Техническая информация
Вредоносные функции:
Внедряет код в
следующие системные процессы:
- %WINDIR%\Explorer.EXE
Изменения в файловой системе:
Создает следующие файлы:
- <Текущая директория>\my.ini
Сетевая активность:
Подключается к:
- 'aa#.#ovevpn.com':80
- 'localhost':1039
- 'ip.#558.org':80
TCP:
Запросы HTTP GET:
- aa#.#ovevpn.com/hot.php
- ip.#558.org/dns.htm
UDP:
- DNS ASK aa#.#ovevpn.com
- DNS ASK ip.#558.org
- '<IP-адрес в локальной сети>':1038
Другое:
Ищет следующие окна:
- ClassName: '' WindowName: 'msn6.exe'
- ClassName: '' WindowName: 'msnmsgr.exe'
- ClassName: '' WindowName: 'NAVAPW32.EXE'
- ClassName: '' WindowName: 'Mir3Game.exe'
- ClassName: '' WindowName: 'miranda32.exe'
- ClassName: '' WindowName: 'mpftray.exe'
- ClassName: '' WindowName: 'netxray.exe'
- ClassName: '' WindowName: 'outpost.exe'
- ClassName: '' WindowName: 'pidgin.exe'
- ClassName: '' WindowName: 'qip.exe'
- ClassName: '' WindowName: 'nod.exe'
- ClassName: '' WindowName: 'nod32.exe'
- ClassName: '' WindowName: 'opera.exe'
- ClassName: '' WindowName: 'MCAGENT.EXE'
- ClassName: '' WindowName: 'gw.exe'
- ClassName: '' WindowName: 'httplook.exe'
- ClassName: '' WindowName: 'ICQ.exe'
- ClassName: '' WindowName: 'googletalk.exe'
- ClassName: '' WindowName: 'GUARD.EXE'
- ClassName: '' WindowName: 'GVOnline.bin'
- ClassName: '' WindowName: 'iexplore.exe'
- ClassName: '' WindowName: 'lotroclient.exe'
- ClassName: '' WindowName: 'magent.exe'
- ClassName: '' WindowName: 'maplestory.exe'
- ClassName: '' WindowName: 'InphaseNXD.exe'
- ClassName: '' WindowName: 'l2.bin'
- ClassName: '' WindowName: 'lin.bin'
- ClassName: '' WindowName: 'zapro.exe'
- ClassName: '' WindowName: 'zlclient.exe'
- ClassName: '' WindowName: 'ZONEALARM.EXE'
- ClassName: '' WindowName: 'wsm.exe'
- ClassName: '' WindowName: 'YahooMessenger.exe'
- ClassName: '' WindowName: 'ybclient.exe'
- ClassName: '' WindowName: 'ZZ__cd75efb816b2cc__.exe'
- ClassName: '' WindowName: '<Имя вируса>.exe'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: 'thp.exe'
- ClassName: '' WindowName: '<Служебное имя>.exe'
- ClassName: '' WindowName: 'cscript.exe'
- ClassName: '' WindowName: 'wow.exe'
- ClassName: '' WindowName: 'smc.exe'
- ClassName: '' WindowName: 'so3d.exe'
- ClassName: '' WindowName: 'spidernt.exe'
- ClassName: '' WindowName: 'Ragexe.exe'
- ClassName: '' WindowName: 'RagFree.exe'
- ClassName: '' WindowName: 'skype.exe'
- ClassName: '' WindowName: 'sro_client.exe'
- ClassName: '' WindowName: 'winbaram.exe'
- ClassName: '' WindowName: 'windump.exe'
- ClassName: '' WindowName: 'woool.exe'
- ClassName: '' WindowName: 'trillian.exe'
- ClassName: '' WindowName: 'TwelveSky2.exe'
- ClassName: '' WindowName: 'WebMoney.exe'
- ClassName: '' WindowName: 'ge.exe'
- ClassName: '' WindowName: 'aion.exe'
- ClassName: '' WindowName: 'ash.exe'
- ClassName: '' WindowName: 'ashAvast.exe'
- ClassName: '' WindowName: '__cd75efb816b2cc__.exe'
- ClassName: '' WindowName: '360tray.exe'
- ClassName: '' WindowName: 'ageofconan.exe'
- ClassName: '' WindowName: 'ashAvSrv.exe'
- ClassName: '' WindowName: 'AVP.COM'
- ClassName: '' WindowName: 'AVP.EXE'
- ClassName: '' WindowName: 'AVP32.EXE'
- ClassName: '' WindowName: 'avgcc.exe'
- ClassName: '' WindowName: 'AVGCC32.EXE'
- ClassName: '' WindowName: 'AVGCTRL.EXE'
- ClassName: '' WindowName: 'alg.exe'
- ClassName: '' WindowName: 'System'
- ClassName: '' WindowName: 'smss.exe'
- ClassName: '' WindowName: 'csrss.exe'
- ClassName: 'msctls_updown32' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: '[System Process]'
- ClassName: '' WindowName: 'winlogon.exe'
- ClassName: '' WindowName: 'explorer.exe'
- ClassName: '' WindowName: 'spoolsv.exe'
- ClassName: '' WindowName: 'ctfmon.exe'
- ClassName: '' WindowName: 'services.exe'
- ClassName: '' WindowName: 'lsass.exe'
- ClassName: '' WindowName: 'svchost.exe'
- ClassName: '' WindowName: 'ecmd.exe'
- ClassName: '' WindowName: 'egni.exe'
- ClassName: '' WindowName: 'ekrn.exe'
- ClassName: '' WindowName: 'drweb386.exe'
- ClassName: '' WindowName: 'Drwebupw.exe'
- ClassName: '' WindowName: 'Drwebwcl.exe'
- ClassName: '' WindowName: 'elementclient.exe'
- ClassName: '' WindowName: 'fsavaui.exe'
- ClassName: '' WindowName: 'fsavgui.exe'
- ClassName: '' WindowName: 'gc.exe'
- ClassName: '' WindowName: 'firefox.exe'
- ClassName: '' WindowName: 'fsav.exe'
- ClassName: '' WindowName: 'fsav32.exe'
- ClassName: '' WindowName: 'Drweb32w.exe'
- ClassName: '' WindowName: 'bdagent.exe'
- ClassName: '' WindowName: 'bdss.exe'
- ClassName: '' WindowName: 'bdsubmit.exe'
- ClassName: '' WindowName: 'AVPCC.EXE'
- ClassName: '' WindowName: 'AVPM.EXE'
- ClassName: '' WindowName: 'AVSYNMGR.EXE'
- ClassName: '' WindowName: 'cabalmain.exe'
- ClassName: '' WindowName: 'dekaron.exe'
- ClassName: '' WindowName: 'dnf.exe'
- ClassName: '' WindowName: 'drweb.exe'
- ClassName: '' WindowName: 'ccapp.exe'
- ClassName: '' WindowName: 'chrome.exe'
- ClassName: '' WindowName: 'ClamWin.exe'
