Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SohuVA' = ''
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'PPAP' = ''
- [<HKLM>\SOFTWARE\Classes\PotPlayerMini.VOB\shell\open\command] '' = '"%ProgramFiles%\PotPlayer\PotPlayerMini.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\PotPlayerMini.F4V\shell\open\command] '' = '"%ProgramFiles%\PotPlayer\PotPlayerMini.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\PotPlayerMini.HLV\shell\open\command] '' = '"%ProgramFiles%\PotPlayer\PotPlayerMini.exe" "%1"'
Вредоносные функции:
Создает и запускает на исполнение:
- '%ProgramFiles%\PotPlayer\RegPotplayer.exe' /i
Запускает на исполнение:
- '<SYSTEM32>\reg.exe' add HKEY_CLASSES_ROOT\CLSID\{00000000-0000-0000-0000-000000000002}\InProcServer32
- '<SYSTEM32>\reg.exe' add HKEY_CLASSES_ROOT\CLSID\{00000000-0000-0000-0000-000000000002}\InProcServer32 /ve /t reg_expand_sz /d <SYSTEM32>\shdocvw.dll /f
- '<SYSTEM32>\reg.exe' add HKEY_CLASSES_ROOT\CLSID\{00000000-0000-0000-0000-000000000002}\Instance
- '%WINDIR%\regedit.exe' /s "%ProgramFiles%\PotPlayer\AviSynth\1.reg"
- '<SYSTEM32>\cmd.exe' /c ""%ProgramFiles%\PotPlayer\AviSynth\yh.bat" "
- '<SYSTEM32>\reg.exe' add HKEY_CLASSES_ROOT\CLSID\{00000000-0000-0000-0000-000000000002}
Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.
Изменения в файловой системе:
Создает следующие файлы:
- %ProgramFiles%\PotPlayer\Module\Bass\bass_ape.dll
- %ProgramFiles%\PotPlayer\Module\Bass\bass_flac.dll
- %ProgramFiles%\PotPlayer\Module\Bass\bass_mpc.dll
- %ProgramFiles%\PotPlayer\ATextOut.dll
- %ProgramFiles%\PotPlayer\Module\RealCodec\atrc.dll
- %ProgramFiles%\PotPlayer\Module\Bass\bass.dll
- %ProgramFiles%\PotPlayer\Module\RealCodec\cook.dll
- %ProgramFiles%\PotPlayer\d3dcompiler_47.dll
- %ProgramFiles%\PotPlayer\d3dx9_43.dll
- %ProgramFiles%\PotPlayer\Module\Bass\bass_ofr.dll
- %ProgramFiles%\PotPlayer\Module\Bass\bass_tta.dll
- %ProgramFiles%\PotPlayer\Module\Bass\bass_wv.dll
- %ProgramFiles%\PotPlayer\Module\AcmVorbis.dll
- %ProgramFiles%\PotPlayer\AviSynth\TrueMotionNoGPU.avs
- %ProgramFiles%\PotPlayer\最安全中文网址导航.URL
- %ProgramFiles%\PotPlayer\深度完美技术Win10系统之家.URL
- %ProgramFiles%\PotPlayer\AviSynth\TrueMotion.avs
- %ProgramFiles%\PotPlayer\AviSynth\TrueMotion2.avs
- %ProgramFiles%\PotPlayer\AviSynth\TrueMotion2NoGPU.avs
- %ProgramFiles%\PotPlayer\DTDrop.exe
- %ProgramFiles%\PotPlayer\PotPlayerMini.exe
- %ProgramFiles%\PotPlayer\RegPotplayer.exe
- %ProgramFiles%\PotPlayer\VapourSynth\Histogram.vpy
- %ProgramFiles%\PotPlayer\VapourSynth\motioninterpolation.vpy
- %ProgramFiles%\PotPlayer\DesktopHook64.exe
- %ProgramFiles%\PotPlayer\DaumCrashHandler.dll
- %ProgramFiles%\PotPlayer\Module\qscl.dll
- %ProgramFiles%\PotPlayer\Module\QuickSync.dll
- %ProgramFiles%\PotPlayer\Module\RealCodec\sipr.dll
- %ProgramFiles%\PotPlayer\PotIcons.dll
- %ProgramFiles%\PotPlayer\IconPack\PotIconsNew.dll
- %ProgramFiles%\PotPlayer\PotPlayer.dll
- %HOMEPATH%\Start Menu\Programs\PotPlayer\PotPlayer.lnk
- %HOMEPATH%\Start Menu\Programs\PotPlayer\ЗеіэЛщУРЙиЦГ.lnk
- %HOMEPATH%\Start Menu\Programs\PotPlayer\RegPotPlayer.lnk
- %ProgramFiles%\PotPlayer\Module\tak_deco_lib.dll
- %TEMP%\nsj2.tmp
- %HOMEPATH%\Desktop\PotPlayer.lnk
- %ProgramFiles%\PotPlayer\Module\RealCodec\pncrt.dll
- %ProgramFiles%\PotPlayer\ffcodec.dll
