Trojan.KeyLogger.19858

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Google Desktop Search' = '"%PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktop.exe" /startup'
[<HKLM>\SOFTWARE\Classes\GoogleGadgetManifest\shell\open\command] '' = '"%PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktop.exe" /display /load "%1"'
[<HKLM>\SOFTWARE\Classes\Google Earth.etafile\shell\open\command] '' = '"%PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktop.exe" /display /kml "%1"'
[<HKLM>\SOFTWARE\Classes\Google Earth.kmzfile\shell\open\command] '' = '"%PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktop.exe" /display /kml "%1"'
[<HKLM>\SOFTWARE\Classes\Google Earth.kmlfile\shell\open\command] '' = '"%PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktop.exe" /display /kml "%1"'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = '%PROGRAM_FILES%\Google\Google Desktop Search\GOEC62~1.DLL'
[<HKLM>\SOFTWARE\Classes\GoogleDesktop.search\shell\open\command] '' = '"%PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktop.exe" /search "%1"'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
[<HKLM>\SOFTWARE\Classes\GoogleGadgetContainer\shell\open\command] '' = '"%PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktop.exe" /display /load "%1"'
[<HKLM>\SOFTWARE\Classes\GoogleGadget\shell\open\command] '' = '"%PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktop.exe" /display /load "%1"'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktop.exe' /install
'%PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktop.exe' /system /gdupdate /quit /system
'%PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktop.exe'
'%PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktop.exe' /display /userreg /quit
'%PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktop.exe' /system /regserver /quit
'%PROGRAM_FILES%\Google\Google Desktop Search\gcdtmp1\GoogleDesktopSetupHelper.exe' /mdo
'%PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktop.exe' /display /regserver /quit
'%PROGRAM_FILES%\Google\Google Desktop Search\gcdtmp1\GoogleDesktop.exe' /manager /service /path "%PROGRAM_FILES%\Google\Google Desktop Search\"

Устанавливает процедуры перхвата сообщений

о нажатии клавиш клавиатуры:

Библиотека-обработчик для всех процессов: %PROGRAM_FILES%\Google\Google Desktop Search\GoogleServices.DLL

Изменения в файловой системе:

Создает следующие файлы:

<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\dbvmh.ht1
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\dbvm.cf1
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\dbu2d.ht1
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\dbc2e.ht1
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\dbm
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\fiid-tmp
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\rpmh.ht1
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\fiih.ht1
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\fii.cf1
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\dbdao
%PROGRAM_FILES%\Google\Google Desktop Search\ai ### ali zaženite
%PROGRAM_FILES%\Google\Google Desktop Search\aj ###
%PROGRAM_FILES%\Google\Google Desktop Search\ag ### ukaz Dodaj ali odstrani programe
%PROGRAM_FILES%\Google\Google Desktop Search\ah ### na nadzorni plošči
%PROGRAM_FILES%\Google\Google Desktop Search\ak ### GoogleDesktopSetup.exe -uninstall
%PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktopMozilla.src
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\dbeao
%PROGRAM_FILES%\Google\Google Desktop Search\al ###
%PROGRAM_FILES%\Google\Google Desktop Search\gcdtmp1\GoogleDesktop.exe
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\safeweb\goog-black-enchashm.cf1
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\supported_domains[1]
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\safeweb\goog-malware-domainm.cf1
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\safeweb\goog-black-enchashmh.ht1
%ALLUSERSPROFILE%\Start Menu\Programs\Google Desktop\Google Desktop.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Google Desktop\Google Desktop - odstranitev.lnk
%ALLUSERSPROFILE%\Desktop\Google Desktop.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Google Desktop\Možnosti programa Google Desktop.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Google Desktop\Google Desktop – stranska vrstica.lnk
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\safeweb\goog-malware-domainmh.ht1
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\rpm1m.cf1
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\hpt2i.ht1
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\rpm.cf1
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\rpm1mh.ht1
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\hp
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\safeweb\goog-black-urlmh.ht1
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\safeweb\goog-black-urlm.cf1
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\safeweb\goog-white-domainmh.ht1
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\safeweb\goog-white-domainm.cf1
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopMozilla.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopMozillaStub.js
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_gzlib.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopCommon.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopMozillaStub.xpt
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopDeskbar2.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopMail.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopMozilla.src
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopMozilla.png
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopOffice.dll
%PROGRAM_FILES%\Google\Google Desktop Search\gcdtmp1\GoogleDesktopSetupHelper.exe
%PROGRAM_FILES%\Google\Google Desktop Search\gcdtmp1\GoogleServices.dll
%PROGRAM_FILES%\Google\Google Desktop Search\gcdtmp1\GoogleDesktopResources_sl.dll
%PROGRAM_FILES%\Google\Google Desktop Search\gcdtmp1\GoogleDesktopCommon.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopIE.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopAPI2.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopResources_sl.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktop.exe
%PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktopSetup.exe
%PROGRAM_FILES%\Google\Google Desktop Search\aa ### OPOZORILO! Ne
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleServices.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_sites.txt
%PROGRAM_FILES%\Google\Google Desktop Search\ab ### premikajte in ne brišite teh
%PROGRAM_FILES%\Google\Google Desktop Search\ae ###
%PROGRAM_FILES%\Google\Google Desktop Search\af ### Za odstranitev uporabite
%PROGRAM_FILES%\Google\Google Desktop Search\ac ### datoteke – vaš računalnik
%PROGRAM_FILES%\Google\Google Desktop Search\ad ### se lahko preneha odzivati
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_gpac.xml
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_plugin_common.js
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_plugin_common.vbs
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopHyper.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopNetwork3.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_topic_sites.dat
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_AnalogClock_sl.gg_NEW_
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_Weather_sl.gg_NEW_
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopSSD.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleUIEngine.dll

Удаляет следующие файлы:

%PROGRAM_FILES%\Google\Google Desktop Search\gcdtmp1\GoogleServices.dll
%PROGRAM_FILES%\Google\Google Desktop Search\gcdtmp1\GoogleDesktopResources_sl.dll
%TEMP%\~DF3762.tmp
%PROGRAM_FILES%\Google\Google Desktop Search\gcdtmp1\GoogleDesktopCommon.dll
%PROGRAM_FILES%\Google\Google Desktop Search\gcdtmp1\GoogleDesktopSetupHelper.exe
%PROGRAM_FILES%\Google\Google Desktop Search\gcdtmp1\GoogleDesktop.exe

Перемещает следующие файлы:

%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_plugin_common.vbs в %PROGRAM_FILES%\Google\Google Desktop Search\plugin_common.vbs
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_topic_sites.dat в %PROGRAM_FILES%\Google\Google Desktop Search\topic_sites.dat
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopSSD.dll в %PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktopSSD.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopHyper.dll в %PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktopHyper.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopNetwork3.dll в %PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktopNetwork3.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_plugin_common.js в %PROGRAM_FILES%\Google\Google Desktop Search\plugin_common.js
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleUIEngine.dll в %PROGRAM_FILES%\Google\Google Desktop Search\GoogleUIEngine.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleServices.dll в %PROGRAM_FILES%\Google\Google Desktop Search\GoogleServices.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_sites.txt в %PROGRAM_FILES%\Google\Google Desktop Search\sites.txt
<LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\fiid-tmp в <LS_APPDATA>\Google\Google Desktop\1f84eaaf221d\fiid
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_AnalogClock_sl.gg_NEW_ в %PROGRAM_FILES%\Google\Google Desktop Search\AnalogClock_sl.gg
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_Weather_sl.gg_NEW_ в %PROGRAM_FILES%\Google\Google Desktop Search\Weather_sl.gg
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_gpac.xml в %PROGRAM_FILES%\Google\Google Desktop Search\gpac.xml
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopMail.dll в %PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktopMail.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopAPI2.dll в %PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktopAPI2.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopOffice.dll в %PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktopOffice.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_gzlib.dll в %PROGRAM_FILES%\Google\Google Desktop Search\gzlib.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopResources_sl.dll в %PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktopResources_sl.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktop.exe в %PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktop.exe
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopIE.dll в %PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktopIE.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopCommon.dll в %PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktopCommon.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopMozilla.src в %PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktopMozilla.src
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopMozilla.png в %PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktopMozilla.png
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopDeskbar2.dll в %PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktopDeskbar2.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopMozilla.dll в %PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktopMozilla.dll
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopMozillaStub.js в %PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktopMozillaStub.js
%PROGRAM_FILES%\Google\Google Desktop Search\_NEW_GoogleDesktopMozillaStub.xpt в %PROGRAM_FILES%\Google\Google Desktop Search\GoogleDesktopMozillaStub.xpt

Сетевая активность:

Подключается к:

'74.##5.232.51':80
'localhost':4664
'74.##5.232.51':443

TCP:

Запросы HTTP GET:

74.##5.232.51/pac?q=###
74.##5.232.51/pac?q=####################################
74.##5.232.51/supported_domains
74.##5.232.51/installer?ac###########################################################################################################

UDP:

DNS ASK de####p.google.com
DNS ASK de####p5.google.com
DNS ASK de####p2.google.com
DNS ASK de####p6.google.com
DNS ASK www.google.com

Другое:

Ищет следующие окна:

ClassName: 'SideBar_AppBarWindow' WindowName: ''
ClassName: '_GD_Mon' WindowName: ''
ClassName: '_GD_Sidebar' WindowName: ''
ClassName: '_GD_MonMD' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней