Trojan.KillFiles.64728

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...
[<HKLM>\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33...

Изменения в файловой системе

Удаляет следующие файлы

%WINDIR%\Prefetch\1.EXE-BF9D2CEF.pf
%WINDIR%\Prefetch\SYSTEMPROPERTIESADVANCED.EXE-68C7C4F0.pf
%WINDIR%\Prefetch\TASKENG.EXE-48D4E289.pf
%WINDIR%\Prefetch\TASKHOST.EXE-7238F31D.pf
%WINDIR%\Prefetch\TEST_MSVCP100.EXE-93B75347.pf
%WINDIR%\Prefetch\TEST_MSVCP100.EXE-D47FF5F1.pf
%WINDIR%\Prefetch\TEST_MSVCP100D_X64.EXE-24890C8A.pf
%WINDIR%\Prefetch\TEST_MSVCP100_X64.EXE-6E02575E.pf
%WINDIR%\Prefetch\TEST_MSVCP110.EXE-F929C484.pf
%WINDIR%\Prefetch\TEST_MSVCP120D.EXE-ED7DFBED.pf
%WINDIR%\Prefetch\TEST_MSVCP110D.EXE-6C7E6CB8.pf
%WINDIR%\Prefetch\TEST_MSVCP110D.EXE-DD6C4BD2.pf
%WINDIR%\Prefetch\TEST_MSVCP110D_X64.EXE-6AFAA41F.pf
%WINDIR%\Prefetch\TEST_MSVCP110_X64.EXE-600927FB.pf
%WINDIR%\Prefetch\TEST_MSVCP120.EXE-5E9C35C1.pf
%WINDIR%\Prefetch\TEST_MSVCP120.EXE-9F64D86B.pf
%WINDIR%\Prefetch\TEST_MSVCP120D.EXE-5E6BDB07.pf
%WINDIR%\Prefetch\SVCHOST.EXE-80F4A784.pf
%WINDIR%\Prefetch\TEST_MSVCP110.EXE-39F2672E.pf
%WINDIR%\Prefetch\SVCHOST.EXE-7AC6742A.pf
%WINDIR%\Prefetch\REGEDIT.EXE-90FEEA06.pf
%WINDIR%\Prefetch\POWERPNT.EXE-158B76A4.pf
%WINDIR%\Prefetch\RDRCEF.EXE-5852A8DE.pf
%WINDIR%\Prefetch\ReadyBoot\Trace3.fx
%WINDIR%\Prefetch\ReadyBoot\Trace4.fx
%WINDIR%\Prefetch\ReadyBoot\Trace5.fx
%WINDIR%\Prefetch\ReadyBoot\Trace6.fx
%WINDIR%\Prefetch\ReadyBoot\Trace7.fx
%WINDIR%\Prefetch\REGSVCS.EXE-A54AD617.pf
%WINDIR%\Prefetch\SPPSVC.EXE-B0F8131B.pf
%WINDIR%\Prefetch\REGTLIB.EXE-E21980A2.pf
%WINDIR%\Prefetch\SC.EXE-945D79AE.pf
%WINDIR%\Prefetch\SCHTASKS.EXE-5CA45734.pf
%WINDIR%\Prefetch\SETUP.EXE-7C026C7F.pf
%WINDIR%\Prefetch\SETUP.EXE-D0F6149E.pf
%WINDIR%\Prefetch\SETUP.EXE-F034C93C.pf
%WINDIR%\Prefetch\SETUP_WM.EXE-D33FD27D.pf
%WINDIR%\Prefetch\STEAMWEBHELPER.EXE-93613764.pf
%WINDIR%\Prefetch\UNINS000.EXE-53663602.pf
%WINDIR%\temp\ts_77d1.tmp
%WINDIR%\Prefetch\TEST_MSVCP140.EXE-6A49BAE5.pf
%WINDIR%\Prefetch\WMPNSCFG.EXE-FC0D39BF.pf
%WINDIR%\Prefetch\_IU14D2N.TMP-74616CED.pf
%WINDIR%\temp\8147932992814195939363050711163993686\adobearm.exe
%WINDIR%\temp\adobearm.log
%WINDIR%\temp\dmi8538.tmp
%WINDIR%\Temp\FXSAPIDebugLogFile.txt
%WINDIR%\Temp\FXSTIFFDebugLogFile.txt
