Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Client32] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\Client32] 'ImagePath' = '"%ProgramFiles%\NetSupport\NetSupport Manager\client32.exe" /* * '
- [<HKLM>\SYSTEM\ControlSet001\Services\PCISys] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\PCISys] 'ImagePath' = 'system32\drivers\pcisys.sys'
Вредоносные функции:
Создает и запускает на исполнение:
- '%WINDIR%\Temp\WdfTemp\Microsoft Kernel-Mode Driver Framework Install-v1.5-WinXP.exe' Kernel-Mode Driver Framework Install-v1.5-WinXP.exe /quiet
- 'C:\c339a754d7480598d29705e9\update\update.exe' /quiet
- '%ProgramFiles%\NetSupport\NetSupport Manager\checkdvd.exe'
- '%ProgramFiles%\NetSupport\NetSupport Manager\WINSTALL.EXE' /EV"NetSupport School" /EF".\Log Files" /EF".\Bookmarks" /EF".\Tests" /EF".\Store" /EF".\inv" /EA /EX /EC /Q /V /Q /I *
Запускает на исполнение:
- '<SYSTEM32>\msiexec.exe' -Embedding A3C18CAD034E5651DBDCDC892840296E
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\cmd.exe' /c ATTRIB -R "%TEMP%\{797FDD5F-552B-46D0-951B-EE8F2628CFBB}\\nsm.lic"
- '<SYSTEM32>\msiexec.exe' -Embedding 27D971F4D70081F81557A4CF85B2E118 M Global\MSI0000
- '<SYSTEM32>\attrib.exe' -R "%TEMP%\{797FDD5F-552B-46D0-951B-EE8F2628CFBB}\\nsm.lic"
- '<SYSTEM32>\net1.exe' stop client32
- '<SYSTEM32>\net.exe' stop client32
- '<SYSTEM32>\taskkill.exe' /F /IM client32.exe
- '<SYSTEM32>\msiexec.exe' /i "c:\temp\netsupportmanager.msi" /q
- '<SYSTEM32>\cmd.exe' /c ""c:\temp\installme.cmd" "
Изменения в файловой системе:
Создает следующие файлы:
- %ProgramFiles%\NetSupport\NetSupport Manager\Inv\amberbar.gif
- %ProgramFiles%\NetSupport\NetSupport Manager\Inv\bar.gif
- %ProgramFiles%\NetSupport\NetSupport Manager\IcoViewer.dll
- %ProgramFiles%\NetSupport\NetSupport Manager\Inv\video2.gif
- %ProgramFiles%\NetSupport\NetSupport Manager\Inv\baseboard.gif
- %ProgramFiles%\NetSupport\NetSupport Manager\Inv\btn_down_grey.gif
- %ProgramFiles%\NetSupport\NetSupport Manager\Inv\btn_up.gif
- %ProgramFiles%\NetSupport\NetSupport Manager\Inv\broken.gif
- %ProgramFiles%\NetSupport\NetSupport Manager\Inv\btn_down.gif
- %ProgramFiles%\NetSupport\NetSupport Manager\shfolder.dll
- %ProgramFiles%\NetSupport\NetSupport Manager\PCICHEK.DLL
- %ProgramFiles%\NetSupport\NetSupport Manager\nsm32.chm
- %ProgramFiles%\NetSupport\NetSupport Manager\supporttool.exe
- %ProgramFiles%\NetSupport\NetSupport Manager\DBI.EXE
- %ProgramFiles%\NetSupport\NetSupport Manager\logo.png
- %ProgramFiles%\NetSupport\NetSupport Manager\PCIhtmlgen.dll
- %ProgramFiles%\NetSupport\NetSupport Manager\WINSTALL.EXE
- %ProgramFiles%\NetSupport\NetSupport Manager\NSClient32UI.exe
- %ProgramFiles%\NetSupport\NetSupport Manager\Inv\verified.gif
- %ProgramFiles%\NetSupport\NetSupport Manager\devcon.exe
- %ProgramFiles%\NetSupport\NetSupport Manager\Inv\redbar.gif
- %ProgramFiles%\NetSupport\NetSupport Manager\Inv\unknown.gif
- %ProgramFiles%\NetSupport\NetSupport Manager\toastChat.png
- %ProgramFiles%\NetSupport\NetSupport Manager\NSToast.exe
- %ProgramFiles%\NetSupport\NetSupport Manager\gdihook5.cat
- %ProgramFiles%\NetSupport\NetSupport Manager\toastImageAndText.png
- %ProgramFiles%\NetSupport\NetSupport Manager\toastMessage.png
- %ProgramFiles%\NetSupport\NetSupport Manager\Inv\cpu2.gif
- %ProgramFiles%\NetSupport\NetSupport Manager\Inv\disk2.gif
- %ProgramFiles%\NetSupport\NetSupport Manager\Inv\btn_up_grey.gif
- %ProgramFiles%\NetSupport\NetSupport Manager\Inv\computer2.gif
- %ProgramFiles%\NetSupport\NetSupport Manager\Inv\greenbar.gif
- %ProgramFiles%\NetSupport\NetSupport Manager\Inv\network2.gif
- %ProgramFiles%\NetSupport\NetSupport Manager\Inv\printer2.gif
- %ProgramFiles%\NetSupport\NetSupport Manager\Inv\header.gif
- %ProgramFiles%\NetSupport\NetSupport Manager\Inv\keyboard2.gif
- C:\c339a754d7480598d29705e9\spmsg.dll
- C:\c339a754d7480598d29705e9\kmdfcustom.dll
- C:\c339a754d7480598d29705e9\spupdsvc.exe
- C:\c339a754d7480598d29705e9\spuninst.exe
- %WINDIR%\Temp\WdfTemp\Microsoft Kernel-Mode Driver Framework Install-v1.5-Win2k.exe
- %WINDIR%\Temp\WdfTemp\Wdf.cat
- %WINDIR%\Temp\WdfTemp\Wdf01000.inf
- %WINDIR%\Temp\WdfTemp\Microsoft Kernel-Mode Driver Framework Install-v1.5-Srv2k3.exe
- %WINDIR%\Temp\WdfTemp\Microsoft Kernel-Mode Driver Framework Install-v1.5-WinXP.exe
- C:\c339a754d7480598d29705e9\update\update.inf
- C:\c339a754d7480598d29705e9\update\update.exe
- C:\c339a754d7480598d29705e9\$shtdwn$.req
- C:\c339a754d7480598d29705e9\update\update.ver
- C:\c339a754d7480598d29705e9\update\updspapi.dll
- C:\c339a754d7480598d29705e9\wdfldr.sys
- C:\c339a754d7480598d29705e9\wdf01000.sys
- C:\c339a754d7480598d29705e9\update\kmdfcustom.dll
- C:\c339a754d7480598d29705e9\update\wdf01005.cat
- %ProgramFiles%\NetSupport\NetSupport Manager\Client32.upd
- %ProgramFiles%\NetSupport\NetSupport Manager\client32.ini
- <DRIVERS>\nsafltr.sys
- %ProgramFiles%\NetSupport\NetSupport Manager\NSM.LIC
- %ProgramFiles%\NetSupport\NetSupport Manager\mfc100u.dll
- %ProgramFiles%\NetSupport\NetSupport Manager\mfc100.dll
- %ProgramFiles%\NetSupport\NetSupport Manager\NSM.ini
- %ProgramFiles%\NetSupport\NetSupport Manager\msvcr100.dll
- %ProgramFiles%\NetSupport\NetSupport Manager\msvcp100.dll
- <SYSTEM32>\tempfile.$$$
- <SYSTEM32>\pcivdd.dll
- %WINDIR%\Temp\WdfTemp\WDF.cab
- <SYSTEM32>\pcisys.ntk
- <SYSTEM32>\pcimon.dll
- <SYSTEM32>\pcigina.dll
- <SYSTEM32>\clhook4.dll
- <DRIVERS>\pcisys.sys
- <SYSTEM32>\pcimsg.dll
- %ProgramFiles%\NetSupport\NetSupport Manager\IsMetro.exe
- %WINDIR%\Installer\MSIE.tmp
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\MSIF.tmp
- %WINDIR%\Installer\2eeec.ipi
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\MSI8.tmp
- %WINDIR%\Installer\MSIB.tmp
- %WINDIR%\Installer\MSIA.tmp
- %ProgramFiles%\NetSupport\NetSupport Manager\client32.exe
- %ProgramFiles%\NetSupport\NetSupport Manager\clhook4.dll
- %ProgramFiles%\NetSupport\NetSupport Manager\CryptPak.dll
- %ProgramFiles%\NetSupport\NetSupport Manager\Control.kbd
- %WINDIR%\Installer\MSI15.tmp
- C:\Config.Msi\2eeed.rbs
- %WINDIR%\Installer\MSI10.tmp
- %WINDIR%\Installer\MSI14.tmp
- %WINDIR%\Installer\MSI13.tmp
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\Installer\2eeea.msi
- %TEMP%\{797FDD5F-552B-46D0-951B-EE8F2628CFBB}\NSM.LIC
- %TEMP%\{797FDD5F-552B-46D0-951B-EE8F2628CFBB}\product.dat
- C:\temp\CLIENT32.INI
- C:\temp\netsupportmanager.msi
- C:\temp\installme.cmd
- C:\temp\NSM.LIC
- C:\temp\NSM.ini
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\MSI2.tmp
- %TEMP%\{797FDD5F-552B-46D0-951B-EE8F2628CFBB}\NS.inf
- %TEMP%\{797FDD5F-552B-46D0-951B-EE8F2628CFBB}\readnsm.chm
- %TEMP%\{797FDD5F-552B-46D0-951B-EE8F2628CFBB}\Client32.upd
- %TEMP%\{797FDD5F-552B-46D0-951B-EE8F2628CFBB}\client32.ini
- %ProgramFiles%\NetSupport\NetSupport Manager\checkdvd.exe
- %ProgramFiles%\NetSupport\NetSupport Manager\startlogo.bmp
