Trojan.Siggen.36538

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ras.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravmon.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravmond.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qqdoctormain.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psctrls.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psimreal.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psimsvc.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravstub.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsagent.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsmain.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwproxy.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravtask.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapsvc.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapw32.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\naprdmgr.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsescn.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsshld.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mghtml.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nmain.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oasclnt.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavsrv51.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pfw.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npfmntor.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updaterui.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uplive.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcr32.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ulibcfg.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbmon.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uihost.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcrmon.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xcommsvr.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xnlscn.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\????.] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webproxy.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vptray.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vstskmgr.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxtray.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanfrm.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safebank.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsnetsvr.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rssafety.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstray.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartup.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sndsrvc.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spbbcsvc.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shstat.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seccenter.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secnotifier.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SetupLD.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccenter.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccevtmgr.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccregvfy.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccapp.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdwizreg.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boxmod.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccsetmgr.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\enc98.EXE] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\extdb.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frameworkservice.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cqw32.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DrvAnti.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentsvr.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'QQ' = '%SystemRoot%\system32\SZ.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'QQ' = '%SystemRoot%\system32\SC.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360hotfix.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apvxdwin.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avltmain.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avtask.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ast.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avengine.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvprescan.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvsrvxp.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvfw.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvmonxp.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvmonxp.kxp] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvxp.kxp] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcdetect.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mctskshd.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcdash.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\livesrv.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcagent.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kasmain.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frwstub.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardfield.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kaccore.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvcui.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kregex.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\knownsvr.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kislnchr.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kmailmon.exe] 'Debugger' = 'cmd.exe /c del /s /f /q'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\SXmmcx] 'Start' = '00000002'

Заражает следующие исполняемые системные файлы:

<SYSTEM32>\sc.exe

Подменяет следующие исполняемые системные файлы:

<SYSTEM32>\dllcache\sc.exe файлом <SYSTEM32>\dllcache\sc.exe.new
<SYSTEM32>\sc.exe файлом <SYSTEM32>\sc.exe.new

Создает следующие файлы на съемном носителе:

<Имя диска съемного носителя>:\ADD.exe
<Имя диска съемного носителя>:\autorun.inf

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует отображение:

скрытых файлов
расширений файлов

Запускает на исполнение:

<SYSTEM32>\attrib.exe +s +h C:\ADD.exe
<SYSTEM32>\attrib.exe +s +h L:\autorun.inf
<SYSTEM32>\attrib.exe +s +h E:\ADD.exe
<SYSTEM32>\attrib.exe +s +h <Имя диска съемного носителя>:\ADD.exe
<SYSTEM32>\attrib.exe +s +h I:\autorun.inf
<SYSTEM32>\attrib.exe +s +h H:\autorun.inf
<SYSTEM32>\attrib.exe +s +h K:\autorun.inf
<SYSTEM32>\attrib.exe +s +h J:\autorun.inf
<SYSTEM32>\attrib.exe +s +h F:\ADD.exe
<SYSTEM32>\attrib.exe +s +h L:\ADD.exe
<SYSTEM32>\attrib.exe +s +h K:\ADD.exe
<SYSTEM32>\cmd.exe /c ""ki.bat""
<SYSTEM32>\cmd.exe /c ""kill.bat""
<SYSTEM32>\attrib.exe +s +h H:\ADD.exe
<SYSTEM32>\attrib.exe +s +h G:\ADD.exe
<SYSTEM32>\attrib.exe +s +h J:\ADD.exe
<SYSTEM32>\attrib.exe +s +h I:\ADD.exe
<SYSTEM32>\attrib.exe +s +h G:\autorun.inf
<SYSTEM32>\attrib.exe +s +h <DRIVERS>\SXmmcx.sys
<SYSTEM32>\attrib.exe +s +h <SYSTEM32>\SC.exe
<SYSTEM32>\attrib.exe +s +h %ALLUSERSPROFILE%\「开始」菜单\程序\启动\SQ.exe
<SYSTEM32>\attrib.exe +s +h %WINDIR%\Web\Wallpaper\SA.exe
<SYSTEM32>\attrib.exe +s +h <SYSTEM32>\SW.exe
<SYSTEM32>\attrib.exe +s +h <SYSTEM32>\SS.exe
<SYSTEM32>\attrib.exe +s +h <SYSTEM32>\SZ.exe
<SYSTEM32>\attrib.exe +s +h <SYSTEM32>\SD.exe
<SYSTEM32>\cmd.exe /c ""reg.bat""
<SYSTEM32>\attrib.exe +s +h <Имя диска съемного носителя>:\autorun.inf
<SYSTEM32>\attrib.exe +s +h C:\autorun.inf
<SYSTEM32>\attrib.exe +s +h F:\autorun.inf
<SYSTEM32>\attrib.exe +s +h E:\autorun.inf
<SYSTEM32>\reg.exe import 5.reg
<SYSTEM32>\cmd.exe /c ""12.bat""
<SYSTEM32>\ntvdm.exe -f
<SYSTEM32>\cmd.exe /c ""tmp.bat""

Принудительно разрешает автозапуск со съемных носителей.

Изменения в файловой системе:

Создает следующие файлы:

<Текущая директория>\tmp.bat
<Текущая директория>\autorun.inf
%WINDIR%\Temp\scs1.tmp
<Текущая директория>\tmp33
<Текущая директория>\tmp44
<Текущая директория>\tmp55
<Текущая директория>\kill.bat
<Текущая директория>\ki.bat
<Текущая директория>\TMP1
%WINDIR%\Temp\scs2.tmp
C:\autorun.inf
C:\ADD.exe
<SYSTEM32>\SD.exe
<SYSTEM32>\SZ.exe
<DRIVERS>\SXmmcx.sys
<SYSTEM32>\SS.exe
<SYSTEM32>\SW.exe
<Текущая директория>\12.bat
<Текущая директория>\tmp11
<Текущая директория>\tmp22
%WINDIR%\Web\Wallpaper\SA.exe
<Текущая директория>\5.reg
<Текущая директория>\reg.bat

Присваивает атрибут 'скрытый' для следующих файлов:

C:\autorun.inf
%WINDIR%\Web\Wallpaper\SA.exe
<Имя диска съемного носителя>:\autorun.inf
<Имя диска съемного носителя>:\ADD.exe
C:\ADD.exe
<SYSTEM32>\SW.exe
<SYSTEM32>\SS.exe
<SYSTEM32>\SD.exe
<DRIVERS>\SXmmcx.sys
<SYSTEM32>\SZ.exe

Удаляет следующие файлы:

%WINDIR%\Temp\scs2.tmp
%TEMP%\~DF1E70.tmp
%WINDIR%\Temp\scs1.tmp
<Текущая директория>\reg.bat
<Текущая директория>\5.reg

Самоудаляется.

Другое:

Ищет следующие окна:

ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-c78.c7c.480001'
ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней