Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'VitaVaccine' = '"%PROGRAM_FILES%\VitaVaccine\VitaVaccine.exe" /Scan'
Вредоносные функции:
Создает и запускает на исполнение:
- %PROGRAM_FILES%\VitaVaccine\VVAutoUpdate.exe /b
- %PROGRAM_FILES%\VitaVaccine\etc\VVReg.exe /avscanpro /chk
- %PROGRAM_FILES%\VitaVaccine\VitaVaccine.exe /Scan
Запускает на исполнение:
- <SYSTEM32>\cmd.exe /c \DelUS.bat
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\VitaVaccine\pop_result1_title.gif
- %TEMP%\VitaVaccine\pop_result1_cancel.bmp
- %TEMP%\VitaVaccine\pop_result2_title.gif
- %TEMP%\VitaVaccine\pop_result2_bg.bmp
- %TEMP%\VitaVaccine\pop_result1_bg.bmp
- %TEMP%\VitaVaccine\pop_end_bg.bmp
- %TEMP%\VitaVaccine\normal.bmp
- %TEMP%\VitaVaccine\pop_end_yes.bmp
- %TEMP%\VitaVaccine\pop_end_cancel.bmp
- %TEMP%\VitaVaccine\realtime_title.bmp
- %TEMP%\VitaVaccine\realtime_stop.bmp
- %TEMP%\VitaVaccine\release_all2.bmp
- %TEMP%\VitaVaccine\release_all.bmp
- %TEMP%\VitaVaccine\realtime_start.bmp
- %TEMP%\VitaVaccine\Pop_Tray_bg.bmp
- %TEMP%\VitaVaccine\pop_resutl1_ok.bmp
- %TEMP%\VitaVaccine\qurantine_title.bmp
- %TEMP%\VitaVaccine\Pop_Tray_bg2.bmp
- %TEMP%\VitaVaccine\list_control\VerticleScrollBarUpArrow.bmp
- %TEMP%\VitaVaccine\list_control\VerticleScrollbarTop.bmp
- %TEMP%\VitaVaccine\logo.bmp
- %TEMP%\VitaVaccine\loading.bmp
- %TEMP%\VitaVaccine\list_control\VerticleScrollBarThumb.bmp
- %TEMP%\VitaVaccine\list_control\VerticleScrollbarBottom.bmp
- %TEMP%\VitaVaccine\list_control\right_pattern.bmp
- %TEMP%\VitaVaccine\list_control\VerticleScrollBarSpan.bmp
- %TEMP%\VitaVaccine\list_control\VerticleScrollBarDownArrow.bmp
- %TEMP%\VitaVaccine\minmize.bmp
- %TEMP%\VitaVaccine\maxmize.bmp
- %TEMP%\VitaVaccine\msg_yes.bmp
- %TEMP%\VitaVaccine\msg_no.bmp
- %TEMP%\VitaVaccine\mark.bmp
- %TEMP%\VitaVaccine\main_chk_general_scan2.bmp
- %TEMP%\VitaVaccine\main_btn_startpage.bmp
- %TEMP%\VitaVaccine\main_chk_vs_scan2.bmp
- %TEMP%\VitaVaccine\main_chk_power_scan2.bmp
- %TEMP%\VitaVaccine\report.bmp
- %TEMP%\VitaVaccine\setup.bmp
- %TEMP%\VitaVaccine\set.bmp
- %TEMP%\VitaVaccine\top_title.bmp
- %TEMP%\VitaVaccine\skin.xml
- %TEMP%\VitaVaccine\service_win_temp_title.bmp
- %TEMP%\VitaVaccine\service_internet_temp_title.bmp
- %TEMP%\VitaVaccine\scan_update_info.bmp
- %TEMP%\VitaVaccine\service_win_searchlist_title.bmp
- %TEMP%\VitaVaccine\service_title.bmp
- %TEMP%\VitaVaccine\view.bmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\autoupdate[1].ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\paychk[1].htm
- %TEMP%\VitaVaccine\updateinfo_title.bmp
