Trojan.Siggen5.21287

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\7-Zip.wim\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.tpz\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.zip\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.z\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.tgz\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.taz\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.tar\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.tbz2\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.tbz\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\.gho\shell\open\command] '' = '"X:\Program Files\Backup\Ghostexp.Exe" "%1"'
[<HKLM>\SOFTWARE\Classes\au3file\shell\open\command] '' = 'x:\Windows\system32\AutoIt3.exe "%1" %*'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'USB_DiskEject' = 'USB_DiskEject.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'WimSetup' = 'hiderun.exe XXX.cmd'
[<HKLM>\SOFTWARE\Classes\chm.file\shell\open\command] '' = 'X:\Program Files\xchm\xchm.exe "%1"'
[<HKLM>\SOFTWARE\Classes\ImDisk\shell\open\command] '' = 'rundll32.exe imdisk.cpl,RunDLL_MountFile %L'
[<HKLM>\SOFTWARE\Classes\Applications\imdisk.cpl\shell\open\command] '' = 'rundll32.exe imdisk.cpl,RunDLL_MountFile %L'
[<HKLM>\SOFTWARE\Classes\TeraCopy.SFVFile\Shell\Open\command] '' = '"X:\Program Files\TeraCopy\TeraCopy.exe" Check "%1"'
[<HKLM>\SOFTWARE\Classes\TeraCopy.MD5File\Shell\Open\command] '' = '"X:\Program Files\TeraCopy\TeraCopy.exe" Check "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.cpio\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.cab\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.gz\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.deb\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.bzip2\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.7z\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\*\shell\Open\command] '' = 'notepad.exe "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.bz2\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.arj\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.rpm\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.rar\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.swm\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.split\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.lzma\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.iso\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.gzip\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.lzh\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\7-Zip.lha\shell\open\command] '' = '"X:\Program Files\7-zip\7zFM.exe" "%1"'