Trojan.KillFiles.64623

Техническая информация

Для обеспечения автозапуска и распространения

Создает следующие сервисы

[<HKLM>\System\CurrentControlSet\Services\bd0001] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\bd0001] 'ImagePath' = '<DRIVERS>\bd0001.sys'
[<HKLM>\SYSTEM\CurrentControlSet\Services\bd0001] 'ImagePath' = 'system32\DRIVERS\bd0001.sys'
[<HKLM>\System\CurrentControlSet\Services\bd0004] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\bd0004] 'ImagePath' = '<DRIVERS>\bd0004.sys'
[<HKLM>\SYSTEM\CurrentControlSet\Services\bd0004] 'ImagePath' = 'system32\DRIVERS\bd0004.sys'
[<HKLM>\System\CurrentControlSet\Services\BDArKit] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\BDArKit] 'ImagePath' = '<DRIVERS>\BDArKit.sys'
[<HKLM>\SYSTEM\CurrentControlSet\Services\BDArKit] 'ImagePath' = 'system32\DRIVERS\BDArKit.sys'
[<HKLM>\System\CurrentControlSet\Services\BDMWrench_x64] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\BDMWrench_x64] 'ImagePath' = '<DRIVERS>\BDMWrench_x64.sys'
[<HKLM>\SYSTEM\CurrentControlSet\Services\BDMWrench_x64] 'ImagePath' = 'system32\DRIVERS\BDMWrench_x64.sys'
[<HKLM>\System\CurrentControlSet\Services\bddlsvc] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\bddlsvc] 'ImagePath' = '"%APPDATA%\baidu\BaiduRJDownloader\1.5.0.63\bddlsvc.exe" -r'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\nsbef78.tmp
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\drivers\bd0004.sys
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\drivers\bd64_x64.dll
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\drivers\bd64_x86.dll
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\skin\skin.rdb
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\microsoft.vc80.atl\microsoft.vc80.atl.manifest
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\microsoft.vc80.atl\atl80.dll
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\microsoft.vc80.crt\microsoft.vc80.crt.manifest
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\microsoft.vc80.crt\msvcm80.dll
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\microsoft.vc80.crt\msvcp80.dll
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\microsoft.vc80.crt\msvcr80.dll
<DRIVERS>\bd0001.sys
<SYSTEM32>\bd64_x64.dll
<SYSTEM32>\bd64_x86.dll
<DRIVERS>\bd0004.sys
<DRIVERS>\bdarkit.sys
<DRIVERS>\bdmwrench_x64.sys
%WINDIR%\temp\udd3bb.tmp
%WINDIR%\temp\udd40a.tmp
%WINDIR%\temp\udd41b.tmp
%PROGRAMDATA%\baidu\common\global.db
%WINDIR%\temp\uddb5f.tmp
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\drivers\bd0001.sys
%PROGRAMDATA%\application data\baidu\baidurjdownloader\config\4402.dat
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\drivers\bdsafebrowser.sys
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\drivers\bdarkit.sys
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\dl.dll
%TEMP%\nsweff6.tmp\installhelper.dll
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\bdrcdl.exe
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\utilsdll.dll
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\reportdll.dll
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\protocoldll.dll
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\basedll.dll
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\config.xml
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\reportrecorddll.dll
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\bugreport.exe
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\aladdinassistant.exe
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\20000802.xml
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\bdsgproxydll.dll
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\appupdater.exe
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\drivermanager.dll
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\bdkitutils.dll
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\bddlsvc.exe
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\uninstaller.exe
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\mindownload.ico
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\iebdsofthelperplug.dll
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\npbdsofthelperplug.dll
%APPDATA%\baidu\baidurjdownloader\1.5.0.63\drivers\bdmwrench_x64.sys
%PROGRAMDATA%\application data\baidu\baidurjdownloader\config\106.dat