Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEXPLORE.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OIS.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPREVIEW.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VFP9.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mplayer.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmplayer.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DXDIAG.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GRAPH.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMV-RTP.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMV-CLN.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSPAINT.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RemoteCmdSvc.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VProConsole.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VProConsole_.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\unlocker.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Update.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ypsr.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ypsrru.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Unins000.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKCU>\Control Panel\Desktop] 'SCRNSAVE.EXE' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Fixinstall.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FORMAT.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppclean.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\save.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\unlocer.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Uninstall.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dfrg.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\keygen.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nipsvc.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ccapp.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cclaw.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcsched.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcod.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcoas.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskkill.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\freecell.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NOD32krn.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\call.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BLUESOLEIL.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RSTRUI.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCRNSAVE.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav32.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procexp.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vb6.exe] 'debugger' = 'C:\Walpaper.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Restore my files.exe] 'debugger' = 'C:\Walpaper.exe'
Создает или изменяет следующие файлы:
- %HOMEPATH%\Start Menu\Programs\Startup\Walpaper.exe
- %HOMEPATH%\Start Menu\Programs\Startup\CHIMX.exe
Создает следующие файлы на съемном носителе:
- <Имя диска съемного носителя>:\Poto 01.exe
- <Имя диска съемного носителя>:\Walpaper.exe
- <Имя диска съемного носителя>:\Gambar Lucu.exe
- <Имя диска съемного носителя>:\Kasihku.exe
- <Имя диска съемного носителя>:\Sayangku.exe
Вредоносные функции:
Для затруднения выявления своего присутствия в системе
блокирует отображение:
- скрытых файлов
Изменяет следующие настройки проводника Windows (Windows Explorer):
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSaveSettings' = '00000001'
Изменения в файловой системе:
Создает следующие файлы:
- %ALLUSERSPROFILE%\Favorites\Image.exe
- %ALLUSERSPROFILE%\Documents\Cantik.exe
- %ALLUSERSPROFILE%\Favorites\Imoet.exe
- C:\Walpaper.exe
- %ALLUSERSPROFILE%\Favorites\Cantik.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\Imoet.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\Image.exe
- %ALLUSERSPROFILE%\Start Menu\Programs\Cantik.exe
- %ALLUSERSPROFILE%\Documents\Imoet.exe
- %ALLUSERSPROFILE%\Documents\Image.exe
- C:\Poto 01.exe
- %WINDIR%\VBVM60.dll
- <SYSTEM32>\VBVM60.dll
- <SYSTEM32>\CHIMX.exe
- %WINDIR%\CHIMX.exe
- C:\Sayangku.exe
- C:\Gambar Lucu.exe
- C:\Kasihku.exe
- %WINDIR%\Walpaper.exe
- <SYSTEM32>\Walpaper.exe
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\CHIMX.exe
- %HOMEPATH%\Start Menu\Programs\Startup\CHIMX.exe
- %WINDIR%\CHIMX.exe
- C:\Walpaper.exe
- <Имя диска съемного носителя>:\Walpaper.exe
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
