Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'BC8B982AA3' = '"%ALLUSERSPROFILE%\Application Data\BC8B982AA3.exe"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '00FF8B982AA3' = '"<Полный путь к файлу>"'
Создает или изменяет следующие файлы:
- %HOMEPATH%\Start Menu\Programs\Startup\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\Start Menu\Programs\Startup\50316C7335FB6617D7533C3337054A8B.x1881
- %HOMEPATH%\Start Menu\Programs\Startup\CAEC521211A0D62249196B8112AABA96.x1881
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
удаляет теневые копии разделов.
Запускает на исполнение:
- '<SYSTEM32>\sc.exe' stop BITS
- '<SYSTEM32>\cmd.exe' /C vssadmin.exe Delete Shadows /All /Quiet
- '<SYSTEM32>\cmd.exe' /C sc stop ERSvc
- '<SYSTEM32>\cmd.exe' /C sc stop WerSvc
- '<SYSTEM32>\cmd.exe' /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\sc.exe' stop ERSvc
- '<SYSTEM32>\sc.exe' stop WerSvc
- '<SYSTEM32>\cmd.exe' /C bcdedit /set {default} recoveryenabled No
- '<SYSTEM32>\sc.exe' stop wscsvc
- '<SYSTEM32>\cmd.exe' /C sc stop WinDefend
- '<SYSTEM32>\sc.exe' stop VVS
- '<SYSTEM32>\cmd.exe' /C sc stop VVS
- '<SYSTEM32>\cmd.exe' /C sc stop wscsvc
- '<SYSTEM32>\sc.exe' stop WinDefend
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\cmd.exe' /C sc stop wuauserv
- '<SYSTEM32>\cmd.exe' /C sc stop BITS
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\History\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\Local Settings\History\C4D49ED000ADB0C0C662F42901B79534.x1881
- %HOMEPATH%\Local Settings\History\History.IE5\0697BDDF04B66A90B684203505C04F04.x1881
- %HOMEPATH%\Local Settings\History\History.IE5\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\Local Settings\History\History.IE5\62989834394E0DA89D2ED7673A57F21C.x1881
- %HOMEPATH%\Favorites\Links\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\Favorites\Links\B275DC742F0D5EF645549BBA3017436A.x1881
- %HOMEPATH%\Local Settings\19AADCB8234C0F84E26B8BC62455F3F8.x1881
- <LS_APPDATA>\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\Local Settings\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\8EF596B0324E75F7E6F6EEF033585A6B.x1881
- %HOMEPATH%\My Documents\My Music\6F602DB53E7D2D7DC3BEB2953F8711F1.x1881
- %HOMEPATH%\My Documents\Downloads\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\My Documents\My Music\5E2746082FC107A423E3317C30CAEC18.x1881
- %HOMEPATH%\My Documents\My Pictures\117AADE4192CBF0EB0DB17CA1A36A382.x1881
- %HOMEPATH%\My Documents\My Music\_HELP_INSTRUCTION.TXT
- %TEMP%\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\Local Settings\History\History.IE5\MSHist012011111020111111\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\Local Settings\<INETFILES>\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\My Documents\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\My Documents\186CB6672720D8F2D447FCF5282ABD66.x1881
- %HOMEPATH%\Favorites\Links\1AB1FE1630D359D54B2D07DA31DD3E49.x1881
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\BF2D513414D9F01EDDD7C7D215E3D492.x1881
- C:\Documents and Settings\NetworkService\Local Settings\History\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\NetworkService\Local Settings\Temp\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\NetworkService\Local Settings\C4A624BF2C74AC6E40DD4CAB2D7E90E2.x1881
- C:\Documents and Settings\NetworkService\Cookies\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\NetworkService\Local Settings\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\NetworkService\Local Settings\History\5ED0F6252114B56F75504A9B221E99E3.x1881
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\0C0741062150EA3841309BFE225ACEAC.x1881
- %HOMEPATH%\Favorites\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\Favorites\5326E9E80ABE0F16C3A1CD540BC7F38A.x1881
- %HOMEPATH%\Favorites\Links\4589B04839AC61985563115C3AB6460C.x1881
- %HOMEPATH%\Favorites\Links\715AFCB83A0635E42D1A2E3A3B101A58.x1881
- %HOMEPATH%\Favorites\Links\679A0D2C0ED3000033601EA90FDCE474.x1881
- %APPDATA%\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\Cookies\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\Favorites\764DBF6412CF41220FE7A15413D92596.x1881
- %HOMEPATH%\Favorites\56DBFE3024687820B7CEE14825725C94.x1881
- %HOMEPATH%\My Documents\My Pictures\8DBB14DE47EF480E13D6B75648F92C82.x1881
- %HOMEPATH%\Start Menu\Programs\Accessories\F415771B1E1A07E1048F00011F23EC55.x1881
- %HOMEPATH%\Start Menu\Programs\Accessories\C766E55013458C0C287002A4144F7080.x1881
- %HOMEPATH%\Start Menu\Programs\Accessories\F23ED36E3B5351B29455A9613C5D3626.x1881
