Call of Duty United Offensive]
[<HKLM>\SOFTWARE\Ubisoft\Splinter Cell Pandora Tomorrow]
[<HKLM>\SOFTWARE\Ubisoft\Splinter Cell Chaos Theory\Keys]
[<HKCU>\Software\LucasArts\Star Wars Battlefront II\1.1]
[<HKCU>\Software\Steganos\SIAVPN]
[<HKCU>\Software\GSC Game World\STALKER-SHOC]
[<HKCU>\Software\LucasArts\Star Wars Battlefront II\1.0]
[<HKCU>\Software\THQ\Gas Powered Games\Supreme Commander]
[<HKCU>\Software\Electronic Arts\EA Games\The Battle for Middle-earth]
[<HKCU>\Software\Electronic Arts\EA Games\The Orange Box]
[<HKCU>\Software\TechSmith\SnagIt\8]
[<HKCU>\Software\TexasCalc\License]
[<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Need For Speed Underground 2]
[<HKCU>\SOFTWARE\Macromedia\Flash\7\Registration]
[<HKCU>\SOFTWARE\Macromedia\Fireworks\7\Registration]
[<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\James Bond 007 Nightfire]
[<HKCU>\SOFTWARE\3d0\Status Legends of Might and Magic]
[<HKCU>\SOFTWARE\Macromedia\Dreamweaver\7\Registration]
[<HKCU>\SOFTWARE\Electronic Arts\Medal of Honor Airborne]
[<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Medal of Honor Allied Assault]
[<HKCU>\SOFTWARE\Electronic Arts\EA Sports\Madden NFL 07]
[<HKCU>\SOFTWARE\JSG\Matrix Saver V2]
[<HKCU>\SOFTWARE\Valve\Half-Life\Setting]
[<HKCU>\SOFTWARE\Electronic Arts\EA Games\Hellgate: London]
[<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Global Operations]
[<HKCU>\SOFTWARE\Valve\Gunman]
[<HKCU>\SOFTWARE\Illusion Softworks\Hidden & Dangerous 2]
[<HKCU>\SOFTWARE\JoWooD\InstalledGames\IG2]
[<HKCU>\SOFTWARE\AVConverter\iPod Converter]
[<HKCU>\SOFTWARE\IGI 2 Retail\CDKey]
[<HKCU>\SOFTWARE\Ahead\InCD]
[<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Medal of Honor Allied Assault Breakthrough]
[<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NBA LIVE 07]
[<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NBA Live 08]
[<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NBA LIVE 2003]
[<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NBA LIVE 2004]
[<HKCU>\SOFTWARE\Electronic Arts\Electronic Arts\Need for Speed Carbon]
[<HKCU>\SOFTWARE\Electronic Arts\Electronic Arts\Need for Speed ProStreet]
[<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Need For Speed Underground]
[<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Need For Speed Hot Pursuit 2]
[<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Need for Speed Most Wanted]
[<HKCU>\SOFTWARE\mIRC]
[<HKCU>\SOFTWARE\Electronic Arts\EA Sports\Nascar Racing 2002]
[<HKCU>\SOFTWARE\Electronic Arts\EA GAMES\Medal of Honor Allied Assault Spearhead]
[<HKCU>\SOFTWARE\Electronic Arts\EA Games\Medal of Honor: Heroes 2]
[<HKCU>\SOFTWARE\Electronic Arts\EA Sports\Nascar Racing 2003]
[<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NHL 2004]
[<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NHL 2005]
[<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NHL 2002]
[<HKCU>\SOFTWARE\Electronic Arts\EA Sports\NHL 2003]

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\iepv.exe
%TEMP%\firefox.txt
%TEMP%\mail.txt
%TEMP%\mailpv.exe
%APPDATA%\RegAsm.pdb
%APPDATA%\RegAsm.il
%TEMP%\passwordfox.exe
%APPDATA%\RegAsm.exe

Удаляет следующие файлы:

%TEMP%\iepv.exe
%TEMP%\mailpv.exe
%TEMP%\passwordfox.exe
%APPDATA%\RegAsm.pdb
%APPDATA%\RegAsm.il

Сетевая активность:

Подключается к:

'ac##ra.in':80
'wp#d':80

TCP:

Запросы HTTP GET:

http://11#.#11.111.1/wpad.dat via wp#d

Запросы HTTP POST:

http://ac##ra.in/design/fancybox/kc/logs.php

UDP:

DNS ASK ac##ra.in
DNS ASK wp#d

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней