Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKLM>\Software\Classes\cfxxefile\shell\open\command] '' = '"%1" %*'
- [<HKLM>\Software\Classes\exefile\shell\open\command] '' = '"%1" %*'
- [<HKLM>\Software\Classes\.com] '' = 'comfile'
- [<HKLM>\Software\Classes\.exe] '' = 'exefile'
- [<HKLM>\Software\Classes\.bat] '' = 'batfile'
- [<HKLM>\Software\Classes\.cmd] '' = 'cmdfile'
- [<HKLM>\Software\Classes\.pif] '' = 'piffile'
- [<HKLM>\Software\Classes\comfile\shell\open\command] '' = '"%1" %*'
- [<HKLM>\Software\Classes\batfile\shell\open\command] '' = '"%1" %*'
- [<HKLM>\Software\Classes\cmdfile\shell\open\command] '' = '"%1" %*'
- [<HKLM>\Software\Classes\piffile\shell\open\command] '' = '"%1" %*'
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] '' = ''
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
Вредоносные функции
Для затруднения выявления своего присутствия в системе
блокирует:
- Компонент восстановления системы (SR)
Изменения в файловой системе
Создает следующие файлы
- C:\32788r22fwjfw\license\curl - license.txt
- C:\32788r22fwjfw\safeboot.dat
- C:\32788r22fwjfw\safeboot.def.dat
- C:\32788r22fwjfw\safeboot.def.vista.dat
- C:\32788r22fwjfw\safeboot.def.w7.dat
- C:\32788r22fwjfw\svc_wht.dat
- C:\32788r22fwjfw\svchost.dat
- C:\32788r22fwjfw\svchost.vista.dat
- C:\32788r22fwjfw\zhsvc.dat
- C:\32788r22fwjfw\svchost.w7.dat
- C:\32788r22fwjfw\system_ini.dat
- C:\32788r22fwjfw\vipev.dat
- C:\32788r22fwjfw\vistareg.dat
- C:\32788r22fwjfw\vun.dat
- C:\32788r22fwjfw\w2kreg.dat
- C:\32788r22fwjfw\w7reg.dat
- C:\32788r22fwjfw\xpreg.dat
- C:\32788r22fwjfw\region.dat
- C:\32788r22fwjfw\rogues.dat
- C:\32788r22fwjfw\svchost.w7.x64.dat
- C:\32788r22fwjfw\zdomain.dat
- C:\32788r22fwjfw\powp.dat
- C:\32788r22fwjfw\023w7.dat
- C:\32788r22fwjfw\creg.dat
- C:\32788r22fwjfw\cregc.dat
- C:\32788r22fwjfw\dnl.dat
- C:\32788r22fwjfw\fin.dat
- C:\32788r22fwjfw\localservice.dat
- C:\32788r22fwjfw\localservicenetworkrestricted.dat
- C:\32788r22fwjfw\localsystemnetworkrestricted.dat
- C:\32788r22fwjfw\ndis_combofix.dat
- C:\32788r22fwjfw\netsvc.bad.dat
- C:\32788r22fwjfw\netsvc.dat
- C:\32788r22fwjfw\netsvc.vista.dat
- C:\32788r22fwjfw\netsvc.xp.dat
- C:\32788r22fwjfw\networkservice.dat
- C:\32788r22fwjfw\policies.dat
- C:\32788r22fwjfw\purity.dat
- C:\32788r22fwjfw\023.dat
- C:\32788r22fwjfw\rclink.dat
- C:\32788r22fwjfw\iexplore.exe
- C:\32788r22fwjfw\erdnt.e_e
- C:\32788r22fwjfw\osid.vbs
- C:\32788r22fwjfw\svcdrv.vbs
- C:\32788r22fwjfw\wmi_rem.vbs
- C:\32788r22fwjfw\image001.gif
- C:\32788r22fwjfw\license\pv_5_2_2.zip
- C:\32788r22fwjfw\license\streamtools.zip
- C:\32788r22fwjfw\en-us\cmd.cfxxe.mui
- C:\32788r22fwjfw\cmd.cfxxe
- C:\32788r22fwjfw\erdntdos.loc
- C:\32788r22fwjfw\prep.done
- C:\32788r22fwjfw\osver00
- C:\32788r22fwjfw\vista.krl
- C:\32788r22fwjfw\n_\18298
- C:\32788r22fwjfw\winnt00
- C:\32788r22fwjfw\set.txt
- C:\32788r22fwjfw\vercf.bat
- C:\32788r22fwjfw\lnkread.vbs
- C:\32788r22fwjfw\drvrun.vbs
- C:\32788r22fwjfw\restore_pt.vbs
- C:\32788r22fwjfw\av.vbs
- C:\32788r22fwjfw\rust.str
- C:\32788r22fwjfw\erdntwin.loc
- C:\32788r22fwjfw\srizbi.md5
- C:\32788r22fwjfw\files.pif
- C:\32788r22fwjfw\hwid.pif
- C:\32788r22fwjfw\md5sum.pif
- C:\32788r22fwjfw\md5sum00.pif
- C:\32788r22fwjfw\n.pif
- C:\32788r22fwjfw\nircmd.chm
- C:\32788r22fwjfw\exe.reg
- C:\32788r22fwjfw\023v.dat
- C:\32788r22fwjfw\ddsdo.sed
- C:\32788r22fwjfw\regdacl.sed
- C:\32788r22fwjfw\regdo.sed
- C:\32788r22fwjfw\run2.sed
- C:\32788r22fwjfw\toolbar.sed
- C:\32788r22fwjfw\asp.str
- C:\32788r22fwjfw\dpf.str
- C:\32788r22fwjfw\xpsboot.reg
- C:\32788r22fwjfw\erunt.loc
- C:\32788r22fwjfw\embedded.sed
- C:\32788r22fwjfw\zip.cfxxe
- C:\32788r22fwjfw\tail.cfxxe
- C:\32788r22fwjfw\swxcacls.cfxxe
- C:\32788r22fwjfw\av.cmd
- C:\32788r22fwjfw\awf.cmd
- C:\32788r22fwjfw\boot-rk.cmd
- C:\32788r22fwjfw\catch-sub.cmd
- C:\32788r22fwjfw\cf-script.cmd
- C:\32788r22fwjfw\create.cmd
- C:\32788r22fwjfw\cregc.cmd
- C:\32788r22fwjfw\cset.cmd
- C:\32788r22fwjfw\fd-sv.cmd
- C:\32788r22fwjfw\fkmgen.cmd
- C:\32788r22fwjfw\gethive.cmd
- C:\32788r22fwjfw\install-rc.cmd
- C:\32788r22fwjfw\katch.cmd
- C:\32788r22fwjfw\kill-all.cmd
- C:\32788r22fwjfw\nt-os.cmd
- C:\32788r22fwjfw\setenvmt.bat
- C:\32788r22fwjfw\moveit.bat
- C:\32788r22fwjfw\auto-rc.cmd
- C:\32788r22fwjfw\nd_.bat
- C:\32788r22fwjfw\list.bat
- C:\32788r22fwjfw\delclsid.bat
- C:\32788r22fwjfw\license\extract.txt
- C:\32788r22fwjfw\license\fi - license.txt
- C:\32788r22fwjfw\license\mtee.txt.txt
- C:\32788r22fwjfw\license\zip - license.txt
- C:\32788r22fwjfw\license\unxutilsdist.html
- C:\32788r22fwjfw\boot.bat
- C:\32788r22fwjfw\c.bat
- C:\32788r22fwjfw\p.cmd
- C:\32788r22fwjfw\swreg.cfxxe
- C:\32788r22fwjfw\combobatch.bat
- C:\32788r22fwjfw\find3m.bat
- C:\32788r22fwjfw\fixlsp.bat
- C:\32788r22fwjfw\history.bat
- C:\32788r22fwjfw\lang.bat
- C:\32788r22fwjfw\list-b.bat
- C:\32788r22fwjfw\list-c.bat
- C:\32788r22fwjfw\list-d.bat
- C:\32788r22fwjfw\license\dumphive-license.txt
- C:\32788r22fwjfw\delclsid64.bat
- C:\32788r22fwjfw\osver
- C:\32788r22fwjfw\regscan.cmd
- C:\32788r22fwjfw\srestore.cmd
- C:\32788r22fwjfw\erunt.cfxxe
- C:\32788r22fwjfw\extract.cfxxe
- C:\32788r22fwjfw\filekill.cfxxe
- C:\32788r22fwjfw\grep.cfxxe
- C:\32788r22fwjfw\gsar.cfxxe
- C:\32788r22fwjfw\handle.cfxxe
- C:\32788r22fwjfw\assoc.cmd
- C:\32788r22fwjfw\mbr.cfxxe
- C:\32788r22fwjfw\license\ncmd.cfxxe
- C:\32788r22fwjfw\ncmd.cfxxe
- C:\32788r22fwjfw\nircmd.cfxxe
- C:\32788r22fwjfw\nircmdc.cfxxe
- C:\32788r22fwjfw\sed.cfxxe
- C:\32788r22fwjfw\setpath.cfxxe
- C:\32788r22fwjfw\swsc.cfxxe
- C:\32788r22fwjfw\combofix-download.cfxxe
- C:\32788r22fwjfw\mtee.cfxxe
- C:\32788r22fwjfw\dumphive.cfxxe
- C:\32788r22fwjfw\dd.cfxxe
- C:\32788r22fwjfw\catchme.cfxxe
- C:\32788r22fwjfw\appinit.bad
- C:\32788r22fwjfw\suppscan.cmd
- C:\32788r22fwjfw\update-cf.cmd
- C:\32788r22fwjfw\badclsid.c
- C:\32788r22fwjfw\clsid.c
- C:\32788r22fwjfw\prep.inf
- C:\32788r22fwjfw\pv.com
- C:\32788r22fwjfw\regscan64.cmd
- C:\32788r22fwjfw\hidec.exe
- C:\32788r22fwjfw\rkey.cmd
- C:\32788r22fwjfw\license\iexplore.exe
- C:\32788r22fwjfw\swreg.exe
- C:\32788r22fwjfw\bootsect.dll
- C:\32788r22fwjfw\ffdefstr.dll
- C:\32788r22fwjfw\w_sock.dll
- C:\32788r22fwjfw\w2k_sock.dll
- C:\32788r22fwjfw\combo-fix.sys
- C:\32788r22fwjfw\snapshot.cmd
- C:\32788r22fwjfw\vinfo
- C:\32788r22fwjfw\pev.exe
- C:\32788r22fwjfw\n_\24828
Удаляет следующие файлы
- C:\32788r22fwjfw\winnt00
- C:\32788r22fwjfw\osver00
Другое
Ищет следующие окна
- ClassName: 'EDIT' WindowName: ''
Создает и запускает на исполнение
- 'C:\32788r22fwjfw\iexplore.exe' win close ititle " Security"
- 'C:\32788r22fwjfw\swreg.cfxxe' ACL "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /RO:F /RA:F /Q
- 'C:\32788r22fwjfw\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /reset /q
- 'C:\32788r22fwjfw\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /reset /q
- 'C:\32788r22fwjfw\swxcacls.cfxxe' "<SYSTEM32>\cmd.exe" /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
- 'C:\32788r22fwjfw\n.pif' exec hide 32788R22FWJFW\GSAR.cfxxe -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "<SYSTEM32>\cmd.exe" "32788R22FWJFW\cmd.cfxxe"
- 'C:\32788r22fwjfw\swreg.cfxxe' ACL "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" /RESET /Q
- 'C:\32788r22fwjfw\nircmd.cfxxe' exec hide 32788R22FWJFW\GSAR.cfxxe -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "<SYSTEM32>\cmd.exe" "32788R22FWJFW\cmd.cfxxe"
- 'C:\32788r22fwjfw\n.pif' cmdwait 1000 exec hide "32788R22FWJFW\cmd.cfxxe" /c 32788R22FWJFW\p.cmd
- 'C:\32788r22fwjfw\nircmd.cfxxe' cmdwait 1700 exec hide "32788R22FWJFW\cmd.cfxxe" /c 32788R22FWJFW\p.cmd
- 'C:\32788r22fwjfw\n.pif' cmdwait 2500 exec hide "32788R22FWJFW\cmd.cfxxe" /c 32788R22FWJFW\p.cmd
- 'C:\32788r22fwjfw\cmd.cfxxe' /c 32788R22FWJFW\p.cmd
- 'C:\32788r22fwjfw\gsar.cfxxe' -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "<SYSTEM32>\cmd.exe" "32788R22FWJFW\cmd.cfxxe"
- 'C:\32788r22fwjfw\grep.cfxxe' -F "6.0.6" OsVer
- 'C:\32788r22fwjfw\grep.cfxxe' -F "6.1.7600" OsVer
- 'C:\32788r22fwjfw\swreg.exe' QUERY "hklm\software\microsoft\windows nt\currentversion" /v currentversion
- 'C:\32788r22fwjfw\grep.cfxxe' -is "currentversion.* 6.[01]" OsVer00
- 'C:\32788r22fwjfw\swreg.exe' QUERY "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_{79007602-0CDB-4405-9DBF-1257BB3226ED}\0000\Control" /v ActiveService
- 'C:\32788r22fwjfw\nircmd.cfxxe' WIN CLOSE CLASS "#32770"
- 'C:\32788r22fwjfw\nircmd.cfxxe' KILLPROCESS "<Полный путь к файлу>"
- 'C:\32788r22fwjfw\swreg.exe' QUERY "HKLM\System\Currentcontrolset\Control\ProductOptions" /v ProductType
- 'C:\32788r22fwjfw\grep.cfxxe' -isq "ProductType.*WinNT" WinNT00
- 'C:\32788r22fwjfw\pev.exe' PLIST
- 'C:\32788r22fwjfw\grep.cfxxe' -F "5.1.2" OsVer
- 'C:\32788r22fwjfw\grep.cfxxe' -Fis "<SYSTEM32>\csrss.exe"
- 'C:\32788r22fwjfw\iexplore.exe' win close ititle "Security Tool"
- 'C:\32788r22fwjfw\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Command Processor" /reset /q
- 'C:\32788r22fwjfw\n.pif' shellcopy <SYSTEM32>\en-us\cmd.exe.mui 32788R22FWJFW\EN-US\cmd.cfxxe.mui yestoall noerrorui silent nosecattr
- 'C:\32788r22fwjfw\nircmd.cfxxe' infobox "Incompatible OS. ComboFix only works for workstations with Windows 2000 and XP~n~nOS incompatible. ComboFix ne fonctionne que pour Windows 2000 et XP~n~nOS niet compatibel. ComboFix ka...
- 'C:\32788r22fwjfw\hidec.exe' 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q
- 'C:\32788r22fwjfw\iexplore.exe' win close ititle "SysInternals"
- 'C:\32788r22fwjfw\iexplore.exe' win close ititle "Security Central"
- 'C:\32788r22fwjfw\iexplore.exe' win close ititle "Security essentials"
- 'C:\32788r22fwjfw\iexplore.exe' exec hide 32788R22FWJFW\License\iexplore.exe -k * and -preg"\\(.{3,}tssd|\d{3,}|svch[^o]st|sv[^c]host|.)\.exe$|%temp:\=\\%\\.*|.*\\System Volume Information\\.*" and not ComboFix.exe
- 'C:\32788r22fwjfw\swreg.exe' acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q
- 'C:\32788r22fwjfw\n.pif' shexec install 32788R22FWJFW\Prep.inf
- 'C:\32788r22fwjfw\pev.exe' -k * and -preg"\\(.{3,}tssd|\d{3,}|svch[^o]st|sv[^c]host|.)\.exe$|%temp:\=\\%\\.*|.*\\System Volume Information\\.*" and not ComboFix.exe
- 'C:\32788r22fwjfw\license\iexplore.exe' -k * and -preg"\\(.{3,}tssd|\d{3,}|svch[^o]st|sv[^c]host|.)\.exe$|%temp:\=\\%\\.*|.*\\System Volume Information\\.*" and not ComboFix.exe
- 'C:\32788r22fwjfw\n.pif' exec hide 32788R22FWJFW\PEV.exe RIMPORT 32788R22FWJFW\EXE.reg
- 'C:\32788r22fwjfw\hidec.exe' 32788R22FWJFW\PEV.exe RIMPORT 32788R22FWJFW\EXE.reg
- 'C:\32788r22fwjfw\hidec.exe' 32788R22FWJFW\pev.exe -k * and -preg"\\(.{3,}tssd|\d{3,}|svch[^o]st|sv[^c]host|.)\.exe$|%temp:\=\\%\\.*|.*\\System Volume Information\\.*" and not ComboFix.exe
- 'C:\32788r22fwjfw\n.pif' cmdwait 3000 exec hide 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /reset /q
- 'C:\32788r22fwjfw\pev.exe' RIMPORT 32788R22FWJFW\EXE.reg
- 'C:\32788r22fwjfw\hidec.exe' 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /reset /q
- 'C:\32788r22fwjfw\hidec.exe' 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Command Processor" /reset /q
- 'C:\32788r22fwjfw\hidec.exe' 32788R22FWJFW\SWXCACLS.cfxxe "<SYSTEM32>\cmd.exe" /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q
- 'C:\32788r22fwjfw\swreg.exe' acl "hklm\software\microsoft\windows nt\currentversion\windows" /O Guest /Q
- 'C:\32788r22fwjfw\n.pif' exec hide 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /O Guest /Q
- 'C:\32788r22fwjfw\n.pif' cmdwait 150 exec hide 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q
- 'C:\32788r22fwjfw\hidec.exe' 32788R22FWJFW\SWREG.exe acl "hklm\software\microsoft\windows nt\currentversion\windows" /O Guest /Q
- 'C:\32788r22fwjfw\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /da:r /q
- 'C:\32788r22fwjfw\hidec.exe' 32788R22FWJFW\swreg.exe acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /da:r /q
- 'C:\32788r22fwjfw\pev.exe' RIMPORT 32788R22FWJFW\EXE.reg' (со скрытым окном)
- 'C:\32788r22fwjfw\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /reset /q' (со скрытым окном)
- 'C:\32788r22fwjfw\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /da:r /q' (со скрытым окном)
- 'C:\32788r22fwjfw\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32" /reset /q' (со скрытым окном)
- 'C:\32788r22fwjfw\swreg.exe' acl "hklm\software\microsoft\windows nt\currentversion\windows" /O Guest /Q' (со скрытым окном)
- 'C:\32788r22fwjfw\gsar.cfxxe' -if -s\:000M:000i:000c:000r:000o -r\:001M:000i:000c:000r:000o "<SYSTEM32>\cmd.exe" "32788R22FWJFW\cmd.cfxxe"' (со скрытым окном)
- 'C:\32788r22fwjfw\license\iexplore.exe' -k * and -preg"\\(.{3,}tssd|\d{3,}|svch[^o]st|sv[^c]host|.)\.exe$|%temp:\=\\%\\.*|.*\\System Volume Information\\.*" and not ComboFix.exe' (со скрытым окном)
- 'C:\32788r22fwjfw\swxcacls.cfxxe' "<SYSTEM32>\cmd.exe" /P /GA:F /GS:F /GU:X /GP:X /I ENABLE /Q' (со скрытым окном)
- 'C:\32788r22fwjfw\cmd.cfxxe' /c 32788R22FWJFW\p.cmd' (со скрытым окном)
- 'C:\32788r22fwjfw\swreg.exe' acl "HKLM\SOFTWARE\Microsoft\Command Processor" /reset /q' (со скрытым окном)
- 'C:\32788r22fwjfw\pev.exe' -k * and -preg"\\(.{3,}tssd|\d{3,}|svch[^o]st|sv[^c]host|.)\.exe$|%temp:\=\\%\\.*|.*\\System Volume Information\\.*" and not ComboFix.exe' (со скрытым окном)
- 'C:\32788r22fwjfw\swreg.exe' acl "hklm\software\microsoft\windows nt\currentversion\windows" /DE:F /Q' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\rundll32.exe' <SYSTEM32>\shell32.dll,OpenAs_RunDLL C:\32788R22FWJFW\nircmd.cfxxe
- '%WINDIR%\syswow64\infdefaultinstall.exe' "C:\32788R22FWJFW\Prep.inf"
- '%WINDIR%\syswow64\runonce.exe' -r
- '%WINDIR%\syswow64\grpconv.exe' -o
- '%WINDIR%\syswow64\chcp.com' 1252