- %HOMEPATH%\Start Menu\Programs\Accessories\1932AC6621B6D456AD30073E22C0B8CA.x1881
- %HOMEPATH%\Start Menu\Programs\Accessories\8A03F8FC4604B3CF03DD31B4470E9843.x1881
- %HOMEPATH%\Start Menu\Programs\B9B1A7A01C74CAE32B0571601D7EAF57.x1881
- %HOMEPATH%\Start Menu\Programs\3A911CEA26328B2C57C57C71273C6FA0.x1881
- %HOMEPATH%\Start Menu\Programs\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\AFC480CC21D814A458AD6A4622E1F918.x1881
- %HOMEPATH%\Start Menu\Programs\Accessories\69EB81E6086B9CD4100C07ED09758148.x1881
- %HOMEPATH%\Start Menu\Programs\Accessories\A8CD183C24FAF9088F00B83B2604DD7C.x1881
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\52F36C200EDF02284606DA3C0FE8E69C.x1881
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\59D124670F29120CB04D761F1032F680.x1881
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\73020BD00BDA04ED8188FA100CE3E961.x1881
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\36B9320046619700FD629C3C476B7B74.x1881
- %HOMEPATH%\Start Menu\Programs\Accessories\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\F6F966AE0B7371B6D671900D0C7D562A.x1881
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\5EE11CB62CC2541C62E91DAD2DCC3890.x1881
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\23CF1A4F244E4C32EB02EC2F255830A6.x1881
- %HOMEPATH%\Start Menu\Programs\5F2AC0A61934B58566BC1DAA1A3E99F9.x1881
- %HOMEPATH%\Recent\A09DCEB81D284CAA968C450C1E32311E.x1881
- %HOMEPATH%\Recent\7A2AF9970C01C2EBF79FF4DB0D0BA75F.x1881
- %HOMEPATH%\Recent\26311058340B7AF080977CE835155F64.x1881
- %HOMEPATH%\Recent\63B51C6221327C24C835F1A6223C6098.x1881
- %HOMEPATH%\Recent\B94152F72438F0826F535DF32542D4F6.x1881
- %HOMEPATH%\My Documents\My Received Files\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\My Documents\My Pictures\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\NetHood\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\Recent\BD2864F13511F5822AC699AF361BD9F6.x1881
- %HOMEPATH%\PrintHood\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\Recent\512FA5742984B6F4959F5E842A8E9B68.x1881
- %HOMEPATH%\Start Menu\3F97234423E776FC181553EC24F15B70.x1881
- %HOMEPATH%\Start Menu\EF27225001C188607760E50802CB6CD4.x1881
- %HOMEPATH%\Start Menu\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\Start Menu\Programs\3C1E34482310ABB4B6898986241A9028.x1881
- %HOMEPATH%\Start Menu\Programs\BD8E0C640800EAD0B1644661090ACF44.x1881
- %HOMEPATH%\Recent\37F535712C134DFA1BAD05832D1D326E.x1881
- %HOMEPATH%\Recent\7048DD700F2D8D6FB1C4F8F0103771E3.x1881
- %HOMEPATH%\Recent\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\SendTo\_HELP_INSTRUCTION.TXT
- %HOMEPATH%\SendTo\2E6C6CDC081BB14090C71C42092595B4.x1881
- C:\Documents and Settings\Default User\PrintHood\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\NetHood\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\Recent\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\SendTo\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\SendTo\9592DEC00F667C2066298E5C10706094.x1881
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\28D337A44ED34F086996AEED4FDD337C.x1881
- C:\Documents and Settings\Default User\Local Settings\Temp\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\My Documents\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\Start Menu\4845BA1344B91B68E6BFB09D45C2FFDC.x1881
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\338CC7623B8501D29F860AC33C8EE646.x1881
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\1165C386072A59209BA99A5308343D94.x1881
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\4038E1D21681DF52CA156F3B178BC3C6.x1881
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\3A3B73C13AA1848028C0C15D3BAB68F4.x1881
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\A1269CE81B2E09FE7E322EBC1C37EE72.x1881
- C:\Documents and Settings\Default User\Start Menu\Programs\C61E6890380D4FE0A025F93C39173454.x1881
- C:\Documents and Settings\Default User\Start Menu\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\EF1D777F02532B89EFE87F63035D0FFD.x1881
- C:\Documents and Settings\Default User\Start Menu\Programs\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\3EF1BB201AFF4BE0318FCE491C093054.x1881
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\61D6D65F0E8D6FDC43E2A7B70F975450.x1881
- C:\CF6C041E3FBBD5610FBD352240C5B9D5.x1881
- C:\F36E6CE6036352F5AC29FE5E046D3769.x1881
- C:\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\_HELP_INSTRUCTION.TXT
- <Текущая директория>\_HELP_INSTRUCTION.TXT
