Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'taskhostw' = '<Полный путь к файлу>'
Заражает следующие исполняемые файлы
- C:\msocache\all users\{90140000-0115-0409-1000-0000000ff1ce}-c\dw20.exe
- %CommonProgramFiles%\microsoft shared\smart tag\fdate.dll
- %CommonProgramFiles%\microsoft shared\smart tag\fbiblio.dll
- %CommonProgramFiles%\microsoft shared\proof\mslid.dll
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\osppwmi.dll
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\ospprearm.exe
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\osppobjs.dll
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\osppcext.dll
- %CommonProgramFiles%\microsoft shared\officesoftwareprotectionplatform\osppc.dll
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\osetupui.dll
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\office.en-us\branding.dll
- %CommonProgramFiles%\microsoft shared\office14\office setup controller\osetup.dll
- %CommonProgramFiles%\microsoft shared\office14\1033\oarpmanr.dll
- %CommonProgramFiles%\microsoft shared\office14\1033\mssoapr3.dll
- %CommonProgramFiles%\microsoft shared\office14\1033\msointl.rest.idx_dll
- %CommonProgramFiles%\microsoft shared\office14\1033\msointl.dll.idx_dll
- %CommonProgramFiles%\microsoft shared\office14\1033\msointl.dll
- %CommonProgramFiles%\microsoft shared\office14\1033\alrtintl.dll
- %CommonProgramFiles%\microsoft shared\office14\1033\acewstr.dll
- %CommonProgramFiles%\microsoft shared\office14\1033\acerecr.dll
- %CommonProgramFiles%\microsoft shared\office14\1033\aceodbci.dll
- %CommonProgramFiles%\microsoft shared\office14\1033\aceintl.dll
- %CommonProgramFiles%\microsoft shared\office14\wisc30.dll
- %CommonProgramFiles%\microsoft shared\smart tag\fperson.dll
- %CommonProgramFiles%\microsoft shared\smart tag\fplace.dll
- %CommonProgramFiles%\microsoft shared\smart tag\fstock.dll
- %CommonProgramFiles%\microsoft shared\smart tag\ietag.dll
- %CommonProgramFiles%\microsoft shared\web server extensions\14\bin\fpsrvutl.dll
- %CommonProgramFiles%\microsoft shared\web folders\1033\msosvint.dll
- %CommonProgramFiles%\microsoft shared\web folders\msosv.dll
- %CommonProgramFiles%\microsoft shared\vsto\vstoee90.tlb
- %CommonProgramFiles%\microsoft shared\vsto\vstoee100.tlb
- %CommonProgramFiles%\microsoft shared\vba\vba7\1033\vbe7intl.dll
- %CommonProgramFiles%\microsoft shared\vba\vba7\vbe7.dll
- %CommonProgramFiles%\microsoft shared\translat\fren\msb1fren.dll
- %CommonProgramFiles%\microsoft shared\translat\esen\msb1esen.dll
- %CommonProgramFiles%\microsoft shared\translat\wtsp61ms.dll
- %CommonProgramFiles%\microsoft shared\translat\msb1xtor.dll
- %CommonProgramFiles%\microsoft shared\translat\msb1core.dll
- %CommonProgramFiles%\microsoft shared\translat\msb1star.dll
- %CommonProgramFiles%\microsoft shared\textconv\wpft632.cnv
- %CommonProgramFiles%\microsoft shared\textconv\wpft532.cnv
- %CommonProgramFiles%\microsoft shared\textconv\wks9pxy.cnv
- %CommonProgramFiles%\microsoft shared\textconv\recovr32.cnv
- %CommonProgramFiles%\microsoft shared\textconv\msconv97.dll
- %CommonProgramFiles%\microsoft shared\source engine\ose.exe
- %CommonProgramFiles%\microsoft shared\smart tag\1033\stintl.dll.idx_dll
- %CommonProgramFiles%\microsoft shared\smart tag\1033\stintl.dll
- %CommonProgramFiles%\microsoft shared\smart tag\mofl.dll
- %CommonProgramFiles%\microsoft shared\smart tag\metconv.dll
- %CommonProgramFiles%\microsoft shared\smart tag\imcontact.dll
- %CommonProgramFiles%\microsoft shared\web server extensions\14\bin\fpwec.dll
- %CommonProgramFiles%\microsoft shared\office14\vbajet32.dll
- %CommonProgramFiles%\microsoft shared\office14\usp10.dll
- %CommonProgramFiles%\microsoft shared\office14\riched20.dll
- %CommonProgramFiles%\microsoft shared\office14\aceodbc.dll
- %CommonProgramFiles%\microsoft shared\office14\aceexcl.dll
- %CommonProgramFiles%\microsoft shared\office14\aceexch.dll
- %CommonProgramFiles%\microsoft shared\office14\acees.dll
- %CommonProgramFiles%\microsoft shared\office14\aceerr.dll
- %CommonProgramFiles%\microsoft shared\office14\acedao.dll
- %CommonProgramFiles%\microsoft shared\office14\acecore.dll
- %CommonProgramFiles%\microsoft shared\msclientdatamgr\mscdm.dll
- %CommonProgramFiles%\microsoft shared\help\itircl55.dll
- %CommonProgramFiles%\microsoft shared\grphflt\wpgimp32.flt
- %CommonProgramFiles%\microsoft shared\grphflt\png32.flt
- %CommonProgramFiles%\microsoft shared\grphflt\pictim32.flt