%WINDIR%\temp\ts_2b0f.tmp
%WINDIR%\Prefetch\TEST_MSVCP120XP.EXE-D7D05439.pf
%WINDIR%\temp\ts_2bfb.tmp
%WINDIR%\temp\ts_316a.tmp
%WINDIR%\temp\ts_361e.tmp
%WINDIR%\temp\ts_3852.tmp
%WINDIR%\temp\ts_39ba.tmp
%WINDIR%\temp\ts_4f66.tmp
%WINDIR%\temp\ts_5080.tmp
%WINDIR%\Prefetch\WMPLAYER.EXE-26C72A86.pf
%WINDIR%\Prefetch\PfSvPerfStats.bin
%WINDIR%\Prefetch\WMIPRVSE.EXE-6768A320.pf
%WINDIR%\Prefetch\TRUSTEDINSTALLER.EXE-3CC531E5.pf
%WINDIR%\Prefetch\TEST_MSVCP140D.EXE-606AF971.pf
%WINDIR%\Prefetch\TEST_MSVCP140D_X64.EXE-3E4F6ADE.pf
%WINDIR%\Prefetch\TEST_MSVCP140XP.EXE-6D280B1D.pf
%WINDIR%\Prefetch\TEST_MSVCP140_X64.EXE-361D99D2.pf
%WINDIR%\Prefetch\TEST_MSVCP90.EXE-29C5DA51.pf
%WINDIR%\Prefetch\TEST_MSVCP90_X64.EXE-CF1ECFBE.pf
%WINDIR%\Prefetch\TRIGGERKMS.EXE-7E8EDFDC.pf
%WINDIR%\Prefetch\TEST_MSVCP120D_X64.EXE-B16C3BB4.pf
%WINDIR%\Prefetch\WMIADAP.EXE-F8DFDFA2.pf
%WINDIR%\Prefetch\VS7JIT.EXE-AEF49C84.pf
%WINDIR%\Prefetch\VSSVC.EXE-B8AFC319.pf
%WINDIR%\Prefetch\WERFAULT.EXE-E69F695A.pf
%WINDIR%\Prefetch\WERMGR.EXE-0F2AC88C.pf
%WINDIR%\Prefetch\WEVTUTIL.EXE-400D93E8.pf
%WINDIR%\Prefetch\WEVTUTIL.EXE-EF5861C4.pf
%WINDIR%\Prefetch\WINWORD.EXE-778F7C2B.pf
%WINDIR%\Prefetch\WMIPRVSE.EXE-1628051C.pf
%WINDIR%\temp\ts_267a.tmp
%WINDIR%\Prefetch\PCAUI.EXE-3E82C312.pf
%WINDIR%\Prefetch\NETSH.EXE-F1B6DA12.pf
%WINDIR%\Prefetch\DLLHOST.EXE-5E46FA0D.pf
%WINDIR%\Prefetch\DLLHOST.EXE-766398D2.pf
%WINDIR%\Prefetch\DLLHOST.EXE-7FAA2E4C.pf
%WINDIR%\Prefetch\DLLHOST.EXE-861F96F8.pf
%WINDIR%\Prefetch\DLLHOST.EXE-B2EB1806.pf
%WINDIR%\Prefetch\DLLHOST.EXE-D58DA3A6.pf
%WINDIR%\Prefetch\DLLHOST.EXE-ECB71776.pf
%WINDIR%\Prefetch\DRVINST.EXE-4CB4314A.pf
%WINDIR%\Prefetch\JAVAW.EXE-DCCF0AB8.pf
%WINDIR%\Prefetch\EXCEL.EXE-53A22446.pf
%WINDIR%\Prefetch\EXPLORER.EXE-A80E4F97.pf
%WINDIR%\Prefetch\FIREFOX.EXE-18ACFCFF.pf
%WINDIR%\Prefetch\FLASHPLAYERUPDATESERVICE.EXE-216D9C35.pf
%WINDIR%\Prefetch\IEXPLORE.EXE-4B6C9213.pf
%WINDIR%\Prefetch\INSTALL.EXE-455F2D9B.pf
%WINDIR%\Prefetch\IPCONFIG.EXE-912F3D5B.pf
%WINDIR%\Prefetch\DEXPLORE.EXE-1749D792.pf
%WINDIR%\Prefetch\DOTNETFX.EXE-FE16BE11.pf
%WINDIR%\Prefetch\DEFRAG.EXE-588F90AD.pf
%WINDIR%\Prefetch\AgGlUAD_P_S-1-5-21-1960123792-2022915161-3775307078-1001.db
%WINDIR%\Prefetch\ACRORD32.EXE-ACF2947D.pf
%WINDIR%\Prefetch\ADDINUTIL.EXE-FEF23417.pf
%WINDIR%\Prefetch\AgAppLaunch.db
%WINDIR%\prefetch\agcx_sc4.db
%WINDIR%\Prefetch\AgGlFaultHistory.db
%WINDIR%\Prefetch\AgGlFgAppHistory.db
%WINDIR%\Prefetch\AgGlGlobalHistory.db
%WINDIR%\Prefetch\AgGlUAD_S-1-5-21-1960123792-2022915161-3775307078-1001.db
%WINDIR%\Prefetch\CONTROL.EXE-817F8F1D.pf
%WINDIR%\prefetch\agrobust.db
%WINDIR%\Prefetch\ARH.EXE-F07E6C2C.pf
%WINDIR%\Prefetch\ASPNET_REGIIS.EXE-B76F1AD7.pf
%WINDIR%\Prefetch\AUDIODG.EXE-BDFD3029.pf
%WINDIR%\Prefetch\BCSSYNC.EXE-3F6C64A2.pf
%WINDIR%\Prefetch\CMD.EXE-4A81B364.pf
%WINDIR%\Prefetch\CONHOST.EXE-1F3E9D7E.pf
%WINDIR%\Prefetch\DBGCLR.EXE-AD18E06E.pf
%WINDIR%\Prefetch\MMC.EXE-F5DC4F82.pf
%WINDIR%\Prefetch\OSE00001.EXE-3DA4B844.pf
%WINDIR%\Prefetch\LAUNCHER.EXE-E41E51EE.pf
%WINDIR%\Prefetch\MSIEXEC.EXE-E09A077A.pf
%WINDIR%\Prefetch\MSIF1A9.TMP-FA1CA0E9.pf
%WINDIR%\Prefetch\MSOHTMED.EXE-35A8CA79.pf
%WINDIR%\Prefetch\MSOHTMED.EXE-68E5AB1E.pf
%WINDIR%\Prefetch\MSOXMLED.EXE-E473A01D.pf
%WINDIR%\Prefetch\MSTSC.EXE-5283258E.pf
%WINDIR%\Prefetch\MSTSC.EXE-76A46E8A.pf
%WINDIR%\Prefetch\NGEN.EXE-7900743E.pf
%WINDIR%\Prefetch\KMSNANO_SETUP.TMP-11A1562C.pf
%WINDIR%\Prefetch\NGEN.EXE-AE594A6B.pf
%WINDIR%\Prefetch\NGEN.EXE-EC3F9239.pf
%WINDIR%\Prefetch\NTOSBOOT-B00DFAAD.pf
%WINDIR%\Prefetch\OPERA.EXE-9DD4E019.pf
%WINDIR%\Prefetch\OPERA_CRASHREPORTER.EXE-E30EBED0.pf
%WINDIR%\Prefetch\OSE.EXE-51C16F0E.pf
%WINDIR%\Prefetch\OSE.EXE-533D8AC9.pf
%WINDIR%\Prefetch\MSIEXEC.EXE-A2D55CB6.pf
%WINDIR%\Prefetch\OSPPSVC.EXE-E53D3CC0.pf
%WINDIR%\Prefetch\MSIEB32.TMP-A0D60608.pf
%WINDIR%\Prefetch\MMC.EXE-F39CDED6.pf
%WINDIR%\prefetch\layout.ini
%WINDIR%\Prefetch\LOGONUI.EXE-09140401.pf
%WINDIR%\Prefetch\MANAGEDDBGCA.EXE-6EA1439B.pf
%WINDIR%\Prefetch\MDM.EXE-EA9906DF.pf
%WINDIR%\Prefetch\MICROSOFT TOOLKIT.EXE-9DAE6A40.pf
%WINDIR%\Prefetch\MIGPOLWIN.EXE-79E606FC.pf
%WINDIR%\Prefetch\MMC.EXE-53159585.pf
%WINDIR%\Prefetch\KMSNANO_SETUP.EXE-631A87C6.pf
%WINDIR%\Prefetch\MSI6837.TMP-63DEBE2C.pf
%WINDIR%\Prefetch\MOFCOMP.EXE-8FE3D558.pf
%WINDIR%\Prefetch\MOFCOMP.EXE-FDE76EFC.pf
%WINDIR%\Prefetch\MSCONFIG.EXE-3A52734E.pf
%WINDIR%\Prefetch\MSCORSVW.EXE-57D17DAF.pf
%WINDIR%\Prefetch\MSCORSVW.EXE-C3C515BD.pf
%WINDIR%\Prefetch\MSDTC.EXE-CC1DEC77.pf
%WINDIR%\Prefetch\MSI419F.TMP-B24CC418.pf
%WINDIR%\Prefetch\MSIDF38.TMP-4231CF8D.pf
%WINDIR%\temp\ts_8e67.tmp

Другое

Создает и запускает на исполнение

'<SYSTEM32>\cmd.exe' /c rmdir C:\Temp /s /q' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c ipconfig / renew' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c ipconfig / release' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh int ip reset' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c netsh winsock reset' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c del /f /S /Q *.log' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c del /f /S /Q *.bak' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c del /f /S /Q TP3Helper.dat' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c del /f /S /Q %systemdrive%ow_drv.log' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c ipconfig / flushdns' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c rmdir %WINDIR%\Prefetch /s /q' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c md %Temp%' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c rmdir %Temp% /s /q' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c rmdir %WINDIR%\Temp /s /q' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c rmdir h:\Temp /s /q' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c rmdir G:\Temp /s /q' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c rmdir <Имя диска съемного носителя>:\Temp /s /q' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c rmdir E:\Temp /s /q' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c rmdir D:\Temp /s /q' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c rmdir %UserProfile%\Recent /s /q' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c sc config NDU start = disabled' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c rmdir C:\Temp /s /q
'<SYSTEM32>\ipconfig.exe' / flushdns
'<SYSTEM32>\ipconfig.exe' / renew
'<SYSTEM32>\ipconfig.exe' / release
'<SYSTEM32>\netsh.exe' winsock reset
'<SYSTEM32>\cmd.exe' /c sc config NDU start = disabled
'<SYSTEM32>\cmd.exe' /c ipconfig / flushdns
'<SYSTEM32>\cmd.exe' /c ipconfig / renew
'<SYSTEM32>\cmd.exe' /c ipconfig / release
'<SYSTEM32>\cmd.exe' /c netsh int ip reset
'<SYSTEM32>\cmd.exe' /c netsh winsock reset
'<SYSTEM32>\cmd.exe' /c del /f /S /Q *.log
'<SYSTEM32>\sc.exe' config NDU start = disabled
'<SYSTEM32>\cmd.exe' /c del /f /S /Q *.bak
'<SYSTEM32>\cmd.exe' /c del /f /S /Q %systemdrive%ow_drv.log
'<SYSTEM32>\cmd.exe' /c rmdir %WINDIR%\Prefetch /s /q
'<SYSTEM32>\cmd.exe' /c rmdir %UserProfile%\Recent /s /q
'<SYSTEM32>\cmd.exe' /c md %Temp%
'<SYSTEM32>\cmd.exe' /c rmdir %Temp% /s /q
'<SYSTEM32>\cmd.exe' /c rmdir %WINDIR%\Temp /s /q
'<SYSTEM32>\cmd.exe' /c rmdir h:\Temp /s /q
'<SYSTEM32>\cmd.exe' /c rmdir G:\Temp /s /q
'<SYSTEM32>\cmd.exe' /c rmdir <Имя диска съемного носителя>:\Temp /s /q
'<SYSTEM32>\cmd.exe' /c rmdir E:\Temp /s /q
'<SYSTEM32>\cmd.exe' /c rmdir D:\Temp /s /q
'<SYSTEM32>\cmd.exe' /c del /f /S /Q TP3Helper.dat
'<SYSTEM32>\netsh.exe' int ip reset

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней