Trojan.DownLoader29.51000

Техническая информация

Для обеспечения автозапуска и распространения

Создает следующие сервисы

[<HKLM>\System\CurrentControlSet\Services\uvnc_service] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\uvnc_service] 'ImagePath' = '"%ProgramFiles%\UltraVNC\winvnc.exe" -service'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\nsx2.tmp
%ProgramFiles%\ultravnc\driver\xp\license.txt
%ProgramFiles%\ultravnc\driver\xp\install_silent.bat
%ProgramFiles%\ultravnc\driver\xp\install.bat
%ProgramFiles%\ultravnc\driver\w2k\driver\mv2.sys
%ProgramFiles%\ultravnc\driver\w2k\driver\mv2.inf
%ProgramFiles%\ultravnc\driver\w2k\driver\mv2.dll
%ProgramFiles%\ultravnc\driver\w2k\driver\mv2.cat
%ProgramFiles%\ultravnc\driver\w2k\uninstall_silent.bat
%ProgramFiles%\ultravnc\driver\xp\uninstall.bat
%ProgramFiles%\ultravnc\driver\xp\setupdrv.exe
%ProgramFiles%\ultravnc\driver\w2k\license.txt
%ProgramFiles%\ultravnc\driver\w2k\install_silent.bat
%ProgramFiles%\ultravnc\driver\w2k\install.bat
%ProgramFiles%\ultravnc\driver\vista64\driver\mv2.sys
%ProgramFiles%\ultravnc\driver\vista64\driver\mv2.inf
%ProgramFiles%\ultravnc\driver\vista64\driver\mv2.dll
%ProgramFiles%\ultravnc\driver\vista64\driver\mv2.cat
%ProgramFiles%\ultravnc\driver\vista64\uninstall_silent.bat
%ProgramFiles%\ultravnc\driver\w2k\uninstall.bat
%ProgramFiles%\ultravnc\ldapauthnt4.dll
%ProgramFiles%\ultravnc\driver\xp\uninstall_silent.bat
%ALLUSERSPROFILE%\start menu\programs\ultravnc\ultravnc server\stop winvnc service.lnk
%ALLUSERSPROFILE%\start menu\programs\ultravnc\ultravnc server\start winvnc service.lnk
%ALLUSERSPROFILE%\start menu\programs\ultravnc\ultravnc server\remove winvnc service.lnk
%ALLUSERSPROFILE%\start menu\programs\ultravnc\ultravnc server\install winvnc service.lnk
%ALLUSERSPROFILE%\start menu\programs\ultravnc\ultravnc server.lnk
%TEMP%\nsd3.tmp\nsscm.dll
%ProgramFiles%\ultravnc\driver\xp64\driver\mv2.sys
%ProgramFiles%\ultravnc\driver\xp64\driver\mv2.inf
%ProgramFiles%\ultravnc\driver\xp64\driver\mv2.dll
%ProgramFiles%\ultravnc\driver\xp64\driver\mv2.cat
%ProgramFiles%\ultravnc\driver\xp64\uninstall_silent.bat
%ProgramFiles%\ultravnc\driver\xp64\uninstall.bat
%ProgramFiles%\ultravnc\driver\xp64\setupdrv.exe
%ProgramFiles%\ultravnc\driver\xp64\license.txt
%ProgramFiles%\ultravnc\driver\xp64\install_silent.bat
%ProgramFiles%\ultravnc\driver\xp64\install.bat
%ProgramFiles%\ultravnc\driver\xp\driver\mv2.sys
%ProgramFiles%\ultravnc\driver\xp\driver\mv2.inf
%ProgramFiles%\ultravnc\driver\xp\driver\mv2.dll
%ProgramFiles%\ultravnc\driver\vista64\uninstall.bat
%ProgramFiles%\ultravnc\driver\w2k\setupdrv.exe
%ProgramFiles%\ultravnc\driver\vista64\setupdrv.exe
%ProgramFiles%\ultravnc\driver\vista64\license.txt
%ProgramFiles%\ultravnc\driver\vista64\install_silent.bat
%ProgramFiles%\ultravnc\vnchooks_settings.reg
%ProgramFiles%\ultravnc\info.txt
%ProgramFiles%\ultravnc\check_install.exe
%ProgramFiles%\ultravnc\cad.exe
%ProgramFiles%\ultravnc\authadmin.dll
%ProgramFiles%\ultravnc\authssp.dll
%ProgramFiles%\ultravnc\acl.txt
%ProgramFiles%\ultravnc\zip32.dll
%ProgramFiles%\ultravnc\whatsnew.txt
%ProgramFiles%\ultravnc\unzip32.dll
%ProgramFiles%\ultravnc\ldapauth.dll
%ProgramFiles%\ultravnc\ultravnc.ico
%ProgramFiles%\ultravnc\schook.dll
%ProgramFiles%\ultravnc\readme.txt
%ProgramFiles%\ultravnc\readme-licence.txt
%ProgramFiles%\ultravnc\msrc4plugin-122.dsm
%ProgramFiles%\ultravnc\mslogonacl.exe
%ProgramFiles%\ultravnc\licence.txt
%ProgramFiles%\ultravnc\aesv2plugin.dsm
%TEMP%\nsd3.tmp\system.dll
%ProgramFiles%\ultravnc\driver\xp\driver\mv2.cat
%ProgramFiles%\ultravnc\ldapauth9x.dll
%ProgramFiles%\ultravnc\logmessages.dll
%ProgramFiles%\ultravnc\isxdl.dll
%ProgramFiles%\ultravnc\driver\vista64\install.bat
%ProgramFiles%\ultravnc\driver\vista\driver\mv2.sys
%ProgramFiles%\ultravnc\driver\vista\driver\mv2.inf
%ProgramFiles%\ultravnc\driver\vista\driver\mv2.dll
%ProgramFiles%\ultravnc\driver\vista\driver\mv2.cat
%ProgramFiles%\ultravnc\driver\vista\uninstall_silent.bat
%ProgramFiles%\ultravnc\driver\vista\uninstall.bat
%ProgramFiles%\ultravnc\driver\vista\setupdrv.exe
%ProgramFiles%\ultravnc\driver\vista\license.txt
%ProgramFiles%\ultravnc\driver\vista\install_silent.bat
%ProgramFiles%\ultravnc\driver\vista\install.bat
%ProgramFiles%\ultravnc\workgrpdomnt4.dll
%ProgramFiles%\ultravnc\winvnc.exe
%ProgramFiles%\ultravnc\vnchooks.dll
%ProgramFiles%\ultravnc\ultravnc.ini
%ProgramFiles%\ultravnc\testauth.exe
%ProgramFiles%\ultravnc\setupdrv.exe
%ProgramFiles%\ultravnc\props.reg
%ProgramFiles%\ultravnc\logging.dll
%ProgramFiles%\ultravnc\uninst.exe