- %ProgramFiles%\PotPlayer\Module\FFmpeg\FFmpegMininum.dll
- %ProgramFiles%\PotPlayer\GameCaptureHook.dll
- %ProgramFiles%\PotPlayer\DesktopHook64.dll
- %ProgramFiles%\PotPlayer\Module\RealCodec\drv2.dll
- %ProgramFiles%\PotPlayer\Module\RealCodec\drvc.dll
- %ProgramFiles%\PotPlayer\Module\RealCodec\msvcr71.dll
- %ProgramFiles%\PotPlayer\IconPack\OldIconPack.dll
- %ProgramFiles%\PotPlayer\Module\Bass\OptimFROG.dll
- %ProgramFiles%\PotPlayer\GameCaptureHook64.dll
- %ProgramFiles%\PotPlayer\MediaDB.dll
- %ProgramFiles%\PotPlayer\Module\MediaInfo.dll
- %ProgramFiles%\PotPlayer\PxShader\Invert.txt
- %ProgramFiles%\PotPlayer\History\Korean.txt
- %ProgramFiles%\PotPlayer\PxShader\LCD angle correction.txt
- %ProgramFiles%\PotPlayer\History\English.txt
- %ProgramFiles%\PotPlayer\PxShader\GrayScale.txt
- %ProgramFiles%\PotPlayer\PxShader\HorzFlip.txt
- %ProgramFiles%\PotPlayer\License.txt
- %ProgramFiles%\PotPlayer\PxShader\NightVision.txt
- %ProgramFiles%\PotPlayer\PxShader\Procamp.txt
- %ProgramFiles%\PotPlayer\PxShader\Letterbox.txt
- %ProgramFiles%\PotPlayer\PxShader\Levels.txt
- %ProgramFiles%\PotPlayer\PxShader\Levels2.txt
- %ProgramFiles%\PotPlayer\PxShader\Emboss.txt
- %ProgramFiles%\PotPlayer\PxShader\BT601BT709.txt
- %ProgramFiles%\PotPlayer\History\Chinese(Simplified).txt
- %ProgramFiles%\PotPlayer\CmdLine.txt
- %ProgramFiles%\PotPlayer\Logos\PotPlayer.png
- %ProgramFiles%\PotPlayer\AviSynth\yh.bat
- %ProgramFiles%\PotPlayer\PxShader\Adaptive sharpen.txt
- %ProgramFiles%\PotPlayer\PxShader\DisplayLessThan16 v1_1.txt
- %ProgramFiles%\PotPlayer\PxShader\EdgeSharpen v1_1(jim ro).txt
- %ProgramFiles%\PotPlayer\PxShader\EdgeSharpen v1_1.txt
- %ProgramFiles%\PotPlayer\PxShader\Contour.txt
- %ProgramFiles%\PotPlayer\PxShader\Deinterlace (blend).txt
- %ProgramFiles%\PotPlayer\PxShader\Denoise.txt
- %ProgramFiles%\PotPlayer\QQ群.txt
- %ProgramFiles%\PotPlayer\Language\Chinese(Simplified).ini
- %ProgramFiles%\PotPlayer\Language\English.ini
- %ProgramFiles%\PotPlayer\Language\Korean.ini
- %ProgramFiles%\PotPlayer\PxShader\YV12 Chroma Upsampling.txt
- %ProgramFiles%\PotPlayer\支持DIY定制.txt
- %ProgramFiles%\PotPlayer\AviSynth\1.reg
- %ProgramFiles%\PotPlayer\AviSynth\FastTrueMotion.avs
- %ProgramFiles%\PotPlayer\AviSynth\FastTrueMotionNoGPU.avs
- %ProgramFiles%\PotPlayer\AviSynth\OverlayText.avs
- %ProgramFiles%\PotPlayer\AviSynth\ColorBars.avs
- %ProgramFiles%\PotPlayer\AviSynth\FasterTrueMotion.avs
- %ProgramFiles%\PotPlayer\AviSynth\FastestTrueMotion.avs
- %ProgramFiles%\PotPlayer\PxShader\Wave.txt
- %ProgramFiles%\PotPlayer\PxShader\SharpenComplex2.txt
- %ProgramFiles%\PotPlayer\PxShader\SharpenFlou (jim ro).txt
- %ProgramFiles%\PotPlayer\PxShader\Sharpen_3x3.txt
- %ProgramFiles%\PotPlayer\PxShader\Remap_16_235.txt
- %ProgramFiles%\PotPlayer\PxShader\Sharpen.txt
- %ProgramFiles%\PotPlayer\PxShader\SharpenComplex (jim ro).txt
- %ProgramFiles%\PotPlayer\PxShader\Undot.txt
- %ProgramFiles%\PotPlayer\PxShader\Unsharp mask.txt
- %ProgramFiles%\PotPlayer\PxShader\VertFlip.txt
- %ProgramFiles%\PotPlayer\PxShader\Sharpen_5x5.txt
- %ProgramFiles%\PotPlayer\PxShader\Sphere.txt
- %ProgramFiles%\PotPlayer\PxShader\Spotlight.txt
Удаляет следующие файлы:
- %TEMP%\nsy3.tmp\nsLink.dll
Другое:
Ищет следующие окна:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
