ПОЛЬЗОВАТЕЛЯМ

Закрыть

Поиск

Поиск

Поддержка
Круглосуточная поддержка

Напишите

Запрос через форму

Позвоните

Бесплатно по России:
8-800-333-79-32

ЧаВо | Форум

Напишите

Задать вопрос в поддержку

Ваши запросы

  • Все: -
  • Незакрытые: -
  • Последний: -

Позвоните

Бесплатно по России:
8-800-333-79-32

Свяжитесь с нами Незакрытые запросы: 

Профиль

Профиль

RU
RU CN DE EN ES FR IT JP KZ UZ PL BY
Закрыть

Переключение языка сайта

Сервисы
Сканеры
FixIt!
Dr.Web vxCube
Экспертиза ВКИ
Вирусная библиотека
База знаний

Технологии

Термины

Обучение и просвещение

Мифы

Новости

Win32.HLLW.Autoruner1.17943

Добавлен в вирусную базу Dr.Web: 2012-06-28

Описание добавлено:

Техническая информация

Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FP-WIN.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPROT.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\F-STOPW.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FINDVIRU.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IAMSERV.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IBMASN.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FRW.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IAMAPP.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ECENGINE.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ESAFE.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DVP95.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DVP95_0.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\F-PROT.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\F-PROT95.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXPWATCH.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\F-AGNT95.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IBMAVSP.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LUALL.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MOOLIVE.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LOCKDOWN2000.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LOOKOUT.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVLU32.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVNT.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPFTRAY.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\N32SCANW.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICMON.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICSUPP95.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICLOAD95.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICLOADNT.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IOMON98.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\JEDI.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICSUPPNT.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IFACE.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLEANER3.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVE32.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGCTRL.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AUTODOWN.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCONSOL.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP32.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKSERV.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVNT.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_AVP32.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_AVPCC.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'TBMonEx' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANTI-TROJAN.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\APVXDWIN.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_AVPM.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ACKWIN32.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPCC.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFIAUDIT.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFINET.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BLACKICE.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFIADMIN.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLAW95CF.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLEANER.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFINET32.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLAW95.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPTC32.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPUPD.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPDOS32.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPM.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWUPD32.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BLACKD.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVSCHED32.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWIN95.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rising.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAVtimer.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\РЮёґ№¤ѕЯ.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAVmon.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAVmonD.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZONEALARM.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MAILMON.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WFINDV32.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\THGUARD.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanHunter.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EGHOST.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NMain.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSvcUI.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVFW.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logo1_.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logo_1.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVwsc.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchUI.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVsvc.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WEBSCANX.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PERSFW.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAV7.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCCWIN98.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCFWALLICON.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SAFEWEB.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCAN32.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAV7WIN.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FESCUE.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NORMIST.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NUPGRADE.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVWNT.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NISUM.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAVSCHED.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAVW.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NVC95.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAVCL.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCAN95.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VET95.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VETTRAY.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TDS2-98.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TDS2-NT.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSHWIN32.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSSTAT.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSCAN40.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSECOMR.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SERV95.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMC.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANPM.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCRSCAN.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TBSCAN.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TCA.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SPHINX.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
  • [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SWEEP95.EXE] 'Debugger' = '%WINDIR%\system\S0UNDMAN.EXE'
Вредоносные функции:
Создает и запускает на исполнение:
  • %WINDIR%\system\S0UNDMAN.EXE
Запускает на исполнение:
  • <SYSTEM32>\cmd.exe /c ""%WINDIR%\system\S0UNDMAN.EXE.bat""
  • <SYSTEM32>\cmd.exe /c ""<Полный путь к вирусу>.bat""
Изменения в файловой системе:
Создает следующие файлы:
  • C:\ntldr.exe
  • %WINDIR%\system\S0UNDMAN.EXE.bat
  • C:\autorun.inf
  • %WINDIR%\system\S0UNDMAN.EXE
  • <Полный путь к вирусу>.bat
Присваивает атрибут 'скрытый' для следующих файлов:
  • C:\ntldr.exe
  • C:\autorun.inf
  • %WINDIR%\system\S0UNDMAN.EXE
Удаляет следующие файлы:
  • %WINDIR%\system\S0UNDMAN.EXE
Самоудаляется.