Trojan.KillProc.17285

Техническая информация

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует отображение:

скрытых файлов

Создает и запускает на исполнение:

%TEMP%\nsw5.tmp\ns16.tmp REG.EXE DELETE "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\RemoteZilla-Server" /f
%TEMP%\nsw5.tmp\ns17.tmp cmd.exe /C del /P /Q "\RZ.txt"
%TEMP%\nsw5.tmp\ns18.tmp cmd.exe /C RMDIR /S /Q "%TEMP%\RZTmp1"
%TEMP%\nsw5.tmp\ns13.tmp REG.EXE DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RZ_Service" /f
%TEMP%\nsw5.tmp\ns14.tmp "netsh.exe" firewall delete allowedprogram "<Текущая директория>\RemoteZilla.exe" ALL
%TEMP%\nsw5.tmp\ns15.tmp "netsh.exe" firewall delete allowedprogram "<Текущая директория>\RemoteZilla.exe" CURRENT
%TEMP%\nsw5.tmp\ns19.tmp cmd.exe /C RMDIR /S /Q "%TEMP%\RZTmp2"
%TEMP%\nsw5.tmp\ns1D.tmp cmd.exe /C RMDIR /S /Q "%TEMP%\RZTmp2"
%TEMP%\nsw5.tmp\ns1E.tmp cmd.exe /C RMDIR /S /Q "<Текущая директория>"
%TEMP%\nsw5.tmp\ns1F.tmp cmd.exe /C RMDIR /S /Q ""
%TEMP%\nsw5.tmp\ns1A.tmp cmd.exe /C RMDIR /S /Q ""
%TEMP%\nsw5.tmp\ns1B.tmp cmd.exe /C del /P /Q "\RZ.txt"
%TEMP%\nsw5.tmp\ns1C.tmp cmd.exe /C RMDIR /S /Q "%TEMP%\RZTmp1"
%TEMP%\nsw5.tmp\ns12.tmp REG.EXE DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RZ_Service\Enum" /f
%TEMP%\nsw5.tmp\ns8.tmp "net.exe" stop RZ_Service
%TEMP%\nsw5.tmp\ns9.tmp "tskill.exe" RZHelper
%TEMP%\nsw5.tmp\nsA.tmp "taskkill.exe" /F /IM RZHelper.exe /T
%TEMP%\A~ADVANTIGu_.exe _?=<Текущая директория>\
%TEMP%\nsw5.tmp\ns6.tmp "sc.exe" delete RZ_Service
%TEMP%\nsw5.tmp\ns7.tmp "sc.exe" delete RZ_CAD
%TEMP%\nsw5.tmp\nsB.tmp "tskill.exe" RemoteZilla
%TEMP%\nsw5.tmp\nsF.tmp REG.EXE DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RZExe" /f
%TEMP%\nsw5.tmp\ns10.tmp REG.EXE DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RZHelper" /f
%TEMP%\nsw5.tmp\ns11.tmp REG.EXE DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RZ_Service\Security" /f
%TEMP%\nsw5.tmp\nsC.tmp "taskkill.exe" /F /IM RemoteZilla.exe /T
%TEMP%\nsw5.tmp\nsD.tmp REG.EXE DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\RZ-Hidden" /f
%TEMP%\nsw5.tmp\nsE.tmp REG.EXE DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\RZ-ShowSuperHidden" /f

Запускает на исполнение:

<SYSTEM32>\reg.exe DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RZExe" /f
<SYSTEM32>\reg.exe DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RZHelper" /f
<SYSTEM32>\reg.exe DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\RZ-Hidden" /f
<SYSTEM32>\reg.exe DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\RZ-ShowSuperHidden" /f
<SYSTEM32>\reg.exe DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RZ_Service" /f
<SYSTEM32>\reg.exe DELETE "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\RemoteZilla-Server" /f
<SYSTEM32>\reg.exe DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RZ_Service\Security" /f
<SYSTEM32>\reg.exe DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RZ_Service\Enum" /f
<SYSTEM32>\net.exe stop RZ_Service
<SYSTEM32>\net1.exe stop RZ_Service
<SYSTEM32>\sc.exe delete RZ_Service
<SYSTEM32>\sc.exe delete RZ_CAD
<SYSTEM32>\tskill.exe RemoteZilla
<SYSTEM32>\taskkill.exe /F /IM RemoteZilla.exe /T
<SYSTEM32>\tskill.exe RZHelper
<SYSTEM32>\taskkill.exe /F /IM RZHelper.exe /T