Trojan.KillFiles.9573

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\pngfile\shell\open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\regfile\shell\open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\rtffile\shell\open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\mpegfile\shell\open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\jpegfile\shell\open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\JSFile\Shell\Open\Command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\mp3file\shell\open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\scrfile\shell\open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\xmlfile\shell\Open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\piffile\shell\open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\strfile\shell\open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\wmffile\shell\open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\txtfile\shell\open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\VBSFile\Shell\Open\Command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\wmafile\shell\open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\jarfile\shell\open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\.com] '' = 'strfile'
[<HKLM>\SOFTWARE\Classes\.cmd] '' = 'strfile'
[<HKLM>\SOFTWARE\Classes\AVIFile\shell\open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\.scr] '' = 'strfile'
[<HKLM>\SOFTWARE\Classes\.exe] '' = 'strfile'
[<HKLM>\SOFTWARE\Classes\.bat] '' = 'strfile'
[<HKLM>\SOFTWARE\Classes\.pif] '' = 'strfile'
[<HKLM>\SOFTWARE\Classes\batfile\shell\open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\htmlfile\shell\open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\inffile\shell\open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\inifile\shell\open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\giffile\shell\open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\cmdfile\shell\open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\comfile\shell\open\command] '' = 'psyc.exe "%1"'
[<HKLM>\SOFTWARE\Classes\exefile\shell\open\command] '' = 'psyc.exe "%1"'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet003\Services\USBSTOR] 'ImagePath' = 'C:\PSYC'
[<HKLM>\SYSTEM\ControlSet002\Services\USBSTOR] 'ImagePath' = 'C:\PSYC'
[<HKLM>\SYSTEM\ControlSet001\Services\USBSTOR] 'ImagePath' = 'C:\PSYC'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует запуск следующих системных утилит:

Диспетчера задач (Taskmgr)

Изменяет следующие настройки проводника Windows (Windows Explorer):

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoTrayContextMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoTrayContextMenu' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoViewContextMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoStartMenuSubFolders' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoSetTaskbar' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSetTaskbar' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoStartMenuSubFolders' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDrives' = '03FFFFFF'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoFind' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoDrives' = '03FFFFFF'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoViewContextMenu' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoDeletePrinter' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDeletePrinter' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoCommonGroups' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoCommonGroups' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoDesktop' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoAddPrinter' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoActiveDesktop' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoActiveDesktop' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoAddPrinter' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoNetHood' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoRun' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoNetHood' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoDesktop' = '00000001'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoFavoritesMenu' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFavoritesMenu' = '00000001'

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = '127.0.0.2:4444'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyServer' = '127.0.0.2:4444'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 'ProxyEnable' = '00000001'

Принудительно разрешает автозапуск со съемных носителей.

Изменения в файловой системе:

Создает следующие файлы: