Trojan.KillProc.23741

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'hdsafe' = '"\LPFsafe.exe"'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\spoolsv.exe'
'<SYSTEM32>\wbem\wmiadap.exe' /R /T

Завершает или пытается завершить

следующие системные процессы:

<SYSTEM32>\spoolsv.exe

Ищет следующие окна с целью

обнаружения утилит для анализа:

ClassName: '' WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\wbem\Performance\WmiApRpl_new.ini

Сетевая активность:

Подключается к:

'<IP-адрес в локальной сети>':139
'<IP-адрес в локальной сети>':80
'<IP-адрес в локальной сети>':445

Другое:

Ищет следующие окна:

ClassName: '' WindowName: 'PP2008 ????'
ClassName: '' WindowName: 'PP2008'
ClassName: '' WindowName: ' PPGou Installation'
ClassName: '' WindowName: 'Poco 2007 ????'
ClassName: '' WindowName: 'Poco2007 ????????????'
ClassName: '' WindowName: 'Poco 2008 ????'
ClassName: '' WindowName: 'PPGou3'
ClassName: '' WindowName: 'RaySource'
ClassName: '' WindowName: '????4.0 - ???????????????? ????'
ClassName: '' WindowName: 'Sooyuu4.0'
ClassName: '' WindowName: 'PPGou3 Beta1'
ClassName: '' WindowName: 'PPGou????????'
ClassName: '' WindowName: 'PPGou Player'
ClassName: '' WindowName: 'Kazaa InstallShield'
ClassName: '' WindowName: 'Kazaa - [Search]'
ClassName: '' WindowName: '???? - ????????2008'
ClassName: '' WindowName: 'BitTorrent 6.1.2'
ClassName: '' WindowName: 'iMesh Installation'
ClassName: '' WindowName: 'iMesh'
ClassName: '' WindowName: '?????????? ????'
ClassName: '' WindowName: '???? - Vagaa????'
ClassName: '' WindowName: '???? - ????Maze'
ClassName: '' WindowName: '????Maze'
ClassName: '' WindowName: '??????????'
ClassName: '' WindowName: '??????????(??????) ????'
ClassName: '' WindowName: '???? V1.2.3.19Beta---????????'
ClassName: '' WindowName: '?????????????????? (??????????????V1.0.1.920) http://www.94xyz.com'
ClassName: '' WindowName: '????(QvodPlayer) 3.0 ????'
ClassName: '' WindowName: 'QQLive'
ClassName: '' WindowName: '???????? V2.8'
ClassName: '' WindowName: '???????? V2.7'
ClassName: '' WindowName: ' Windows ?????????? '
ClassName: '' WindowName: 'Foxy ?w???{??'
ClassName: '' WindowName: '????(QvodPlayer) 3.0 ?????? ????'
ClassName: '' WindowName: '????(QvodPlayer)3.0 ?????? ????'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: 'Foxy'
ClassName: '' WindowName: '?????????????? Beta3.1'
ClassName: '' WindowName: 'avVods'
ClassName: '' WindowName: '??Torrent Setup'
ClassName: '' WindowName: '??Torrent 1.8.1'
ClassName: '' WindowName: '??????????????????_??????????????_???????????????????? - Microsoft Internet Explorer'
ClassName: '' WindowName: '???????????? ????????'
ClassName: '' WindowName: '????TuoTu - [???? 3.3.112 (2008.11.27 ??????)]'
ClassName: '' WindowName: '????????(TuoTu) 3.3.112 ?????? TuoTu.com ????: ????????'
ClassName: '' WindowName: '?????? ????'
ClassName: '' WindowName: 'WinHex'
ClassName: '' WindowName: 'Process Explorer - Sysinternals: www.sysinternals.com'
ClassName: '' WindowName: 'VMware Workstation'
ClassName: '' WindowName: '??????6 ????'
ClassName: '' WindowName: '??????6'
ClassName: '' WindowName: 'OllyDbg'
ClassName: '' WindowName: 'BitTorrent Setup'
ClassName: '' WindowName: '???????????? 9PTV 2008'
ClassName: '' WindowName: '????PUBWIN??????????'
ClassName: '' WindowName: '??????'
ClassName: '' WindowName: 'Transport'
ClassName: '' WindowName: 'FlashBT'
ClassName: '' WindowName: 'etc'
ClassName: '' WindowName: '???????????? ???? '
ClassName: '' WindowName: '??????????????????????????????'
ClassName: '' WindowName: '???? - ??????????????'
ClassName: '' WindowName: '?????????????? - ????????P2P??????'
ClassName: '' WindowName: 'PPLive'
ClassName: '' WindowName: '????????--???????????????????? - Microsoft Internet Explorer'
ClassName: '' WindowName: '???????????????? - Microsoft Internet Explorer'
ClassName: '' WindowName: '????WEB????'
ClassName: '' WindowName: 'PP??????'
ClassName: '' WindowName: 'poco'
ClassName: '' WindowName: '????????????'
ClassName: '' WindowName: '???? - ????5'
ClassName: '' WindowName: '????5'
ClassName: '' WindowName: '???????????? 2008 v5.5'
ClassName: '' WindowName: '????'
ClassName: '' WindowName: 'EXEEM'
ClassName: '' WindowName: 'TuoTu????'
ClassName: '' WindowName: '????????'
ClassName: '' WindowName: 'EZPEER'
ClassName: '' WindowName: 'KUGOO'
ClassName: '' WindowName: 'PPMate ????????'
ClassName: '' WindowName: 'PPMate ???????? - ????????'
ClassName: '' WindowName: '????????????????'
ClassName: '' WindowName: 'PPLive i???????????? ???????? ?????????? ???????????????? ??????????????PPLive???????????????? - Microsoft Internet Explorer'
ClassName: '' WindowName: 'PP.tv????????-???????? - Microsoft Internet Explorer'
ClassName: '' WindowName: 'PPS????'
ClassName: '' WindowName: '360??????????(????) 3.0 ????'
ClassName: '' WindowName: '??????????????????'
ClassName: '' WindowName: 'BitComet'
ClassName: '' WindowName: 'BitComet(????????) 1.07 ????'
ClassName: '' WindowName: '????(QvodPlayer)'
ClassName: '' WindowName: '???? - ?????????????????????????????????? / QVOD - ???????????????? - Microsoft Internet Explorer'
ClassName: '' WindowName: '???????? - ????????'
ClassName: '' WindowName: 'TvAnts ????????'
ClassName: '' WindowName: 'UUSee????????2008'
ClassName: '' WindowName: 'UUSEE'
ClassName: '' WindowName: '???????????? PPNTV 2008'
ClassName: '' WindowName: 'SNS?????????????????? ????'
ClassName: '' WindowName: '?????? - ???????????????????? ???????? ???????????? ???????? - Microsoft Internet Explorer'
ClassName: '' WindowName: 'UUSee ???????? 2008'
ClassName: '' WindowName: '???? - PIPI'
ClassName: '' WindowName: 'PIPIPlayer'
ClassName: '' WindowName: 'PPLive 2.0 ????'
ClassName: '' WindowName: 'TVkoo! Ver:080313A'
ClassName: '' WindowName: 'SopCast - ????'
ClassName: '' WindowName: 'SopCast - anonymous@sopcast.org'