- %CommonProgramFiles%\microsoft shared\grphflt\jpegim32.flt
- %CommonProgramFiles%\microsoft shared\grphflt\gifimp32.flt
- %CommonProgramFiles%\microsoft shared\grphflt\epsimp32.flt
- %CommonProgramFiles%\microsoft shared\grphflt\cgmimp32.flt
- %CommonProgramFiles%\microsoft shared\euro\msoeuro.dll
- %CommonProgramFiles%\microsoft shared\equation\1033\eeintl.dll
- %CommonProgramFiles%\microsoft shared\equation\eqnedt32.exe
- %CommonProgramFiles%\microsoft shared\dw\dwtrig20.exe
- %CommonProgramFiles%\microsoft shared\dw\dw20.exe
- %CommonProgramFiles%\microsoft shared\dw\dbghelp.dll
- %CommonProgramFiles%\designer\msaddndr.dll
- %CommonProgramFiles%\microsoft shared\office14\aceoddbs.dll
- %CommonProgramFiles%\microsoft shared\office14\aceodexl.dll
- %CommonProgramFiles%\microsoft shared\office14\aceodtxt.dll
- %CommonProgramFiles%\microsoft shared\office14\aceoledb.dll
- %CommonProgramFiles%\microsoft shared\office14\ophproxy.dll
- %CommonProgramFiles%\microsoft shared\office14\offrel.dll
- %CommonProgramFiles%\microsoft shared\office14\muoptin.dll
- %CommonProgramFiles%\microsoft shared\office14\mssoap30.dll
- %CommonProgramFiles%\microsoft shared\office14\msptls.dll
- %CommonProgramFiles%\microsoft shared\office14\msoxmlmf.dll
- %CommonProgramFiles%\microsoft shared\office14\msoxmled.exe
- %CommonProgramFiles%\microsoft shared\office14\msoxev.dll
- %CommonProgramFiles%\microsoft shared\office14\msores.dll
- %CommonProgramFiles%\microsoft shared\office14\msoicons.exe
- %CommonProgramFiles%\microsoft shared\office14\mso.dll
- %CommonProgramFiles%\microsoft shared\office14\iacom2.dll
- %CommonProgramFiles%\microsoft shared\office14\liclua.exe
- %CommonProgramFiles%\microsoft shared\office14\fltldr.exe
- %CommonProgramFiles%\microsoft shared\office14\exp_xps.dll
- %CommonProgramFiles%\microsoft shared\office14\exp_pdf.dll
- %CommonProgramFiles%\microsoft shared\office14\expsrv.dll
- %CommonProgramFiles%\microsoft shared\office14\acexbe.dll
- %CommonProgramFiles%\microsoft shared\office14\acewss.dll
- %CommonProgramFiles%\microsoft shared\office14\acewdat.dll
- %CommonProgramFiles%\microsoft shared\office14\acetxt.dll
- %CommonProgramFiles%\microsoft shared\office14\acerep.dll
- %CommonProgramFiles%\microsoft shared\office14\acerclr.dll
- %CommonProgramFiles%\microsoft shared\office14\acer3x.dll
- %CommonProgramFiles%\microsoft shared\office14\optinps.dll
- %CommonProgramFiles%\system\msmapi\1033\msmapi32.dll
Создает следующие файлы на съемном носителе
- <Имя диска съемного носителя>:\readme.txt
Изменения в файловой системе
Создает следующие файлы
- C:\readme.txt
- D:\readme.txt
- %HOMEPATH%\desktop\readme.txt
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww2.cab.zeroguard0@skiff.com.oxtx8vfdjftg.zeroguard
Присваивает атрибут 'скрытый' для следующих файлов
- <Полный путь к файлу>
Изменяет следующие файлы
- C:\kms\kms_vl_all_aio.cmd
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.en\proof.cab
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proofing.xml
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordmui.xml
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\wordlr.cab
- C:\msocache\all users\{90140000-001b-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlookmui.xml
- C:\msocache\all users\{90140000-001a-0409-1000-0000000ff1ce}-c\outlklr.cab
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publr.cab
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\publishermui.xml
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\pptlr.cab
- C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\powerpointmui.xml
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excelmui.xml
- C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\excellr.cab
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\setup.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\propsww.cab
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\proplusww.xml
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\pkeyconfig-office.xrm-ms
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\owow32ww.cab
- C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\office32ww.xml
- C:\kms\kms_vl_all_aio_debug.log
- D:\install.log
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.cab
- C:\msocache\all users\{90140000-002c-0409-1000-0000000ff1ce}-c\proof.es\proof.xml
Изменяет множество файлов.
Изменяет множество файлов пользовательских данных (Trojan.Encoder).