- %TEMP%\VitaVaccine\tray_btn_cure.bmp
- %TEMP%\VitaVaccine\tray_btn_close.bmp
- %TEMP%\VitaVaccine\tray_copy.gif
- %TEMP%\VitaVaccine\tray_btn_x.bmp
- %TEMP%\VitaVaccine\scaning_pattern_count.bmp
- %TEMP%\VitaVaccine\scaning_objects_count.bmp
- %TEMP%\VitaVaccine\scaning_scan.bmp
- %TEMP%\VitaVaccine\scaning_progresbar.bmp
- %TEMP%\VitaVaccine\scaning_counting.bmp
- %TEMP%\VitaVaccine\scaing_repair.bmp
- %TEMP%\VitaVaccine\restore.bmp
- %TEMP%\VitaVaccine\scaning_cancel.bmp
- %TEMP%\VitaVaccine\scaing_repair_can.bmp
- %TEMP%\VitaVaccine\scan_start.bmp
- %TEMP%\VitaVaccine\scan_list_bg.bmp
- %TEMP%\VitaVaccine\scan_title.bmp
- %TEMP%\VitaVaccine\scan_start2.bmp
- %TEMP%\VitaVaccine\scan_info.bmp
- %TEMP%\VitaVaccine\scanlog_title.bmp
- %TEMP%\VitaVaccine\scaning_target.bmp
- %TEMP%\VitaVaccine\scan_engine_update_info.bmp
- %TEMP%\VitaVaccine\scan_db_update_info.bmp
- %TEMP%\VitaVaccine\list_control\pattern.bmp
- %TEMP%\nsm2.tmp\DLLWebCount_new.dll
- %TEMP%\nsm2.tmp\IEFunctions.dll
- %TEMP%\nsm2.tmp\SelfDelete.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\inst_nor[1].php
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\VitaVaccine.lnk
- %HOMEPATH%\Start Menu\Programs\VitaVaccine\VitaVaccine.lnk
- %PROGRAM_FILES%\VitaVaccine\Uninstall.exe
- %HOMEPATH%\Start Menu\VitaVaccine.lnk
- %HOMEPATH%\Start Menu\Programs\VitaVaccine\VitaVaccine Б¦°Е.lnk
- %TEMP%\VitaVaccine\about_blank.bmp
- %TEMP%\VitaVaccine\5.bmp
- %TEMP%\VitaVaccine\all_select2.bmp
- %TEMP%\VitaVaccine\all_select.bmp
- %TEMP%\VitaVaccine\4.bmp
- %TEMP%\VitaVaccine\1.bmp
- C:\DelUS.bat
- %TEMP%\VitaVaccine\3.bmp
- %TEMP%\VitaVaccine\2.bmp
- %PROGRAM_FILES%\VitaVaccine\VVEngine.dll
- %PROGRAM_FILES%\VitaVaccine\VVAutoUpdate.exe
- %PROGRAM_FILES%\VitaVaccine\VitaVaccine.exe
- %PROGRAM_FILES%\VitaVaccine\VVUpdateServer.dat
- %TEMP%\nsm2.tmp\DLLWaitForKillProgram.dll
- %TEMP%\nsm2.tmp\IsVista.dll
- %TEMP%\nsm2.tmp\stack.dll
- %TEMP%\nsm2.tmp\KillProcDLL.dll
- %TEMP%\nsm2.tmp\VitaVaccineMsg.dll
- %PROGRAM_FILES%\VitaVaccine\skin\default.avs
- %PROGRAM_FILES%\VitaVaccine\Lang\kr.xml
- %PROGRAM_FILES%\VitaVaccine\partner.ini
- %TEMP%\nsm2.tmp\processes_second.dll
- %PROGRAM_FILES%\VitaVaccine\etc\VVmonRemote.dll
- %PROGRAM_FILES%\VitaVaccine\etc\VVFilterDriver.SYS
- %PROGRAM_FILES%\VitaVaccine\conf.ini
- %PROGRAM_FILES%\VitaVaccine\etc\VVReg.exe
- %PROGRAM_FILES%\VitaVaccine\etc\VVMon.exe
- %TEMP%\VitaVaccine\bg.bmp
- %TEMP%\VitaVaccine\in_scan_title.bmp
- %TEMP%\VitaVaccine\home.bmp
- %TEMP%\VitaVaccine\license_date.bmp
- %TEMP%\VitaVaccine\last_scan_date.bmp
- %TEMP%\VitaVaccine\help.bmp
- %TEMP%\VitaVaccine\common_exit.bmp
- %TEMP%\VitaVaccine\common_dlg_backpattern.bmp
- %TEMP%\VitaVaccine\engine_ver.bmp
- %TEMP%\VitaVaccine\del.bmp
- %TEMP%\VitaVaccine\list_control\HorizontalScrollBarSpan.bmp
- %TEMP%\VitaVaccine\list_control\HorizontalScrollBarRightArrow.bmp
- %TEMP%\VitaVaccine\list_control\left_pattern.bmp
- %TEMP%\VitaVaccine\list_control\HorizontalScrollBarThumb.bmp
- %TEMP%\VitaVaccine\list_control\HorizontalScrollBarLeftArrow.bmp
- %TEMP%\VitaVaccine\list_control\ColumnHeaderSpan.bmp
- %TEMP%\VitaVaccine\list_control\ColumnHeaderEnd.bmp
- %TEMP%\VitaVaccine\list_control\height_blank.bmp
- %TEMP%\VitaVaccine\list_control\ColumnHeaderStart.bmp
- %TEMP%\VitaVaccine\btn_qurantine.bmp
- %TEMP%\VitaVaccine\btn_menu1.bmp
- %TEMP%\VitaVaccine\btn_realtime_start.bmp
- %TEMP%\VitaVaccine\btn_realtime.bmp
- %TEMP%\VitaVaccine\btn_logout.bmp
- %TEMP%\VitaVaccine\btn_autoupdate.bmp
- %TEMP%\VitaVaccine\btn_account.bmp
- %TEMP%\VitaVaccine\btn_exit.bmp
- %TEMP%\VitaVaccine\btn_cure.bmp
- %TEMP%\VitaVaccine\btn_x.bmp
- %TEMP%\VitaVaccine\btn_updateinfo.bmp
- %TEMP%\VitaVaccine\common_close.bmp
- %TEMP%\VitaVaccine\close.bmp
- %TEMP%\VitaVaccine\btn_skin.bmp
- %TEMP%\VitaVaccine\btn_scan.bmp
- %TEMP%\VitaVaccine\btn_realtime_stop.bmp
- %TEMP%\VitaVaccine\btn_service.bmp
- %TEMP%\VitaVaccine\btn_scanlog.bmp
Удаляет следующие файлы:
- %TEMP%\nsm2.tmp\processes_second.dll
- %TEMP%\nsm2.tmp\KillProcDLL.dll
- %TEMP%\nsm2.tmp\SelfDelete.dll
- %TEMP%\nsm2.tmp\VitaVaccineMsg.dll
- %TEMP%\nsm2.tmp\stack.dll
- %TEMP%\nsm2.tmp\DLLWaitForKillProgram.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\inst_nor[1].php
- %TEMP%\nsm2.tmp\DLLWebCount_new.dll
- %TEMP%\nsm2.tmp\IsVista.dll
- %TEMP%\nsm2.tmp\IEFunctions.dll
Самоудаляется.
Сетевая активность:
Подключается к:
- 'up####.vitavaccine.com':80
- 'lo#.##sence.co.kr':80
- 'www.vi###accine.com':80
TCP:
Запросы HTTP GET:
- up####.vitavaccine.com/Update_ini/VitaVaccine/autoupdate.ini
- lo#.##sence.co.kr/logexp.php?ai################################
- www.vi###accine.com/app/inst_nor.php?pi######
Запросы HTTP POST:
- www.vi###accine.com/app/paychk.php
UDP:
- DNS ASK up####.vitavaccine.com
- DNS ASK lo#.##sence.co.kr
- DNS ASK www.vi###accine.com
Другое:
Ищет следующие окна:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: 'GINA Logon'
- ClassName: '' WindowName: 'VitaVaccine ??????'
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: '' WindowName: 'VVMon'
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
