Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'newUserProfile' = ''
Вредоносные функции:
Создает и запускает на исполнение:
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Documentation\eng\Far.FAQ.txt"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Documentation\eng\Plugins.Install.txt"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Documentation\eng\Arc.Support.txt"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Documentation\eng\Bug.Report.txt"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Documentation\rus\Arc.Support.txt"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Documentation\rus\Bug.Report.txt"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Documentation\eng\Plugins.Review.txt"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Documentation\eng\TechInfo.txt"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Addons\README.TXT"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarks.html"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%HOMEPATH%\Templates\excel.xls"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Documents and Settings\Default User\Templates\winword2.doc"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%APPDATA%\Microsoft\Internet Explorer\brndlog.txt"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%HOMEPATH%\Templates\winword.doc"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%HOMEPATH%\Templates\winword2.doc"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%HOMEPATH%\Templates\excel4.xls"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%HOMEPATH%\Templates\powerpnt.ppt"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Documentation\rus\Far.FAQ.txt"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Plugins\FTP\FtpCmds_rus.txt"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Plugins\FTP\Notes.txt"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Plugins\FTP\FtpCmds.txt"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Plugins\Colorer\hrd\catalog-text.xml"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Documentation\rus\TechInfo.txt"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Plugins\7-Zip\far7z.txt"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Documentation\rus\Plugins.Install.txt"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Documentation\rus\Plugins.Review.txt"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Plugins\Colorer\hrd\catalog-console.xml"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Plugins\Colorer\hrd\catalog-rgb.xml"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Plugins\Colorer\catalog.xml"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Far2\Plugins\Colorer\hrc\changes.txt"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe'
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Documents and Settings\Default User\Templates\powerpnt.ppt"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Documents and Settings\Default User\Templates\winword.doc"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Documents and Settings\Default User\Templates\excel.xls"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "C:\Documents and Settings\Default User\Templates\excel4.xls"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp"
- '%PROGRAM_FILES%\Internet Explorer\sd.exe' -p 5 -s -q "%ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp"
Запускает на исполнение:
- '<SYSTEM32>\reg.exe' ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v newUserProfile /t REG_EXPAND_SZ /d "%PROGRAM_FILES%\Internet Explorer\gadgets.exe" /f
- '<SYSTEM32>\cmd.exe' /c "%PROGRAM_FILES%\Internet Explorer\rsrt.bat"
- '<SYSTEM32>\cmd.exe' /c ..bat
- '<SYSTEM32>\ping.exe' 127.0.0.1
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\Templates\winword2.doc.brkn
- C:\Far2\Addons\README.TXT.brkn
- %HOMEPATH%\Templates\powerpnt.ppt.brkn
- %HOMEPATH%\Templates\winword.doc.brkn
- C:\Far2\Documentation\eng\Arc.Support.txt.brkn
- C:\Far2\Documentation\eng\Plugins.Review.txt.brkn
- C:\Far2\Documentation\eng\TechInfo.txt.brkn
- C:\Far2\Documentation\eng\Bug.Report.txt.brkn
- C:\Far2\Documentation\eng\Far.FAQ.txt.brkn
- %HOMEPATH%\Templates\excel4.xls.brkn
- C:\Documents and Settings\Default User\Templates\excel4.xls.brkn
- C:\Documents and Settings\Default User\Templates\powerpnt.ppt.brkn
- C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\brndlog.txt.brkn
- C:\Documents and Settings\Default User\Templates\excel.xls.brkn
- C:\Documents and Settings\Default User\Templates\winword.doc.brkn
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\bookmarks.html.brkn
- %HOMEPATH%\Templates\excel.xls.brkn
- C:\Documents and Settings\Default User\Templates\winword2.doc.brkn
- %APPDATA%\Microsoft\Internet Explorer\brndlog.txt.brkn
- C:\Far2\Documentation\rus\Arc.Support.txt.brkn
- C:\Far2\Plugins\ExtSearch\doc\ENG_READ.TXT.brkn
- C:\Far2\Plugins\ExtSearch\doc\REGEXPS.TXT.brkn
- C:\Far2\Plugins\Colorer\hrd\catalog-text.xml.brkn
- C:\Far2\Plugins\ExtSearch\doc\ENG_NEWS.TXT.brkn
- C:\Far2\Plugins\ExtSearch\doc\RUS_NEWS.TXT.brkn
- C:\Far2\Plugins\FTP\FtpCmds_rus.txt.brkn
- C:\Far2\Plugins\FTP\Notes.txt.brkn
- C:\Far2\Plugins\ExtSearch\doc\RUS_READ.TXT.brkn
- C:\Far2\Plugins\FTP\FtpCmds.txt.brkn
- C:\Far2\Plugins\Colorer\hrd\catalog-rgb.xml.brkn
- C:\Far2\Documentation\rus\Plugins.Install.txt.brkn
- C:\Far2\Documentation\rus\Plugins.Review.txt.brkn
- C:\Far2\Documentation\rus\Bug.Report.txt.brkn
- C:\Far2\Documentation\rus\Far.FAQ.txt.brkn
- C:\Far2\Documentation\rus\TechInfo.txt.brkn
- C:\Far2\Plugins\Colorer\hrc\changes.txt.brkn
- C:\Far2\Plugins\Colorer\hrd\catalog-console.xml.brkn
- C:\Far2\Plugins\7-Zip\far7z.txt.brkn
- C:\Far2\Plugins\Colorer\catalog.xml.brkn
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Winter.jpg.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.brkn
- %PROGRAM_FILES%\Internet Explorer\sha.ll
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.brkn
- %PROGRAM_FILES%\Internet Explorer\rsrt.bat
- %PROGRAM_FILES%\Internet Explorer\index2.html
- %PROGRAM_FILES%\Internet Explorer\images\9db2353294d43c8aa1af68ac2a80f69a_full.jpg
- <Текущая директория>\..bat
- %PROGRAM_FILES%\Internet Explorer\sd.exe
- %PROGRAM_FILES%\Internet Explorer\images\shape713378204.gif
- %PROGRAM_FILES%\Internet Explorer\images\shape716614257.gif
- %PROGRAM_FILES%\Internet Explorer\sla.ll
- %PROGRAM_FILES%\Internet Explorer\images\shape713722810.gif
- %PROGRAM_FILES%\Internet Explorer\images\shape713735571.gif
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\guest.bmp.brkn
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Sunset.jpg.brkn
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Water lilies.jpg.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\%USERNAME%.bmp.brkn
- %ALLUSERSPROFILE%\Documents\My Pictures\Sample Pictures\Blue hills.jpg.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.brkn
- %ALLUSERSPROFILE%\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.brkn
Самоперемещается:
- из <Полный путь к вирусу> в %PROGRAM_FILES%\Internet Explorer\gadgets.exe
Другое:
Ищет следующие окна:
- ClassName: 'Button' WindowName: '&Agree'
- ClassName: '(null)' WindowName: 'SDelete License Agreement'
- ClassName: 'Indicator' WindowName: '(null)'
