Trojan.KeyLogger.41387

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\Software\Classes\GoogleDesktop.search\shell\open\command] '' = '"%ProgramFiles(x86)%\Google\Google Desktop Search\GoogleDesktop.exe" /search "%1"'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = '%ProgramFiles%\Google\GOOGLE~1\GO36F4~1.DLL'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
[<HKLM>\Software\Classes\GoogleGadget\shell\open\command] '' = '"%ProgramFiles(x86)%\Google\Google Desktop Search\GoogleDesktop.exe" /display /load "%1"'
[<HKLM>\Software\Classes\GoogleGadgetContainer\shell\open\command] '' = '"%ProgramFiles(x86)%\Google\Google Desktop Search\GoogleDesktop.exe" /display /load "%1"'
[<HKLM>\Software\Classes\GoogleGadgetManifest\shell\open\command] '' = '"%ProgramFiles(x86)%\Google\Google Desktop Search\GoogleDesktop.exe" /display /load "%1"'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Google Desktop Search' = '"%ProgramFiles(x86)%\Google\Google Desktop Search\GoogleDesktop.exe" /startup'
[<HKLM>\Software\Classes\Google Earth.etafile\shell\open\command] '' = '"%ProgramFiles(x86)%\Google\Google Desktop Search\GoogleDesktop.exe" /display /kml "%1"'
[<HKLM>\Software\Classes\Google Earth.kmlfile\shell\open\command] '' = '"%ProgramFiles(x86)%\Google\Google Desktop Search\GoogleDesktop.exe" /display /kml "%1"'
[<HKLM>\Software\Classes\Google Earth.kmzfile\shell\open\command] '' = '"%ProgramFiles(x86)%\Google\Google Desktop Search\GoogleDesktop.exe" /display /kml "%1"'

Создает следующие сервисы

[<HKLM>\System\CurrentControlSet\Services\GoogleDesktopManager-121807-210419] 'ImagePath' = '"%ProgramFiles(x86)%\Google\Google Desktop Search\GoogleDesktop.exe"'

Вредоносные функции

Устанавливает процедуры перхвата сообщений

о нажатии клавиш клавиатуры:

Библиотека-обработчик для всех процессов: %ProgramFiles(x86)%\Google\Google Desktop Search\GoogleServices.DLL

Изменения в файловой системе

Создает следующие файлы

%ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktopresources_en.dll
<LS_APPDATA>\google\google desktop\266de371bfc9\dbc2e.ht1
<LS_APPDATA>\google\google desktop\266de371bfc9\dbu2d.ht1
<LS_APPDATA>\google\google desktop\266de371bfc9\dbdao
<LS_APPDATA>\google\google desktop\266de371bfc9\dbeao
%ProgramFiles(x86)%\google\google desktop search\googledesktopmozilla.src
%ProgramFiles(x86)%\google\google desktop search\googleservices.dll
%ProgramFiles(x86)%\google\google desktop search\googleuiengine.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktopssd.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktopnetwork3.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktopactions.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktophyper.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktopmail.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktopdeskbar2.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktopmozilla.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktopcommon.dll
%ProgramFiles(x86)%\google\google desktop search\gzlib.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktopoffice.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktopapi2.dll
%ProgramFiles(x86)%\google\google desktop search\googledesktopie.dll
<LS_APPDATA>\google\google desktop\266de371bfc9\dbvmh.ht1
<LS_APPDATA>\google\google desktop\266de371bfc9\dbm
%PROGRAMDATA%\microsoft\windows\start menu\programs\google desktop\uninstall google desktop.lnk
<LS_APPDATA>\google\google desktop\266de371bfc9\fiih.ht1
%PROGRAMDATA%\microsoft\windows\start menu\programs\google desktop\google desktop sidebar.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\google desktop\google desktop options.lnk
%PROGRAMDATA%\microsoft\windows\start menu\programs\google desktop\google desktop.lnk
<LS_APPDATA>\google\google desktop\266de371bfc9\safeweb\goog-black-enchashm.cf1
<LS_APPDATA>\google\google desktop\266de371bfc9\safeweb\goog-black-enchashmh.ht1
<LS_APPDATA>\google\google desktop\266de371bfc9\safeweb\goog-malware-domainm.cf1
<LS_APPDATA>\google\google desktop\266de371bfc9\safeweb\goog-malware-domainmh.ht1
<LS_APPDATA>\google\google desktop\266de371bfc9\safeweb\goog-black-urlm.cf1
<LS_APPDATA>\google\google desktop\266de371bfc9\safeweb\goog-black-urlmh.ht1
<LS_APPDATA>\google\google desktop\266de371bfc9\safeweb\goog-white-domainm.cf1
<LS_APPDATA>\google\google desktop\266de371bfc9\safeweb\goog-white-domainmh.ht1
<LS_APPDATA>\google\google desktop\266de371bfc9\hp
<LS_APPDATA>\google\google desktop\266de371bfc9\hpt2i.ht1
<LS_APPDATA>\google\google desktop\266de371bfc9\rpm1m.cf1
<LS_APPDATA>\google\google desktop\266de371bfc9\rpm1mh.ht1
<LS_APPDATA>\google\google desktop\266de371bfc9\rpm.cf1
<LS_APPDATA>\google\google desktop\266de371bfc9\rpmh.ht1
<LS_APPDATA>\google\google desktop\266de371bfc9\fiid-tmp
<LS_APPDATA>\google\google desktop\266de371bfc9\fii.cf1
%ProgramFiles(x86)%\google\google desktop search\googledesktop.exe
<LS_APPDATA>\google\google desktop\266de371bfc9\dbvm.cf1
%ProgramFiles(x86)%\google\google desktop search\googledesktopresources_en.dll
%ProgramFiles(x86)%\google\google desktop search\_new_plugin_common.js
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopactions.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktophyper.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmail.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopdeskbar2.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozilla.png
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozilla.src
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozillastub.xpt
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozillastub.js
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozilla.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopcommon.dll
%ProgramFiles(x86)%\google\google desktop search\_new_gzlib.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopoffice.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopapi2.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopie.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktop.exe
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopresources_en.dll
%ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googleservices.dll
%ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktopsetuphelper.exe
%ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktopcommon.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopnetwork3.dll
%ProgramFiles(x86)%\google\google desktop search\_new_plugin_common.vbs
%ProgramFiles(x86)%\google\google desktop search\al ###
%ProgramFiles(x86)%\google\google desktop search\_new_topic_sites.dat
%ProgramFiles(x86)%\google\google desktop search\ak ### googledesktopsetup.exe -uninstall
%ProgramFiles(x86)%\google\google desktop search\aj ###
%ProgramFiles(x86)%\google\google desktop search\ai ### or run
%ProgramFiles(x86)%\google\google desktop search\ah ### in the control panel
%ProgramFiles(x86)%\google\google desktop search\ag ### add-remove programs
%ProgramFiles(x86)%\google\google desktop search\af ### to uninstall use
%ProgramFiles(x86)%\google\google desktop search\ae ###
%ProgramFiles(x86)%\google\google desktop search\ad ### may stop working
%ProgramFiles(x86)%\google\google desktop search\ac ### files - your system
%ProgramFiles(x86)%\google\google desktop search\ab ### move or delete these
%ProgramFiles(x86)%\google\google desktop search\aa ### warning - do not
%ProgramFiles(x86)%\google\google desktop search\googledesktopsetup.exe
%ProgramFiles(x86)%\google\google desktop search\_new_sites.txt
%ProgramFiles(x86)%\google\google desktop search\_new_googleservices.dll
%ProgramFiles(x86)%\google\google desktop search\_new_gpac.xml
%ProgramFiles(x86)%\google\google desktop search\_new_weather_en.gg_new_
%ProgramFiles(x86)%\google\google desktop search\_new_analogclock_en.gg_new_
%ProgramFiles(x86)%\google\google desktop search\_new_googleuiengine.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopssd.dll
%ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktop.exe
C:\users\public\desktop\google desktop.lnk

Удаляет следующие файлы

%ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktopcommon.dll
%ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktopsetuphelper.exe
%ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktop.exe
%ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googleservices.dll
%ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktopresources_en.dll

