Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %HOMEPATH%\Start Menu\Programs\Startup\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- %HOMEPATH%\Start Menu\Programs\Startup\Shortcut to startup_local.lnk
Заражает следующие исполняемые файлы:
- C:\Far2\Plugins\arclite\7zS2con.sfx
- C:\Far2\Plugins\arclite\7zSD.sfx
- C:\Far2\Plugins\arclite\7zS2.sfx
- C:\Far2\Plugins\arclite\7z.sfx
- C:\Far2\Plugins\arclite\7zCon.sfx
Изменения в файловой системе:
Создает следующие файлы:
- C:\Far2\Plugins\Colorer\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\Plugins\Brackets\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\Plugins\Colorer\hrc\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\Plugins\Colorer\bin\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\Plugins\Align\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\Plugins\7-Zip\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\Plugins\AutoWrap\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\Plugins\arclite\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\Plugins\Colorer\hrc\auto\types\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\Plugins\ExtSearch\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\Plugins\EMenu\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\Plugins\ExtSearch\sources\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\Plugins\ExtSearch\doc\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\Plugins\Compare\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\Plugins\Colorer\hrd\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\Plugins\EditCase\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\Plugins\DrawLine\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- %HOMEPATH%\My Documents\My Pictures\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- %HOMEPATH%\My Documents\My Music\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- %HOMEPATH%\Start Menu\Programs\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- %HOMEPATH%\Start Menu\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\1ON3y[1].jpg
- %APPDATA%\sevnz.exe
- %HOMEPATH%\Favorites\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- %HOMEPATH%\Favorites\Links\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\Documentation\eng\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\Addons\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\Encyclopedia\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\Documentation\rus\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\Entertainment\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- %HOMEPATH%\Start Menu\Programs\Accessories\Accessibility\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\Addons\Shell\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
- C:\Far2\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT
Удаляет следующие файлы:
- <Полный путь к файлу>
- %APPDATA%\sevnz.exe
Сетевая активность:
Подключается к:
- 'ip###ger.info':80
TCP:
Запросы HTTP GET:
- http://ip###ger.info/1ON3y.jpg
UDP:
- DNS ASK ip###ger.info
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
Создает и запускает на исполнение:
- '%APPDATA%\sevnz.exe'
Запускает на исполнение:
- '<SYSTEM32>\mshta.exe' "javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('<Имя файла>.exe');close()}catch(e){}},10);"
- '<SYSTEM32>\cmd.exe' /c copy /y "<Полный путь к файлу>" "%APPDATA%\sevnz.exe"
