Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\Software\Classes\teamviewer8\shell\open\command] '' = '"%ProgramFiles%\TeamViewer\TeamViewer.exe" %1'
Создает следующие сервисы
- [<HKLM>\System\CurrentControlSet\Services\TeamViewer] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\TeamViewer] 'ImagePath' = '"%ProgramFiles%\TeamViewer\TeamViewer_Service.exe"'
Вредоносные функции
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\TeamViewer\TeamViewer.exe' = '%ProgramFiles%\TeamVi...
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\TeamViewer\TeamViewer_Service.exe' = '%ProgramFiles...
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\nsa2.tmp
- %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewer.gpd
- %ProgramFiles%\teamviewer\tvextracttemp\x86\tvpsprint.cat
- %ProgramFiles%\teamviewer\tvextracttemp\x86\tvprint.cat
- %ProgramFiles%\teamviewer\tvextracttemp\x86\tvmonitor.cat
- %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewervpn.cat
- %ProgramFiles%\teamviewer\tvextracttemp\tvfilesx86.7z
- %ProgramFiles%\teamviewer\tvextracttemp\tv_x64.dll
- %ProgramFiles%\teamviewer\tvextracttemp\tv_w32.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ro.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_staticres.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_zhcn.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_vi.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_uk.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_tr.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_th.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_sv.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_sr.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_sk.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_zhtw.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ru.dll
- %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewervpn.inf
- %ProgramFiles%\teamviewer\i386\teamviewer.gpd
- %WINDIR%\fonts\teamviewer10host.otf
- %APPDATA%\teamviewer\teamviewer10_logfile.log
- %TEMP%\nsi3.tmp\ns6.tmp
- %TEMP%\nsi3.tmp\ns5.tmp
- %ALLUSERSPROFILE%\start menu\programs\teamviewer 10\license.lnk
- %ALLUSERSPROFILE%\start menu\programs\teamviewer 10\teamviewer 10 host.lnk
- %ALLUSERSPROFILE%\start menu\programs\teamviewer 10\uninstall teamviewer 10 host.lnk
- %ALLUSERSPROFILE%\desktop\teamviewer 10 host.lnk
- %ProgramFiles%\teamviewer\tvextracttemp\x86\tvmonitor.inf
- %ProgramFiles%\teamviewer\tvextracttemp\w2k\teamviewervpn.inf
- %TEMP%\nsi3.tmp\findprocdll.dll
- %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewer_printprocessor.dll
- %ProgramFiles%\teamviewer\tvextracttemp\x86\tvmonitor.sy_
- %ProgramFiles%\teamviewer\tvextracttemp\w2k\teamviewervpn.sy_
- %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewervpn.sy_
- %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewer.ppd
- %ProgramFiles%\teamviewer\tvextracttemp\x86\tvpsprint.inf
- %ProgramFiles%\teamviewer\tvextracttemp\x86\tvprint.inf
- %ProgramFiles%\teamviewer\i386\teamviewer.ppd
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_pt.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_pl.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_no.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer.exe
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer10host.otf
- %ProgramFiles%\teamviewer\tvextracttemp\lizenz_teamviewer_en_unicode.txt
- %ProgramFiles%\teamviewer\tvextracttemp\lizenz_teamviewer_de_unicode.txt
- %ProgramFiles%\teamviewer\tvextracttemp\copyrights_en.txt
- %ProgramFiles%\teamviewer\tvextracttemp\copyrights_de.txt
- %TEMP%\nsi3.tmp\nsis7z.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_service.exe
- %ProgramFiles%\teamviewer\tvextracttemp\tvfiles.7z
- %TEMP%\nsi3.tmp\tvproc.dll
- %TEMP%\nsi3.tmp\tvupdateinfo.exe
- %TEMP%\teamviewer\tv10install.log
- %TEMP%\nsi3.tmp\ns4.tmp
- %TEMP%\nsi3.tmp\nsexec.dll
- %TEMP%\nsi3.tmp\system.dll
- %TEMP%\nsi3.tmp\userinfo.dll
- %TEMP%\nsi3.tmp\tvgetversion.dll
- %TEMP%\nsi3.tmp\nsarray.dll
- %ProgramFiles%\teamviewer\tvextracttemp\tv_w32.exe
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_desktop.exe
- %ProgramFiles%\teamviewer\tvextracttemp\tv_x64.exe
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_nl.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_fr.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_lt.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ko.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ja.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_it.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_id.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_hu.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_hr.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_he.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_fi.dll
- %ProgramFiles%\teamviewer\tvextracttemp\uninstall.exe
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_es.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_en.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_el.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_de.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_da.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_cs.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_bg.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ar.dll
- %TEMP%\nsi3.tmp\ns7.tmp
- %ProgramFiles%\teamviewer\teamviewer10_logfile.log
Удаляет следующие файлы
- %TEMP%\nsi3.tmp\ns4.tmp
- %TEMP%\nsi3.tmp\tvproc.dll
- %TEMP%\nsi3.tmp\tvgetversion.dll
- %TEMP%\nsi3.tmp\system.dll
- %TEMP%\nsi3.tmp\nsis7z.dll
- %TEMP%\nsi3.tmp\nsexec.dll
- %TEMP%\nsi3.tmp\nsarray.dll
- %TEMP%\nsi3.tmp\findprocdll.dll
- %ProgramFiles%\teamviewer\tvextracttemp\w2k\teamviewervpn.sy_
- %ProgramFiles%\teamviewer\tvextracttemp\w2k\teamviewervpn.inf
- %TEMP%\teamviewer\tvinstalltemp\tvfile144.bak
- %TEMP%\teamviewer\tvinstalltemp\tvfile128.bak
- %TEMP%\teamviewer\tvinstalltemp\tvfile127.bak
- %TEMP%\nsi3.tmp\ns7.tmp
- %TEMP%\nsi3.tmp\ns6.tmp
- %TEMP%\nsi3.tmp\ns5.tmp
- %ProgramFiles%\teamviewer\tvextracttemp\tvfilesx86.7z
- %ProgramFiles%\teamviewer\tvextracttemp\tvfiles.7z
- %TEMP%\nsi3.tmp\tvupdateinfo.exe
- %TEMP%\nsi3.tmp\userinfo.dll
Перемещает следующие файлы
- %ProgramFiles%\teamviewer\tvextracttemp\copyrights_de.txt в %ProgramFiles%\teamviewer\copyrights_de.txt
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_fi.dll в %ProgramFiles%\teamviewer\teamviewer_resource_fi.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_no.dll в %ProgramFiles%\teamviewer\teamviewer_resource_no.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ja.dll в %ProgramFiles%\teamviewer\teamviewer_resource_ja.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ru.dll в %ProgramFiles%\teamviewer\teamviewer_resource_ru.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ko.dll в %ProgramFiles%\teamviewer\teamviewer_resource_ko.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_cs.dll в %ProgramFiles%\teamviewer\teamviewer_resource_cs.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ar.dll в %ProgramFiles%\teamviewer\teamviewer_resource_ar.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_zhcn.dll в %ProgramFiles%\teamviewer\teamviewer_resource_zhcn.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_pl.dll в %ProgramFiles%\teamviewer\teamviewer_resource_pl.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_tr.dll в %ProgramFiles%\teamviewer\teamviewer_resource_tr.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_bg.dll в %ProgramFiles%\teamviewer\teamviewer_resource_bg.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_el.dll в %ProgramFiles%\teamviewer\teamviewer_resource_el.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_he.dll в %ProgramFiles%\teamviewer\teamviewer_resource_he.dll
- %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewervpn.sy_ в %ProgramFiles%\teamviewer\x86\teamviewervpn.sy_
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_hr.dll в %ProgramFiles%\teamviewer\teamviewer_resource_hr.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_id.dll в %ProgramFiles%\teamviewer\teamviewer_resource_id.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_lt.dll в %ProgramFiles%\teamviewer\teamviewer_resource_lt.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_ro.dll в %ProgramFiles%\teamviewer\teamviewer_resource_ro.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_sk.dll в %ProgramFiles%\teamviewer\teamviewer_resource_sk.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_sr.dll в %ProgramFiles%\teamviewer\teamviewer_resource_sr.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_th.dll в %ProgramFiles%\teamviewer\teamviewer_resource_th.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_uk.dll в %ProgramFiles%\teamviewer\teamviewer_resource_uk.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_vi.dll в %ProgramFiles%\teamviewer\teamviewer_resource_vi.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_zhtw.dll в %ProgramFiles%\teamviewer\teamviewer_resource_zhtw.dll
- %ProgramFiles%\teamviewer\lizenz_teamviewer_en_unicode.txt в %ProgramFiles%\teamviewer\license.txt
- %ProgramFiles%\teamviewer\copyrights_en.txt в %ProgramFiles%\teamviewer\copyrights.txt
- %ProgramFiles%\teamviewer\lizenz_teamviewer_de_unicode.txt в %TEMP%\teamviewer\tvinstalltemp\tvfile127.bak
- %ProgramFiles%\teamviewer\copyrights_de.txt в %TEMP%\teamviewer\tvinstalltemp\tvfile128.bak
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_pt.dll в %ProgramFiles%\teamviewer\teamviewer_resource_pt.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_sv.dll в %ProgramFiles%\teamviewer\teamviewer_resource_sv.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_nl.dll в %ProgramFiles%\teamviewer\teamviewer_resource_nl.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_it.dll в %ProgramFiles%\teamviewer\teamviewer_resource_it.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_fr.dll в %ProgramFiles%\teamviewer\teamviewer_resource_fr.dll
- %ProgramFiles%\teamviewer\tvextracttemp\lizenz_teamviewer_de_unicode.txt в %ProgramFiles%\teamviewer\lizenz_teamviewer_de_unicode.txt
- %ProgramFiles%\teamviewer\tvextracttemp\lizenz_teamviewer_en_unicode.txt в %ProgramFiles%\teamviewer\lizenz_teamviewer_en_unicode.txt
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer.exe в %ProgramFiles%\teamviewer\teamviewer.exe
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_desktop.exe в %ProgramFiles%\teamviewer\teamviewer_desktop.exe
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_service.exe в %ProgramFiles%\teamviewer\teamviewer_service.exe
- %ProgramFiles%\teamviewer\tvextracttemp\uninstall.exe в %ProgramFiles%\teamviewer\uninstall.exe
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_staticres.dll в %ProgramFiles%\teamviewer\teamviewer_staticres.dll
- %ProgramFiles%\teamviewer\tvextracttemp\tv_w32.dll в %ProgramFiles%\teamviewer\tv_w32.dll
- %ProgramFiles%\teamviewer\tvextracttemp\tv_w32.exe в %ProgramFiles%\teamviewer\tv_w32.exe
- %ProgramFiles%\teamviewer\tvextracttemp\tv_x64.dll в %ProgramFiles%\teamviewer\tv_x64.dll
- %ProgramFiles%\teamviewer\tvextracttemp\tv_x64.exe в %ProgramFiles%\teamviewer\tv_x64.exe
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer10host.otf в %ProgramFiles%\teamviewer\teamviewer10host.otf
- %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewervpn.cat в %ProgramFiles%\teamviewer\x86\teamviewervpn.cat
- %ProgramFiles%\teamviewer\x86\teamviewervpn.sy_ в %ProgramFiles%\teamviewer\x86\teamviewervpn.sys
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_hu.dll в %ProgramFiles%\teamviewer\teamviewer_resource_hu.dll
- %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewervpn.inf в %ProgramFiles%\teamviewer\x86\teamviewervpn.inf
- %ProgramFiles%\teamviewer\tvextracttemp\x86\tvmonitor.inf в %ProgramFiles%\teamviewer\x86\tvmonitor.inf
- %ProgramFiles%\teamviewer\tvextracttemp\x86\tvmonitor.sy_ в %ProgramFiles%\teamviewer\x86\tvmonitor.sy_
- %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewer_printprocessor.dll в %ProgramFiles%\teamviewer\x86\teamviewer_printprocessor.dll
- %ProgramFiles%\teamviewer\tvextracttemp\x86\tvprint.cat в %ProgramFiles%\teamviewer\x86\tvprint.cat
- %ProgramFiles%\teamviewer\tvextracttemp\x86\tvprint.inf в %ProgramFiles%\teamviewer\x86\tvprint.inf
- %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewer.gpd в %ProgramFiles%\teamviewer\x86\teamviewer.gpd
- %ProgramFiles%\teamviewer\tvextracttemp\x86\tvpsprint.cat в %ProgramFiles%\teamviewer\x86\tvpsprint.cat
- %ProgramFiles%\teamviewer\tvextracttemp\x86\tvpsprint.inf в %ProgramFiles%\teamviewer\x86\tvpsprint.inf
- %ProgramFiles%\teamviewer\tvextracttemp\x86\teamviewer.ppd в %ProgramFiles%\teamviewer\x86\teamviewer.ppd
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_en.dll в %ProgramFiles%\teamviewer\teamviewer_resource_en.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_de.dll в %ProgramFiles%\teamviewer\teamviewer_resource_de.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_es.dll в %ProgramFiles%\teamviewer\teamviewer_resource_es.dll
- %ProgramFiles%\teamviewer\tvextracttemp\teamviewer_resource_da.dll в %ProgramFiles%\teamviewer\teamviewer_resource_da.dll
- %ProgramFiles%\teamviewer\tvextracttemp\copyrights_en.txt в %ProgramFiles%\teamviewer\copyrights_en.txt
- %ProgramFiles%\teamviewer\tvextracttemp\x86\tvmonitor.cat в %ProgramFiles%\teamviewer\x86\tvmonitor.cat
- %ProgramFiles%\teamviewer\teamviewer10host.otf в %TEMP%\teamviewer\tvinstalltemp\tvfile144.bak
Подменяет следующие файлы
- %ProgramFiles%\teamviewer\x86\teamviewervpn.sy_
Сетевая активность
UDP
- DNS ASK pi###.#eamviewer.com
- DNS ASK do#####d.teamviewer.com
- DNS ASK wp#d
- DNS ASK ma#####.teamviewer.com
Другое
Ищет следующие окна
- ClassName: '#32770' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\nsi3.tmp\ns4.tmp' schtasks /Create /TN TVInstallRestore /TR "<Полный путь к файлу> /RESTORE" /RU SYSTEM /SC ONLOGON /F
- '%TEMP%\nsi3.tmp\tvupdateinfo.exe'
- '%TEMP%\nsi3.tmp\ns5.tmp' %ProgramFiles%\TeamViewer\TeamViewer_Service.exe -install
- '%ProgramFiles%\teamviewer\teamviewer_service.exe' -install
- '%TEMP%\nsi3.tmp\ns6.tmp' %ProgramFiles%\TeamViewer\TeamViewer.exe --InstallAPI --StartedByInstaller
- '%ProgramFiles%\teamviewer\teamviewer.exe' --InstallAPI --StartedByInstaller
- '%TEMP%\nsi3.tmp\ns7.tmp' schtasks /Delete /TN TVInstallRestore /F
- '%ProgramFiles%\teamviewer\teamviewer_service.exe'
- '%ProgramFiles%\teamviewer\teamviewer.exe'
- '%ProgramFiles%\teamviewer\tv_w32.exe' --action hooks --log %ProgramFiles%\TeamViewer\TeamViewer10_Logfile.log
- '%TEMP%\nsi3.tmp\ns4.tmp' schtasks /Create /TN TVInstallRestore /TR "<Полный путь к файлу> /RESTORE" /RU SYSTEM /SC ONLOGON /F' (со скрытым окном)
- '%TEMP%\nsi3.tmp\ns5.tmp' %ProgramFiles%\TeamViewer\TeamViewer_Service.exe -install' (со скрытым окном)
- '%TEMP%\nsi3.tmp\ns6.tmp' %ProgramFiles%\TeamViewer\TeamViewer.exe --InstallAPI --StartedByInstaller' (со скрытым окном)
- '%TEMP%\nsi3.tmp\ns7.tmp' schtasks /Delete /TN TVInstallRestore /F' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\schtasks.exe' /Create /TN TVInstallRestore /TR "<Полный путь к файлу> /RESTORE" /RU SYSTEM /SC ONLOGON /F
- '<SYSTEM32>\schtasks.exe' /Delete /TN TVInstallRestore /F