- %ALLUSERSPROFILE%\Application Data\BC8B982AA3.exe:Zone.Identifier
- %ALLUSERSPROFILE%\Application Data\BC8B982AA3.exe
- %ALLUSERSPROFILE%\Application Data\F06C3C509054X0B7D28ZCDDBB17087B9C3E.x1881
- C:\7ABDF66F419A67304F7E817D42A44BA4.x1881
- C:\655CF19A155B1B9678AE24991665000A.x1881
- %ALLUSERSPROFILE%\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\Local Settings\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\Local Settings\45CCE23724ABD601E3F499FD25B5BA75.x1881
- C:\Documents and Settings\Default User\Local Settings\Application Data\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\Local Settings\History\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\Local Settings\History\E0F18250207E2230E58B085E218806A4.x1881
- C:\Documents and Settings\Default User\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\810B7CE0446B6C2A522E85304575509E.x1881
- C:\Documents and Settings\Default User\Application Data\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\Favorites\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\Cookies\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\6789B75821A5DE00340B65B522AFC274.x1881
- C:\Documents and Settings\LocalService\Application Data\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\LocalService\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\LocalService\Cookies\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\LocalService\Local Settings\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\LocalService\Local Settings\76887E2F48B1160B4E3515C549BAFA7F.x1881
- C:\Documents and Settings\Default User\Templates\D12CCF5621FDC5125CBD8A322307A986.x1881
- C:\Documents and Settings\Default User\Templates\0E2DA32C3F00A102181EA2DA400A8576.x1881
- C:\Documents and Settings\Default User\Templates\6FA75F1F2E94C7AE358FC66D2F9EAC22.x1881
- C:\Documents and Settings\LocalService\F6C003F614292408F111B7BA1533087C.x1881
- C:\Documents and Settings\Default User\Templates\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\LocalService\Local Settings\Application Data\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\LocalService\Local Settings\Temp\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\NetworkService\CE47343523D96F1CE4D5FBCF24E35390.x1881
- C:\Documents and Settings\NetworkService\Application Data\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\NetworkService\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\LocalService\Local Settings\History\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\LocalService\Local Settings\History\7950299C0D79ABB96A8FFF640E83902D.x1881
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\848DD92A2DD1E392BD2FDBCA2EDBC806.x1881
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\27375EE820F9E3628164F0E42203C7D6.x1881
- C:\Documents and Settings\Default User\Templates\AC6BE7F92FFB49E23F425F7B31052E56.x1881
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\378B21E0272D81C00A32378E28376634.x1881
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\73F7F6060BBC21620F43BBED0CC605D6.x1881
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\171CED98050D561F87CD258806173A93.x1881
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\57C280F03C89C8E8FBBB50EA3D93AD5C.x1881
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\7791C4043427721ED563218635315692.x1881
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\55D076F035394698EB13273A36432B0C.x1881
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\9AECCD883C7DD7E673C032DC3D87BC5A.x1881
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\AC8F98902B7B6668E1C68B682C854ADC.x1881
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\Templates\EC2D466E16F95444CD234205180338B8.x1881
- C:\Documents and Settings\Default User\Templates\B66C2F843B1BD9D8ED89E91A3C25BE4C.x1881
- C:\Documents and Settings\Default User\Templates\AA74F0B022FD7AC00764152D24075F34.x1881
- C:\Documents and Settings\Default User\Templates\B3D721CD42E5896B9986406F43EF6DDF.x1881
- C:\Documents and Settings\Default User\Templates\35A6D8A01FF5E420BD1D685F20FFC894.x1881
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\_HELP_INSTRUCTION.TXT
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\3DFFBF2442BA603C805D7EC143C444B0.x1881
- C:\Documents and Settings\Default User\Templates\37467ED6174BB1AF77BB763A18559623.x1881
- C:\Documents and Settings\Default User\Templates\B62F22B432219BE0C8EE613F332B8054.x1881
- C:\Documents and Settings\Default User\Templates\EEC17A7D2430545C667CFDEB253A38D0.x1881
