Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\fsproflt] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\FSProFilter] 'Start' = '00000000'
Вредоносные функции:
Создает и запускает на исполнение:
- %TEMP%\is-R89LO.tmp\Setup.tmp /SL5="$200E0,1288394,54272,%ALLUSERSPROFILE%\Application Data\Setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
- %ALLUSERSPROFILE%\Application Data\Setup.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
Запускает на исполнение:
- <SYSTEM32>\sc.exe create fsproflt binPath= <SYSTEM32>\fsproflt.exe DisplayName= "FSPro Filter Service" Start= Auto
- <SYSTEM32>\sc.exe start fsproflt
- <SYSTEM32>\sc.exe create FSProFilter binPath= System32\Drivers\FSPFltd.sys Type= filesys start= boot DisplayName= "FSPro File Filter" group= "FSFilter Content Screener" depend= FltMgr tag= yes
- <SYSTEM32>\fltMc.exe load FSProFilter
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\Hide Folders 2009\langs\is-8JDV6.tmp
- %PROGRAM_FILES%\Hide Folders 2009\langs\is-31FGU.tmp
- %PROGRAM_FILES%\Hide Folders 2009\langs\is-TNROI.tmp
- %PROGRAM_FILES%\Hide Folders 2009\langs\is-EBRU4.tmp
- %PROGRAM_FILES%\Hide Folders 2009\langs\is-HTKIP.tmp
- %PROGRAM_FILES%\Hide Folders 2009\langs\is-FJI4D.tmp
- %PROGRAM_FILES%\Hide Folders 2009\langs\is-JMUBL.tmp
- %PROGRAM_FILES%\Hide Folders 2009\langs\is-OOAHE.tmp
- %PROGRAM_FILES%\Hide Folders 2009\langs\is-037DI.tmp
- %PROGRAM_FILES%\Hide Folders 2009\langs\is-LLO8U.tmp
- %PROGRAM_FILES%\Hide Folders 2009\langs\is-9Q103.tmp
- %HOMEPATH%\Desktop\Hide Folders 2009.lnk
- %HOMEPATH%\Start Menu\Programs\Hide Folders 2009\Uninstall Hide Folders 2009.lnk
- %PROGRAM_FILES%\Hide Folders 2009\unins000.msg
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\release-notes[1].html
- %PROGRAM_FILES%\Hide Folders 2009\unins000.dat
- %HOMEPATH%\Start Menu\Programs\Hide Folders 2009\Hide Folders 2009 Homepage....lnk
- %PROGRAM_FILES%\Hide Folders 2009\langs\is-IL3O7.tmp
- %HOMEPATH%\Start Menu\Programs\Hide Folders 2009\Buy Hide Folders 2009 Now!.lnk
- %HOMEPATH%\Start Menu\Programs\Hide Folders 2009\Hide Folders 2009 Help.lnk
- %HOMEPATH%\Start Menu\Programs\Hide Folders 2009\Hide Folders 2009.lnk
- %TEMP%\is-24IFI.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-24IFI.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-24IFI.tmp\_isetup\_iscrypt.dll
- %PROGRAM_FILES%\Hide Folders 2009\is-4UQ6C.tmp
- %PROGRAM_FILES%\Hide Folders 2009\is-SENJG.tmp
- %ALLUSERSPROFILE%\Application Data\Setup.exe
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\is-R89LO.tmp\Setup.tmp
- %ALLUSERSPROFILE%\Application Data\$$.tmp
- %PROGRAM_FILES%\Hide Folders 2009\is-48S13.tmp
- %PROGRAM_FILES%\Hide Folders 2009\is-7714A.tmp
- %PROGRAM_FILES%\Hide Folders 2009\is-9UO6M.tmp
- <DRIVERS>\is-B8ICO.tmp
- %PROGRAM_FILES%\Hide Folders 2009\langs\is-BAN3H.tmp
- %PROGRAM_FILES%\Hide Folders 2009\langs\is-L57S5.tmp
- %PROGRAM_FILES%\Hide Folders 2009\is-1TFKI.tmp
- %PROGRAM_FILES%\Hide Folders 2009\is-TVLJV.tmp
- %PROGRAM_FILES%\Hide Folders 2009\is-6NS2Q.tmp
- %PROGRAM_FILES%\Hide Folders 2009\is-98AOJ.tmp
- %PROGRAM_FILES%\Hide Folders 2009\is-U9M27.tmp
Удаляет следующие файлы:
- %TEMP%\is-24IFI.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-R89LO.tmp\Setup.tmp
- %ALLUSERSPROFILE%\Application Data\Setup.exe
- %TEMP%\is-24IFI.tmp\_isetup\_RegDLL.tmp
- %TEMP%\aut1.tmp
- %TEMP%\aut2.tmp
- %TEMP%\is-24IFI.tmp\_isetup\_iscrypt.dll
Сетевая активность:
Подключается к:
- 'www.fs##o.net':80
- 'localhost':1035
TCP:
Запросы HTTP GET:
- www.fs##o.net/hide-folders/release-notes.html
UDP:
- DNS ASK www.fs##o.net
Другое:
Ищет следующие окна:
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'THF2009MainForm' WindowName: ''
- ClassName: '' WindowName: ''