Перемещает следующие файлы

%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopresources_en.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktopresources_en.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googleservices.dll в %ProgramFiles(x86)%\google\google desktop search\googleservices.dll
%ProgramFiles(x86)%\google\google desktop search\_new_gpac.xml в %ProgramFiles(x86)%\google\google desktop search\gpac.xml
%ProgramFiles(x86)%\google\google desktop search\_new_weather_en.gg_new_ в %ProgramFiles(x86)%\google\google desktop search\weather_en.gg
%ProgramFiles(x86)%\google\google desktop search\_new_analogclock_en.gg_new_ в %ProgramFiles(x86)%\google\google desktop search\analogclock_en.gg
%ProgramFiles(x86)%\google\google desktop search\_new_googleuiengine.dll в %ProgramFiles(x86)%\google\google desktop search\googleuiengine.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopssd.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktopssd.dll
%ProgramFiles(x86)%\google\google desktop search\_new_topic_sites.dat в %ProgramFiles(x86)%\google\google desktop search\topic_sites.dat
%ProgramFiles(x86)%\google\google desktop search\_new_plugin_common.vbs в %ProgramFiles(x86)%\google\google desktop search\plugin_common.vbs
%ProgramFiles(x86)%\google\google desktop search\_new_plugin_common.js в %ProgramFiles(x86)%\google\google desktop search\plugin_common.js
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopnetwork3.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktopnetwork3.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopactions.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktopactions.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktophyper.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktophyper.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmail.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktopmail.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopdeskbar2.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktopdeskbar2.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozilla.png в %ProgramFiles(x86)%\google\google desktop search\googledesktopmozilla.png
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozilla.src в %ProgramFiles(x86)%\google\google desktop search\googledesktopmozilla.src
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozillastub.xpt в %ProgramFiles(x86)%\google\google desktop search\googledesktopmozillastub.xpt
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozillastub.js в %ProgramFiles(x86)%\google\google desktop search\googledesktopmozillastub.js
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopmozilla.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktopmozilla.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopcommon.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktopcommon.dll
%ProgramFiles(x86)%\google\google desktop search\_new_gzlib.dll в %ProgramFiles(x86)%\google\google desktop search\gzlib.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopoffice.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktopoffice.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopapi2.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktopapi2.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktopie.dll в %ProgramFiles(x86)%\google\google desktop search\googledesktopie.dll
%ProgramFiles(x86)%\google\google desktop search\_new_googledesktop.exe в %ProgramFiles(x86)%\google\google desktop search\googledesktop.exe
%ProgramFiles(x86)%\google\google desktop search\_new_sites.txt в %ProgramFiles(x86)%\google\google desktop search\sites.txt
<LS_APPDATA>\google\google desktop\266de371bfc9\fiid-tmp в <LS_APPDATA>\google\google desktop\266de371bfc9\fiid

Сетевая активность

Подключается к

'localhost':4664

Другое

Ищет следующие окна

ClassName: '_GD_MonMD' WindowName: ''
ClassName: 'Progman' WindowName: ''
ClassName: '_GD_Sidebar' WindowName: ''
ClassName: 'SideBar_AppBarWindow' WindowName: ''
ClassName: '_GD_Crawl' WindowName: ''
ClassName: '_GD_Mon' WindowName: ''

Создает и запускает на исполнение

'%ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktopsetuphelper.exe' /mdo
'%ProgramFiles(x86)%\google\google desktop search\googledesktop.exe' /system /regserver /quit
'%ProgramFiles(x86)%\google\google desktop search\gcdtmp1\googledesktop.exe' /manager /service /path "%ProgramFiles(x86)%\Google\Google Desktop Search\"
'%ProgramFiles(x86)%\google\google desktop search\googledesktop.exe' /display /regserver /quit
'%ProgramFiles(x86)%\google\google desktop search\googledesktop.exe' /system /gdupdate /quit /system
'%ProgramFiles(x86)%\google\google desktop search\googledesktop.exe' /install
'%ProgramFiles(x86)%\google\google desktop search\googledesktop.exe' /display /userreg /quit
'%ProgramFiles(x86)%\google\google desktop search\googledesktop.exe'
'%ProgramFiles(x86)%\google\google desktop search\googledesktop.exe' /crawl /recent /ie /shell

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней