Trojan.KillFiles.61887

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'USB Security' = '%ProgramFiles%\USB Disk Security\USBGuard.exe'
[<HKLM>\SOFTWARE\Classes\InstallRite File\Shell\Open\Command] '' = '<Полный путь к файлу> %1'

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\USB Disk Security\Microsoft.VC80.MFC.manifest
%ProgramFiles%\USB Disk Security\msvcp80.dll
%ProgramFiles%\USB Disk Security\mfc80u.dll
%ProgramFiles%\USB Disk Security\Microsoft.VC80.CRT.manifest
%ProgramFiles%\USB Disk Security\msvcr80.dll
%ProgramFiles%\USB Disk Security\USB Disk Security Update Log.txt
%ProgramFiles%\USB Disk Security\USBGuard.chm
%ProgramFiles%\USB Disk Security\unins000.dat
%ProgramFiles%\USB Disk Security\unins000.exe
%ProgramFiles%\USB Disk Security\locales\thai.dll
%ProgramFiles%\USB Disk Security\locales\turkish.dll
%ProgramFiles%\USB Disk Security\locales\russian.dll
%ProgramFiles%\USB Disk Security\locales\spanish.dll
%ProgramFiles%\USB Disk Security\locales\ukrainian.dll
%ProgramFiles%\USB Disk Security\log2.dmb
%ProgramFiles%\USB Disk Security\log3.dmb
%ProgramFiles%\USB Disk Security\log.dmb
%ProgramFiles%\USB Disk Security\log1.dmb
<SYSTEM32>\wbem\Repository\FS\ID9.tmp
%TEMP%\41\delreg.lst
<SYSTEM32>\wbem\Repository\FS\ID7.tmp
<SYSTEM32>\wbem\Repository\FS\ID8.tmp
%TEMP%\41\iwt_registry.reg
C:\Documents and Settings\ADMIN\Application Data\Zbshareware Lab\USBGuard\program_config.ini
%ALLUSERSPROFILE%\Application Data\Zbshareware Lab\profile.ini
%TEMP%\41\iwt_INI.lst
C:\Documents and Settings\ADMIN\Application Data\Zbshareware Lab\USBGuard\config.ini
%ProgramFiles%\USB Disk Security\USBGuardUpdate.exe
%WINDIR%\ID1.tmp
%ProgramFiles%\USB Disk Security\USBGuard.exe
%ProgramFiles%\USB Disk Security\USBGuardUpdate.dat
<SYSTEM32>\config\ID2.tmp
<SYSTEM32>\wbem\Repository\FS\ID5.tmp
<SYSTEM32>\wbem\Repository\FS\ID6.tmp
<SYSTEM32>\config\ID3.tmp
<SYSTEM32>\wbem\Repository\FS\ID4.tmp
C:\Documents and Settings\ADMIN\Local Settings\<INETFILES>\Content.IE5\5QHYS2QF\icon_pause[1].png
C:\Documents and Settings\ADMIN\Local Settings\<INETFILES>\Content.IE5\5QHYS2QF\jquery.json-2.2[1].js
C:\Documents and Settings\ADMIN\Local Settings\Temp\BetterInstaller.exe
C:\Documents and Settings\ADMIN\Local Settings\<INETFILES>\Content.IE5\5QHYS2QF\downloaderGeneric[1].css
C:\Documents and Settings\ADMIN\Local Settings\<INETFILES>\Content.IE5\6MMW013B\7f027acf1c54b44d88468cc84340486a[1].htm
C:\Documents and Settings\ADMIN\Local Settings\<INETFILES>\Content.IE5\6MMW013B\progress_bar_bg[1].gif
C:\Documents and Settings\ADMIN\Local Settings\<INETFILES>\Content.IE5\FW5Q2BCS\icon_resume[1].png
C:\Documents and Settings\ADMIN\Local Settings\<INETFILES>\Content.IE5\6MMW013B\installer_adapter[1].js
C:\Documents and Settings\ADMIN\Local Settings\<INETFILES>\Content.IE5\6MMW013B\jquery.min[1].js
%TEMP%\41\Filelist.lst
%TEMP%\41\delfile.lst
%TEMP%\41\kit.opt
%TEMP%\41\ver.txt
%TEMP%\41\dirlist.lst
C:\Documents and Settings\ADMIN\Local Settings\History\History.IE5\index.dat
C:\Documents and Settings\ADMIN\Local Settings\History\History.IE5\MSHist012012042320120424\index.dat
C:\Documents and Settings\ADMIN\Application Data\Microsoft\HTML Help\hh.dat
C:\Documents and Settings\ADMIN\Cookies\index.dat
%ProgramFiles%\USB Disk Security\BCGPStyle2010Blue150.dll
%ProgramFiles%\USB Disk Security\locales\arabic.dll
%ALLUSERSPROFILE%\Start Menu\Programs\USB Disk Security\USB Disk Security.lnk
%ProgramFiles%\USB Disk Security\BCGCBPRO1500u80.dll
%ProgramFiles%\USB Disk Security\locales\chinetw.dll
%ProgramFiles%\USB Disk Security\locales\japanese.dll
%ProgramFiles%\USB Disk Security\locales\portuese.dll
%ProgramFiles%\USB Disk Security\locales\french.dll
%ProgramFiles%\USB Disk Security\locales\indonesian.dll
C:\Documents and Settings\ADMIN\Local Settings\<INETFILES>\Content.IE5\XOJBR9QS\downloaderController[1].js
C:\Documents and Settings\ADMIN\Local Settings\<INETFILES>\Content.IE5\XOJBR9QS\progress_bar_bg_inactive[1].gif
C:\Documents and Settings\ADMIN\Local Settings\<INETFILES>\Content.IE5\FW5Q2BCS\jquery.tmpl.min[1].js
C:\Documents and Settings\ADMIN\Local Settings\<INETFILES>\Content.IE5\index.dat
C:\Documents and Settings\ADMIN\Recent\Crack(Manual Patch).lnk
%ALLUSERSPROFILE%\Start Menu\Programs\USB Disk Security\Help.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\USB Disk Security\USB Disk Security ЕбЫЗБ КЛИнК.lnk
C:\Documents and Settings\ADMIN\Recent\Serials.lnk
%ALLUSERSPROFILE%\Desktop\USB Disk Security.lnk

Присваивает атрибут 'скрытый' для следующих файлов:

C:\Documents and Settings\ADMIN\Local Settings\History\History.IE5\MSHist012012042320120424\index.dat
C:\Documents and Settings\ADMIN\Cookies\index.dat

Удаляет следующие файлы: