Trojan.KillProc.18366

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'DirtyRemover2.7.2' = '"<SYSTEM32>\DR2.7.2.exe" -auto'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует отображение:

скрытых файлов

Запускает на исполнение:

<SYSTEM32>\taskkill.exe /f /im h\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r i:\*.*
<SYSTEM32>\taskkill.exe /f /im g\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r h:\*.*
<SYSTEM32>\taskkill.exe /f /im j\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r k:\*.*
<SYSTEM32>\taskkill.exe /f /im i\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r j:\*.*
<SYSTEM32>\taskkill.exe /f /im d\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r e:\*.*
<SYSTEM32>\taskkill.exe /f /im c\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r <Имя диска съемного носителя>:\*.*
<SYSTEM32>\taskkill.exe /f /im f\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r g:\*.*
<SYSTEM32>\taskkill.exe /f /im e\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r f:\*.*
<SYSTEM32>\taskkill.exe /f /im p\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r q:\*.*
<SYSTEM32>\taskkill.exe /f /im o\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r p:\*.*
<SYSTEM32>\taskkill.exe /f /im r\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r s:\*.*
<SYSTEM32>\taskkill.exe /f /im q\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r r:\*.*
<SYSTEM32>\taskkill.exe /f /im l\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r m:\*.*
<SYSTEM32>\taskkill.exe /f /im k\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r l:\*.*
<SYSTEM32>\taskkill.exe /f /im n\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r o:\*.*
<SYSTEM32>\taskkill.exe /f /im m\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r n:\*.*
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\FLASHGUARD.TMP
<SYSTEM32>\taskkill.exe /f /im FLASHGUARD.TMP
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\DRIVEGUARD.EXE
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\FLASHGUARD.TMP
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\FLASHGUARD.EXE
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\FLASHGUARD.EXE
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\FLASHGUARD.TMP
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\FLASHGUARD.TMP
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\ypsan.f
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\ypsan.f
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\ypsan.f
<SYSTEM32>\taskkill.exe /f /im ypsan.f
<SYSTEM32>\taskkill.exe /f /im DRIVEGUARD.EXE
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\DRIVEGUARD.EXE
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\DRIVEGUARD.EXE
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\DRIVEGUARD.EXE
<SYSTEM32>\attrib.exe -s -h -r %TEMP%\FLASHGUARD.EXE
<SYSTEM32>\attrib.exe -s -h -r %TEMP%\FLASHGUARD.TMP
<SYSTEM32>\attrib.exe -s -h -r %TEMP%\GHMPG.TMP
<SYSTEM32>\attrib.exe -s -h -r %TEMP%\DRIVEGUARD.EXE
<SYSTEM32>\taskkill.exe /f /im "%PROGRAM_FILES%\winflashguard\*.*"
<SYSTEM32>\attrib.exe -s -h -r c:\*.*
<SYSTEM32>\taskkill.exe /f /im "%PROGRAM_FILES%\FlashGuard\*.*"
<SYSTEM32>\taskkill.exe /f /im "%PROGRAM_FILES%\DriveGuard\*.*"
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\FLASHGUARD.EXE
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\GHMPG.TMP
<SYSTEM32>\taskkill.exe /f /im FLASHGUARD.EXE
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\FLASHGUARD.EXE
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\GHMPG.TMP
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\GHMPG.TMP
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\GHMPG.TMP
<SYSTEM32>\taskkill.exe /f /im GHMPG.TMP
<SYSTEM32>\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ /v SuperHidden /t REG_DWORD /d 1 /f
<SYSTEM32>\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ /v ShowSuperHidden /t REG_DWORD /d 1 /f
<SYSTEM32>\reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v monit /f
<SYSTEM32>\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ /v Hidden /t REG_DWORD /d 1 /f
<SYSTEM32>\reg.exe add HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ /v ShowSuperHidden /t REG_DWORD /d 1 /f
<SYSTEM32>\reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN\ /v CheckedValue /t REG_DWORD /d 2 /f
<SYSTEM32>\reg.exe add HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ /v Hidden /t REG_DWORD /d 1 /f
<SYSTEM32>\reg.exe add HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ /v SuperHidden /t REG_DWORD /d 1 /f
<SYSTEM32>\reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v FlashGuard /f
<SYSTEM32>\reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v DriveGuard /f
<SYSTEM32>\reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v scvhost /f
<SYSTEM32>\reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v FlashGuard /f
<SYSTEM32>\reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v wscript /f
<SYSTEM32>\reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v monit /f
<SYSTEM32>\reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v DriveGuard /f
<SYSTEM32>\reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v wscript /f
<SYSTEM32>\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v DisableTaskMgr /t REG_DWORD /d 0 /f
<SYSTEM32>\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ /v NoFind /t REG_DWORD /d 0 /f
<SYSTEM32>\reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ /v NoFolderOptions /t REG_DWORD /d 0 /f
<SYSTEM32>\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ /v DisableRegistryTools /t REG_DWORD /d 0 /f
<SYSTEM32>\reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /d "explorer.exe" /f
<SYSTEM32>\reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /d "<SYSTEM32>\userinit.exe," /f
<SYSTEM32>\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
<SYSTEM32>\reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
<SYSTEM32>\reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\ /v CheckedValue /t REG_DWORD /d 1 /f
<SYSTEM32>\reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\ /v DefaultValue /t REG_DWORD /d 2 /f
<SYSTEM32>\reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN\ /v DefaultValue /t REG_DWORD /d 2 /f
<SYSTEM32>\reg.exe delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\ /v CheckedValue /f
<SYSTEM32>\reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\ /v Type /t REG_SZ /d Group /f
<SYSTEM32>\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ /v NoFolderOptions /t REG_DWORD /d 0 /f
<SYSTEM32>\reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\ /v CheckedValue /t REG_DWORD /d 0 /f
<SYSTEM32>\reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\ /v DefaultValue /t REG_DWORD /d 0 /f
<SYSTEM32>\taskkill.exe /f /im x\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r y:\*.*
<SYSTEM32>\taskkill.exe /f /im w\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r x:\*.*
<SYSTEM32>\taskkill.exe /f /im z\:system\security\*.*
<SYSTEM32>\reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v amva /f
<SYSTEM32>\taskkill.exe /f /im y\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r z:\*.*
<SYSTEM32>\taskkill.exe /f /im t\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r u:\*.*
<SYSTEM32>\taskkill.exe /f /im s\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r t:\*.*
<SYSTEM32>\taskkill.exe /f /im v\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r w:\*.*
<SYSTEM32>\taskkill.exe /f /im u\:system\security\*.*
<SYSTEM32>\attrib.exe -s -h -r v:\*.*
<SYSTEM32>\reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v DirtyRemover2.6 /f
<SYSTEM32>\reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v DirtyRemover2.7 /f
<SYSTEM32>\reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v DirtyRemover2.5 /f
<SYSTEM32>\reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v DirtyRemover2.6 /f
<SYSTEM32>\reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v DirtyRemover2.7.1 /f
<SYSTEM32>\reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v scvhost /f
<SYSTEM32>\reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v DirtyRemover2.7 /f
<SYSTEM32>\reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v DirtyRemover2.7.1 /f
<SYSTEM32>\reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v avpo /f
<SYSTEM32>\reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v avpa /f
<SYSTEM32>\reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v amva /f
<SYSTEM32>\reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v avpo /f
<SYSTEM32>\reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v MS32DLL /f
<SYSTEM32>\reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v DirtyRemover2.5 /f
<SYSTEM32>\reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v avpa /f
<SYSTEM32>\reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v MS32DLL /f
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\ypsan.f
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\ntdelect.com
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\ntde1ect.com
<SYSTEM32>\taskkill.exe /f /im ntdelect.com
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\ntdelect.com
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\ntde1ect.com
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\ntde1ect.com
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\ntde1ect.com
<SYSTEM32>\taskkill.exe /f /im ntde1ect.com
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\ntdeiect.com
<SYSTEM32>\taskkill.exe /f /im ntdeiect.com
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\host.exe
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\ntdeiect.com
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\ntdelect.com
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\ntdelect.com
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\ntdeiect.com
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\ntdeiect.com
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\killvbs.vbs
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\killvbs.vbs
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\newfol~1.exe
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\newfol~1.exe
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\killvbs.vbs
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\u.bat
<SYSTEM32>\taskkill.exe /f /im killvbs.vbs
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\killvbs.vbs
<SYSTEM32>\taskkill.exe /f /im system.exe
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\system.exe
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\system.exe
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\system.exe
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\newfol~1.exe
<SYSTEM32>\taskkill.exe /f /im newfol~1.exe
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\system.exe
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\newfol~1.exe
<SYSTEM32>\taskkill.exe /f /im avpo.exe
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\avpo.exe
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\avpo.exe
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\avpo.exe
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\semo2x.exe.tmp
<SYSTEM32>\taskkill.exe /f /im semo2x.exe.tmp
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\avpo.exe
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\semo2x.exe.tmp
<SYSTEM32>\wscript.exe <LS_APPDATA>\start.vbs
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\amvo.exe
<SYSTEM32>\reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "DirtyRemover2.7.2" /t REG_SZ /d "\"<SYSTEM32>\DR2.7.2.exe\" -auto" /f
<SYSTEM32>\reg.exe add "HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\Run Dirty Remover\command" /ve /d "\"<SYSTEM32>\DR2.7.2.exe\" -auto" /f
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\amvo.exe
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\amvo.exe
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\amvo.exe
<SYSTEM32>\taskkill.exe /f /im amvo.exe
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\copy.exe
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\copy.exe
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\copy.exe
<SYSTEM32>\taskkill.exe /f /im copy.exe
<SYSTEM32>\taskkill.exe /f /im host.exe
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\host.exe
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\host.exe
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\host.exe
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\semo2x.exe
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\semo2x.exe
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\semo2x.exe.tmp
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\semo2x.exe.tmp
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\semo2x.exe
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\copy.exe
<SYSTEM32>\taskkill.exe /f /im semo2x.exe
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\semo2x.exe
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\vcmgcd32.dll
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\vcmgcd32.dll
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\vcmgcd32.dll
<SYSTEM32>\taskkill.exe /f /im vcmgcd32.dll
<SYSTEM32>\taskkill.exe /f /im scvhost.exe
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\scvhost.exe
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\scvhost.exe
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\scvhost.exe
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\vcmgcd32.dl_
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\vcmgcd32.dl_
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\03442508.SVD
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\03442508.SVD
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\vcmgcd32.dl_
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\vcmgcd32.dll
<SYSTEM32>\taskkill.exe /f /im vcmgcd32.dl_
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\vcmgcd32.dl_
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\mswin32.dll.vbs
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\winlogon.vbs
<SYSTEM32>\taskkill.exe /f /im mswin32.dll.vbs
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\mswin32.dll.vbs
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\winlogon.vbs
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\winlogon.vbs
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\winlogon.vbs
<SYSTEM32>\taskkill.exe /f /im winlogon.vbs
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\713xRMTmon.exe
<SYSTEM32>\taskkill.exe /f /im 713xRMTmon.exe
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\scvhost.exe
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\713xRMTmon.exe
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\mswin32.dll.vbs
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\mswin32.dll.vbs
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\713xRMTmon.exe
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\713xRMTmon.exe
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\monit.exe
<SYSTEM32>\taskkill.exe /f /im monit.exe
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\boot.vbs
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\monit.exe
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\winamp6_full_emusic.exe
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\winamp6_full_emusic.exe
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\monit.exe
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\monit.exe
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\u.bat
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\u.bat
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\u.bat
<SYSTEM32>\taskkill.exe /f /im u.bat
<SYSTEM32>\taskkill.exe /f /im boot.vbs
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\boot.vbs
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\boot.vbs
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\boot.vbs
<SYSTEM32>\taskkill.exe /f /im DPTRDANDRS-877.PMS.exe
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\DPTRDANDRS-877.PMS.exe
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\DPTRDANDRS-877.PMS.exe
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\DPTRDANDRS-877.PMS.exe
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\03442508.SVD
<SYSTEM32>\taskkill.exe /f /im 03442508.SVD
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\DPTRDANDRS-877.PMS.exe
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\03442508.SVD
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\winamp6_full_emusic.exe
<SYSTEM32>\attrib.exe -s -h -r <SYSTEM32>\help.exe.tmp
<SYSTEM32>\taskkill.exe /f /im winamp6_full_emusic.exe
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\winamp6_full_emusic.exe
<SYSTEM32>\taskkill.exe /f /im %WINDIR%\help.exe.tmp
<SYSTEM32>\taskkill.exe /f /im <SYSTEM32>\help.exe.tmp
<SYSTEM32>\attrib.exe -s -h -r %WINDIR%\help.exe.tmp
<SYSTEM32>\taskkill.exe /f /im help.exe.tmp

Изменяет следующие настройки проводника Windows (Windows Explorer):

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFind' = '00000000'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoFolderOptions' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoFolderOptions' = '00000000'

Принудительно разрешает автозапуск со съемных носителей.

Изменения в файловой системе:

Создает следующие файлы:

<LS_APPDATA>\start.vbs
<LS_APPDATA>\end.vbs
<SYSTEM32>\DR2.7.2.exe
%TEMP%\a78663.bat
<LS_APPDATA>\dr.bat
<LS_APPDATA>\Clean.bat
<LS_APPDATA>\TK.bat
<LS_APPDATA>\Print.bat

Присваивает атрибут 'скрытый' для следующих файлов:

%TEMP%\a78663.bat

Другое:

Ищет следующие окна:

ClassName: '' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней