Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\easysms\Installer\mdac.exe
- %TEMP%\IXP000.TMP\mstext35.dll
- %TEMP%\IXP000.TMP\msxbse35.dll
- %TEMP%\IXP000.TMP\msjtor35.dll
- %TEMP%\IXP000.TMP\msjt4jlt.dll
- %TEMP%\IXP000.TMP\JOLTRE~1.TXT
- %TEMP%\IXP000.TMP\makapt15.bat
- %TEMP%\IXP000.TMP\msrepl35.dll
- %TEMP%\IXP000.TMP\msrd2x35.dll
- %TEMP%\IXP000.TMP\msadrh15.dll
- %TEMP%\IXP000.TMP\adojavas.inc
- %TEMP%\IXP000.TMP\adovbs.inc
- %TEMP%\IXP000.TMP\adoapt15.reg
- %TEMP%\IXP000.TMP\adofre15.reg
- %TEMP%\IXP000.TMP\msader15.dll
- %TEMP%\IXP000.TMP\msador15.dll
- %TEMP%\IXP000.TMP\odbctl32.dll
- %TEMP%\IXP000.TMP\msado15.dll
- %TEMP%\IXP000.TMP\vbajet32.dll
- %TEMP%\IXP000.TMP\odbcjet.cnt
- %TEMP%\IXP000.TMP\msjet35.dll
- %TEMP%\IXP000.TMP\msjint35.dll
- %TEMP%\IXP000.TMP\msjter35.dll
- %TEMP%\IXP000.TMP\vbar332.dll
- %TEMP%\IXP000.TMP\msexcl35.dll
- %TEMP%\IXP000.TMP\mspdox35.dll
- %TEMP%\IXP000.TMP\msltus35.dll
- %TEMP%\IXP000.TMP\odexl32.dll
- %TEMP%\IXP000.TMP\odfox32.dll
- %TEMP%\IXP000.TMP\odpdx32.dll
- %TEMP%\IXP000.TMP\odtext32.dll
- %TEMP%\IXP000.TMP\msexch35.dll
- %TEMP%\IXP000.TMP\expsrv.dll
- %TEMP%\IXP000.TMP\oddbse32.dll
- %TEMP%\IXP000.TMP\odbcjet.hlp
- %TEMP%\IXP000.TMP\makfre15.bat
- %TEMP%\IXP000.TMP\msadcf.dll
- %TEMP%\IXP000.TMP\mssetup.dll
- %TEMP%\IXP000.TMP\acmsetup.exe
- %TEMP%\IXP000.TMP\odbcstf.dll
- %TEMP%\IXP000.TMP\common98.dll
- %TEMP%\IXP000.TMP\SelfReg.dll
- %TEMP%\IXP000.TMP\adcvbs.inc
- %TEMP%\IXP000.TMP\mdac11.cab
- %TEMP%\IXP000.TMP\acmsetup.hlp
- %TEMP%\IXP000.TMP\setup.tdf
- %TEMP%\IXP000.TMP\setup.exe
- %TEMP%\IXP000.TMP\qfeupd.exe
- %TEMP%\IXP000.TMP\mdac_typ.inf
- %TEMP%\IXP000.TMP\mdac_typ.stf
- %TEMP%\IXP000.TMP\odbckey.inf
- %TEMP%\IXP000.TMP\setup.ini
- %TEMP%\IXP000.TMP\msadce.dll
- %TEMP%\IXP000.TMP\ADOREA~1.TXT
- %TEMP%\IXP000.TMP\HANDLER.SRG
- %TEMP%\IXP000.TMP\msadcer.dll
- %TEMP%\IXP000.TMP\msdatsrc.tlb
- %TEMP%\IXP000.TMP\msadco.dll
- %TEMP%\IXP000.TMP\msadcor.dll
- %TEMP%\IXP000.TMP\msjtes40.dll
- %TEMP%\_is3\easySms.msi
- %TEMP%\IXP000.TMP\adcjavas.inc
- %TEMP%\IXP000.TMP\msadcs.dll
- %TEMP%\IXP000.TMP\msadcfr.dll
- %TEMP%\IXP000.TMP\msdfmap.dll
- %TEMP%\IXP000.TMP\msdfmap.ini
- %TEMP%\IXP000.TMP\HANDLER.reg
- %TEMP%\IXP000.TMP\msadds.dll
- %TEMP%\IXP000.TMP\msaddsr.dll
- %TEMP%\IXP000.TMP\msdaprst.dll
- %TEMP%\IXP000.TMP\odbcjt32.dll
- %TEMP%\IXP000.TMP\odbcji32.dll
- %TEMP%\IXP000.TMP\drvvfp.cnt
- %TEMP%\IXP000.TMP\msdadc.dll
- %TEMP%\IXP000.TMP\msdasql.dll
- %TEMP%\~2.tmp
- %TEMP%\IXP000.TMP\msdatt.dll
- %TEMP%\IXP000.TMP\msdaenum.dll
- %TEMP%\IXP000.TMP\mtxdm.dll
- %TEMP%\IXP000.TMP\MSDASC.HLP
- %TEMP%\IXP000.TMP\msvcrt.dll
- %TEMP%\_is3\0x0409.ini
- %TEMP%\IXP000.TMP\msdasqlr.dll
- %TEMP%\IXP000.TMP\msdatl2.dll
- %TEMP%\IXP000.TMP\msdaerr.dll
- %TEMP%\IXP000.TMP\MSDASQ~1.TXT
- %TEMP%\_is3\_ISMSIDEL.INI
- %TEMP%\_is3\Setup.INI
- %TEMP%\IXP000.TMP\msdasc.dll
- %TEMP%\IXP000.TMP\ds16gt.dll
- %TEMP%\IXP000.TMP\odbc32gt.dll
- %TEMP%\IXP000.TMP\odbc32.dll
- %TEMP%\IXP000.TMP\odbccp32.dll
- %TEMP%\IXP000.TMP\odbcint.dll
- %TEMP%\IXP000.TMP\odbccr32.dll
- %TEMP%\IXP000.TMP\odbccu32.dll
- %TEMP%\IXP000.TMP\odbc16gt.dll
- %TEMP%\IXP000.TMP\MSDASC.CNT
- %TEMP%\easysms\Installer\easysms_setup.exe
- %TEMP%\IXP000.TMP\odbccp32.cpl
- %TEMP%\IXP000.TMP\odbctrac.dll
- %TEMP%\IXP000.TMP\odbcinst.hlp
- %TEMP%\IXP000.TMP\odbcinst.cnt
- %TEMP%\IXP000.TMP\odbcconf.exe
- %TEMP%\IXP000.TMP\ds32gt.dll
- %TEMP%\IXP000.TMP\odbcad32.exe
- %TEMP%\IXP000.TMP\msdaer.dll
- %TEMP%\IXP000.TMP\MSDASC.TXT
- %TEMP%\IXP000.TMP\sqloledb.dll
- %TEMP%\IXP000.TMP\SQLSOLDB.hlp
- %TEMP%\IXP000.TMP\SQLOLEDB.TXT
- %TEMP%\IXP000.TMP\msorcl32.dll
- %TEMP%\IXP000.TMP\msorcl32.hlp
- %TEMP%\IXP000.TMP\windbver.exe
- %TEMP%\IXP000.TMP\sqlsodbc.hlp
- %TEMP%\IXP000.TMP\dbmsshrn.dll
- %TEMP%\IXP000.TMP\msorcl32.cnt
- %TEMP%\IXP000.TMP\mtxoci.dll
- %TEMP%\IXP000.TMP\vfpodbc.dll
- %TEMP%\IXP000.TMP\vfpodbc.txt
- %TEMP%\IXP000.TMP\drvvfp.hlp
- %TEMP%\IXP000.TMP\MSORAC~1.TXT
- %TEMP%\IXP000.TMP\msdaora.dll
- %TEMP%\IXP000.TMP\MSORCL~1.TXT
- %TEMP%\IXP000.TMP\sqlsrdme.txt
- %TEMP%\IXP000.TMP\12520437.cpx
- %TEMP%\IXP000.TMP\msdaosp.dll
- %TEMP%\IXP000.TMP\oledb32.dll
- %TEMP%\IXP000.TMP\oledb32r.dll
- %TEMP%\IXP000.TMP\oleaut32.dll
- %TEMP%\IXP000.TMP\olepro32.dll
- %TEMP%\IXP000.TMP\asycfilt.dll
- %TEMP%\IXP000.TMP\stdole2.tlb
- %TEMP%\IXP000.TMP\oledb32x.dll
- %TEMP%\IXP000.TMP\msdaps.dll
- %TEMP%\IXP000.TMP\dbnmpntw.dll
- %TEMP%\IXP000.TMP\instcat.sql
- %TEMP%\IXP000.TMP\dbmssocn.dll
- %TEMP%\IXP000.TMP\odbcbcp.dll
- %TEMP%\IXP000.TMP\mscpxl32.dll
- %TEMP%\IXP000.TMP\12520850.cpx
- %TEMP%\IXP000.TMP\sqlsrv32.dll
- %TEMP%\IXP000.TMP\setup.lst
- %WINDIR%\Temp\scs4.tmp
Удаляет следующие файлы:
- %TEMP%\~2.tmp
Другое:
Создает и запускает на исполнение:
- '%TEMP%\easysms\Installer\mdac.exe' /q:a /c:\"setup.exe /qt /n\"
- '%TEMP%\easysms\Installer\easysms_setup.exe'
Запускает на исполнение:
- '<SYSTEM32>\ntvdm.exe' -f -i1 -w -a <SYSTEM32>\krnl386.exe