- %ProgramFiles%\NetSupport\NetSupport Manager\VolumeControlWXP.DLL
- %ProgramFiles%\NetSupport\NetSupport Manager\product.dat
- %ProgramFiles%\NetSupport\NetSupport Manager\pcisys.sys
- %ProgramFiles%\NetSupport\NetSupport Manager\TCCTL32.DLL
- %ProgramFiles%\NetSupport\NetSupport Manager\remcmdstub.exe
- %ProgramFiles%\NetSupport\NetSupport Manager\nsmres.dll
- %ProgramFiles%\NetSupport\NetSupport Manager\pcictl.dll
- %ProgramFiles%\NetSupport\NetSupport Manager\nsafltr.inf
- %ProgramFiles%\NetSupport\NetSupport Manager\pcicapi.dll
- %ProgramFiles%\NetSupport\NetSupport Manager\AudioCapture.dll
- %ProgramFiles%\NetSupport\NetSupport Manager\nsafltr.sys
- %ProgramFiles%\NetSupport\NetSupport Manager\pscrinst.dll
- %ProgramFiles%\NetSupport\NetSupport Manager\VolumeControlWVI.DLL
- %ProgramFiles%\NetSupport\NetSupport Manager\WdfCoInstaller01005.dll
- %ProgramFiles%\NetSupport\NetSupport Manager\nspscr.sys
- %ProgramFiles%\NetSupport\NetSupport Manager\nspscr.inf
- %ProgramFiles%\NetSupport\NetSupport Manager\NTFSDB.MSG
- %ProgramFiles%\NetSupport\NetSupport Manager\nsmexec.exe
- %ProgramFiles%\NetSupport\NetSupport Manager\PCICL32.DLL
- %ProgramFiles%\NetSupport\NetSupport Manager\NTFSDB.EXE
- %ProgramFiles%\NetSupport\NetSupport Manager\injlib.dll
- %ProgramFiles%\NetSupport\NetSupport Manager\gdihook5.sys
- %ProgramFiles%\NetSupport\NetSupport Manager\gdihook5.dll
- %ProgramFiles%\NetSupport\NetSupport Manager\HTCTL32.DLL
- %ProgramFiles%\NetSupport\NetSupport Manager\gdihook5.inf
- %ProgramFiles%\NetSupport\NetSupport Manager\PCIMSG.DLL
- %ProgramFiles%\NetSupport\NetSupport Manager\pcimonhook.dll
- %ProgramFiles%\NetSupport\NetSupport Manager\PCIVDD.DLL
- %ProgramFiles%\NetSupport\NetSupport Manager\PCIRES.dll
- %ProgramFiles%\NetSupport\NetSupport Manager\PCIMON.DLL
- %ProgramFiles%\NetSupport\NetSupport Manager\PCIHOOKS.DLL
- %ProgramFiles%\NetSupport\NetSupport Manager\pcigina.dll
- %ProgramFiles%\NetSupport\NetSupport Manager\PCIinv.dll
- %ProgramFiles%\NetSupport\NetSupport Manager\PCIIMAGE.DLL
Удаляет следующие файлы:
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\MSIE.tmp
- %WINDIR%\Installer\MSIB.tmp
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\MSI14.tmp
- %WINDIR%\Installer\MSI15.tmp
- %WINDIR%\Installer\MSI10.tmp
- %WINDIR%\Installer\MSI13.tmp
- %WINDIR%\Installer\MSIA.tmp
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI8.tmp
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\MSI7.tmp
Сетевая активность:
Подключается к:
- 'csc3-2010-crl.verisign.com':80
- 'crl.verisign.com':80
- 'wp#d':80
TCP:
Запросы HTTP GET:
- http://crl.verisign.com/pca3-g5.crl
- http://csc3-2010-crl.verisign.com/CSC3-2010.crl
- http://11#.#11.111.1/wpad.dat via wp#d
- http://crl.verisign.com/pca3.crl
UDP:
- DNS ASK csc3-2010-crl.verisign.com
- DNS ASK crl.verisign.com
- DNS ASK wp#d
Другое:
Ищет следующие окна:
- ClassName: 'PCIVideoPlayer32' WindowName: ''
- ClassName: 'NSSWControl32' WindowName: ''
- ClassName: 'PCIRemoteInstall' WindowName: ''
- ClassName: 'NSMRunSCript' WindowName: ''
- ClassName: 'PCISAClass' WindowName: ''
- ClassName: 'ScriptWClass' WindowName: ''
- ClassName: 'NSMWControl32' WindowName: ''
- ClassName: 'NSConnSvrUI' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'RUNPLUGIN [loggedonuser]' WindowName: 'PCIRUNPLUGIN [loggedonuser]'
- ClassName: 'RUNPLUGIN' WindowName: 'PCIRUNPLUGIN'
- ClassName: 'NSMWClass' WindowName: ''
