Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'csrss' = '<SYSTEM32>\wbem\csrss.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- <SYSTEM32>\wbem\csrss.exe
Запускает на исполнение:
- <SYSTEM32>\cmd.exe /c %TEMP%\temp.bat
Изменяет следующие настройки браузера Windows Internet Explorer:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\ins[1].htm
- %TEMP%\temp.bat
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\upd[1].htm
- <SYSTEM32>\n.ini
- <LS_APPDATA>\n.ini
- <SYSTEM32>\wbem\csrss.exe
Самоудаляется.
Сетевая активность:
Подключается к:
- 'localhost':1037
- '20#.#4.117.62':80
- 'localhost':1035
Другое:
Ищет следующие окна:
- ClassName: '172573' WindowName: ''
- ClassName: '173619' WindowName: ''
- ClassName: '170557' WindowName: ''
- ClassName: '171557' WindowName: ''
- ClassName: '174635' WindowName: ''
- ClassName: '177698' WindowName: ''
- ClassName: '178807' WindowName: ''
- ClassName: '175635' WindowName: ''
- ClassName: '176651' WindowName: ''
- ClassName: '163073' WindowName: ''
- ClassName: '164073' WindowName: ''
- ClassName: '160948' WindowName: ''
- ClassName: '161948' WindowName: ''
- ClassName: '165229' WindowName: ''
- ClassName: '168557' WindowName: ''
- ClassName: '169557' WindowName: ''
- ClassName: '166229' WindowName: ''
- ClassName: '167244' WindowName: ''
- ClassName: '189541' WindowName: ''
- ClassName: '190651' WindowName: ''
- ClassName: '187541' WindowName: ''
- ClassName: '188541' WindowName: ''
- ClassName: '191666' WindowName: ''
- ClassName: '194713' WindowName: ''
- ClassName: '195823' WindowName: ''
- ClassName: '192666' WindowName: ''
- ClassName: '193666' WindowName: ''
- ClassName: '181401' WindowName: ''
- ClassName: '182541' WindowName: ''
- ClassName: '178838' WindowName: ''
- ClassName: '180385' WindowName: ''
- ClassName: '182885' WindowName: ''
- ClassName: '185541' WindowName: ''
- ClassName: '186541' WindowName: ''
- ClassName: '183541' WindowName: ''
- ClassName: '184541' WindowName: ''
- ClassName: '136526' WindowName: ''
- ClassName: '137526' WindowName: ''
- ClassName: '134369' WindowName: ''
- ClassName: '135526' WindowName: ''
- ClassName: '138526' WindowName: ''
- ClassName: '141557' WindowName: ''
- ClassName: '142557' WindowName: ''
- ClassName: '139526' WindowName: ''
- ClassName: '140557' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '105304' WindowName: ''
- ClassName: '103' WindowName: ''
- ClassName: '124226' WindowName: ''
- ClassName: '133429' WindowName: ''
- ClassName: '134354' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '153713' WindowName: ''
- ClassName: '154760' WindowName: ''
- ClassName: '151713' WindowName: ''
- ClassName: '152713' WindowName: ''
- ClassName: '155760' WindowName: ''
- ClassName: '158916' WindowName: ''
- ClassName: '159932' WindowName: ''
- ClassName: '156760' WindowName: ''
- ClassName: '157776' WindowName: ''
- ClassName: '145666' WindowName: ''
- ClassName: '146666' WindowName: ''
- ClassName: '143573' WindowName: ''
- ClassName: '144588' WindowName: ''
- ClassName: '147666' WindowName: ''
- ClassName: '149713' WindowName: ''
- ClassName: '150713' WindowName: ''
- ClassName: '147916' WindowName: ''
- ClassName: '148682' WindowName: ''
