W97M.DownLoader.5468

Техническая информация

Вредоносные функции

Запускает на исполнение (эксплоит)

'%ProgramFiles%\microsoft office\office12\clview.exe' "WINWORD" "Microsoft Office Word"

Изменения в файловой системе

Создает следующие файлы

%ALLUSERSPROFILE%\application data\microsoft help\ms.winword.12.1033_1033_mvalidator.lck
%TEMP%\imt49.tmp
%TEMP%\imt48.tmp
%TEMP%\imt47.tmp
%TEMP%\imt46.tmp
%TEMP%\imt45.tmp
%TEMP%\imt44.tmp
%TEMP%\imt43.tmp
%TEMP%\imt42.tmp
%TEMP%\imt41.tmp
%TEMP%\imt40.tmp
%ALLUSERSPROFILE%\application data\microsoft help\ms.winword.dev.12.1033_1033_mkwd_f.hxw
%TEMP%\imt4a.tmp
%TEMP%\imt3f.tmp
%TEMP%\imt3d.tmp
%TEMP%\imt3c.tmp
%TEMP%\imt3b.tmp
%TEMP%\imt3a.tmp
%TEMP%\imt39.tmp
%TEMP%\imt38.tmp
%TEMP%\imt37.tmp
%TEMP%\imt36.tmp
%TEMP%\imt35.tmp
%TEMP%\imt34.tmp
%TEMP%\imt33.tmp
%TEMP%\imt3e.tmp
%TEMP%\imt57.tmp
%HOMEPATH%\local settings\<INETFILES>\content.ie5\z9pmdpek\ont[1].css
%TEMP%\imt4c.tmp
%HOMEPATH%\local settings\<INETFILES>\content.ie5\etuaii8e\office12[1].js
%HOMEPATH%\local settings\<INETFILES>\content.ie5\h8mbgrq8\hv01202453[1].htm
%TEMP%\imt61.tmp
%TEMP%\imt60.tmp
%TEMP%\imt5f.tmp
%TEMP%\imt5e.tmp
%TEMP%\imt5d.tmp
%TEMP%\imt5c.tmp
%TEMP%\imt5b.tmp
%TEMP%\imt5a.tmp
%TEMP%\imt59.tmp
%ALLUSERSPROFILE%\application data\microsoft help\ms.winword.dev.12.1033_1033_mtoc_winword.dev_col.hxh
%TEMP%\imt58.tmp
%TEMP%\imt56.tmp
%ALLUSERSPROFILE%\application data\microsoft help\ms.winword.dev.12.1033_1033_mvalidator.hxd
%TEMP%\imt55.tmp
%TEMP%\imt54.tmp
%TEMP%\imt53.tmp
%TEMP%\imt52.tmp
%TEMP%\imt51.tmp
%TEMP%\imt50.tmp
%TEMP%\imt4f.tmp
%TEMP%\imt4e.tmp
%TEMP%\imt4d.tmp
%ALLUSERSPROFILE%\application data\microsoft help\ms.winword.dev.12.1033_1033_mkwd_k.hxw
%TEMP%\imt4b.tmp
%TEMP%\imt32.tmp
%ALLUSERSPROFILE%\application data\microsoft help\ms.winword.12.1033_1033_mkwd_k.hxw
%TEMP%\imt17.tmp
%TEMP%\imt16.tmp
%TEMP%\imt15.tmp
%TEMP%\imt14.tmp
%TEMP%\imt13.tmp
%TEMP%\imt12.tmp
%TEMP%\imt11.tmp
%TEMP%\imt10.tmp
%ALLUSERSPROFILE%\application data\microsoft help\ms.winword.12.1033_1033_mkwd_f.hxw
%TEMP%\imtf.tmp
%TEMP%\imte.tmp
%TEMP%\imt18.tmp
%TEMP%\imtd.tmp
%TEMP%\imtb.tmp
%TEMP%\imta.tmp
%TEMP%\imt9.tmp
%TEMP%\imt8.tmp
%TEMP%\imt7.tmp
%TEMP%\imt6.tmp
%TEMP%\imt5.tmp
%TEMP%\imt4.tmp
%TEMP%\imt3.tmp
%ALLUSERSPROFILE%\application data\microsoft help\ms.winword.12.1033_1033_mtoc_winword_col.hxh
%TEMP%\imt2.tmp
%TEMP%\imtc.tmp
%TEMP%\imt25.tmp
%HOMEPATH%\local settings\<INETFILES>\msofficehelp12\moh31.tmp\clientviewersettings.xml
%TEMP%\imt1a.tmp
%HOMEPATH%\local settings\<INETFILES>\content.ie5\z9pmdpek\clientviewersettings[1].xml
%TEMP%\imt30.tmp
%TEMP%\imt2f.tmp
%TEMP%\imt2e.tmp
%TEMP%\imt2d.tmp
%TEMP%\imt2c.tmp
%TEMP%\imt2b.tmp
%TEMP%\imt2a.tmp
%TEMP%\imt29.tmp
%TEMP%\imt28.tmp
%TEMP%\imt27.tmp
%ALLUSERSPROFILE%\application data\microsoft help\ms.winword.dev.12.1033_1033_mvalidator.lck
%TEMP%\imt26.tmp
%ALLUSERSPROFILE%\application data\microsoft help\ms.winword.12.1033_1033_mvalidator.hxd
%TEMP%\imt24.tmp
%TEMP%\imt23.tmp
%TEMP%\imt22.tmp
%TEMP%\imt21.tmp
%TEMP%\imt20.tmp
%TEMP%\imt1f.tmp
%TEMP%\imt1e.tmp
%TEMP%\imt1d.tmp
%TEMP%\imt1c.tmp
%TEMP%\imt1b.tmp
%TEMP%\imt19.tmp
%HOMEPATH%\local settings\<INETFILES>\content.ie5\ee7gwdg8\contenthxs[1].css

Присваивает атрибут 'скрытый' для следующих файлов

%ALLUSERSPROFILE%\application data\microsoft help\ms.winword.12.1033_1033_mtoc_winword_col.hxh
%ALLUSERSPROFILE%\application data\microsoft help\ms.winword.12.1033_1033_mkwd_f.hxw
%ALLUSERSPROFILE%\application data\microsoft help\ms.winword.12.1033_1033_mkwd_k.hxw
%ALLUSERSPROFILE%\application data\microsoft help\ms.winword.12.1033_1033_mvalidator.hxd
%ALLUSERSPROFILE%\application data\microsoft help\ms.winword.dev.12.1033_1033_mtoc_winword.dev_col.hxh
%ALLUSERSPROFILE%\application data\microsoft help\ms.winword.dev.12.1033_1033_mkwd_f.hxw
%ALLUSERSPROFILE%\application data\microsoft help\ms.winword.dev.12.1033_1033_mkwd_k.hxw
%ALLUSERSPROFILE%\application data\microsoft help\ms.winword.dev.12.1033_1033_mvalidator.hxd

Другое

Ищет следующие окна