Trojan.KeyLogger.17887

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices] 'Desktop' = '%PROGRAM_FILES%\deskt0p.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices] 'Config' = 'C:\Config.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices] 'AUT0EXEC' = 'C:\AUT0EXEC.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Runservices] 'System' = '%WINDIR%\System.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Runservices] 'Exp1orer' = '%WINDIR%\Exp1orer.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Runservices] 'NetSystem' = '%WINDIR%\NetSystem.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices] 'MS DOS' = 'C:\SYSTEM\SYSTEM\MS_DOS.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices] 'Internet' = '%WINDIR%\SYSTEM\Internet.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices] 'Runll32' = '%WINDIR%\SYSTEM\Run1132.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices] 'System' = '%WINDIR%\System.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices] 'LoginPC' = 'C:\SYSTEM\SYSTEM\LoginPC.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices] 'C0MMAND' = 'C:\SYSTEM\C0MMAND.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices] 'Win' = 'C:\SYSTEM\Win.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ScanReg' = '<Текущая директория>\DRAGON QQ.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Runservices] 'Desktop' = '%PROGRAM_FILES%\deskt0p.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Runservices] 'Config' = 'C:\Config.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Runservices] 'ScanReg' = '<Текущая директория>\DRAGON QQ.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices] 'ScanReg' = '<Текущая директория>\DRAGON QQ.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ScanReg' = '<Текущая директория>\DRAGON QQ.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Runservices] 'AUT0EXEC' = 'C:\AUT0EXEC.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Runservices] 'Win' = 'C:\SYSTEM\Win.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Runservices] 'Internet' = '%WINDIR%\SYSTEM\Internet.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Runservices] 'Runll32' = '%WINDIR%\SYSTEM\Run1132.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Runservices] 'MS DOS' = 'C:\SYSTEM\SYSTEM\MS_DOS.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Runservices] 'LoginPC' = 'C:\SYSTEM\SYSTEM\LoginPC.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Runservices] 'C0MMAND' = 'C:\SYSTEM\C0MMAND.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AUT0EXEC' = 'C:\AUT0EXEC.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MS DOS' = 'C:\SYSTEM\SYSTEM\MS_DOS.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'LoginPC' = 'C:\SYSTEM\SYSTEM\LoginPC.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'NetSystem' = '%WINDIR%\NetSystem.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Desktop' = '%PROGRAM_FILES%\deskt0p.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Config' = 'C:\Config.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'C0MMAND' = 'C:\SYSTEM\C0MMAND.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'System' = '%WINDIR%\System.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Exp1orer' = '%WINDIR%\Exp1orer.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'NetSystem' = '%WINDIR%\NetSystem.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Win' = 'C:\SYSTEM\Win.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Internet' = '%WINDIR%\SYSTEM\Internet.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Runll32' = '%WINDIR%\SYSTEM\Run1132.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Config' = 'C:\Config.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'AUT0EXEC' = 'C:\AUT0EXEC.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MS DOS' = 'C:\SYSTEM\SYSTEM\MS_DOS.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices] 'Exp1orer' = '%WINDIR%\Exp1orer.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices] 'NetSystem' = '%WINDIR%\NetSystem.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Desktop' = '%PROGRAM_FILES%\deskt0p.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'LoginPC' = 'C:\SYSTEM\SYSTEM\LoginPC.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Runll32' = '%WINDIR%\SYSTEM\Run1132.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'System' = '%WINDIR%\System.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Exp1orer' = '%WINDIR%\Exp1orer.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'C0MMAND' = 'C:\SYSTEM\C0MMAND.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Win' = 'C:\SYSTEM\Win.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Internet' = '%WINDIR%\SYSTEM\Internet.exe'