Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Classes\regedit\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [<HKLM>\SOFTWARE\Classes\cmdfile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [<HKLM>\SOFTWARE\Classes\hlpfile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [<HKLM>\SOFTWARE\Classes\regfile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [<HKLM>\SOFTWARE\Classes\batfile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path] 'debugger' = '<LS_APPDATA>\shell.exe'
- [<HKLM>\SOFTWARE\Classes\piffile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [<HKLM>\SOFTWARE\Classes\comfile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [<HKLM>\SOFTWARE\Classes\Directory\shell\open\command] '' = '<SYSTEM32>\kernel.sys'
- [<HKLM>\SOFTWARE\Classes\WinRAR\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [<HKLM>\SOFTWARE\Classes\Folder\shell\open\command] '' = '<SYSTEM32>\kernel.sys'
- [<HKLM>\SOFTWARE\Classes\Drive\shell\open\command] '' = '<SYSTEM32>\kernel.sys'
- [<HKLM>\SOFTWARE\Classes\lnkfile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [<HKLM>\SOFTWARE\Classes\inifile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [<HKLM>\SOFTWARE\Classes\MSInfo.Document\Shell\Open\Command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [<HKLM>\SOFTWARE\Classes\mailto\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = '<SYSTEM32>\pengging.scr'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'service' = '<LS_APPDATA>\csrss.exe'
- [<HKLM>\SOFTWARE\Microsoft\Command Processor] 'Autorun' = '%WINDIR%\pengging.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.Exe "%WINDIR%\pengging.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'systray' = '%WINDIR%\pengging.exe'
- [<HKLM>\SOFTWARE\Classes\exefile\shell\open\command] '' = '"<SYSTEM32>\shell.exe" "%1" %*'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'pengging' = '<LS_APPDATA>\smss.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'msg' = '<LS_APPDATA>\lsass.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Paint.exe] 'Debugger' = '<LS_APPDATA>\shell.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Notepad.exe] 'Debugger' = '<LS_APPDATA>\shell.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe] 'Debugger' = '<LS_APPDATA>\shell.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe] 'Debugger' = '<LS_APPDATA>\shell.exe'
- [<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'Explorer.Exe "%WINDIR%\pengging.exe"'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\Userinit.Exe, %WINDIR%\pengging.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regedit.exe] 'Debugger' = '<LS_APPDATA>\shell.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe] 'Debugger' = '<LS_APPDATA>\shell.exe'
Создает или изменяет следующие файлы:
- %HOMEPATH%\Start Menu\Programs\Startup\%USERNAME%.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\default.exe
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует отображение:
- скрытых файлов
- расширений файлов
блокирует запуск следующих системных утилит:
- Диспетчера задач (Taskmgr)
- Редактора реестра (RegEdit)
блокирует:
- Компонент восстановления системы (SR)
Создает и запускает на исполнение:
- %WINDIR%\pengging.exe
Изменяет следующие настройки проводника Windows (Windows Explorer):
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'StartMenuLogOff' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoUserNameInStartMenu' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSMHelp' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoChangeStartMenu' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoThemesTab' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoTrayContextMenu' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetTaskbar' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetFolders' = '00000001'
Изменения в файловой системе:
Создает следующие файлы:
- <LS_APPDATA>\services.exe
- <LS_APPDATA>\lsass.exe
- <LS_APPDATA>\winlogon.exe
- <LS_APPDATA>\shell.exe
- %WINDIR%\msvbvm50.dll
- %WINDIR%\msvbvm60.dll
- <LS_APPDATA>\smss.exe
- <LS_APPDATA>\csrss.exe
- <SYSTEM32>\pengging.scr
- <SYSTEM32>\svchost .exe
- %WINDIR%\pengging.exe
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\default.exe
- <LS_APPDATA>\pengging.exe
- <SYSTEM32>\shell.exe
- <SYSTEM32>\kernel.sys
Присваивает атрибут 'скрытый' для следующих файлов:
- <LS_APPDATA>\shell.exe
- <LS_APPDATA>\winlogon.exe
- <LS_APPDATA>\services.exe
- %WINDIR%\msvbvm60.dll
- %WINDIR%\msvbvm50.dll
- <LS_APPDATA>\csrss.exe
- <SYSTEM32>\pengging.scr
- %WINDIR%\pengging.exe
- <SYSTEM32>\svchost .exe
- <LS_APPDATA>\smss.exe
- <LS_APPDATA>\lsass.exe
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: 'Luke Filewalker'
- ClassName: '' WindowName: 'AntiVir PersonalEdition Classic'
- ClassName: '' WindowName: 'CProcess'
- ClassName: '' WindowName: 'Antivirus'
- ClassName: '' WindowName: 'Display Properties'
- ClassName: '' WindowName: 'Application Data'
- ClassName: '' WindowName: 'Killer Machine'
- ClassName: '' WindowName: 'The Killer Machine'
- ClassName: '' WindowName: 'ScanVirus'
- ClassName: '' WindowName: 'TuneUp Process Manager'
- ClassName: '' WindowName: 'TuneUp Registry Editor'
- ClassName: '' WindowName: 'G TaskMan'
- ClassName: '' WindowName: 'TuneUp RegistryCleaner'
- ClassName: '' WindowName: 'Kaspersky Lab'
- ClassName: '' WindowName: 'AntiVirX'
- ClassName: '' WindowName: 'VBRezQ'
- ClassName: '' WindowName: 'I*n*d*o*prog v_i_rus s*c*a*n*ner'
- ClassName: '' WindowName: 'Antivir'
- ClassName: '' WindowName: 'Kaspersky'
- ClassName: '' WindowName: 'Program'
- ClassName: '' WindowName: 'antiviral'
- ClassName: '' WindowName: 'C:\WINNT\system32\cmd.exe'
- ClassName: '' WindowName: 'Safely Remove Hardware'
- ClassName: '' WindowName: 'Run'
- ClassName: '' WindowName: '<SYSTEM32>\cmd.exe'
- ClassName: '' WindowName: 'Anti Virus'
- ClassName: '' WindowName: 'Select Drive'
- ClassName: '' WindowName: 'Deep Freeze 5'
- ClassName: '' WindowName: 'Local Settings'
- ClassName: '' WindowName: 'System Restore'
- ClassName: '' WindowName: 'User Accounts'
- ClassName: '' WindowName: 'My Network Places'
- ClassName: '' WindowName: 'Deep Freeze 6'
- ClassName: '' WindowName: 'Deep Freeze STD'
- ClassName: '' WindowName: 'ShowKillProcess'
- ClassName: '' WindowName: 'System Properties'
- ClassName: '' WindowName: 'Master'
- ClassName: '' WindowName: 'WINNT'
- ClassName: '' WindowName: 'Program Files'
- ClassName: '' WindowName: 'system32'
- ClassName: '' WindowName: 'WINDOWS'
- ClassName: '' WindowName: 'Search Results'
- ClassName: '' WindowName: 'Group Policy'
- ClassName: '' WindowName: 'Taskbar and Start Menu Properties'
- ClassName: '' WindowName: 'Registry Editor'
- ClassName: '' WindowName: 'Windows Task Manager'
- ClassName: '' WindowName: 'ngging'
- ClassName: 'Indicator' WindowName: ''
- ClassName: '' WindowName: 'StartUp'
- ClassName: '' WindowName: 'RECYCLER'
- ClassName: '' WindowName: 'Process Viewer'
- ClassName: '' WindowName: 'Open With'
- ClassName: '' WindowName: 'An'
- ClassName: '' WindowName: 'Tuneup Utilities'
- ClassName: '' WindowName: 'CompactbyteAV'
- ClassName: '' WindowName: 'Norman Generic Fix'
- ClassName: '' WindowName: 'CurrProcess'
- ClassName: '' WindowName: 'Lock Folder 3.0'
- ClassName: '' WindowName: 'Pemantau dan Penghapus Proses/File Jahat'
- ClassName: '' WindowName: 'Anti...worm - www.gdata.pl/eng'
- ClassName: '' WindowName: 'Autoplay'
- ClassName: '' WindowName: 'Temp'
- ClassName: '' WindowName: 'Recycle Bin'
- ClassName: '' WindowName: 'Folder Options'
- ClassName: '' WindowName: 'Command Prompt'
- ClassName: '' WindowName: 'Control Panel'
- ClassName: '' WindowName: 'Add or Remove Programs'
- ClassName: '' WindowName: 'All Users'
- ClassName: '' WindowName: 'System Configuration Utility'
