Техническая информация
- [<HKLM>\SOFTWARE\Classes\cmdfile\shell\open\command] '' = '"%1" %*'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] '' = ''
- [<HKLM>\SOFTWARE\Classes\comfile\shell\open\command] '' = '"%1" %*'
- [<HKLM>\SOFTWARE\Classes\exefile\shell\open\command] '' = '"%1" %*'
- [<HKLM>\SOFTWARE\Classes\batfile\shell\open\command] '' = '"%1" %*'
- Компонент восстановления системы (SR)
- C:\<Имя вируса>\Attrib.cfexe +R *.com
- <SYSTEM32>\CF16095.exe /S /D /c" ECHO..CFEXE;.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH"
- C:\<Имя вируса>\grep.cfexe -sqx "REGEDIT4" Fin.dat
- C:\<Имя вируса>\Attrib.cfexe +R *.cfexe
- C:\<Имя вируса>\grep.cfexe -qi "\.CFEXE;"
- C:\<Имя вируса>\FINDSTR.cfexe -LIEVG:ForeignWht ForeignC01
- C:\<Имя вируса>\WRP.cfexe "<SYSTEM32>\cmd.exe"
- C:\<Имя вируса>\pv.cfexe -m CF16095.exe
- C:\<Имя вируса>\sed.cfexe -R "1,3d; /[4-9]\S{7}\s*\d* .:\\/d; /.*(.:\\.*)/I!d; s//\1/" ForeignC00
- C:\32788R22FWJFW\hidec.exe "<SYSTEM32>\CF16095.exe" /C DEL "\32788R22FWJFW\prep.cmd"
- <SYSTEM32>\CF16095.exe /C DEL "\32788R22FWJFW\prep.cmd"
- C:\32788R22FWJFW\hidec.exe "<SYSTEM32>\CF16095.exe" /F:OFF /D /C CALL Start_.cmd
- <SYSTEM32>\CF16095.exe /F:OFF /D /C CALL Start_.cmd
- <SYSTEM32>\CF16095.exe /k c.bat
- C:\<Имя вируса>\swreg.exe QUERY "hklm\system\select" /v "current"
- C:\<Имя вируса>\sed.cfexe -r "/.*\t/!d; s//00/; s/^[0-9]*(...) .*/@SET ControlSet=ControlSet\1\nSET CS000=HKEY_LOCAL_MACHINE\\system\\ControlSet\1\\Services/" CurrentCS00
- C:\<Имя вируса>\pv.cfexe -kf cmd.exe cmd.execf
- C:\<Имя вируса>\NirCmd.cfexe SERVICE STOP CRYPTSVC
- C:\<Имя вируса>\FINDSTR.cfexe -B File,
- C:\<Имя вируса>\ComboFix-Download.cfexe -s --connect-timeout 5 -H "Host: www.fo####yware.com" http://75.##7.69.91/sUBs/version.txt
- C:\<Имя вируса>\grep.cfexe "^[0-9][0-9].* [0-9]"
- C:\<Имя вируса>\SWREG.cfexe DELETE "HKLM\SOFTWARE\QUADRA"
- C:\<Имя вируса>\SWREG.cfexe DELETE "HKLM\SOFTWARE\UAC"
- C:\<Имя вируса>\ComboFix-Download.cfexe -s --connect-timeout 5 -H "Host: download.bleepingcomputer.com" http://20#.#3.120.24/sUBs/version.txt
- C:\<Имя вируса>\sed.cfexe -r "/-/!d;s/.* ([0-9]{4})-([0-9][0-9])-([0-9][0-9]) .*/(\1*365+\2*30+\3)/;s/\+0/\+/g" Sum00
- C:\<Имя вируса>\nircmd.com QBOXCOMTOP "Current date is Mon 09/03/2012. ComboFix has expired~n~nClick 'Yes' to run in REDUCED FUNCTIONALITY mode~n~nClick 'No' to exit" "Version_09-02-17.02" "" FILLDELETE ABORTB
- C:\<Имя вируса>\ComboFix-Download.cfexe -s --connect-timeout 5 -H "Host: subs.geekstogo.com" http://74.##7.128.223/sUBs/version.txt
- C:\<Имя вируса>\vFind.cfexe -ltf kmd.dat C.bat
- C:\<Имя вируса>\pv.cfexe -d2000 -x PING.EXE
- C:\<Имя вируса>\pv.cfexe -m PING.EXE
- C:\<Имя вируса>\grep.cfexe -isq "\/u" sfx.cmd
- C:\<Имя вируса>\hidec.exe PING.EXE -n 1 -w 250 127.0.0.1
- C:\<Имя вируса>\sed.cfexe -R "1,3d; /((10|4)00000|[4-9]\S{7})\s*\d* .:\\/d; /C:\\WINDOWS\\system32\\(xpsp2res|Normaliz|urlmon|odbcint|imon)\.dll/Id; /\)|\\/I!d; s/.*(.:\\)/\1/" pingtest00
- C:\<Имя вируса>\SWREG.cfexe DELETE "HKLM\SOFTWARE\TDSS"
- C:\<Имя вируса>\SWREG.cfexe DELETE "HKLM\SOFTWARE\SENEKA"
- C:\<Имя вируса>\FINDSTR.cfexe -LIEVG:ForeignWht pingtest01
- C:\<Имя вируса>\pv.cfexe -kf PING.EXE
- <SYSTEM32>\cmd.execf /c 32788R22FWJFW\prep.cmd >\Bug.txt
- C:\32788R22FWJFW\pv.cfexe -kf Nircmd.com
- C:\32788R22FWJFW\nircmd.com cmdwait 750 exec hide "~$folder.system$\cmd.execf" /c 32788R22FWJFW\prep.cmd >\Bug.txt
- C:\32788R22FWJFW\nircmd.com cmdwait 1500 exec hide "~$folder.system$\cmd.execf" /c 32788R22FWJFW\prep.cmd
- C:\32788R22FWJFW\nircmd.com cmdwait 2500 exec hide "~$folder.system$\cmd.execf" /c 32788R22FWJFW\prep.cmd
- C:\32788R22FWJFW\NirCmd.cfexe win close class "#32770"
- C:\32788R22FWJFW\NirCmd.cfexe win close ititle "ComboFix"
- <SYSTEM32>\cmd.execf /c 32788R22FWJFW\prep.cmd
- C:\32788R22FWJFW\pv.cfexe -kf runonce.exe grpconv.exe procmon.exe
- C:\32788R22FWJFW\nircmd.com exec hide 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /O Guest /Q
- C:\32788R22FWJFW\swreg.exe import 32788R22FWJFW\EXE.reg
- C:\32788R22FWJFW\nircmd.com shexec install 32788R22FWJFW\nircmd.inf
- C:\32788R22FWJFW\hidec.exe 32788R22FWJFW\swreg.exe import 32788R22FWJFW\EXE.reg
- C:\32788R22FWJFW\swreg.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /O Guest /Q
- C:\32788R22FWJFW\nircmd.com exec hide 32788R22FWJFW\GSAR.cfexe -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "~$folder.system$\cmd.exe" "~$folder.system$\cmd.execf"
- C:\32788R22FWJFW\gsar.cfexe -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "<SYSTEM32>\cmd.exe" "<SYSTEM32>\cmd.execf"
- C:\32788R22FWJFW\nircmd.com cmdwait 150 exec hide 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q
- C:\32788R22FWJFW\swreg.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q
- C:\32788R22FWJFW\swreg.exe QUERY "hklm\software\microsoft\windows\currentversion\app paths\combofix.exe" /ve
- C:\32788R22FWJFW\grep.cfexe -isq "\/cfDebug" sfx.cmd
- C:\32788R22FWJFW\grep.cfexe -sq "=.*[a-z]" sfx.cmd
- <SYSTEM32>\cmd.execf /S /D /c" SET SfxCmd "
- C:\32788R22FWJFW\sed.cfexe -r "/SfxCmd=/I!d; s///; s/^(\x22[^\x22]*\x22|[^\x22][^ ]*) +//; s/^([^\x22][^ ]*)/@SET SfxCmd=\x22\1\x22/; s/^(\x22.*)/@SET SfxCmd=\1/"
- C:\32788R22FWJFW\grep.cfexe -sqx "REGEDIT4" Fin.dat
- C:\32788R22FWJFW\swreg.exe ADD HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys /D Driver
- C:\32788R22FWJFW\swreg.exe ADD HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys /D Driver
- C:\32788R22FWJFW\grep.cfexe -isqx "FileName=[-[:alnum:]@.]*" FileName
- <SYSTEM32>\CF16095.exe /S /D /c" DIR /AD/B C:\* "
- C:\32788R22FWJFW\grep.cfexe -Fisq "<SYSTEM32>\userinit.exe" Userinit00
- C:\32788R22FWJFW\swreg.exe QUERY "HKLM\SYSTEM\CurrentControlSet\Control\Nls\CodePage" /V ACP
- C:\32788R22FWJFW\swreg.exe ADD "hklm\software\microsoft\windows\currentversion\app paths\combofix.exe" /ve /d "<Полный путь к вирусу>"
- C:\32788R22FWJFW\swreg.exe QUERY "hklm\software\microsoft\windows nt\currentversion\winlogon" /v Userinit
- C:\32788R22FWJFW\sed.cfexe "/.*\t/!d; s//@CHCP.com /" NlsCodePageACP00
- C:\32788R22FWJFW\swreg.exe QUERY HKLM\System\CurrentControlSet\Control\NLS\Language /V Default
- C:\32788R22FWJFW\sed.cfexe "/.*\t/!d; s///" NlsLanguage00
- C:\32788R22FWJFW\swreg.exe ADD HKCU\Console /V CodePage /T REG_DWORD /D "1251"
- C:\32788R22FWJFW\swreg.exe ADD HKU\S-1-5-18\Console /V CodePage /T REG_DWORD /D "1251"
- <SYSTEM32>\findstr.exe -EI "06" NlsLanguageDefault
- <SYSTEM32>\findstr.exe -EI "14" NlsLanguageDefault
- <SYSTEM32>\findstr.exe -EI "1D" NlsLanguageDefault
- <SYSTEM32>\findstr.exe -EI "0B" NlsLanguageDefault
- <SYSTEM32>\findstr.exe -EI "10" NlsLanguageDefault
- <SYSTEM32>\findstr.exe -EI "05" NlsLanguageDefault
- <SYSTEM32>\findstr.exe -EI "15" NlsLanguageDefault
- <SYSTEM32>\ping.exe -n 1 -w 250 127.0.0.1
- <SYSTEM32>\ping.exe -n 2 -w 500 google.com
- <SYSTEM32>\sort.exe Mirrors00
- <SYSTEM32>\findstr.exe -LIXC:"<Имя вируса>" DirName00
- <SYSTEM32>\cscript.exe //NOLOGO //E:VBSCRIPT //B //T:08 av.vbs
- <SYSTEM32>\findstr.exe -C:"*On-access scanning enabled*" Resident.txt
- <SYSTEM32>\findstr.exe -IVX ComboFix
- <SYSTEM32>\find.exe "5.1.2" OsVer
- <SYSTEM32>\attrib.exe +R "<Полный путь к вирусу>"
- <SYSTEM32>\chcp.com 1251
- <SYSTEM32>\find.exe "5.2." OsVer
- <SYSTEM32>\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 C:\32788R22FWJFW\nircmd.inf
- <SYSTEM32>\runonce.exe -r
- <SYSTEM32>\grpconv.exe -o
- <SYSTEM32>\findstr.exe -EI "[08]04" NlsLanguageDefault
- <SYSTEM32>\findstr.exe -EI "07" NlsLanguageDefault
- <SYSTEM32>\findstr.exe -EI "16" NlsLanguageDefault
- <SYSTEM32>\findstr.exe -EI "[4C]04" NlsLanguageDefault
- <SYSTEM32>\findstr.exe -EI "09" NlsLanguageDefault
- <SYSTEM32>\findstr.exe -EI "0C" NlsLanguageDefault
- <SYSTEM32>\findstr.exe -EI "13" NlsLanguageDefault
- C:\32788R22FWJFW\swsc.cfexe
- C:\32788R22FWJFW\SF.cfexe
- C:\32788R22FWJFW\swxcacls.cfexe
- C:\32788R22FWJFW\unzip.cfexe
- C:\32788R22FWJFW\tail.cfexe
- C:\32788R22FWJFW\setpath.cfexe
- C:\32788R22FWJFW\psexec.cfexe
- C:\32788R22FWJFW\NirCmdC.cfexe
- C:\32788R22FWJFW\pv.cfexe
- C:\32788R22FWJFW\setcsum.cfexe
- C:\32788R22FWJFW\sed.cfexe
- C:\32788R22FWJFW\RCLink
- C:\32788R22FWJFW\BootSect
- C:\32788R22FWJFW\appinit.bad
- C:\32788R22FWJFW\image001.gif
- C:\32788R22FWJFW\ERDNT.e_e
- C:\32788R22FWJFW\badclsid
- C:\32788R22FWJFW\WRP.cfexe
- C:\32788R22FWJFW\vFind.cfexe
- C:\32788R22FWJFW\zip.cfexe
- C:\32788R22FWJFW\Combo-Fix.sys
- C:\32788R22FWJFW\ffdefstr.dll
- C:\32788R22FWJFW\catchme.cfexe
- C:\32788R22FWJFW\BON.cfexe
- C:\32788R22FWJFW\ComboFix-Download.cfexe
- C:\32788R22FWJFW\dumphive.cfexe
- C:\32788R22FWJFW\dd.cfexe
- C:\32788R22FWJFW\swreg.exe
- C:\32788R22FWJFW\clsid.c
- C:\32788R22FWJFW\badclsid.c
- C:\32788R22FWJFW\NirCmd.inf
- C:\32788R22FWJFW\hidec.exe
- C:\32788R22FWJFW\nircmd.com
- C:\32788R22FWJFW\md5deep.cfexe
- C:\32788R22FWJFW\handle.cfexe
- C:\32788R22FWJFW\moveex.cfexe
- C:\32788R22FWJFW\NirCmd.cfexe
- C:\32788R22FWJFW\mtee.cfexe
- C:\32788R22FWJFW\gsar.cfexe
- C:\32788R22FWJFW\extract.cfexe
- C:\32788R22FWJFW\ERUNT.cfexe
- C:\32788R22FWJFW\fdsv.cfexe
- C:\32788R22FWJFW\grep.cfexe
- C:\32788R22FWJFW\fi.cfexe
- C:\<Имя вируса>\kmd.dat
- C:\<Имя вируса>\N_\16068
- C:\<Имя вируса>\erunt.dat
- C:\<Имя вируса>\ForeignC00
- C:\<Имя вируса>\ForeignWht
- C:\<Имя вируса>\N_\7739
- C:\Qoobox\Quarantine\catchme.log
- C:\<Имя вируса>\N_\17236
- C:\<Имя вируса>\CurrentCS00
- C:\<Имя вируса>\SWREG.cfexe
- C:\<Имя вируса>\CCS.bat
- C:\<Имя вируса>\N_\23940
- C:\<Имя вируса>\N_\19307
- C:\<Имя вируса>\Sum00
- C:\<Имя вируса>\N_\14755
- C:\<Имя вируса>\Sum01
- C:\<Имя вируса>\N_\24896
- C:\<Имя вируса>\N_\12058
- C:\<Имя вируса>\N_\22206
- C:\<Имя вируса>\Mirrors00
- C:\<Имя вируса>\N_\6981
- C:\<Имя вируса>\Mirrors
- C:\32788R22FWJFW\NlsCodePageACP00
- C:\32788R22FWJFW\Userinit00
- C:\32788R22FWJFW\CHCP.bat
- C:\32788R22FWJFW\NlsLanguage00
- C:\32788R22FWJFW\N_\2638
- C:\32788R22FWJFW\Oldsfxname00
- C:\Bug.txt
- <SYSTEM32>\cmd.execf
- C:\32788R22FWJFW\OsVer
- C:\32788R22FWJFW\N_\12836
- C:\32788R22FWJFW\N_\N
- C:\<Имя вируса>\N_\16199
- C:\Start_.cmd
- C:\<Имя вируса>\FINDSTR.cfexe
- C:\<Имя вируса>\Attrib.cfexe
- C:\<Имя вируса>\N_\29105
- C:\32788R22FWJFW\DirName00
- C:\32788R22FWJFW\sfx.cmd
- C:\32788R22FWJFW\NlsLanguageDefault
- <SYSTEM32>\CF16095.exe
- C:\32788R22FWJFW\FileName
- C:\32788R22FWJFW\N_\12309
- C:\32788R22FWJFW\Update-CF.cmd
- C:\32788R22FWJFW\netsvc.vista.dat
- C:\32788R22FWJFW\netsvc.dat
- C:\32788R22FWJFW\netsvc.xp.dat
- C:\32788R22FWJFW\Policies.dat
- C:\32788R22FWJFW\NetworkService.dat
- C:\32788R22FWJFW\netsvc.bad.dat
- C:\32788R22FWJFW\LocalService.dat
- C:\32788R22FWJFW\Fin.dat
- C:\32788R22FWJFW\LocalServiceNetworkRestricted.dat
- C:\32788R22FWJFW\ndis_combofix.dat
- C:\32788R22FWJFW\LocalSystemNetworkRestricted.dat
- C:\32788R22FWJFW\svchost.dat
- C:\32788R22FWJFW\svc_wht.dat
- C:\32788R22FWJFW\svchost.vista.dat
- C:\32788R22FWJFW\vistareg.dat
- C:\32788R22FWJFW\system_ini.dat
- C:\32788R22FWJFW\safeboot.def.vista.dat
- C:\32788R22FWJFW\region.dat
- C:\32788R22FWJFW\Purity.dat
- C:\32788R22FWJFW\rogues.dat
- C:\32788R22FWJFW\safeboot.def.dat
- C:\32788R22FWJFW\safeboot.dat
- C:\32788R22FWJFW\run2.sed
- C:\32788R22FWJFW\RegDo.sed
- C:\32788R22FWJFW\toolbar.sed
- C:\32788R22FWJFW\Exe.reg
- C:\32788R22FWJFW\srizbi.md5
- C:\32788R22FWJFW\REGDACL.sed
- C:\32788R22FWJFW\ERDNTWIN.LOC
- C:\32788R22FWJFW\ERDNTDOS.LOC
- C:\32788R22FWJFW\ERUNT.LOC
- C:\32788R22FWJFW\embedded.sed
- C:\32788R22FWJFW\ddsDo.sed
- C:\32788R22FWJFW\023.dat
- C:\32788R22FWJFW\DPF.str
- C:\32788R22FWJFW\023v.dat
- C:\32788R22FWJFW\CregC.dat
- C:\32788R22FWJFW\Creg.dat
- C:\32788R22FWJFW\SvcDrv.vbs
- C:\32788R22FWJFW\FProps.vbs
- C:\32788R22FWJFW\av.vbs
- C:\32788R22FWJFW\lnkread.vbs
- C:\32788R22FWJFW\restore_pt.vbs
- C:\32788R22FWJFW\OSid.vbs
- C:\32788R22FWJFW\CregC.cmd
- C:\32788R22FWJFW\Create.cmd
- C:\32788R22FWJFW\CSet.cmd
- C:\32788R22FWJFW\FKMGen.cmd
- C:\32788R22FWJFW\FD-SV.cmd
- C:\32788R22FWJFW\CF-Script.cmd
- C:\32788R22FWJFW\av.cmd
- C:\32788R22FWJFW\Auto-RC.cmd
- C:\32788R22FWJFW\AWF.cmd
- C:\32788R22FWJFW\Catch-sub.cmd
- C:\32788R22FWJFW\Boot-Rk.cmd
- C:\32788R22FWJFW\Rkey.cmd
- C:\32788R22FWJFW\RegScan.cmd
- C:\32788R22FWJFW\SnapShot.cmd
- C:\32788R22FWJFW\SuppScan.cmd
- C:\32788R22FWJFW\SRestore.cmd
- C:\32788R22FWJFW\Prep.cmd
- C:\32788R22FWJFW\Install-RC.cmd
- C:\32788R22FWJFW\GetHive.cmd
- C:\32788R22FWJFW\katch.cmd
- C:\32788R22FWJFW\NT-OS.cmd
- C:\32788R22FWJFW\Kill-All.cmd
- C:\32788R22FWJFW\DelClsid.bat
- C:\32788R22FWJFW\Combobatch.bat
- C:\32788R22FWJFW\FIND3M.bat
- C:\32788R22FWJFW\history.bat
- C:\32788R22FWJFW\FIXLSP.bat
- C:\32788R22FWJFW\c.bat
- C:\32788R22FWJFW\xpreg.dat
- C:\32788R22FWJFW\w2kreg.dat
- C:\32788R22FWJFW\zDomain.dat
- C:\32788R22FWJFW\Boot.bat
- C:\32788R22FWJFW\zhsvc.dat
- C:\32788R22FWJFW\RestoreO4.bat
- C:\32788R22FWJFW\ND_.bat
- C:\32788R22FWJFW\SafeBootRepair.bat
- C:\32788R22FWJFW\Assoc.cmd
- C:\32788R22FWJFW\SetEnvmt.bat
- C:\32788R22FWJFW\MoveIt.bat
- C:\32788R22FWJFW\List-B.bat
- C:\32788R22FWJFW\Lang.bat
- C:\32788R22FWJFW\List-C.bat
- C:\32788R22FWJFW\List.bat
- C:\32788R22FWJFW\List-D.bat
- C:\<Имя вируса>\N_\12058
- C:\<Имя вируса>\N_\16068
- C:\<Имя вируса>\N_\16199
- C:\<Имя вируса>\Sum00
- C:\<Имя вируса>\ForeignC00
- C:\<Имя вируса>\Mirrors00
- C:\<Имя вируса>\Update-CF.cmd
- C:\<Имя вируса>\N_\17236
- C:\<Имя вируса>\N_\29105
- C:\<Имя вируса>\N_\6981
- C:\<Имя вируса>\N_\7739
- C:\<Имя вируса>\N_\24896
- C:\<Имя вируса>\N_\19307
- C:\<Имя вируса>\N_\22206
- C:\<Имя вируса>\N_\23940
- C:\32788R22FWJFW\DirName00
- C:\32788R22FWJFW\Oldsfxname00
- C:\32788R22FWJFW\Prep.cmd
- C:\32788R22FWJFW\FileName
- C:\32788R22FWJFW\Userinit00
- C:\32788R22FWJFW\NlsCodePageACP00
- C:\32788R22FWJFW\NlsLanguage00
- C:\32788R22FWJFW\N_\12309
- C:\Bug.txt
- C:\Start_.cmd
- <SYSTEM32>\cmd.execf
- C:\<Имя вируса>\CurrentCS00
- C:\32788R22FWJFW\N_\12836
- C:\32788R22FWJFW\N_\2638
- C:\32788R22FWJFW\N_\N
- '74.##7.128.223':80
- '20#.#3.120.24':80
- '75.##7.69.91':80
- 74.##7.128.223/sUBs/version.txt
- 20#.#3.120.24/sUBs/version.txt
- 75.##7.69.91/sUBs/version.txt
- DNS ASK google.com
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''