Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'pejmi' = '%HOMEPATH%\My Documents\fqtowj.exe'
Создает или изменяет следующие файлы:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\_ReCoVeRy_+jnriw.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\_ReCoVeRy_+jnriw.png
Вредоносные функции:
Внедряет код в
следующие пользовательские процессы:
- fqtowj.exe
Завершает или пытается завершить
следующие системные процессы:
- <SYSTEM32>\cmd.exe
следующие пользовательские процессы:
- ecmd.exe
Изменения в файловой системе:
Создает следующие файлы:
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Cookies\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-19\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Credentials\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Cookies\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Application Data\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Cookies\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Application Data\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Application Data\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Local Settings\Temp\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Local Settings\Temp\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Local Settings\Temp\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\BGGTYMH1\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\CJCTQ25G\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Local Settings\History\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Local Settings\Application Data\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Local Settings\Application Data\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Local Settings\History\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Local Settings\History\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Templates\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Templates\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Templates\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Start Menu\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Start Menu\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Start Menu\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Start Menu\Programs\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Start Menu\Programs\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Startup\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\S-1-5-19\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Credentials\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Application Data\Microsoft\Media Player\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Credentials\S-1-5-20\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Application Data\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Cookies\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Cookies\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Cookies\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Application Data\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Application Data\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Local Settings\Temp\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Local Settings\Temp\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Local Settings\Application Data\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Local Settings\History\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Local Settings\Temp\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Local Settings\History\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Local Settings\History\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Local Settings\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Local Settings\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Local Settings\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\S-1-5-20\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\MOE00UY1\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\LBMMC3H3\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\LocalService\Local Settings\<INETFILES>\Content.IE5\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Credentials\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\NetworkService\Application Data\Microsoft\Media Player\_ReCoVeRy_+jnriw.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\_ReCoVeRy_+jnriw.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Administrative Tools\_ReCoVeRy_+jnriw.png
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\_ReCoVeRy_+jnriw.html
- %ALLUSERSPROFILE%\Start Menu\Programs\_ReCoVeRy_+jnriw.png
- %ALLUSERSPROFILE%\Start Menu\Programs\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\_ReCoVeRy_+jnriw.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\_ReCoVeRy_+jnriw.png
- %ALLUSERSPROFILE%\Start Menu\Programs\Games\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\_ReCoVeRy_+jnriw.png
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\_ReCoVeRy_+jnriw.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\_ReCoVeRy_+jnriw.png
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\_ReCoVeRy_+jnriw.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Communications\_ReCoVeRy_+jnriw.png
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\_ReCoVeRy_+jnriw.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\System Tools\_ReCoVeRy_+jnriw.png
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Entertainment\_ReCoVeRy_+jnriw.html
- %ALLUSERSPROFILE%\Start Menu\Programs\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\Media Player\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\Templates\_ReCoVeRy_+jnriw.png
- %ALLUSERSPROFILE%\Templates\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\Start Menu\_ReCoVeRy_+jnriw.html
- %ALLUSERSPROFILE%\Start Menu\_ReCoVeRy_+jnriw.png
- %ALLUSERSPROFILE%\Start Menu\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\_ReCoVeRy_+jnriw.png
- %ALLUSERSPROFILE%\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\Templates\_ReCoVeRy_+jnriw.html
- %ALLUSERSPROFILE%\_ReCoVeRy_+jnriw.png
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\_ReCoVeRy_+jnriw.png
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\_ReCoVeRy_+jnriw.html
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\_ReCoVeRy_+jnriw.png
- %ALLUSERSPROFILE%\Documents\My Music\Sample Music\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\_ReCoVeRy_+jnriw.html
- %ALLUSERSPROFILE%\Documents\My Music\_ReCoVeRy_+jnriw.png
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\0338E140\_ReCoVeRy_+jnriw.html
- %ALLUSERSPROFILE%\Documents\My Music\Sample Playlists\_ReCoVeRy_+jnriw.png
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\wcspng[1].htm
- <Текущая директория>\_ReCoVeRy_+jnriw.png
- <Текущая директория>\_ReCoVeRy_+jnriw.txt
- %HOMEPATH%\My Documents\recover.txt
- %HOMEPATH%\My Documents\fqtowj.exe
- <Текущая директория>\pejmi.bat
- %ALLUSERSPROFILE%\Documents\My Music\My Playlists\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\Documents\My Music\My Playlists\_ReCoVeRy_+jnriw.html
- %ALLUSERSPROFILE%\Documents\My Music\My Playlists\_ReCoVeRy_+jnriw.png
- <Текущая директория>\_ReCoVeRy_+jnriw.html
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\binstr[1].htm
- %ALLUSERSPROFILE%\Documents\My Music\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\DRM\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\DRM\_ReCoVeRy_+jnriw.html
- %ALLUSERSPROFILE%\DRM\_ReCoVeRy_+jnriw.png
- %ALLUSERSPROFILE%\Documents\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\Documents\_ReCoVeRy_+jnriw.html
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\_ReCoVeRy_+jnriw.png
- %ALLUSERSPROFILE%\Start Menu\Programs\Accessories\Accessibility\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\Favorites\_ReCoVeRy_+jnriw.html
- %ALLUSERSPROFILE%\Favorites\_ReCoVeRy_+jnriw.png
- %ALLUSERSPROFILE%\Favorites\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\Documents\_ReCoVeRy_+jnriw.png
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\_ReCoVeRy_+jnriw.html
- %ALLUSERSPROFILE%\Documents\My Pictures\_ReCoVeRy_+jnriw.png
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\Documents\My Music\_ReCoVeRy_+jnriw.html
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\_ReCoVeRy_+jnriw.png
- %ALLUSERSPROFILE%\Documents\My Videos\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\Documents\My Videos\_ReCoVeRy_+jnriw.html
- %ALLUSERSPROFILE%\Documents\My Videos\_ReCoVeRy_+jnriw.png
- %ALLUSERSPROFILE%\Documents\My Pictures\_ReCoVeRy_+jnriw.txt
- %ALLUSERSPROFILE%\Documents\My Pictures\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\YPORKZYZ\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Local Settings\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\2VAZY7AN\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Local Settings\Temp\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Local Settings\Temp\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\U98D4X8H\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Local Settings\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\SendTo\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\SendTo\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\SendTo\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Recent\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Recent\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Entertainment\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Recent\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\My Documents\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\NetHood\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\My Documents\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Local Settings\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\My Documents\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\PrintHood\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\PrintHood\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\PrintHood\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\NetHood\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\NetHood\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Application Data\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Cookies\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Application Data\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Application Data\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Favorites\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Favorites\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Favorites\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Cookies\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Cookies\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Local Settings\Application Data\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Local Settings\History\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Local Settings\Temp\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Local Settings\History\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Local Settings\History\History.IE5\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Local Settings\History\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Media Player\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\_ReCoVeRy_+jnriw.txt
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\_ReCoVeRy_+jnriw.html
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\_ReCoVeRy_+jnriw.png
- C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\_ReCoVeRy_+jnriw.txt
Присваивает атрибут 'скрытый' для следующих файлов:
- %HOMEPATH%\My Documents\fqtowj.exe
Удаляет следующие файлы:
- <Текущая директория>\pejmi.bat
- <Полный путь к файлу>
Сетевая активность:
Подключается к:
- 'co######reaknetworks.com':80
- 'sa####raining.com':80
- 'my###hour.com':80
- '19#.1.95.93':80
- 'ke##2.com':80
TCP:
Запросы HTTP POST:
- http://co######reaknetworks.com/dev/wp-content/uploads/2015/07/binstr.php
- http://sa####raining.com/wp-includes/theme-compat/wcspng.php
- http://co######reaknetworks.com/dev/wp-content/uploads/2015/07/wcspng.php
- http://19#.1.95.93/~deveconomytravel/cache/binstr.php
- http://ke##2.com/wp-content/plugins/ajax-admin/binstr.php
- http://my###hour.com/blog//wp-content/themes/berlinproof/binstr.php
UDP:
- DNS ASK co######reaknetworks.com
- DNS ASK sa####raining.com
- DNS ASK ke##2.com
- DNS ASK my###hour.com
Другое:
Создает и запускает на исполнение:
- '%HOMEPATH%\My Documents\fqtowj.exe'
- '<Полный путь к файлу>'
Запускает на исполнение:
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v pejmi /t REG_SZ /d "%HOMEPATH%\My Documents\fqtowj.exe" /f
- '<SYSTEM32>\cmd.exe' /c pejmi.bat
- '<SYSTEM32>\cmd.exe' /c DEL <Полный путь к файлу> >> NUL
