Trojan.KillFiles.62987

Техническая информация

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\1.tmp\2.tmp\3.bat
%WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_networks.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg.exe
%WINDIR%\Help\Tours\htmlTour\control_up.jpg.exe
%WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg.exe
C:\Documents and Settings\Default User\Templates\winword2.doc.exe
%WINDIR%\Help\Tours\htmlTour\desktop_up.jpg.exe
%WINDIR%\Help\Tours\htmlTour\folder_up.jpg.exe
%WINDIR%\Help\Tours\htmlTour\gradient.jpg.exe
%WINDIR%\Help\Tours\htmlTour\icon_up.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img004b.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img014.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img033.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img033a.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img034.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img040.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img046.jpg.exe
%WINDIR%\Help\Tours\htmlTour\img060.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg.exe
%WINDIR%\Help\Tours\htmlTour\connected_data.jpg.exe
%WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg.exe
%WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg.exe
%APPDATA%\SetupCVitae.exe
C:\boots\boot.exe
C:\Documents
C:\boots\systems
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
C:\Documents and Settings\Default User\Templates\excel.xls.exe
C:\Documents and Settings\Default User\Templates\excel4.xls.exe
C:\Documents and Settings\Default User\Templates\powerpnt.ppt.exe
%WINDIR%\Help\Tours\htmlTour\img068.jpg.exe
%WINDIR%\Help\Tours\htmlTour\end_up.jpg.exe
C:\Documents and Settings\Default User\Templates\winword.doc.exe
%HOMEPATH%\Templates\excel4.xls.exe
%HOMEPATH%\Templates\powerpnt.ppt.exe
%HOMEPATH%\Templates\winword.doc.exe
%HOMEPATH%\Templates\winword2.doc.exe
%WINDIR%\Help\Tours\htmlTour\best_road.jpg.exe
%WINDIR%\Help\Tours\htmlTour\best_road_big.jpg.exe
%WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg.exe
%WINDIR%\Help\Tours\htmlTour\best_robust.jpg.exe
%WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg.exe
%WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg.exe
%WINDIR%\Help\Tours\htmlTour\best_secure.jpg.exe
%APPDATA%\taskguest.exe
%HOMEPATH%\Templates\excel.xls.exe
%WINDIR%\Help\Tours\htmlTour\img072.jpg.exe

Удаляет следующие файлы:

%APPDATA%\taskguest.exe
%WINDIR%\Help\Tours\htmlTour\connected_wizard_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\control_up.jpg
%WINDIR%\Help\Tours\htmlTour\desktop_screen_shot.jpg
%WINDIR%\Help\Tours\htmlTour\desktop_up.jpg
%WINDIR%\Help\Tours\htmlTour\end_up.jpg
%WINDIR%\Help\Tours\htmlTour\folder_up.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard.jpg
%WINDIR%\Help\Tours\htmlTour\connected_wizard_big.jpg
%WINDIR%\Help\Tours\htmlTour\gradient.jpg
%WINDIR%\Help\Tours\htmlTour\img014.jpg
%WINDIR%\Help\Tours\htmlTour\img033.jpg
%WINDIR%\Help\Tours\htmlTour\img033a.jpg
%WINDIR%\Help\Tours\htmlTour\img034.jpg
%WINDIR%\Help\Tours\htmlTour\img040.jpg
%WINDIR%\Help\Tours\htmlTour\img046.jpg
%WINDIR%\Help\Tours\htmlTour\icon_up.jpg
%WINDIR%\Help\Tours\htmlTour\img004b.jpg
%WINDIR%\Help\Tours\htmlTour\connected_networks_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_networks_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_networks.jpg
%TEMP%\1.tmp\2.tmp\3.bat
%WINDIR%\Help\Tours\htmlTour\best_road.jpg
%WINDIR%\Help\Tours\htmlTour\best_road_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_road_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust_big.jpg
%WINDIR%\Help\Tours\htmlTour\best_robust_ghost.jpg
%APPDATA%\SetupCVitae.exe
%WINDIR%\Help\Tours\htmlTour\best_secure.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_data_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\connected_multiple.jpg
%WINDIR%\Help\Tours\htmlTour\connected_multiple_big.jpg
%WINDIR%\Help\Tours\htmlTour\connected_multiple_ghost.jpg
%WINDIR%\Help\Tours\htmlTour\best_secure_big.jpg
%WINDIR%\Help\Tours\htmlTour\img060.jpg
%WINDIR%\Help\Tours\htmlTour\img068.jpg

Другое:

Ищет следующие окна:

ClassName: 'InstItClass' WindowName: ''

Создает и запускает на исполнение:

'%APPDATA%\taskguest.exe'
'%APPDATA%\SetupCVitae.exe'
'C:\boots\boot.exe' taskguest.exe %APPDATA%/Microsoft/Windows/"Start Menu"/Programs/Startup/systems.exe

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\2.tmp\3.bat" <Полный путь к файлу>"
'<SYSTEM32>\cmd.exe' /c c:/boots/boot.exe taskguest.exe %APPDATA%/Microsoft/Windows/"Start Menu"/Programs/Startup/systems.exe